Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. These observations are more relevant to Responsible vulnerability disclosure in communities, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. These observations are more relevant to SLIs SLOs and golden signals, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. These observations are more relevant to OpenTelemetry instrumentation and exporters, not this case. The distinguishing check is: Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Workload context: A Java client caches a removed Pod address indefinitely despite a stable Kubernetes Service record being available.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Workload context: A Java client caches a removed Pod address indefinitely despite a stable Kubernetes Service record being available.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Workload context: A Java client caches a removed Pod address indefinitely despite a stable Kubernetes Service record being available.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

The container sees the intended isolated resources while usage limits are reflected in host accounting. That result validates Linux namespaces and cgroups rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. That result validates Labels selectors and annotations rather than the requirement here. Verify instead: Administrative commands target the intended cluster and avoid accidental changes to another environment. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: An operator deploys an ephemeral debug container without a target process namespace and cannot observe the expected application process.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. These observations are more relevant to Blue-green versus canary release patterns, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: An operator deploys an ephemeral debug container without a target process namespace and cannot observe the expected application process.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: An operator deploys an ephemeral debug container without a target process namespace and cannot observe the expected application process.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This action addresses Prometheus pull scraping and metrics endpoints instead of the controlling requirement. Prometheus primarily scrapes targets on an interval; instrumentation must expose values and high-cardinality labels can overload storage. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This action addresses CNCF project maturity and adoption decisions instead of the controlling requirement. CNCF maturity levels indicate aspects of governance and adoption, not a guarantee of security or perfect product fit. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. That result validates SLIs SLOs and golden signals rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. That result validates Metrics logs and traces distinctions rather than the requirement here. Verify instead: A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Co-located containers communicate over localhost and move through Pod lifecycle as an atomic scheduling unit. That result validates Pod shared network namespace and lifecycle rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Administrative commands target the intended cluster and avoid accidental changes to another environment. That result validates kubectl context and cluster selection rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Examine authentication identity, RBAC decision, admission webhook result and API response status. These observations are more relevant to Authentication authorization and admission order, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. These observations are more relevant to StorageClass dynamic provisioning, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. These observations are more relevant to Node pressure and Pod eviction analysis, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. That result validates nodeSelector equality placement rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: A low-priority batch Pod is evicted to make room for a priority-class system workload after capacity is exhausted.

Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. That result validates DaemonSet node-local workloads rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: A low-priority batch Pod is evicted to make room for a priority-class system workload after capacity is exhausted.

Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. That result validates Scheduler versus autoscaler responsibility rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: A low-priority batch Pod is evicted to make room for a priority-class system workload after capacity is exhausted.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. This action addresses kubectl apply and declarative updates instead of the controlling requirement. Declarative apply merges intended fields but conflicts and imperative edits require field ownership review. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This action addresses Scheduler versus autoscaler responsibility instead of the controlling requirement. The autoscaler provisions nodes; it does not assign Pod nodeName or fix impossible affinity or quota constraints by itself. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.