Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. This action addresses Container versus virtual machine isolation instead of the controlling requirement. Ordinary containers share the host kernel, whereas a VM normally runs its own guest kernel. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A registry migration changes its host name and worker nodes report image pull failures despite healthy deployment manifests.

Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. This action addresses Open source licensing and contribution basics instead of the controlling requirement. Open source permits work under a specific license; public availability of source code alone does not erase conditions. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Report suspected project security vulnerabilities through the designated private security channel before public reproduction details or exploit examples. This action addresses Responsible vulnerability disclosure in communities instead of the controlling requirement. Public bug trackers are not always the right venue for undisclosed security issues; project security policies define channels. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This action addresses CNCF project maturity and adoption decisions instead of the controlling requirement. CNCF maturity levels indicate aspects of governance and adoption, not a guarantee of security or perfect product fit. For this scenario prefer: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This action addresses Scheduler versus autoscaler responsibility instead of the controlling requirement. The autoscaler provisions nodes; it does not assign Pod nodeName or fix impossible affinity or quota constraints by itself. For this scenario prefer: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. This action addresses DaemonSet node-local workloads instead of the controlling requirement. A DaemonSet creates node-level replicas automatically rather than a fixed overall replica count like a Deployment. For this scenario prefer: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. That result validates Declarative resource manifests and API versions rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

All intended replicas run the approved digest and upgrades trace back to a reviewed artifact. That result validates Immutable container images and digests rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. That result validates Pending Pods and resource-fit checks rather than the requirement here. Verify instead: Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. That result validates Sidecar containers and shared Pod lifecycle rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. That result validates ConfigMap and Secret boundaries rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. This step belongs to Container runtime and CRI rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This step belongs to Labels selectors and annotations rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. This step belongs to Kubelet node agent responsibilities rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. These observations are more relevant to ResourceQuota and LimitRange policies, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. These observations are more relevant to Ephemeral debugging containers, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Check Pod nodeSelector keys and values against node labels and scheduling events. This step belongs to nodeSelector equality placement rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. This step belongs to Kubernetes upgrades and version skew rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.