Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. These observations are more relevant to SLIs SLOs and golden signals, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A new team dismisses every CNCF sandbox project as unusable despite a well-scoped pilot and maintained code.

Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. These observations are more relevant to CNCF ecosystem and Kubernetes roles, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A new team dismisses every CNCF sandbox project as unusable despite a well-scoped pilot and maintained code.

Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. These observations are more relevant to Open source licensing and contribution basics, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A new team dismisses every CNCF sandbox project as unusable despite a well-scoped pilot and maintained code.

Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. These observations are more relevant to StatefulSet identity and volume templates, not this case. The distinguishing check is: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: An admin deletes a Pod and expects its bound persistent volume's underlying data to disappear automatically.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. These observations are more relevant to Cluster DNS and service discovery, not this case. The distinguishing check is: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: An admin deletes a Pod and expects its bound persistent volume's underlying data to disappear automatically.

Review namespace pod-security labels, admission warnings, violations and workload securityContext. These observations are more relevant to Pod Security Admission and namespaces, not this case. The distinguishing check is: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: An admin deletes a Pod and expects its bound persistent volume's underlying data to disappear automatically.

Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. These observations are more relevant to Sidecar containers and shared Pod lifecycle, not this case. The distinguishing check is: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. These observations are more relevant to Node cordon drain maintenance, not this case. The distinguishing check is: Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Check Pod priority, preemptionPolicy, scheduling events, available alternatives and victim selection. These observations are more relevant to PriorityClass and preemption, not this case. The distinguishing check is: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Check API endpoint connectivity, request audit records, resource authorization and response status. These observations are more relevant to Kubernetes API server and API requests, not this case. The distinguishing check is: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. These observations are more relevant to Image layers and build cache, not this case. The distinguishing check is: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. These observations are more relevant to Ingress and Gateway API routing, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This action addresses Cluster DNS and service discovery instead of the controlling requirement. Kubernetes DNS uses namespace-aware search paths; a fully qualified Service name avoids ambiguity across namespaces. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Validate with: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. This step belongs to Node readiness and scheduling exclusion rather than the complementary implementation and evidence pair. The intended approach is: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Validate with: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. This step belongs to Controller manager reconciliation loops rather than the complementary implementation and evidence pair. The intended approach is: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Validate with: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. This step belongs to Container OOMKilled and resource pressure rather than the complementary implementation and evidence pair. The intended approach is: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Validate with: Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. Workload context: A service fails after runAsNonRoot is applied because its image expects to write to a root-owned directory.

Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. This step belongs to StatefulSet identity and volume templates rather than the complementary implementation and evidence pair. The intended approach is: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Validate with: Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. Workload context: A service fails after runAsNonRoot is applied because its image expects to write to a root-owned directory.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. Validate with: Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. Workload context: A service fails after runAsNonRoot is applied because its image expects to write to a root-owned directory.

Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. This step belongs to Container versus virtual machine isolation rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. This step belongs to Sidecar containers and shared Pod lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. This step belongs to nodeSelector equality placement rather than the complementary implementation and evidence pair. The intended approach is: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Validate with: Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A development namespace cannot modify production ConfigMaps through the API but its Pods can still contact a production database over TCP.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A development namespace cannot modify production ConfigMaps through the API but its Pods can still contact a production database over TCP.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A development namespace cannot modify production ConfigMaps through the API but its Pods can still contact a production database over TCP.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.