Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect maxSurge, maxUnavailable, rollout conditions, ReplicaSets, readiness and prior image revisions. This step belongs to Deployment rolling updates and rollback rather than the complementary implementation and evidence pair. The intended approach is: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Validate with: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. This step belongs to Correlating metrics logs and traces rather than the complementary implementation and evidence pair. The intended approach is: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Validate with: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. This step belongs to Software supply chain attestations rather than the complementary implementation and evidence pair. The intended approach is: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Validate with: Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. Workload context: A cluster deletes a failed Pod and developers discover local kubectl logs are gone without centralized retention.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This action addresses Ephemeral debug containers for minimal images instead of the controlling requirement. Ephemeral containers are for diagnostics and cannot be treated as permanent workload replicas or restarted like ordinary containers. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. This action addresses CI versus CD pipeline separation instead of the controlling requirement. CI validates and packages changes while CD handles delivery or deployment; a successful build is not proof of production rollout. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Deployment rollout fails because a validating webhook times out, but the team checks only application stdout.

Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. This step belongs to Namespace scope and limits rather than the complementary implementation and evidence pair. The intended approach is: Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. Validate with: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

An operator investigates a running Pod without modifying its immutable application image or replacing production workload containers. This step belongs to Ephemeral debugging containers rather than the complementary implementation and evidence pair. The intended approach is: Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. Validate with: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. Validate with: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. This action addresses OCI registries and image distribution instead of the controlling requirement. OCI registries store/distribute image artifacts; they do not orchestrate Pods or apply cluster networking. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Confirm the active kubeconfig context and namespace before using kubectl on production clusters. This action addresses kubectl context and cluster selection instead of the controlling requirement. A context combines cluster, user and namespace settings; the current shell directory alone does not select a cluster. For this scenario prefer: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Workload context: An operator advertises a node as having GPU hardware by adding a label but no device plugin reports allocatable GPUs.

Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. This step belongs to Kubelet node agent responsibilities rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

Teams receive predictable defaults and cannot consume more namespace resources than policy permits. This step belongs to ResourceQuota and LimitRange policies rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

Check API endpoint connectivity, request audit records, resource authorization and response status. This step belongs to Kubernetes API server and API requests rather than the complementary implementation and evidence pair. The intended approach is: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Validate with: Compare object metadata labels, Service/Deployment selectors and selected object lists. Workload context: A Service routes to no endpoints after a release because app labels change but its selector retains the old key.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This step belongs to Software supply chain attestations rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. This step belongs to Progressive delivery and release metrics rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. This step belongs to Correlating metrics logs and traces rather than the complementary implementation and evidence pair. The intended approach is: Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. Validate with: Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. Workload context: A team rebuilds the same Git revision separately in production and gets different dependencies than the approved staging artifact.

Maintainers can reproduce and triage the problem without access to private credentials or customer systems. That result validates Upstream issue reporting and review collaboration rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

Workloads can be redeployed between supported clusters with explicitly identified environment-specific adaptations. That result validates Open standards vendor-neutral portability rather than the requirement here. Verify instead: Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. Workload context: A new Kubernetes contributor submits a patch without required sign-off and wonders why maintainers cannot merge it.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A StatefulSet scales from two to three replicas and the new ordinal needs its own persistent claim.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A StatefulSet scales from two to three replicas and the new ordinal needs its own persistent claim.

Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. That result validates PV reclaim policy Retain versus Delete rather than the requirement here. Verify instead: Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. Workload context: A StatefulSet scales from two to three replicas and the new ordinal needs its own persistent claim.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: An engineer edits a deployed Service directly after helm install and the next chart upgrade overwrites the change.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: An engineer edits a deployed Service directly after helm install and the next chart upgrade overwrites the change.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This action addresses Artifact promotion by digest instead of the controlling requirement. An image digest identifies the immutable artifact; matching labels or Git SHAs alone do not prove identical layers. For this scenario prefer: Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. Workload context: An engineer edits a deployed Service directly after helm install and the next chart upgrade overwrites the change.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Set workload requests for placement and limits for bounded runtime use based on measured application needs. This action addresses CPU requests and memory limits instead of the controlling requirement. Requests influence scheduling; limits govern enforcement and memory-limit breaches can terminate containers. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Workload context: An administrator cordons a node and expects its existing application Pods to move away automatically.

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This action addresses Pod affinity anti-affinity instead of the controlling requirement. Pod affinity references other Pods by labels, not node resource attributes, and required rules can make replicas Pending. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This action addresses Scheduler responsibility and binding instead of the controlling requirement. kube-scheduler assigns Pods to nodes; kubelet executes Pods after assignment and the controller manager reconciles controllers. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.