Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Validate with: Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

External HTTP clients reach the correct application by hostname and route rules while unrelated paths stay rejected. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This step belongs to ServiceAccount and workload RBAC boundaries rather than the complementary implementation and evidence pair. The intended approach is: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Validate with: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Check Pod priority, preemptionPolicy, scheduling events, available alternatives and victim selection. These observations are more relevant to PriorityClass and preemption, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. These observations are more relevant to ConfigMap and Secret boundaries, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. These observations are more relevant to Container runtime and CRI, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

New claims provision compatible storage without requiring manual static PV creation for each request. This step belongs to StorageClass dynamic provisioning rather than the complementary implementation and evidence pair. The intended approach is: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Validate with: Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. Workload context: A team adds a LoadBalancer public IP to fix a timeout between two Pods that already communicate through internal DNS.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This step belongs to Pending pod FailedScheduling events rather than the complementary implementation and evidence pair. The intended approach is: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Validate with: Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. Workload context: A team adds a LoadBalancer public IP to fix a timeout between two Pods that already communicate through internal DNS.

Review namespace pod-security labels, admission warnings, violations and workload securityContext. This step belongs to Pod Security Admission and namespaces rather than the complementary implementation and evidence pair. The intended approach is: Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. Validate with: Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. Workload context: A team adds a LoadBalancer public IP to fix a timeout between two Pods that already communicate through internal DNS.

Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. These observations are more relevant to CNCF ecosystem and Kubernetes roles, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A startup chooses a graduated project without testing whether it supports required protocols and maintenance staffing.

Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. These observations are more relevant to Metrics logs and traces distinctions, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A startup chooses a graduated project without testing whether it supports required protocols and maintenance staffing.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. These observations are more relevant to Microservices contracts and failure isolation, not this case. The distinguishing check is: Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. Workload context: A startup chooses a graduated project without testing whether it supports required protocols and maintenance staffing.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. Workload context: A researcher discovers a critical authentication bypass in an ecosystem controller and posts a working exploit in a public issue first.

Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. These observations are more relevant to Open source licensing and contribution basics, not this case. The distinguishing check is: Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. Workload context: A researcher discovers a critical authentication bypass in an ecosystem controller and posts a working exploit in a public issue first.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. Workload context: A researcher discovers a critical authentication bypass in an ecosystem controller and posts a working exploit in a public issue first.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: Pods are Ready and endpoint slices contain valid addresses but traffic drops after a node's service proxy configuration fails.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. This action addresses Blue-green versus canary release patterns instead of the controlling requirement. Blue-green switches environments, whereas canary ramps exposure; a basic Deployment alone may not provide precise traffic percentages. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. This action addresses kubectl logs current versus previous instance instead of the controlling requirement. kubectl logs streams container stdout/stderr, and --previous selects the prior terminated instance if available. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: An operator hand-edits a Deployment in production and Argo CD later restores the Git-declared image tag.

Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. This step belongs to Open source licensing and contribution basics rather than the complementary implementation and evidence pair. The intended approach is: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Validate with: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. This step belongs to Open standards vendor-neutral portability rather than the complementary implementation and evidence pair. The intended approach is: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Validate with: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. This step belongs to SLIs SLOs and golden signals rather than the complementary implementation and evidence pair. The intended approach is: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Validate with: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This step belongs to Node affinity required vs preferred rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Inspect FailedScheduling events, Pod requests, node allocatable and scheduler filter outcomes. This step belongs to Pending Pods and resource-fit checks rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.