Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This action addresses Container runtime and CRI instead of the controlling requirement. A runtime executes containers; the CRI is its API integration with kubelet rather than the Kubernetes API server. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: A multi-tenant hosting provider runs untrusted code and assumes a container namespace is equivalent to a separate hypervisor VM.

Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. That result validates Labels selectors and annotations rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: A Service lookup from a second namespace fails because the caller uses an unqualified name and resolves its local namespace.

Deployments use lean images without exposed build-time credentials or unnecessary packages. That result validates Image layers and build cache rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: A Service lookup from a second namespace fails because the caller uses an unqualified name and resolves its local namespace.

Clients reach the intended healthy backends through a stable Service name despite Pod replacement. That result validates Service stable virtual endpoint rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: A Service lookup from a second namespace fails because the caller uses an unqualified name and resolves its local namespace.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This action addresses Secret base64 encoding versus encryption instead of the controlling requirement. Base64 is a reversible encoding, not encryption; Secret storage and access policies require separate protection. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. These observations are more relevant to Sidecar containers and shared Pod lifecycle, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Inspect process namespace, container cgroup limits, OOM events and host resource metrics. These observations are more relevant to Linux namespaces and cgroups, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

In-cluster clients reach internal services and exposed node ports are limited to approved traffic. That result validates ClusterIP and NodePort Service exposure rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. That result validates ReadWriteOnce and ReadWriteMany semantics rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

Public requests reach the intended application host and path with a valid certificate and matching backends. That result validates Ingress route and TLS mismatch diagnosis rather than the requirement here. Verify instead: Template rendering produces intended resources and upgrades or rollbacks remain tied to specific chart revisions. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

A failing candidate build halts or rolls back before reaching full audience while healthy versions progress safely. That result validates Progressive delivery and release metrics rather than the requirement here. Verify instead: Template rendering produces intended resources and upgrades or rollbacks remain tied to specific chart revisions. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. That result validates Correlating metrics logs and traces rather than the requirement here. Verify instead: Template rendering produces intended resources and upgrades or rollbacks remain tied to specific chart revisions. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

A supported resource can be applied predictably and unknown fields or removed API versions are identified before rollout. That result validates Declarative resource manifests and API versions rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Operators identify the failing object and use evidence before editing controllers or escalating access. That result validates kubectl inspect and describe diagnostics rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. That result validates nodeSelector equality placement rather than the requirement here. Verify instead: Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. Workload context: A developer receives permission to list Pods in one namespace but believes it also allows deleting Nodes across the cluster.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This action addresses Ephemeral debug containers for minimal images instead of the controlling requirement. Ephemeral containers are for diagnostics and cannot be treated as permanent workload replicas or restarted like ordinary containers. For this scenario prefer: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Inspect image metadata, Pod command/args, process exit code and startup logs. These observations are more relevant to Container command entrypoint and arguments, not this case. The distinguishing check is: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This step belongs to Image pull policy and cached images rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. This step belongs to DaemonSet node-local workloads rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. This step belongs to Pod affinity anti-affinity rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: An engineer assumes a public registry automatically signs every published image and disables provenance verification.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.