Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This action addresses Progressive delivery and release metrics instead of the controlling requirement. Automated analysis requires representative telemetry and guardrails; an unchanged rollout status does not prove user experience is healthy. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This action addresses GitOps reconciliation and source of truth instead of the controlling requirement. GitOps is a pull/reconciliation operating model rather than merely running kubectl from a CI server. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: A service returns 503 from its readiness endpoint but the process remains Running with restartCount zero.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. This step belongs to Image pull policy and cached images rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Validate with: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This step belongs to CPU requests and memory limits rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Validate with: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. Validate with: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

Pin production images to verified digests or governed immutable tags so every node runs a known artifact. This action addresses Immutable container images and digests instead of the controlling requirement. Mutable image tags can resolve to different builds over time; digests identify immutable content. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: A runtime upgrade changes socket permissions so kubelet cannot communicate with its configured CRI endpoint.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. These observations are more relevant to kubectl logs current versus previous instance, not this case. The distinguishing check is: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. These observations are more relevant to Software supply chain attestations, not this case. The distinguishing check is: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. That result validates Correlating metrics logs and traces rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A pipeline marks a change released because unit tests passed but no deployment job ever updated the Kubernetes cluster.

Live cluster configurations converge to reviewed Git commits and unauthorized drift is flagged or corrected. That result validates GitOps reconciliation and source of truth rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A pipeline marks a change released because unit tests passed but no deployment job ever updated the Kubernetes cluster.

Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. That result validates Software supply chain attestations rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A pipeline marks a change released because unit tests passed but no deployment job ever updated the Kubernetes cluster.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. These observations are more relevant to Node readiness and scheduling exclusion, not this case. The distinguishing check is: Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. Workload context: Two teams put apps in different namespaces and assume the Pods cannot communicate even without NetworkPolicies.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. Workload context: Two teams put apps in different namespaces and assume the Pods cannot communicate even without NetworkPolicies.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. Workload context: Two teams put apps in different namespaces and assume the Pods cannot communicate even without NetworkPolicies.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This action addresses Authentication authorization and admission order instead of the controlling requirement. Authentication answers who called, authorization answers what may be done, and admission can apply policy to allowed requests. For this scenario prefer: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. This action addresses Service endpoint routing and kube-proxy instead of the controlling requirement. Service routing depends on endpoints and the cluster's Service dataplane; some clusters replace kube-proxy with an alternate implementation. For this scenario prefer: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. That result validates Service endpoint routing and kube-proxy rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. That result validates NetworkPolicy ingress egress isolation rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. That result validates Authentication authorization and admission order rather than the requirement here. Verify instead: In-cluster clients reach internal services and exposed node ports are limited to approved traffic. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. These observations are more relevant to LoadBalancer Service provisioning, not this case. The distinguishing check is: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Inspect volume type, mount paths, Pod owner, node placement and data recovery requirements. These observations are more relevant to Ephemeral emptyDir versus persistent volumes, not this case. The distinguishing check is: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. These observations are more relevant to ImagePullBackOff registry and auth errors, not this case. The distinguishing check is: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: Two containers inside one Pod share an emptyDir for generated configuration, but a second Pod cannot see it by default.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: Two containers inside one Pod share an emptyDir for generated configuration, but a second Pod cannot see it by default.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: Two containers inside one Pod share an emptyDir for generated configuration, but a second Pod cannot see it by default.

Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. These observations are more relevant to ServiceAccount and workload RBAC boundaries, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. These observations are more relevant to Node pressure and Pod eviction analysis, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. These observations are more relevant to NetworkPolicy ingress egress isolation, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.