Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This action addresses Secret base64 encoding versus encryption instead of the controlling requirement. Base64 is a reversible encoding, not encryption; Secret storage and access policies require separate protection. For this scenario prefer: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This action addresses Authentication authorization and admission order instead of the controlling requirement. Authentication answers who called, authorization answers what may be done, and admission can apply policy to allowed requests. For this scenario prefer: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Workload context: Multiple Pods on the same node mount one ReadWriteOnce volume and an engineer mistakes the mode for a strict single-Pod guarantee.

Inspect kubectl config current-context, cluster server, user identity and namespace field. This step belongs to kubectl context and cluster selection rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. This step belongs to Declarative resource manifests and API versions rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This step belongs to CPU requests and memory limits rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

Compare object metadata labels, Service/Deployment selectors and selected object lists. These observations are more relevant to Labels selectors and annotations, not this case. The distinguishing check is: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. These observations are more relevant to Image layers and build cache, not this case. The distinguishing check is: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Check API endpoint connectivity, request audit records, resource authorization and response status. These observations are more relevant to Kubernetes API server and API requests, not this case. The distinguishing check is: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: A team deploys three individually named Pods with no higher-level controller and expects automated rolling updates.

Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. These observations are more relevant to Upstream issue reporting and review collaboration, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. These observations are more relevant to Open standards vendor-neutral portability, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. These observations are more relevant to Namespace scope and limits, not this case. The distinguishing check is: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Check API endpoint connectivity, request audit records, resource authorization and response status. These observations are more relevant to Kubernetes API server and API requests, not this case. The distinguishing check is: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. These observations are more relevant to Image scanning and software bills of materials, not this case. The distinguishing check is: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This action addresses Progressive delivery and release metrics instead of the controlling requirement. Automated analysis requires representative telemetry and guardrails; an unchanged rollout status does not prove user experience is healthy. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. This action addresses DaemonSet node-local workloads instead of the controlling requirement. A DaemonSet creates node-level replicas automatically rather than a fixed overall replica count like a Deployment. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This action addresses CPU requests and memory limits instead of the controlling requirement. Requests influence scheduling; limits govern enforcement and memory-limit breaches can terminate containers. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. This action addresses Ephemeral debugging containers instead of the controlling requirement. Ephemeral containers are intended for debugging and do not behave like ordinary replicated application containers. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. This action addresses Node pressure and Pod eviction analysis instead of the controlling requirement. Kubelet can evict Pods under node pressure; eviction is different from a liveness probe killing one container. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This action addresses Pending pod FailedScheduling events instead of the controlling requirement. Pending may mean unschedulable or image preparation; distinguish whether node assignment occurred before choosing next checks. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Workload context: A memory leak causes gradual growth and intermittent restart after each request burst despite unchanged code and service routing.

Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. This step belongs to PersistentVolume and claim bindings rather than the complementary implementation and evidence pair. The intended approach is: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Validate with: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Healthy but initializing Pods avoid traffic and genuinely stuck workloads recover without unnecessary restart loops. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Validate with: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Validate with: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A namespace lacks the correct registry pull Secret and otherwise healthy Pods remain in ImagePullBackOff.