Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This action addresses GitOps reconciliation and source of truth instead of the controlling requirement. GitOps is a pull/reconciliation operating model rather than merely running kubectl from a CI server. For this scenario prefer: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Workload context: A registry mirror silently changes the contents behind a mutable release tag after the staging signoff.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This action addresses Cluster DNS and service discovery instead of the controlling requirement. Kubernetes DNS uses namespace-aware search paths; a fully qualified Service name avoids ambiguity across namespaces. For this scenario prefer: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. These observations are more relevant to Ingress and Gateway API routing, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Review image references, signing identities, attestations, admission decisions and deployed imageIDs. These observations are more relevant to Image provenance and admission policies, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Validate with: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. This step belongs to Deployment and ReplicaSet ownership rather than the complementary implementation and evidence pair. The intended approach is: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Validate with: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Compare object metadata labels, Service/Deployment selectors and selected object lists. This step belongs to Labels selectors and annotations rather than the complementary implementation and evidence pair. The intended approach is: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Validate with: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Inspect kubelet runtime endpoint, CRI protocol support, containerd service status and runtime errors. These observations are more relevant to Container runtime and CRI, not this case. The distinguishing check is: Inspect image metadata, Pod command/args, process exit code and startup logs. Workload context: A developer supplies only args and expects it to replace the image entrypoint executable rather than pass new parameters.

Inspect etcd quorum health, member status, snapshot freshness, certificate validity and restore procedure. These observations are more relevant to etcd consistency and cluster state, not this case. The distinguishing check is: Inspect image metadata, Pod command/args, process exit code and startup logs. Workload context: A developer supplies only args and expects it to replace the image entrypoint executable rather than pass new parameters.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Inspect image metadata, Pod command/args, process exit code and startup logs. Workload context: A developer supplies only args and expects it to replace the image entrypoint executable rather than pass new parameters.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. This action addresses etcd consistency and cluster state instead of the controlling requirement. etcd is a consistent key-value store for API state; it is not where persistent application volume data lives. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: An engineer adds a ResourceQuota but forgets required request defaults and new Pods fail admission without resource fields.

New claims provision compatible storage without requiring manual static PV creation for each request. That result validates StorageClass dynamic provisioning rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A replicated database Deployment recreates Pods with different names and volumes while its clustering logic requires stable ordinals.

Temporary data is disposable while durable application records remain accessible across Pod recreation. That result validates Ephemeral emptyDir versus persistent volumes rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A replicated database Deployment recreates Pods with different names and volumes while its clustering logic requires stable ordinals.

Noncompliant Pod specifications are rejected under enforcement without unexpectedly blocking approved workloads. That result validates Pod Security Admission and namespaces rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A replicated database Deployment recreates Pods with different names and volumes while its clustering logic requires stable ordinals.

Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. That result validates Deployment and ReplicaSet ownership rather than the requirement here. Verify instead: Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. Workload context: An operator assumes a strict PDB will keep an application online even when every worker suffers a power outage.

Administrative commands target the intended cluster and avoid accidental changes to another environment. That result validates kubectl context and cluster selection rather than the requirement here. Verify instead: Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. Workload context: An operator assumes a strict PDB will keep an application online even when every worker suffers a power outage.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. Workload context: An operator assumes a strict PDB will keep an application online even when every worker suffers a power outage.

Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. This step belongs to Deployment and ReplicaSet ownership rather than the complementary implementation and evidence pair. The intended approach is: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Validate with: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. This step belongs to Container versus virtual machine isolation rather than the complementary implementation and evidence pair. The intended approach is: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Validate with: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This step belongs to Node affinity required vs preferred rather than the complementary implementation and evidence pair. The intended approach is: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Validate with: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: A Pod requires disktype=ssd but the infrastructure uses storage-tier=ssd labels on all workers.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This action addresses Scheduler responsibility and binding instead of the controlling requirement. kube-scheduler assigns Pods to nodes; kubelet executes Pods after assignment and the controller manager reconciles controllers. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. This action addresses PodDisruptionBudget during voluntary eviction instead of the controlling requirement. A PodDisruptionBudget governs voluntary eviction; it does not guarantee protection against hardware failure or create new replicas. For this scenario prefer: Use kube-apiserver as the authenticated front end for Kubernetes API objects, rather than connecting clients directly to etcd. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Production uses a tested traceable artifact only after required promotion and environment gates succeed. That result validates CI versus CD pipeline separation rather than the requirement here. Verify instead: An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.

Healthy Pods enter ready endpoints only after application dependencies function, without restarting healthy processes unnecessarily. That result validates Readiness-probe failure versus process crash rather than the requirement here. Verify instead: An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.

Engineers identify the failing process message associated with the correct container instance and time window. That result validates kubectl logs current versus previous instance rather than the requirement here. Verify instead: An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.