Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

New claims provision compatible storage without requiring manual static PV creation for each request. That result validates StorageClass dynamic provisioning rather than the requirement here. Verify instead: Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. That result validates Authentication authorization and admission order rather than the requirement here. Verify instead: Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This step belongs to OCI registries and image distribution rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Inspect image metadata, Pod command/args, process exit code and startup logs. This step belongs to Container command entrypoint and arguments rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. This step belongs to kubectl apply and declarative updates rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. These observations are more relevant to Software supply chain attestations, not this case. The distinguishing check is: Inspect selected Pod/container, executed command, RBAC exec permission and audit records. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Inspect selected Pod/container, executed command, RBAC exec permission and audit records. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. These observations are more relevant to Progressive delivery and release metrics, not this case. The distinguishing check is: Inspect selected Pod/container, executed command, RBAC exec permission and audit records. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. That result validates Kubelet node agent responsibilities rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. That result validates ConfigMap and Secret boundaries rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This step belongs to Upstream issue reporting and review collaboration rather than the complementary implementation and evidence pair. The intended approach is: Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. Validate with: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. This step belongs to SLIs SLOs and golden signals rather than the complementary implementation and evidence pair. The intended approach is: Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. Validate with: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. This step belongs to CNCF ecosystem and Kubernetes roles rather than the complementary implementation and evidence pair. The intended approach is: Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. Validate with: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. This action addresses Blue-green versus canary release patterns instead of the controlling requirement. Blue-green switches environments, whereas canary ramps exposure; a basic Deployment alone may not provide precise traffic percentages. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. This action addresses Helm charts templates and values instead of the controlling requirement. Helm templates generate manifests; a chart repository alone does not deploy resources or validate runtime behavior. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. This step belongs to ResourceQuota and LimitRange policies rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

An operator investigates a running Pod without modifying its immutable application image or replacing production workload containers. This step belongs to Ephemeral debugging containers rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This step belongs to Node labels and allocatable inventory rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. These observations are more relevant to Software supply chain attestations, not this case. The distinguishing check is: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. These observations are more relevant to kubectl describe and event chronology, not this case. The distinguishing check is: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Co-located containers communicate over localhost and move through Pod lifecycle as an atomic scheduling unit. That result validates Pod shared network namespace and lifecycle rather than the requirement here. Verify instead: The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. That result validates Kubelet node agent responsibilities rather than the requirement here. Verify instead: The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Protected nodes accept explicitly tolerated workloads and repel unrelated Pods under intended effects. That result validates Taints tolerations and node protection rather than the requirement here. Verify instead: The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Authorized clients create or read resources through the API and unauthorized calls fail consistently. That result validates Kubernetes API server and API requests rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.