Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This step belongs to CNCF project maturity and adoption decisions rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Metrics are collected from intended targets at expected intervals with bounded label series and useful alerts. This step belongs to Prometheus pull scraping and metrics endpoints rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. This step belongs to Microservices contracts and failure isolation rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. These observations are more relevant to LoadBalancer Service provisioning, not this case. The distinguishing check is: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: An operator raises CPU shares in response to an OOMKilled event without investigating application memory usage.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. These observations are more relevant to Microservices contracts and failure isolation, not this case. The distinguishing check is: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. These observations are more relevant to SLIs SLOs and golden signals, not this case. The distinguishing check is: Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. These observations are more relevant to CNCF project maturity and adoption decisions, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. These observations are more relevant to Open standards vendor-neutral portability, not this case. The distinguishing check is: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: A company expects kube-scheduler to provide distributed tracing dashboards without any monitoring instrumentation or backend.

Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. These observations are more relevant to Upstream issue reporting and review collaboration, not this case. The distinguishing check is: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. These observations are more relevant to CNCF project maturity and adoption decisions, not this case. The distinguishing check is: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

Inspect metric labels and samples, log fields, trace/span correlation and sampling rates. These observations are more relevant to Metrics logs and traces distinctions, not this case. The distinguishing check is: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: Co-located containers communicate over localhost and move through Pod lifecycle as an atomic scheduling unit. Workload context: A team assumes a multi-container Pod receives a unique IP address for every container and configures contradictory routes.

Pending eligible Pods receive appropriate node bindings when capacity and constraints allow scheduling. That result validates Scheduler responsibility and binding rather than the requirement here. Verify instead: Co-located containers communicate over localhost and move through Pod lifecycle as an atomic scheduling unit. Workload context: A team assumes a multi-container Pod receives a unique IP address for every container and configures contradictory routes.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Co-located containers communicate over localhost and move through Pod lifecycle as an atomic scheduling unit. Workload context: A team assumes a multi-container Pod receives a unique IP address for every container and configures contradictory routes.

Distributed requests produce correlated spans and approved telemetry reaches its configured backend without leaking secrets. That result validates OpenTelemetry instrumentation and exporters rather than the requirement here. Verify instead: Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. That result validates SLIs SLOs and golden signals rather than the requirement here. Verify instead: Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This action addresses CPU requests and memory limits instead of the controlling requirement. Requests influence scheduling; limits govern enforcement and memory-limit breaches can terminate containers. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Set container command and args with awareness of how Kubernetes overrides image ENTRYPOINT and CMD defaults. This action addresses Container command entrypoint and arguments instead of the controlling requirement. Kubernetes command maps to the image ENTRYPOINT override and args maps to CMD arguments; a process exit can restart a Pod. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. Workload context: An analyst launches a debug container with host privileges even though inspecting a shared Pod network namespace would suffice.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This action addresses Labels selectors and annotations instead of the controlling requirement. Labels support equality and set-based selectors; annotations do not become Service selectors automatically. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A deployment switches from an image tag to digest pinning but administrators assume they no longer need registry authorization.

Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. This step belongs to kubectl apply and declarative updates rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: A cost-sensitive workload uses required affinity for spot nodes and becomes Pending when only on-demand capacity exists.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This step belongs to nodeSelector equality placement rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: A cost-sensitive workload uses required affinity for spot nodes and becomes Pending when only on-demand capacity exists.

Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. This step belongs to Pod shared network namespace and lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: A cost-sensitive workload uses required affinity for spot nodes and becomes Pending when only on-demand capacity exists.

Administrative commands target the intended cluster and avoid accidental changes to another environment. This step belongs to kubectl context and cluster selection rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. This step belongs to etcd consistency and cluster state rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. This step belongs to Pod shared network namespace and lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.