Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. These observations are more relevant to Service endpoint routing and kube-proxy, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. These observations are more relevant to Ingress and Gateway API routing, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A security engineer assumes a policy that selects server Pods also blocks outgoing traffic, although only ingress policyTypes are configured.

Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. These observations are more relevant to ServiceAccount and workload RBAC boundaries, not this case. The distinguishing check is: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. These observations are more relevant to Readiness liveness and startup probe behavior, not this case. The distinguishing check is: Review image references, signing identities, attestations, admission decisions and deployed imageIDs. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. This step belongs to Node affinity required vs preferred rather than the complementary implementation and evidence pair. The intended approach is: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Validate with: Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. This step belongs to CPU requests and memory limits rather than the complementary implementation and evidence pair. The intended approach is: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Validate with: Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This step belongs to Declarative resource manifests and API versions rather than the complementary implementation and evidence pair. The intended approach is: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Validate with: Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. This action addresses NetworkPolicy ingress egress isolation instead of the controlling requirement. Without policies a standard namespace usually permits traffic; NetworkPolicy enforcement requires a compatible networking implementation. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. Workload context: A stateful app writes records to container writable layers and loses them when a Pod is rescheduled to another node.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. This step belongs to PersistentVolume and claim bindings rather than the complementary implementation and evidence pair. The intended approach is: Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. Validate with: Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. Workload context: A namespace is renamed and cross-namespace NetworkPolicy selectors no longer match labels used by permitted traffic.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This step belongs to Scheduler responsibility and binding rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. This step belongs to Service stable virtual endpoint rather than the complementary implementation and evidence pair. The intended approach is: Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. Validate with: Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. Workload context: An operator modifies one Deployment-owned Pod image tag directly and is surprised the replacement reverts to the template.

Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. That result validates etcd consistency and cluster state rather than the requirement here. Verify instead: Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. That result validates Node affinity required vs preferred rather than the requirement here. Verify instead: Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. Workload context: A new Kubernetes node receives workloads but has no metrics agent because the DaemonSet's node selector excludes it.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This action addresses GitOps reconciliation and source of truth instead of the controlling requirement. GitOps is a pull/reconciliation operating model rather than merely running kubectl from a CI server. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. This action addresses Readiness-probe failure versus process crash instead of the controlling requirement. Readiness-probe failure normally removes endpoint traffic without killing the container; liveness changes restart behavior. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: A chart installs successfully in development but production values accidentally disable its readiness probes.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This action addresses Secret base64 encoding versus encryption instead of the controlling requirement. Base64 is a reversible encoding, not encryption; Secret storage and access policies require separate protection. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This action addresses Pending pod FailedScheduling events instead of the controlling requirement. Pending may mean unschedulable or image preparation; distinguish whether node assignment occurred before choosing next checks. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A supply-chain pipeline promotes a scanned image but cannot prove which CI builder generated the deployed digest.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. These observations are more relevant to Secret base64 encoding versus encryption, not this case. The distinguishing check is: Examine authentication identity, RBAC decision, admission webhook result and API response status. Workload context: A service account authenticates but receives 403 when deleting Secrets; developers assume an admission webhook caused the denial.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This action addresses Pending pod FailedScheduling events instead of the controlling requirement. Pending may mean unschedulable or image preparation; distinguish whether node assignment occurred before choosing next checks. For this scenario prefer: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. This action addresses PersistentVolume and claim bindings instead of the controlling requirement. A PVC is a storage request and a PV is a cluster storage resource; neither should be confused with an emptyDir volume. For this scenario prefer: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.