Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. This action addresses Open source licensing and contribution basics instead of the controlling requirement. Open source permits work under a specific license; public availability of source code alone does not erase conditions. For this scenario prefer: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. This action addresses CNCF ecosystem and Kubernetes roles instead of the controlling requirement. The CNCF ecosystem contains complementary projects; Kubernetes itself is not a complete application observability or delivery platform. For this scenario prefer: Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. Workload context: A platform designer assumes CNCF staff directly merge every pull request without maintainer review from the relevant project community.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: A developer commits a YAML Secret containing base64 API tokens to a public repository under the assumption they are encrypted.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Inspect volume type, mount paths, Pod owner, node placement and data recovery requirements. These observations are more relevant to Ephemeral emptyDir versus persistent volumes, not this case. The distinguishing check is: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. These observations are more relevant to ImagePullBackOff registry and auth errors, not this case. The distinguishing check is: Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. Workload context: An app in namespace finance resolves api to its own nonexistent finance Service instead of the api Service in payments.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This step belongs to Service stable virtual endpoint rather than the complementary implementation and evidence pair. The intended approach is: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Validate with: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A node offers spare CPU yet a Pending Pod never schedules because it requires an unavailable node label.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. This step belongs to DaemonSet node-local workloads rather than the complementary implementation and evidence pair. The intended approach is: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Validate with: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A node offers spare CPU yet a Pending Pod never schedules because it requires an unavailable node label.

Containers launch the intended process with arguments preserved and failures remain visible through status. This step belongs to Container command entrypoint and arguments rather than the complementary implementation and evidence pair. The intended approach is: Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. Validate with: Inspect Pod scheduling events, available node capacity, taints, selectors and assigned nodeName. Workload context: A node offers spare CPU yet a Pending Pod never schedules because it requires an unavailable node label.

Run containers with nonroot identities, minimal capabilities and an appropriate seccomp profile for reduced kernel attack surface. This action addresses Linux securityContext and seccomp basics instead of the controlling requirement. Disabling privilege escalation and dropping Linux capabilities reduce risk but do not replace image or API authorization. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: A Service has no endpoints because its selector refers to app=backend while replicas carry app=api.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This action addresses Cluster DNS and service discovery instead of the controlling requirement. Kubernetes DNS uses namespace-aware search paths; a fully qualified Service name avoids ambiguity across namespaces. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: A Service has no endpoints because its selector refers to app=backend while replicas carry app=api.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. Workload context: A Service has no endpoints because its selector refers to app=backend while replicas carry app=api.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This action addresses CNCF project maturity and adoption decisions instead of the controlling requirement. CNCF maturity levels indicate aspects of governance and adoption, not a guarantee of security or perfect product fit. For this scenario prefer: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Workload context: A developer submits 'Kubernetes is broken' with no version, manifest or error details and receives requests for reproduction evidence.

Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. This action addresses Open standards vendor-neutral portability instead of the controlling requirement. Cloud native APIs improve portability but do not guarantee identical storage classes, load balancers or custom controllers across clouds. For this scenario prefer: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Workload context: A developer submits 'Kubernetes is broken' with no version, manifest or error details and receives requests for reproduction evidence.

Report suspected project security vulnerabilities through the designated private security channel before public reproduction details or exploit examples. This action addresses Responsible vulnerability disclosure in communities instead of the controlling requirement. Public bug trackers are not always the right venue for undisclosed security issues; project security policies define channels. For this scenario prefer: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Workload context: A developer submits 'Kubernetes is broken' with no version, manifest or error details and receives requests for reproduction evidence.

Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. This step belongs to Kubernetes API server and API requests rather than the complementary implementation and evidence pair. The intended approach is: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Validate with: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. This step belongs to Kubernetes upgrades and version skew rather than the complementary implementation and evidence pair. The intended approach is: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Validate with: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. This step belongs to Service stable virtual endpoint rather than the complementary implementation and evidence pair. The intended approach is: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Validate with: Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A monitoring agent obtains a 403 from the Kubernetes API and operators mistakenly conclude the backing etcd database is unavailable.

Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. This action addresses Deployment and ReplicaSet ownership instead of the controlling requirement. A Deployment manages ReplicaSets and rolling changes; direct edits to controlled Pods are transient. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A monitoring agent obtains a 403 from the Kubernetes API and operators mistakenly conclude the backing etcd database is unavailable.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A monitoring agent obtains a 403 from the Kubernetes API and operators mistakenly conclude the backing etcd database is unavailable.

Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. This action addresses PodDisruptionBudget during voluntary eviction instead of the controlling requirement. A PodDisruptionBudget governs voluntary eviction; it does not guarantee protection against hardware failure or create new replicas. For this scenario prefer: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Workload context: A release uses image:latest and nodes pull different revisions because registry tags were moved between schedules.

Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. This action addresses Kubernetes API server and API requests instead of the controlling requirement. kube-apiserver validates and serves API requests; etcd stores cluster state rather than exposing the user API. For this scenario prefer: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Workload context: A release uses image:latest and nodes pull different revisions because registry tags were moved between schedules.

Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. This action addresses Linux namespaces and cgroups instead of the controlling requirement. Namespaces and cgroups provide different Linux primitives; neither independently creates Kubernetes scheduling. For this scenario prefer: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Workload context: A release uses image:latest and nodes pull different revisions because registry tags were moved between schedules.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: A helper process must keep running while the main app serves requests but a regular init container exits and never provides the service.

Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. That result validates etcd consistency and cluster state rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: A helper process must keep running while the main app serves requests but a regular init container exits and never provides the service.

Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. That result validates Image pull policy and cached images rather than the requirement here. Verify instead: The helper supports the main app and its lifecycle is correctly coordinated during start and shutdown. Workload context: A helper process must keep running while the main app serves requests but a regular init container exits and never provides the service.