Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This step belongs to kubectl inspect and describe diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Technical proposals reach appropriate reviewers with documented rationale and open community feedback. That result validates Kubernetes SIG and community governance rather than the requirement here. Verify instead: Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. Workload context: A service dashboard shows high response latency but no trace context connects it to the slow upstream dependency.

A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. That result validates Microservices contracts and failure isolation rather than the requirement here. Verify instead: Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. Workload context: A service dashboard shows high response latency but no trace context connects it to the slow upstream dependency.

Metrics are collected from intended targets at expected intervals with bounded label series and useful alerts. That result validates Prometheus pull scraping and metrics endpoints rather than the requirement here. Verify instead: Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. Workload context: A service dashboard shows high response latency but no trace context connects it to the slow upstream dependency.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

All intended replicas run the approved digest and upgrades trace back to a reviewed artifact. That result validates Immutable container images and digests rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. This action addresses PersistentVolume zone binding and placement instead of the controlling requirement. Immediate volume binding can constrain later Pod placement, while WaitForFirstConsumer accounts for scheduling topology. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. This action addresses Ephemeral debugging containers instead of the controlling requirement. Ephemeral containers are intended for debugging and do not behave like ordinary replicated application containers. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Healthy but initializing Pods avoid traffic and genuinely stuck workloads recover without unnecessary restart loops. That result validates Readiness liveness and startup probe behavior rather than the requirement here. Verify instead: External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. Workload context: A developer creates an Ingress YAML but no ingress controller is installed and the application remains inaccessible.

The precise scheduling blocker is removed and the workload binds to an eligible node. That result validates Pending pod FailedScheduling events rather than the requirement here. Verify instead: External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. Workload context: A developer creates an Ingress YAML but no ingress controller is installed and the application remains inaccessible.

Clients resolve the intended in-cluster Service name and external DNS forwarding operates as designed. That result validates Cluster DNS and service discovery rather than the requirement here. Verify instead: External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. Workload context: A developer creates an Ingress YAML but no ingress controller is installed and the application remains inaccessible.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Workload context: A custom operator bypasses scheduler checks by assigning every incoming Pod to a single worker irrespective of memory pressure.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Workload context: A custom operator bypasses scheduler checks by assigning every incoming Pod to a single worker irrespective of memory pressure.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Workload context: A custom operator bypasses scheduler checks by assigning every incoming Pod to a single worker irrespective of memory pressure.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This action addresses Container runtime and CRI instead of the controlling requirement. A runtime executes containers; the CRI is its API integration with kubelet rather than the Kubernetes API server. For this scenario prefer: Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. Workload context: A critical DNS Pod remains Pending and the team gives it higher priority without investigating incompatible node selectors.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. Workload context: A critical DNS Pod remains Pending and the team gives it higher priority without investigating incompatible node selectors.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. Workload context: A critical DNS Pod remains Pending and the team gives it higher priority without investigating incompatible node selectors.

Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. These observations are more relevant to Ingress route and TLS mismatch diagnosis, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Inspect rendered helm template output, values merge order, chart dependency versions and release status. These observations are more relevant to Helm charts templates and values, not this case. The distinguishing check is: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This action addresses Prometheus pull scraping and metrics endpoints instead of the controlling requirement. Prometheus primarily scrapes targets on an interval; instrumentation must expose values and high-cardinality labels can overload storage. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. This action addresses Kubernetes SIG and community governance instead of the controlling requirement. Kubernetes development is governed through open community processes rather than a single cloud vendor's private roadmap. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This action addresses CNCF project maturity and adoption decisions instead of the controlling requirement. CNCF maturity levels indicate aspects of governance and adoption, not a guarantee of security or perfect product fit. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Scheduling constraints match verified node attributes without exhausting reserved system resources. That result validates Node labels and allocatable inventory rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. That result validates Sidecar containers and shared Pod lifecycle rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. That result validates Kubernetes upgrades and version skew rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. This action addresses Container versus virtual machine isolation instead of the controlling requirement. Ordinary containers share the host kernel, whereas a VM normally runs its own guest kernel. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.