Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This action addresses Scheduler versus autoscaler responsibility instead of the controlling requirement. The autoscaler provisions nodes; it does not assign Pod nodeName or fix impossible affinity or quota constraints by itself. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: A support team tries to add a permanent second service by creating an ephemeral container and expects Deployment updates to preserve it.

Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. This action addresses NetworkPolicy ingress egress isolation instead of the controlling requirement. Without policies a standard namespace usually permits traffic; NetworkPolicy enforcement requires a compatible networking implementation. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A bare-metal test cluster creates a LoadBalancer Service but EXTERNAL-IP remains pending because no load-balancer controller exists.

Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. This action addresses CNI Pod networking implementation instead of the controlling requirement. The CNI plugin supplies Pod networking; a Kubernetes Service alone cannot correct a broken Pod network implementation. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A bare-metal test cluster creates a LoadBalancer Service but EXTERNAL-IP remains pending because no load-balancer controller exists.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A bare-metal test cluster creates a LoadBalancer Service but EXTERNAL-IP remains pending because no load-balancer controller exists.

The container sees the intended isolated resources while usage limits are reflected in host accounting. This step belongs to Linux namespaces and cgroups rather than the complementary implementation and evidence pair. The intended approach is: Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. Validate with: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.

Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. Validate with: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This step belongs to Scheduler responsibility and binding rather than the complementary implementation and evidence pair. The intended approach is: Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. Validate with: Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This action addresses Prometheus pull scraping and metrics endpoints instead of the controlling requirement. Prometheus primarily scrapes targets on an interval; instrumentation must expose values and high-cardinality labels can overload storage. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Report suspected project security vulnerabilities through the designated private security channel before public reproduction details or exploit examples. This action addresses Responsible vulnerability disclosure in communities instead of the controlling requirement. Public bug trackers are not always the right venue for undisclosed security issues; project security policies define channels. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. That result validates Open standards vendor-neutral portability rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. That result validates Metrics logs and traces distinctions rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

Distributed requests produce correlated spans and approved telemetry reaches its configured backend without leaking secrets. That result validates OpenTelemetry instrumentation and exporters rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A 99.9 percent availability objective is written without specifying which requests count as successful over what period.

Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. This step belongs to Ephemeral emptyDir versus persistent volumes rather than the complementary implementation and evidence pair. The intended approach is: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Validate with: Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Validate with: Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. Validate with: Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. Workload context: An admin deletes a StatefulSet and assumes all its PVCs and underlying disks must be deleted by default.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. These observations are more relevant to CI versus CD pipeline separation, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. These observations are more relevant to Ephemeral debug containers for minimal images, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Inspect maxSurge, maxUnavailable, rollout conditions, ReplicaSets, readiness and prior image revisions. These observations are more relevant to Deployment rolling updates and rollback, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Replica placement stays within the intended skew or reports clear scheduling limits. That result validates Topology spread constraints rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: A cluster adds nodes successfully but the scheduler still rejects the workload because it requests a nonexistent topology label.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This step belongs to Ephemeral debug containers for minimal images rather than the complementary implementation and evidence pair. The intended approach is: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Validate with: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A release team observes healthy node memory metrics but a specific downstream queue service accumulates errors during peak load.

Production uses a tested traceable artifact only after required promotion and environment gates succeed. This step belongs to CI versus CD pipeline separation rather than the complementary implementation and evidence pair. The intended approach is: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Validate with: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A release team observes healthy node memory metrics but a specific downstream queue service accumulates errors during peak load.

Compare Git revision, application sync status, live resource diff and reconciliation events. This step belongs to GitOps reconciliation and source of truth rather than the complementary implementation and evidence pair. The intended approach is: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Validate with: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A release team observes healthy node memory metrics but a specific downstream queue service accumulates errors during peak load.

Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Validate with: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Validate with: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Validate with: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A project sets an audit Pod Security label and assumes this alone prevents privileged workloads from starting.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.