Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. This action addresses CNI Pod networking implementation instead of the controlling requirement. The CNI plugin supplies Pod networking; a Kubernetes Service alone cannot correct a broken Pod network implementation. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Pending eligible Pods receive appropriate node bindings when capacity and constraints allow scheduling. That result validates Scheduler responsibility and binding rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. That result validates Ingress and Gateway API routing rather than the requirement here. Verify instead: The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. That result validates ReadWriteOnce and ReadWriteMany semantics rather than the requirement here. Verify instead: The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

The container remains running or completes as intended without repeated backoff cycles after a targeted correction. That result validates CrashLoopBackOff and previous logs rather than the requirement here. Verify instead: The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. That result validates Kubelet node agent responsibilities rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

An operator investigates a running Pod without modifying its immutable application image or replacing production workload containers. That result validates Ephemeral debugging containers rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Deployments use lean images without exposed build-time credentials or unnecessary packages. That result validates Image layers and build cache rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. This step belongs to Container runtime and CRI rather than the complementary implementation and evidence pair. The intended approach is: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Validate with: Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. This step belongs to Linux namespaces and cgroups rather than the complementary implementation and evidence pair. The intended approach is: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Validate with: Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. This step belongs to PersistentVolume zone binding and placement rather than the complementary implementation and evidence pair. The intended approach is: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Validate with: Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. This step belongs to Linux namespaces and cgroups rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Authorized clients create or read resources through the API and unauthorized calls fail consistently. This step belongs to Kubernetes API server and API requests rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. This step belongs to Node affinity required vs preferred rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A release image contains a software dependency absent from its application repository because it was included by a transitive build layer.

Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. These observations are more relevant to Responsible vulnerability disclosure in communities, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. These observations are more relevant to Microservices contracts and failure isolation, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. These observations are more relevant to Upstream issue reporting and review collaboration, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Metrics are collected from intended targets at expected intervals with bounded label series and useful alerts. That result validates Prometheus pull scraping and metrics endpoints rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. That result validates Open standards vendor-neutral portability rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. That result validates SLIs SLOs and golden signals rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Replica placement stays within the intended skew or reports clear scheduling limits. That result validates Topology spread constraints rather than the requirement here. Verify instead: Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. Workload context: A Deployment requests 16 CPUs per Pod but every eligible worker has fewer allocatable CPUs even when idle.

Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. That result validates Pod affinity anti-affinity rather than the requirement here. Verify instead: Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. Workload context: A Deployment requests 16 CPUs per Pod but every eligible worker has fewer allocatable CPUs even when idle.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. That result validates Kubelet node agent responsibilities rather than the requirement here. Verify instead: Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. Workload context: A Deployment requests 16 CPUs per Pod but every eligible worker has fewer allocatable CPUs even when idle.