Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Check Pod nodeSelector keys and values against node labels and scheduling events. These observations are more relevant to nodeSelector equality placement, not this case. The distinguishing check is: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. These observations are more relevant to Container runtime and CRI, not this case. The distinguishing check is: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Storage is provisioned in a suitable placement domain after the first eligible consumer is considered. That result validates WaitForFirstConsumer volume binding rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Noncompliant Pod specifications are rejected under enforcement without unexpectedly blocking approved workloads. That result validates Pod Security Admission and namespaces rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. That result validates ServiceAccount and workload RBAC boundaries rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. These observations are more relevant to Pod affinity anti-affinity, not this case. The distinguishing check is: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Inspect kubectl config current-context, cluster server, user identity and namespace field. These observations are more relevant to kubectl context and cluster selection, not this case. The distinguishing check is: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. These observations are more relevant to Node affinity required vs preferred, not this case. The distinguishing check is: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A StorageClass immediately provisions a zonal disk before the Pod's zone affinity is evaluated and creates a placement conflict.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. These observations are more relevant to Node affinity required vs preferred, not this case. The distinguishing check is: Inspect kubectl config current-context, cluster server, user identity and namespace field. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Inspect kubectl config current-context, cluster server, user identity and namespace field. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. These observations are more relevant to kubectl inspect and describe diagnostics, not this case. The distinguishing check is: Inspect kubectl config current-context, cluster server, user identity and namespace field. Workload context: An engineer has staging and production kubeconfig contexts but runs kubectl delete while the wrong context is active.

Set container command and args with awareness of how Kubernetes overrides image ENTRYPOINT and CMD defaults. This action addresses Container command entrypoint and arguments instead of the controlling requirement. Kubernetes command maps to the image ENTRYPOINT override and args maps to CMD arguments; a process exit can restart a Pod. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. This action addresses kubectl apply and declarative updates instead of the controlling requirement. Declarative apply merges intended fields but conflicts and imperative edits require field ownership review. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. That result validates Container runtime and CRI rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: Two replicas must not share a host but the Deployment uses podAffinity and places both beside each other.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: Two replicas must not share a host but the Deployment uses podAffinity and places both beside each other.

Unschedulable unhealthy nodes are excluded until they meet documented readiness checks, preserving healthy placement. That result validates Node readiness and scheduling exclusion rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: Two replicas must not share a host but the Deployment uses podAffinity and places both beside each other.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Set container command and args with awareness of how Kubernetes overrides image ENTRYPOINT and CMD defaults. Workload context: A service enters CrashLoopBackOff because an override points at a binary absent from the container image.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Set container command and args with awareness of how Kubernetes overrides image ENTRYPOINT and CMD defaults. Workload context: A service enters CrashLoopBackOff because an override points at a binary absent from the container image.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Set container command and args with awareness of how Kubernetes overrides image ENTRYPOINT and CMD defaults. Workload context: A service enters CrashLoopBackOff because an override points at a binary absent from the container image.

Public requests reach the intended application host and path with a valid certificate and matching backends. That result validates Ingress route and TLS mismatch diagnosis rather than the requirement here. Verify instead: Root-cause hypotheses align with recorded warning events and targeted corrective actions. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

Production uses a tested traceable artifact only after required promotion and environment gates succeed. That result validates CI versus CD pipeline separation rather than the requirement here. Verify instead: Root-cause hypotheses align with recorded warning events and targeted corrective actions. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

Healthy Pods enter ready endpoints only after application dependencies function, without restarting healthy processes unnecessarily. That result validates Readiness-probe failure versus process crash rather than the requirement here. Verify instead: Root-cause hypotheses align with recorded warning events and targeted corrective actions. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. This step belongs to Container OOMKilled and resource pressure rather than the complementary implementation and evidence pair. The intended approach is: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Validate with: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. This step belongs to LoadBalancer Service provisioning rather than the complementary implementation and evidence pair. The intended approach is: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Validate with: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. This step belongs to CNI Pod networking implementation rather than the complementary implementation and evidence pair. The intended approach is: Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. Validate with: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. These observations are more relevant to Readiness-probe failure versus process crash, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Inspect selected Pod/container, executed command, RBAC exec permission and audit records. These observations are more relevant to kubectl exec diagnostic boundaries, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. These observations are more relevant to Artifact promotion by digest, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. That result validates Node pressure and Pod eviction analysis rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: A debugging process mounts a long-lived token with cluster-admin rights even though it only needs to watch its own namespace's Pods.

Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. That result validates Linux securityContext and seccomp basics rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: A debugging process mounts a long-lived token with cluster-admin rights even though it only needs to watch its own namespace's Pods.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. Workload context: A debugging process mounts a long-lived token with cluster-admin rights even though it only needs to watch its own namespace's Pods.