Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. This step belongs to CrashLoopBackOff and previous logs rather than the complementary implementation and evidence pair. The intended approach is: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Validate with: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. This step belongs to Node pressure and Pod eviction analysis rather than the complementary implementation and evidence pair. The intended approach is: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Validate with: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Validate with: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This action addresses Scheduler responsibility and binding instead of the controlling requirement. kube-scheduler assigns Pods to nodes; kubelet executes Pods after assignment and the controller manager reconciles controllers. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This action addresses Labels selectors and annotations instead of the controlling requirement. Labels support equality and set-based selectors; annotations do not become Service selectors automatically. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. These observations are more relevant to PersistentVolume zone binding and placement, not this case. The distinguishing check is: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Compare object metadata labels, Service/Deployment selectors and selected object lists. These observations are more relevant to Labels selectors and annotations, not this case. The distinguishing check is: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This action addresses Pod affinity anti-affinity instead of the controlling requirement. Pod affinity references other Pods by labels, not node resource attributes, and required rules can make replicas Pending. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: A monitoring query groups Pods by team label and accidentally includes an unrelated workload after a copy-pasted metadata block.

Maintainers can reproduce and triage the problem without access to private credentials or customer systems. This step belongs to Upstream issue reporting and review collaboration rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. This step belongs to CNCF project maturity and adoption decisions rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. This step belongs to Open standards vendor-neutral portability rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

An operator investigates a running Pod without modifying its immutable application image or replacing production workload containers. That result validates Ephemeral debugging containers rather than the requirement here. Verify instead: Replica placement stays within the intended skew or reports clear scheduling limits. Workload context: A new fourth replica remains Pending after DoNotSchedule maxSkew conflicts with nodes available in only one zone.

Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. That result validates Node affinity required vs preferred rather than the requirement here. Verify instead: Replica placement stays within the intended skew or reports clear scheduling limits. Workload context: A new fourth replica remains Pending after DoNotSchedule maxSkew conflicts with nodes available in only one zone.

Unschedulable unhealthy nodes are excluded until they meet documented readiness checks, preserving healthy placement. That result validates Node readiness and scheduling exclusion rather than the requirement here. Verify instead: Replica placement stays within the intended skew or reports clear scheduling limits. Workload context: A new fourth replica remains Pending after DoNotSchedule maxSkew conflicts with nodes available in only one zone.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. These observations are more relevant to ResourceQuota and LimitRange policies, not this case. The distinguishing check is: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A cluster reports a NotReady node when kubelet cannot reach the configured runtime after a host reboot.

Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. These observations are more relevant to Deployment and ReplicaSet ownership, not this case. The distinguishing check is: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A cluster reports a NotReady node when kubelet cannot reach the configured runtime after a host reboot.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A cluster reports a NotReady node when kubelet cannot reach the configured runtime after a host reboot.

Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. These observations are more relevant to Controller manager reconciliation loops, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Review node taint key/effect, Pod toleration key/operator and associated scheduler events. These observations are more relevant to Taints tolerations and node protection, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. These observations are more relevant to Pod affinity anti-affinity, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Inspect selected Pod/container, executed command, RBAC exec permission and audit records. These observations are more relevant to kubectl exec diagnostic boundaries, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. These observations are more relevant to CI versus CD pipeline separation, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Inspect maxSurge, maxUnavailable, rollout conditions, ReplicaSets, readiness and prior image revisions. These observations are more relevant to Deployment rolling updates and rollback, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This step belongs to kubectl inspect and describe diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.