Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Validate with: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. This step belongs to PersistentVolume zone binding and placement rather than the complementary implementation and evidence pair. The intended approach is: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Validate with: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. This step belongs to Node readiness and scheduling exclusion rather than the complementary implementation and evidence pair. The intended approach is: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Validate with: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. This step belongs to Container OOMKilled and resource pressure rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Inspect volume type, mount paths, Pod owner, node placement and data recovery requirements. This step belongs to Ephemeral emptyDir versus persistent volumes rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. These observations are more relevant to Metrics logs and traces distinctions, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. These observations are more relevant to Open standards vendor-neutral portability, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. These observations are more relevant to PodDisruptionBudget during voluntary eviction, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. These observations are more relevant to Container runtime and CRI, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. This step belongs to kubectl logs current versus previous instance rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A hotfix is deployed manually from a laptop with no artifact digest or link to a passing CI run.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This step belongs to GitOps reconciliation and source of truth rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A hotfix is deployed manually from a laptop with no artifact digest or link to a passing CI run.

Public requests reach the intended application host and path with a valid certificate and matching backends. This step belongs to Ingress route and TLS mismatch diagnosis rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A hotfix is deployed manually from a laptop with no artifact digest or link to a passing CI run.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. This step belongs to StatefulSet identity and volume templates rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This step belongs to WaitForFirstConsumer volume binding rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Compare object metadata labels, Service/Deployment selectors and selected object lists. These observations are more relevant to Labels selectors and annotations, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. These observations are more relevant to Role and ClusterRole authorization, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. These observations are more relevant to Container runtime and CRI, not this case. The distinguishing check is: Validate manifest API group/version, field schema, kind, namespace, admission responses and managed-field conflicts. Workload context: A developer puts an unsupported spec field in a ConfigMap and assumes YAML formatting guarantees correct Kubernetes behavior.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. This action addresses CrashLoopBackOff and previous logs instead of the controlling requirement. CrashLoopBackOff indicates repeated container exits and restart delays, not a scheduler placement failure. For this scenario prefer: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Inspect process namespace, container cgroup limits, OOM events and host resource metrics. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. That result validates Node affinity required vs preferred rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. That result validates Sidecar containers and shared Pod lifecycle rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Pending eligible Pods receive appropriate node bindings when capacity and constraints allow scheduling. That result validates Scheduler responsibility and binding rather than the requirement here. Verify instead: Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.