Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

The Service has healthy matching backends and forwards to the application process's actual port. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This step belongs to ClusterIP and NodePort Service exposure rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Inspect Deployment observedGeneration, rollout status, revision annotations, ReplicaSet ownership and release events. These observations are more relevant to Rollout history status and change correlation, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. These observations are more relevant to Readiness-probe failure versus process crash, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Inspect rendered helm template output, values merge order, chart dependency versions and release status. These observations are more relevant to Helm charts templates and values, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. These observations are more relevant to ImagePullBackOff registry and auth errors, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. These observations are more relevant to LoadBalancer Service provisioning, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. These observations are more relevant to Ingress and Gateway API routing, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: A node runs containerd but kubelet points at a nonexistent CRI socket and all Pod sandboxes fail.

Compare object metadata labels, Service/Deployment selectors and selected object lists. This step belongs to Labels selectors and annotations rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: A node runs containerd but kubelet points at a nonexistent CRI socket and all Pod sandboxes fail.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: A node runs containerd but kubelet points at a nonexistent CRI socket and all Pod sandboxes fail.

Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. This step belongs to OCI registries and image distribution rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: An automation uses a ClusterRole via a namespaced RoleBinding and auditors need to confirm its permissions do not escape the namespace.

Protected nodes accept explicitly tolerated workloads and repel unrelated Pods under intended effects. This step belongs to Taints tolerations and node protection rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: An automation uses a ClusterRole via a namespaced RoleBinding and auditors need to confirm its permissions do not escape the namespace.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This step belongs to ResourceQuota and LimitRange policies rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: An automation uses a ClusterRole via a namespaced RoleBinding and auditors need to confirm its permissions do not escape the namespace.

Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. This action addresses CI versus CD pipeline separation instead of the controlling requirement. CI validates and packages changes while CD handles delivery or deployment; a successful build is not proof of production rollout. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. These observations are more relevant to Ephemeral debugging containers, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. These observations are more relevant to Kubernetes upgrades and version skew, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. That result validates Secret base64 encoding versus encryption rather than the requirement here. Verify instead: Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. That result validates Namespace segmentation with NetworkPolicies rather than the requirement here. Verify instead: Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. That result validates Ingress and Gateway API routing rather than the requirement here. Verify instead: Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. These observations are more relevant to Responsible vulnerability disclosure in communities, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. These observations are more relevant to SLIs SLOs and golden signals, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. These observations are more relevant to OpenTelemetry instrumentation and exporters, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.