Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Kubelet can start Pod sandboxes and containers through the configured CRI without incompatible shim failures. That result validates Container runtime and CRI rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A CI job sends gigabytes of irrelevant files as build context and produces unexpectedly large, slow image artifacts.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A CI job sends gigabytes of irrelevant files as build context and produces unexpectedly large, slow image artifacts.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Deployments use lean images without exposed build-time credentials or unnecessary packages. Workload context: A CI job sends gigabytes of irrelevant files as build context and produces unexpectedly large, slow image artifacts.

Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. That result validates Pod affinity anti-affinity rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Project maintainers receive actionable confidential reports and releases can be coordinated without exposing affected users prematurely. That result validates Responsible vulnerability disclosure in communities rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. That result validates Metrics logs and traces distinctions rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. That result validates Secret base64 encoding versus encryption rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Eligible nodes retrieve the intended immutable artifact and Pods progress beyond image pull. That result validates ImagePullBackOff registry and auth errors rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. That result validates Secret base64 encoding versus encryption rather than the requirement here. Verify instead: Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Clients resolve the intended in-cluster Service name and external DNS forwarding operates as designed. That result validates Cluster DNS and service discovery rather than the requirement here. Verify instead: Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. Workload context: A container starts as root and requests SYS_ADMIN despite needing only to read a mounted configuration file.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A customer database stores its only copy of records in emptyDir and loses them after a Pod eviction.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This action addresses PV reclaim policy Retain versus Delete instead of the controlling requirement. Retain leaves storage for deliberate recovery; Delete usually removes underlying dynamically provisioned storage when supported. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A customer database stores its only copy of records in emptyDir and loses them after a Pod eviction.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. Workload context: A customer database stores its only copy of records in emptyDir and loses them after a Pod eviction.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. That result validates PV reclaim policy Retain versus Delete rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. That result validates Container OOMKilled and resource pressure rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

External clients reach only the intended healthy Service backends and the allocated endpoint matches network policy. That result validates LoadBalancer Service provisioning rather than the requirement here. Verify instead: Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. These observations are more relevant to Kubernetes upgrades and version skew, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. These observations are more relevant to kubectl inspect and describe diagnostics, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. These observations are more relevant to Image layers and build cache, not this case. The distinguishing check is: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. These observations are more relevant to Ingress route and TLS mismatch diagnosis, not this case. The distinguishing check is: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. These observations are more relevant to Blue-green versus canary release patterns, not this case. The distinguishing check is: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This action addresses Progressive delivery and release metrics instead of the controlling requirement. Automated analysis requires representative telemetry and guardrails; an unchanged rollout status does not prove user experience is healthy. For this scenario prefer: Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. Workload context: A release team merges an invalid manifest and the GitOps controller repeatedly reports out-of-sync rather than deploying it successfully.

Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. These observations are more relevant to Node cordon drain maintenance, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. These observations are more relevant to Kubelet node agent responsibilities, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.

Inspect verbs, apiGroups, resources, RoleBinding/ClusterRoleBinding subjects and kubectl auth can-i results. These observations are more relevant to Role and ClusterRole authorization, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A team deletes a Service after seeing a timeout without inspecting endpoints, selector or targetPort details.