Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. These observations are more relevant to Node labels and allocatable inventory, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: A log forwarder in a separate Pod tries to reach localhost:9000 on the application Pod and fails.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: A log forwarder in a separate Pod tries to reach localhost:9000 on the application Pod and fails.

Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. These observations are more relevant to OCI registries and image distribution, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: A log forwarder in a separate Pod tries to reach localhost:9000 on the application Pod and fails.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. That result validates Container runtime and CRI rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. These observations are more relevant to Artifact promotion by digest, not this case. The distinguishing check is: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. These observations are more relevant to Ingress route and TLS mismatch diagnosis, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. These observations are more relevant to Blue-green versus canary release patterns, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. These observations are more relevant to kubectl logs current versus previous instance, not this case. The distinguishing check is: Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. These observations are more relevant to Secret base64 encoding versus encryption, not this case. The distinguishing check is: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Examine authentication identity, RBAC decision, admission webhook result and API response status. These observations are more relevant to Authentication authorization and admission order, not this case. The distinguishing check is: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. These observations are more relevant to Cluster DNS and service discovery, not this case. The distinguishing check is: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

The faulty revision is identified and rollback or correction restores the intended application version. This step belongs to Rollout history status and change correlation rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This step belongs to Artifact promotion by digest rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. This step belongs to CI versus CD pipeline separation rather than the complementary implementation and evidence pair. The intended approach is: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Validate with: Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. This step belongs to StatefulSet identity and volume templates rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

New claims provision compatible storage without requiring manual static PV creation for each request. This step belongs to StorageClass dynamic provisioning rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This step belongs to Image provenance and admission policies rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

The container remains running or completes as intended without repeated backoff cycles after a targeted correction. That result validates CrashLoopBackOff and previous logs rather than the requirement here. Verify instead: Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. That result validates ServiceAccount and workload RBAC boundaries rather than the requirement here. Verify instead: Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. That result validates Linux securityContext and seccomp basics rather than the requirement here. Verify instead: Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.