Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. These observations are more relevant to PersistentVolume and claim bindings, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. These observations are more relevant to Readiness liveness and startup probe behavior, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This action addresses Labels selectors and annotations instead of the controlling requirement. Labels support equality and set-based selectors; annotations do not become Service selectors automatically. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This action addresses Container runtime and CRI instead of the controlling requirement. A runtime executes containers; the CRI is its API integration with kubelet rather than the Kubernetes API server. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. This action addresses Taints tolerations and node protection instead of the controlling requirement. A toleration permits scheduling onto tainted nodes but does not force the scheduler to choose those nodes. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A node runs an outdated tagged image from cache under IfNotPresent after a mutable release tag changes.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. This action addresses Linux namespaces and cgroups instead of the controlling requirement. Namespaces and cgroups provide different Linux primitives; neither independently creates Kubernetes scheduling. For this scenario prefer: Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. Workload context: An administrator installs a Docker CLI and assumes Kubernetes always requires the Docker daemon to schedule Pods.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Confirm the active kubeconfig context and namespace before using kubectl on production clusters. This action addresses kubectl context and cluster selection instead of the controlling requirement. A context combines cluster, user and namespace settings; the current shell directory alone does not select a cluster. For this scenario prefer: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. Workload context: An ops lead changes a node's label but forgets that hard nodeSelector constraints will strand dependent Pods.

Review kubelet service logs, node conditions, CRI connectivity and Pod events for assigned nodes. These observations are more relevant to Kubelet node agent responsibilities, not this case. The distinguishing check is: Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. Workload context: Two application containers in one Pod both try to bind port 8080 and the second fails at startup.

Review node taint key/effect, Pod toleration key/operator and associated scheduler events. These observations are more relevant to Taints tolerations and node protection, not this case. The distinguishing check is: Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. Workload context: Two application containers in one Pod both try to bind port 8080 and the second fails at startup.

Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. These observations are more relevant to Scheduler versus autoscaler responsibility, not this case. The distinguishing check is: Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. Workload context: Two application containers in one Pod both try to bind port 8080 and the second fails at startup.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A new Pod shows FailedScheduling: insufficient memory while its container image is available in the registry.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A new Pod shows FailedScheduling: insufficient memory while its container image is available in the registry.

Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. These observations are more relevant to Service selector and port mismatch diagnostics, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: A new Pod shows FailedScheduling: insufficient memory while its container image is available in the registry.

Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. This action addresses kubectl apply and declarative updates instead of the controlling requirement. Declarative apply merges intended fields but conflicts and imperative edits require field ownership review. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This action addresses Scheduler versus autoscaler responsibility instead of the controlling requirement. The autoscaler provisions nodes; it does not assign Pod nodeName or fix impossible affinity or quota constraints by itself. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. This step belongs to ImagePullBackOff registry and auth errors rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. Validate with: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A Pod reports Running yet its Service has no ready endpoints because the readiness probe uses a nonexistent URL.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.

All intended replicas run the approved digest and upgrades trace back to a reviewed artifact. That result validates Immutable container images and digests rather than the requirement here. Verify instead: Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.

Clients reach the intended healthy backends through a stable Service name despite Pod replacement. That result validates Service stable virtual endpoint rather than the requirement here. Verify instead: Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. Workload context: A controller-plane report shows a Pod bound to a worker that has a stopped kubelet and no running containers.