Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A platform team drains a node hosting local ephemeral data without evaluating whether eviction will discard required state.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A platform team drains a node hosting local ephemeral data without evaluating whether eviction will discard required state.

Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. This action addresses Kubelet node agent responsibilities instead of the controlling requirement. kubelet manages Pod execution on a node; it does not serve the central Kubernetes API or select new nodes. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A platform team drains a node hosting local ephemeral data without evaluating whether eviction will discard required state.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This action addresses Secret base64 encoding versus encryption instead of the controlling requirement. Base64 is a reversible encoding, not encryption; Secret storage and access policies require separate protection. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A test batch job stores intermediate scratch files in emptyDir and appropriately discards them when it completes.

Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. This action addresses StorageClass dynamic provisioning instead of the controlling requirement. StorageClass names provisioning behavior; a controller and backend must support dynamic provisioning. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A test batch job stores intermediate scratch files in emptyDir and appropriately discards them when it completes.

Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. This action addresses Namespace segmentation with NetworkPolicies instead of the controlling requirement. NetworkPolicy governs data-plane traffic, whereas RBAC governs API actions; neither alone replaces the other. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A test batch job stores intermediate scratch files in emptyDir and appropriately discards them when it completes.

Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. These observations are more relevant to Declarative resource manifests and API versions, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Check Pod nodeSelector keys and values against node labels and scheduling events. These observations are more relevant to nodeSelector equality placement, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. This step belongs to kubectl describe and event chronology rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: A pipeline signs a release tag string without binding its attestation to the exact image digest deployed later.

Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. This step belongs to Helm charts templates and values rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: A pipeline signs a release tag string without binding its attestation to the exact image digest deployed later.

Healthy Pods enter ready endpoints only after application dependencies function, without restarting healthy processes unnecessarily. This step belongs to Readiness-probe failure versus process crash rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: A pipeline signs a release tag string without binding its attestation to the exact image digest deployed later.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Workload context: A release renames Pod labels and the frontend's Service has no endpoints despite available healthy Pods.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Workload context: A release renames Pod labels and the frontend's Service has no endpoints despite available healthy Pods.

Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. This action addresses StorageClass dynamic provisioning instead of the controlling requirement. StorageClass names provisioning behavior; a controller and backend must support dynamic provisioning. For this scenario prefer: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Workload context: A release renames Pod labels and the frontend's Service has no endpoints despite available healthy Pods.

Containers launch the intended process with arguments preserved and failures remain visible through status. This step belongs to Container command entrypoint and arguments rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Confirm the active kubeconfig context and namespace before using kubectl on production clusters. This step belongs to kubectl context and cluster selection rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Validate with: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. These observations are more relevant to Node readiness and scheduling exclusion, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A release contains an Ingress manifest using an API version removed by the current Kubernetes release.

Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. This action addresses Namespace segmentation with NetworkPolicies instead of the controlling requirement. NetworkPolicy governs data-plane traffic, whereas RBAC governs API actions; neither alone replaces the other. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: A backend loads a missing environment variable, exits with code 1 and enters CrashLoopBackOff after multiple restarts.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: A backend loads a missing environment variable, exits with code 1 and enters CrashLoopBackOff after multiple restarts.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: A backend loads a missing environment variable, exits with code 1 and enters CrashLoopBackOff after multiple restarts.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This step belongs to Prometheus pull scraping and metrics endpoints rather than the complementary implementation and evidence pair. The intended approach is: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Validate with: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. This step belongs to OpenTelemetry instrumentation and exporters rather than the complementary implementation and evidence pair. The intended approach is: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Validate with: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. This step belongs to CNCF ecosystem and Kubernetes roles rather than the complementary implementation and evidence pair. The intended approach is: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Validate with: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Workload context: A node loses CNI connectivity and control-plane heartbeats before workloads appear stuck in Terminating state.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Workload context: A node loses CNI connectivity and control-plane heartbeats before workloads appear stuck in Terminating state.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Workload context: A node loses CNI connectivity and control-plane heartbeats before workloads appear stuck in Terminating state.

Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. This step belongs to Node pressure and Pod eviction analysis rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.