Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A service hits its cgroup memory ceiling and is killed even though host-wide free RAM remains available.

Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. This step belongs to kubectl apply and declarative updates rather than the complementary implementation and evidence pair. The intended approach is: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Validate with: Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. Workload context: A team changes only imagePullPolicy but expects it to provide cryptographic provenance for untrusted registry content.

Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Validate with: Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. Workload context: A team changes only imagePullPolicy but expects it to provide cryptographic provenance for untrusted registry content.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This step belongs to Image pull policy and cached images rather than the complementary implementation and evidence pair. The intended approach is: Pin production images to verified digests or governed immutable tags so every node runs a known artifact. Validate with: Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. Workload context: A team changes only imagePullPolicy but expects it to provide cryptographic provenance for untrusted registry content.

Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This step belongs to ImagePullBackOff registry and auth errors rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

New claims provision compatible storage without requiring manual static PV creation for each request. This step belongs to StorageClass dynamic provisioning rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. This step belongs to Kubernetes SIG and community governance rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A service packages OCI-compatible images but its persistent volume depends on a provider-only disk implementation unavailable in a second cloud.

Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. This step belongs to CNCF ecosystem and Kubernetes roles rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A service packages OCI-compatible images but its persistent volume depends on a provider-only disk implementation unavailable in a second cloud.

Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. This step belongs to Open source licensing and contribution basics rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A service packages OCI-compatible images but its persistent volume depends on a provider-only disk implementation unavailable in a second cloud.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. These observations are more relevant to ResourceQuota and LimitRange policies, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A workload with a custom zone selector is stuck because nodes use a different label key than the manifest.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A workload with a custom zone selector is stuck because nodes use a different label key than the manifest.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A workload with a custom zone selector is stuck because nodes use a different label key than the manifest.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: The precise scheduling blocker is removed and the workload binds to an eligible node. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. That result validates Secret base64 encoding versus encryption rather than the requirement here. Verify instead: The precise scheduling blocker is removed and the workload binds to an eligible node. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. That result validates Container OOMKilled and resource pressure rather than the requirement here. Verify instead: The precise scheduling blocker is removed and the workload binds to an eligible node. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. This action addresses StatefulSet identity and volume templates instead of the controlling requirement. StatefulSets manage stable identities and can provision distinct PVCs; they do not automatically provide database replication correctness. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This action addresses Authentication authorization and admission order instead of the controlling requirement. Authentication answers who called, authorization answers what may be done, and admission can apply policy to allowed requests. For this scenario prefer: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Inspect kubectl config current-context, cluster server, user identity and namespace field. These observations are more relevant to kubectl context and cluster selection, not this case. The distinguishing check is: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A cluster upgrade removes an API version used by an old application chart and production apply fails.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This step belongs to Sidecar containers and shared Pod lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Validate with: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. This step belongs to PodDisruptionBudget during voluntary eviction rather than the complementary implementation and evidence pair. The intended approach is: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Validate with: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. This step belongs to PersistentVolume zone binding and placement rather than the complementary implementation and evidence pair. The intended approach is: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Validate with: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. This step belongs to NetworkPolicy ingress egress isolation rather than the complementary implementation and evidence pair. The intended approach is: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Validate with: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This step belongs to Pod Security Admission and namespaces rather than the complementary implementation and evidence pair. The intended approach is: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Validate with: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Validate with: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This action addresses Container runtime and CRI instead of the controlling requirement. A runtime executes containers; the CRI is its API integration with kubelet rather than the Kubernetes API server. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.