Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A business bundles third-party CNCF ecosystem tools into a product and assumes every project has identical legal obligations.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. These observations are more relevant to Microservices contracts and failure isolation, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A business bundles third-party CNCF ecosystem tools into a product and assumes every project has identical legal obligations.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A business bundles third-party CNCF ecosystem tools into a product and assumes every project has identical legal obligations.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An engineer changes node affinity to fix repeated process crashes even though the Pod already has a healthy node assignment.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This action addresses PV reclaim policy Retain versus Delete instead of the controlling requirement. Retain leaves storage for deliberate recovery; Delete usually removes underlying dynamically provisioned storage when supported. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An engineer changes node affinity to fix repeated process crashes even though the Pod already has a healthy node assignment.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An engineer changes node affinity to fix repeated process crashes even though the Pod already has a healthy node assignment.

Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. These observations are more relevant to Service selector and port mismatch diagnostics, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. These observations are more relevant to ClusterIP and NodePort Service exposure, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. These observations are more relevant to PersistentVolume and claim bindings, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Inspect kubectl config current-context, cluster server, user identity and namespace field. These observations are more relevant to kubectl context and cluster selection, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Engineers identify the failing process message associated with the correct container instance and time window. That result validates kubectl logs current versus previous instance rather than the requirement here. Verify instead: Live cluster configurations converge to reviewed Git commits and unauthorized drift is flagged or corrected. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Traffic shifts as planned with clear rollback triggers and both versions behaving under their measured loads. That result validates Blue-green versus canary release patterns rather than the requirement here. Verify instead: Live cluster configurations converge to reviewed Git commits and unauthorized drift is flagged or corrected. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Public requests reach the intended application host and path with a valid certificate and matching backends. That result validates Ingress route and TLS mismatch diagnosis rather than the requirement here. Verify instead: Live cluster configurations converge to reviewed Git commits and unauthorized drift is flagged or corrected. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Clients resolve the intended in-cluster Service name and external DNS forwarding operates as designed. That result validates Cluster DNS and service discovery rather than the requirement here. Verify instead: Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. That result validates Ingress and Gateway API routing rather than the requirement here. Verify instead: Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. That result validates StatefulSet identity and volume templates rather than the requirement here. Verify instead: Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This action addresses Labels selectors and annotations instead of the controlling requirement. Labels support equality and set-based selectors; annotations do not become Service selectors automatically. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This action addresses CPU requests and memory limits instead of the controlling requirement. Requests influence scheduling; limits govern enforcement and memory-limit breaches can terminate containers. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Unschedulable unhealthy nodes are excluded until they meet documented readiness checks, preserving healthy placement. That result validates Node readiness and scheduling exclusion rather than the requirement here. Verify instead: Clients reach the intended healthy backends through a stable Service name despite Pod replacement. Workload context: An engineer exposes database Pods using a NodePort solely because an in-cluster client needs a stable private name.

Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. That result validates etcd consistency and cluster state rather than the requirement here. Verify instead: Clients reach the intended healthy backends through a stable Service name despite Pod replacement. Workload context: An engineer exposes database Pods using a NodePort solely because an in-cluster client needs a stable private name.

Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. That result validates Labels selectors and annotations rather than the requirement here. Verify instead: Clients reach the intended healthy backends through a stable Service name despite Pod replacement. Workload context: An engineer exposes database Pods using a NodePort solely because an in-cluster client needs a stable private name.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. These observations are more relevant to Node readiness and scheduling exclusion, not this case. The distinguishing check is: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A Pod is accepted by the API but has no nodeName while an operator insists the kubelet must choose a host.

Inspect image metadata, Pod command/args, process exit code and startup logs. These observations are more relevant to Container command entrypoint and arguments, not this case. The distinguishing check is: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A Pod is accepted by the API but has no nodeName while an operator insists the kubelet must choose a host.

Check API endpoint connectivity, request audit records, resource authorization and response status. These observations are more relevant to Kubernetes API server and API requests, not this case. The distinguishing check is: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A Pod is accepted by the API but has no nodeName while an operator insists the kubelet must choose a host.

Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. That result validates Service endpoint routing and kube-proxy rather than the requirement here. Verify instead: Noncompliant Pod specifications are rejected under enforcement without unexpectedly blocking approved workloads. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Temporary data is disposable while durable application records remain accessible across Pod recreation. That result validates Ephemeral emptyDir versus persistent volumes rather than the requirement here. Verify instead: Noncompliant Pod specifications are rejected under enforcement without unexpectedly blocking approved workloads. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. That result validates Namespace segmentation with NetworkPolicies rather than the requirement here. Verify instead: Noncompliant Pod specifications are rejected under enforcement without unexpectedly blocking approved workloads. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This action addresses Progressive delivery and release metrics instead of the controlling requirement. Automated analysis requires representative telemetry and guardrails; an unchanged rollout status does not prove user experience is healthy. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This action addresses GitOps reconciliation and source of truth instead of the controlling requirement. GitOps is a pull/reconciliation operating model rather than merely running kubectl from a CI server. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.