Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Authorized clients create or read resources through the API and unauthorized calls fail consistently. That result validates Kubernetes API server and API requests rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. These observations are more relevant to Cluster DNS and service discovery, not this case. The distinguishing check is: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. These observations are more relevant to Kubernetes upgrades and version skew, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. These observations are more relevant to Container versus virtual machine isolation, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. This action addresses CrashLoopBackOff and previous logs instead of the controlling requirement. CrashLoopBackOff indicates repeated container exits and restart delays, not a scheduler placement failure. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A Deployment references a removed private-registry tag and the kubelet repeatedly reports manifest unknown.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A Deployment references a removed private-registry tag and the kubelet repeatedly reports manifest unknown.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This action addresses PV reclaim policy Retain versus Delete instead of the controlling requirement. Retain leaves storage for deliberate recovery; Delete usually removes underlying dynamically provisioned storage when supported. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A Deployment references a removed private-registry tag and the kubelet repeatedly reports manifest unknown.

Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. This action addresses Linux securityContext and seccomp basics instead of the controlling requirement. Disabling privilege escalation and dropping Linux capabilities reduce risk but do not replace image or API authorization. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: Two workloads share the default service account and one unexpectedly gains permissions intended for the other.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: Two workloads share the default service account and one unexpectedly gains permissions intended for the other.

In-cluster clients reach internal services and exposed node ports are limited to approved traffic. That result validates ClusterIP and NodePort Service exposure rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: Two workloads share the default service account and one unexpectedly gains permissions intended for the other.

Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. This action addresses Node pressure and Pod eviction analysis instead of the controlling requirement. Kubelet can evict Pods under node pressure; eviction is different from a liveness probe killing one container. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This action addresses Cluster DNS and service discovery instead of the controlling requirement. Kubernetes DNS uses namespace-aware search paths; a fully qualified Service name avoids ambiguity across namespaces. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. This action addresses Deployment and ReplicaSet ownership instead of the controlling requirement. A Deployment manages ReplicaSets and rolling changes; direct edits to controlled Pods are transient. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. This step belongs to NetworkPolicy ingress egress isolation rather than the complementary implementation and evidence pair. The intended approach is: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Validate with: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. This step belongs to Cluster DNS and service discovery rather than the complementary implementation and evidence pair. The intended approach is: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Validate with: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Validate with: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. These observations are more relevant to Ingress and Gateway API routing, not this case. The distinguishing check is: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. These observations are more relevant to Container versus virtual machine isolation, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.