Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. These observations are more relevant to Node labels and allocatable inventory, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. These observations are more relevant to PodDisruptionBudget during voluntary eviction, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. This step belongs to ClusterIP and NodePort Service exposure rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This step belongs to Cluster DNS and service discovery rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

The container remains running or completes as intended without repeated backoff cycles after a targeted correction. This step belongs to CrashLoopBackOff and previous logs rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. These observations are more relevant to Progressive delivery and release metrics, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

Inspect selected Pod/container, executed command, RBAC exec permission and audit records. These observations are more relevant to kubectl exec diagnostic boundaries, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Principals can perform only intended operations at the correct scope while denied actions remain inaccessible. That result validates Role and ClusterRole authorization rather than the requirement here. Verify instead: Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. That result validates Kubernetes upgrades and version skew rather than the requirement here. Verify instead: Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. This step belongs to Kubelet node agent responsibilities rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A PVC stays Pending with WaitForFirstConsumer and an operator mislabels this as a storage failure before any consuming Pod is scheduled.

Review node taint key/effect, Pod toleration key/operator and associated scheduler events. This step belongs to Taints tolerations and node protection rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A PVC stays Pending with WaitForFirstConsumer and an operator mislabels this as a storage failure before any consuming Pod is scheduled.

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This step belongs to Pod affinity anti-affinity rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A PVC stays Pending with WaitForFirstConsumer and an operator mislabels this as a storage failure before any consuming Pod is scheduled.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A logging team sets a DaemonSet replica count to three expecting exactly three agents across twenty workers.

Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. This action addresses PersistentVolume zone binding and placement instead of the controlling requirement. Immediate volume binding can constrain later Pod placement, while WaitForFirstConsumer accounts for scheduling topology. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A logging team sets a DaemonSet replica count to three expecting exactly three agents across twenty workers.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This action addresses ResourceQuota and LimitRange policies instead of the controlling requirement. ResourceQuota applies aggregate namespace limits while LimitRange sets per-object defaults and constraints; quotas do not make capacity. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A logging team sets a DaemonSet replica count to three expecting exactly three agents across twenty workers.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. This action addresses Ephemeral emptyDir versus persistent volumes instead of the controlling requirement. emptyDir exists for the lifetime of a Pod on a node and is lost when the Pod is removed. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. This action addresses Service endpoint routing and kube-proxy instead of the controlling requirement. Service routing depends on endpoints and the cluster's Service dataplane; some clusters replace kube-proxy with an alternate implementation. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: New Pods on one worker have no IP addresses because its CNI daemon cannot initialize the local network interface.

Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Validate with: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. This step belongs to Cluster DNS and service discovery rather than the complementary implementation and evidence pair. The intended approach is: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Validate with: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This step belongs to Pending pod FailedScheduling events rather than the complementary implementation and evidence pair. The intended approach is: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Validate with: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Temporary data is disposable while durable application records remain accessible across Pod recreation. That result validates Ephemeral emptyDir versus persistent volumes rather than the requirement here. Verify instead: Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

The precise scheduling blocker is removed and the workload binds to an eligible node. That result validates Pending pod FailedScheduling events rather than the requirement here. Verify instead: Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. That result validates Secret base64 encoding versus encryption rather than the requirement here. Verify instead: Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. Workload context: A team adds a strict NetworkPolicy yet a leaked service-account token still has excessive Kubernetes API permissions.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. This action addresses Taints tolerations and node protection instead of the controlling requirement. A toleration permits scheduling onto tainted nodes but does not force the scheduler to choose those nodes. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. This action addresses DaemonSet node-local workloads instead of the controlling requirement. A DaemonSet creates node-level replicas automatically rather than a fixed overall replica count like a Deployment. For this scenario prefer: Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

The container sees the intended isolated resources while usage limits are reflected in host accounting. That result validates Linux namespaces and cgroups rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. That result validates Namespace scope and limits rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. That result validates Kubernetes upgrades and version skew rather than the requirement here. Verify instead: Workloads read needed configuration while unauthorized users cannot retrieve credential material through the API. Workload context: A workload expects a ConfigMap-mounted configuration file to update after restart yet uses an immutable environment variable without rollout.