Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Check Pod nodeSelector keys and values against node labels and scheduling events. This step belongs to nodeSelector equality placement rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. This step belongs to Kubernetes upgrades and version skew rather than the complementary implementation and evidence pair. The intended approach is: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Validate with: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. That result validates StatefulSet identity and volume templates rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. That result validates NetworkPolicy ingress egress isolation rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

External clients reach only the intended healthy Service backends and the allocated endpoint matches network policy. That result validates LoadBalancer Service provisioning rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A Service declares port 80 and targetPort 8080 but the app listens on 9090, producing connection failures despite valid DNS.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. This step belongs to Correlating metrics logs and traces rather than the complementary implementation and evidence pair. The intended approach is: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Validate with: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Inspect maxSurge, maxUnavailable, rollout conditions, ReplicaSets, readiness and prior image revisions. This step belongs to Deployment rolling updates and rollback rather than the complementary implementation and evidence pair. The intended approach is: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Validate with: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This step belongs to Software supply chain attestations rather than the complementary implementation and evidence pair. The intended approach is: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Validate with: Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. Workload context: A payment team wants 5% of transactions on a candidate build but simply replaces every Pod in a standard rolling update.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. These observations are more relevant to Service stable virtual endpoint, not this case. The distinguishing check is: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

Check API endpoint connectivity, request audit records, resource authorization and response status. These observations are more relevant to Kubernetes API server and API requests, not this case. The distinguishing check is: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

The container remains running or completes as intended without repeated backoff cycles after a targeted correction. That result validates CrashLoopBackOff and previous logs rather than the requirement here. Verify instead: The Service has healthy matching backends and forwards to the application process's actual port. Workload context: An API listens on port 9000 but its Service targetPort remains 8080 from a previous release.

New claims provision compatible storage without requiring manual static PV creation for each request. That result validates StorageClass dynamic provisioning rather than the requirement here. Verify instead: The Service has healthy matching backends and forwards to the application process's actual port. Workload context: An API listens on port 9000 but its Service targetPort remains 8080 from a previous release.

Healthy but initializing Pods avoid traffic and genuinely stuck workloads recover without unnecessary restart loops. That result validates Readiness liveness and startup probe behavior rather than the requirement here. Verify instead: The Service has healthy matching backends and forwards to the application process's actual port. Workload context: An API listens on port 9000 but its Service targetPort remains 8080 from a previous release.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: A support account authenticates to a cluster yet sees empty resources because its current context points at another namespace.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. That result validates nodeSelector equality placement rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: A support account authenticates to a cluster yet sees empty resources because its current context points at another namespace.

Workloads relocate where permitted and the maintained node returns to service without unexpected data loss. That result validates Node cordon drain maintenance rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: A support account authenticates to a cluster yet sees empty resources because its current context points at another namespace.

Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. Validate with: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. This step belongs to Kubernetes upgrades and version skew rather than the complementary implementation and evidence pair. The intended approach is: Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. Validate with: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This step belongs to Controller manager reconciliation loops rather than the complementary implementation and evidence pair. The intended approach is: Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. Validate with: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Inspect kubectl config current-context, cluster server, user identity and namespace field. These observations are more relevant to kubectl context and cluster selection, not this case. The distinguishing check is: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. These observations are more relevant to ResourceQuota and LimitRange policies, not this case. The distinguishing check is: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Inspect FailedScheduling events, Pod requests, node allocatable and scheduler filter outcomes. These observations are more relevant to Pending Pods and resource-fit checks, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. These observations are more relevant to Controller manager reconciliation loops, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A drain is blocked when a PDB requires two healthy replicas but only one is currently Ready.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Workload context: An engineer reduces a Pod CPU limit but leaves its excessive request unchanged and sees no improvement in scheduling.

Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. This action addresses Kubelet node agent responsibilities instead of the controlling requirement. kubelet manages Pod execution on a node; it does not serve the central Kubernetes API or select new nodes. For this scenario prefer: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Workload context: An engineer reduces a Pod CPU limit but leaves its excessive request unchanged and sees no improvement in scheduling.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Workload context: An engineer reduces a Pod CPU limit but leaves its excessive request unchanged and sees no improvement in scheduling.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A cluster upgrade changes workload securityContext defaults and the team ignores admission warning logs during staging.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A cluster upgrade changes workload securityContext defaults and the team ignores admission warning logs during staging.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A cluster upgrade changes workload securityContext defaults and the team ignores admission warning logs during staging.