Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. These observations are more relevant to Pod shared network namespace and lifecycle, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. These observations are more relevant to Kubelet node agent responsibilities, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. These observations are more relevant to Role and ClusterRole authorization, not this case. The distinguishing check is: Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. This action addresses PodDisruptionBudget during voluntary eviction instead of the controlling requirement. A PodDisruptionBudget governs voluntary eviction; it does not guarantee protection against hardware failure or create new replicas. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A team backs up container logs and assumes it can recreate lost deployments after all etcd members fail simultaneously.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: An app exceeds its memory limit and restarts with OOMKilled while its CPU request remains satisfied.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: An app exceeds its memory limit and restarts with OOMKilled while its CPU request remains satisfied.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This action addresses ResourceQuota and LimitRange policies instead of the controlling requirement. ResourceQuota applies aggregate namespace limits while LimitRange sets per-object defaults and constraints; quotas do not make capacity. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: An app exceeds its memory limit and restarts with OOMKilled while its CPU request remains satisfied.

Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A PVC stays Pending while no Pod references it and the team calls the CSI provisioner broken despite WaitForFirstConsumer.

Clients resolve the intended in-cluster Service name and external DNS forwarding operates as designed. This step belongs to Cluster DNS and service discovery rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A PVC stays Pending while no Pod references it and the team calls the CSI provisioner broken despite WaitForFirstConsumer.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A PVC stays Pending while no Pod references it and the team calls the CSI provisioner broken despite WaitForFirstConsumer.

Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. This action addresses Linux securityContext and seccomp basics instead of the controlling requirement. Disabling privilege escalation and dropping Linux capabilities reduce risk but do not replace image or API authorization. For this scenario prefer: Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This action addresses Authentication authorization and admission order instead of the controlling requirement. Authentication answers who called, authorization answers what may be done, and admission can apply policy to allowed requests. For this scenario prefer: Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. This action addresses DaemonSet node-local workloads instead of the controlling requirement. A DaemonSet creates node-level replicas automatically rather than a fixed overall replica count like a Deployment. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This action addresses Scheduler responsibility and binding instead of the controlling requirement. kube-scheduler assigns Pods to nodes; kubelet executes Pods after assignment and the controller manager reconciles controllers. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Healthy but initializing Pods avoid traffic and genuinely stuck workloads recover without unnecessary restart loops. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Validate with: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. This step belongs to NetworkPolicy ingress egress isolation rather than the complementary implementation and evidence pair. The intended approach is: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Validate with: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. This step belongs to ClusterIP and NodePort Service exposure rather than the complementary implementation and evidence pair. The intended approach is: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Validate with: Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. That result validates Labels selectors and annotations rather than the requirement here. Verify instead: Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. That result validates Namespace scope and limits rather than the requirement here. Verify instead: Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. That result validates nodeSelector equality placement rather than the requirement here. Verify instead: Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. This action addresses etcd consistency and cluster state instead of the controlling requirement. etcd is a consistent key-value store for API state; it is not where persistent application volume data lives. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Use namespaces to group namespaced resources and policies, and add explicit RBAC and network controls for isolation. This action addresses Namespace scope and limits instead of the controlling requirement. Namespaces organize resource names but are not automatically strong security boundaries or separate clusters. For this scenario prefer: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Teams receive predictable defaults and cannot consume more namespace resources than policy permits. That result validates ResourceQuota and LimitRange policies rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

The container sees the intended isolated resources while usage limits are reflected in host accounting. That result validates Linux namespaces and cgroups rather than the requirement here. Verify instead: Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.