Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. This action addresses Node pressure and Pod eviction analysis instead of the controlling requirement. Kubelet can evict Pods under node pressure; eviction is different from a liveness probe killing one container. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. This action addresses Service endpoint routing and kube-proxy instead of the controlling requirement. Service routing depends on endpoints and the cluster's Service dataplane; some clusters replace kube-proxy with an alternate implementation. For this scenario prefer: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Inspect image metadata, Pod command/args, process exit code and startup logs. This step belongs to Container command entrypoint and arguments rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This step belongs to Sidecar containers and shared Pod lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. This step belongs to CPU requests and memory limits rather than the complementary implementation and evidence pair. The intended approach is: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Validate with: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Review image references, signing identities, attestations, admission decisions and deployed imageIDs. These observations are more relevant to Image provenance and admission policies, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. These observations are more relevant to PV reclaim policy Retain versus Delete, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. These observations are more relevant to WaitForFirstConsumer volume binding, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Review image references, signing identities, attestations, admission decisions and deployed imageIDs. These observations are more relevant to Image provenance and admission policies, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Inspect StatefulSet ordinal Pod names, headless Service, volumeClaimTemplates and update strategy. These observations are more relevant to StatefulSet identity and volume templates, not this case. The distinguishing check is: Review namespace pod-security labels, admission warnings, violations and workload securityContext. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Staging and production execute identical approved artifact content and releases remain reproducible. That result validates Artifact promotion by digest rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

Engineers identify the failing process message associated with the correct container instance and time window. That result validates kubectl logs current versus previous instance rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

Diagnostics are reproducible, scoped and do not leave unreviewed configuration changes inside containers. That result validates kubectl exec diagnostic boundaries rather than the requirement here. Verify instead: Production uses a tested traceable artifact only after required promotion and environment gates succeed. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Validate with: Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Teams receive predictable defaults and cannot consume more namespace resources than policy permits. This step belongs to ResourceQuota and LimitRange policies rather than the complementary implementation and evidence pair. The intended approach is: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Validate with: Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. This step belongs to Role and ClusterRole authorization rather than the complementary implementation and evidence pair. The intended approach is: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Validate with: Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Traffic shifts as planned with clear rollback triggers and both versions behaving under their measured loads. That result validates Blue-green versus canary release patterns rather than the requirement here. Verify instead: Troubleshooters inspect network and process behavior without bloating or rebuilding the immutable production image. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. That result validates Correlating metrics logs and traces rather than the requirement here. Verify instead: Troubleshooters inspect network and process behavior without bloating or rebuilding the immutable production image. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. That result validates Software supply chain attestations rather than the requirement here. Verify instead: Troubleshooters inspect network and process behavior without bloating or rebuilding the immutable production image. Workload context: A distroless TLS gateway Pod has no curl binary and engineers want to publish a new image merely to diagnose routing.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Eligible nodes retrieve the intended immutable artifact and Pods progress beyond image pull. This step belongs to ImagePullBackOff registry and auth errors rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. This step belongs to Linux securityContext and seccomp basics rather than the complementary implementation and evidence pair. The intended approach is: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Validate with: Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Technical proposals reach appropriate reviewers with documented rationale and open community feedback. That result validates Kubernetes SIG and community governance rather than the requirement here. Verify instead: Distributed requests produce correlated spans and approved telemetry reaches its configured backend without leaking secrets. Workload context: Two microservices emit traces but headers are not propagated, so each service appears as an unrelated root request.

Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. That result validates SLIs SLOs and golden signals rather than the requirement here. Verify instead: Distributed requests produce correlated spans and approved telemetry reaches its configured backend without leaking secrets. Workload context: Two microservices emit traces but headers are not propagated, so each service appears as an unrelated root request.

Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. That result validates Open standards vendor-neutral portability rather than the requirement here. Verify instead: Distributed requests produce correlated spans and approved telemetry reaches its configured backend without leaking secrets. Workload context: Two microservices emit traces but headers are not propagated, so each service appears as an unrelated root request.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. These observations are more relevant to Node affinity required vs preferred, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Inspect process namespace, container cgroup limits, OOM events and host resource metrics. These observations are more relevant to Linux namespaces and cgroups, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. These observations are more relevant to Controller manager reconciliation loops, not this case. The distinguishing check is: Check Pod nodeSelector keys and values against node labels and scheduling events. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. This step belongs to kubectl logs current versus previous instance rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This step belongs to Ephemeral debug containers for minimal images rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.

Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. This step belongs to Software supply chain attestations rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A scheduler reports FailedScheduling for topology constraints and developers waste time changing the web-app port.