Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This step belongs to Node affinity required vs preferred rather than the complementary implementation and evidence pair. The intended approach is: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Validate with: Inspect FailedScheduling events, Pod requests, node allocatable and scheduler filter outcomes. Workload context: A cluster autoscaler adds nodes of the same small instance type and the oversized Pod still cannot fit.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. This step belongs to PodDisruptionBudget during voluntary eviction rather than the complementary implementation and evidence pair. The intended approach is: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Validate with: Inspect FailedScheduling events, Pod requests, node allocatable and scheduler filter outcomes. Workload context: A cluster autoscaler adds nodes of the same small instance type and the oversized Pod still cannot fit.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. Validate with: Inspect FailedScheduling events, Pod requests, node allocatable and scheduler filter outcomes. Workload context: A cluster autoscaler adds nodes of the same small instance type and the oversized Pod still cannot fit.

Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. That result validates Node affinity required vs preferred rather than the requirement here. Verify instead: Scheduling constraints match verified node attributes without exhausting reserved system resources. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Teams receive predictable defaults and cannot consume more namespace resources than policy permits. That result validates ResourceQuota and LimitRange policies rather than the requirement here. Verify instead: Scheduling constraints match verified node attributes without exhausting reserved system resources. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. That result validates PriorityClass and preemption rather than the requirement here. Verify instead: Scheduling constraints match verified node attributes without exhausting reserved system resources. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Staging and production execute identical approved artifact content and releases remain reproducible. This step belongs to Artifact promotion by digest rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This step belongs to Rollout history status and change correlation rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. This step belongs to Blue-green versus canary release patterns rather than the complementary implementation and evidence pair. The intended approach is: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Validate with: Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. These observations are more relevant to CNCF project maturity and adoption decisions, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. These observations are more relevant to Upstream issue reporting and review collaboration, not this case. The distinguishing check is: Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. Workload context: A team copies sample code from a public repository but never reads its license or checks redistribution notices.

Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. This action addresses Kubernetes SIG and community governance instead of the controlling requirement. Kubernetes development is governed through open community processes rather than a single cloud vendor's private roadmap. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. This action addresses OpenTelemetry instrumentation and exporters instead of the controlling requirement. OpenTelemetry standardizes collection and export; a collector is not itself the storage/query backend for all signals. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A deployment has an /metrics endpoint but Prometheus shows the target as down because its Service port annotation is wrong.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. This step belongs to Kubernetes SIG and community governance rather than the complementary implementation and evidence pair. The intended approach is: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Validate with: Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. Workload context: An enterprise experiences a kubelet regression only on a specific runtime version and needs a small sanitized reproduction case.

Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. This step belongs to CNCF ecosystem and Kubernetes roles rather than the complementary implementation and evidence pair. The intended approach is: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Validate with: Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. Workload context: An enterprise experiences a kubelet regression only on a specific runtime version and needs a small sanitized reproduction case.

Check a project's license, contributor requirements and redistribution obligations before copying or shipping components. This step belongs to Open source licensing and contribution basics rather than the complementary implementation and evidence pair. The intended approach is: File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. Validate with: Check upstream issue templates, duplicate reports, version matrix, clear reproduction and contributor communication. Workload context: An enterprise experiences a kubelet regression only on a specific runtime version and needs a small sanitized reproduction case.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. These observations are more relevant to kubectl apply and declarative updates, not this case. The distinguishing check is: Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. These observations are more relevant to Deployment and ReplicaSet ownership, not this case. The distinguishing check is: Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. These observations are more relevant to OCI registries and image distribution, not this case. The distinguishing check is: Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Temporary data is disposable while durable application records remain accessible across Pod recreation. That result validates Ephemeral emptyDir versus persistent volumes rather than the requirement here. Verify instead: The PVC binds to a suitable volume and survives recreation of the application Pod as designed. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. That result validates Node pressure and Pod eviction analysis rather than the requirement here. Verify instead: The PVC binds to a suitable volume and survives recreation of the application Pod as designed. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. That result validates PV reclaim policy Retain versus Delete rather than the requirement here. Verify instead: The PVC binds to a suitable volume and survives recreation of the application Pod as designed. Workload context: A PVC remains Pending because no available PV can meet its requested size and storage class.

Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. This action addresses Open standards vendor-neutral portability instead of the controlling requirement. Cloud native APIs improve portability but do not guarantee identical storage classes, load balancers or custom controllers across clouds. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. This action addresses OpenTelemetry instrumentation and exporters instead of the controlling requirement. OpenTelemetry standardizes collection and export; a collector is not itself the storage/query backend for all signals. For this scenario prefer: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Workload context: An alert fires for every isolated transient failure even when SLO error budget remains healthy and users are unaffected.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. That result validates PV reclaim policy Retain versus Delete rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

External clients reach only the intended healthy Service backends and the allocated endpoint matches network policy. That result validates LoadBalancer Service provisioning rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. That result validates Service endpoint routing and kube-proxy rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. These observations are more relevant to PodDisruptionBudget during voluntary eviction, not this case. The distinguishing check is: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. These observations are more relevant to Image layers and build cache, not this case. The distinguishing check is: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. These observations are more relevant to Scheduler versus autoscaler responsibility, not this case. The distinguishing check is: Review node taint key/effect, Pod toleration key/operator and associated scheduler events. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.