Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This action addresses Pod affinity anti-affinity instead of the controlling requirement. Pod affinity references other Pods by labels, not node resource attributes, and required rules can make replicas Pending. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Use kube-scheduler to bind eligible unscheduled Pods to suitable nodes based on resources and scheduling constraints. This action addresses Scheduler responsibility and binding instead of the controlling requirement. kube-scheduler assigns Pods to nodes; kubelet executes Pods after assignment and the controller manager reconciles controllers. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. Workload context: An engineer records build information only as an annotation and expects a Deployment selector to find those Pods.

Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. These observations are more relevant to Kubernetes SIG and community governance, not this case. The distinguishing check is: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. These observations are more relevant to Microservices contracts and failure isolation, not this case. The distinguishing check is: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. These observations are more relevant to CNCF project maturity and adoption decisions, not this case. The distinguishing check is: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A vendor migration promises zero changes even though the workloads depend on cloud-specific identity and networking controllers.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This action addresses ResourceQuota and LimitRange policies instead of the controlling requirement. ResourceQuota applies aggregate namespace limits while LimitRange sets per-object defaults and constraints; quotas do not make capacity. For this scenario prefer: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. Workload context: An engineer treats a base-image CVE as automatically reachable despite a distribution backport and no vulnerable code path.

Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. This action addresses Linux namespaces and cgroups instead of the controlling requirement. Namespaces and cgroups provide different Linux primitives; neither independently creates Kubernetes scheduling. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A ClusterIP Service exists and DNS resolves but traffic times out because no ready Pods match the selector.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A ClusterIP Service exists and DNS resolves but traffic times out because no ready Pods match the selector.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A ClusterIP Service exists and DNS resolves but traffic times out because no ready Pods match the selector.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. This action addresses Namespace segmentation with NetworkPolicies instead of the controlling requirement. NetworkPolicy governs data-plane traffic, whereas RBAC governs API actions; neither alone replaces the other. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Unschedulable unhealthy nodes are excluded until they meet documented readiness checks, preserving healthy placement. That result validates Node readiness and scheduling exclusion rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This action addresses Ephemeral debug containers for minimal images instead of the controlling requirement. Ephemeral containers are for diagnostics and cannot be treated as permanent workload replicas or restarted like ordinary containers. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: An app container is distroless with no shell, but the team assumes kubectl exec /bin/sh must always succeed.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. Workload context: A worker cannot validate the registry certificate after an internal CA rotation while other nodes still pull images successfully.

Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. This action addresses Blue-green versus canary release patterns instead of the controlling requirement. Blue-green switches environments, whereas canary ramps exposure; a basic Deployment alone may not provide precise traffic percentages. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. This action addresses Readiness-probe failure versus process crash instead of the controlling requirement. Readiness-probe failure normally removes endpoint traffic without killing the container; liveness changes restart behavior. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This action addresses Ephemeral debug containers for minimal images instead of the controlling requirement. Ephemeral containers are for diagnostics and cannot be treated as permanent workload replicas or restarted like ordinary containers. For this scenario prefer: Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. Workload context: A Pod's YAML looks valid yet describe reports FailedMount after the expected Secret was omitted.

Eligible nodes retrieve the intended immutable artifact and Pods progress beyond image pull. That result validates ImagePullBackOff registry and auth errors rather than the requirement here. Verify instead: Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

The Service has healthy matching backends and forwards to the application process's actual port. That result validates Service selector and port mismatch diagnostics rather than the requirement here. Verify instead: Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Storage is provisioned in a suitable placement domain after the first eligible consumer is considered. That result validates WaitForFirstConsumer volume binding rather than the requirement here. Verify instead: Deleted claims follow the intended deletion or retention policy without unexpectedly destroying important data. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. These observations are more relevant to Node labels and allocatable inventory, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. These observations are more relevant to PodDisruptionBudget during voluntary eviction, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.