Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. These observations are more relevant to Readiness liveness and startup probe behavior, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A worker runs out of ephemeral disk space and BestEffort Pods disappear with Evicted status.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A worker runs out of ephemeral disk space and BestEffort Pods disappear with Evicted status.

Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. These observations are more relevant to StorageClass dynamic provisioning, not this case. The distinguishing check is: Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. Workload context: A worker runs out of ephemeral disk space and BestEffort Pods disappear with Evicted status.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This action addresses ResourceQuota and LimitRange policies instead of the controlling requirement. ResourceQuota applies aggregate namespace limits while LimitRange sets per-object defaults and constraints; quotas do not make capacity. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: The workload's spread selector matches no Pods and the controller reports an apparently balanced but incorrect placement.

Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. This action addresses CNCF ecosystem and Kubernetes roles instead of the controlling requirement. The CNCF ecosystem contains complementary projects; Kubernetes itself is not a complete application observability or delivery platform. For this scenario prefer: Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. Workload context: An architect assumes a project listed in the CNCF landscape is necessarily graduated and supported by the Kubernetes maintainers.

Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. This action addresses OpenTelemetry instrumentation and exporters instead of the controlling requirement. OpenTelemetry standardizes collection and export; a collector is not itself the storage/query backend for all signals. For this scenario prefer: Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. Workload context: An architect assumes a project listed in the CNCF landscape is necessarily graduated and supported by the Kubernetes maintainers.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. Workload context: An architect assumes a project listed in the CNCF landscape is necessarily graduated and supported by the Kubernetes maintainers.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. This step belongs to Immutable container images and digests rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. This step belongs to Controller manager reconciliation loops rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This step belongs to Node readiness and scheduling exclusion rather than the complementary implementation and evidence pair. The intended approach is: Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. Validate with: Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. Workload context: A stateful Pod cannot start in a healthy zone because its existing block volume is attached to another availability zone.

The Pod schedules only onto eligible labeled nodes while other nodes remain untouched. That result validates nodeSelector equality placement rather than the requirement here. Verify instead: Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Reapplying unchanged configuration is safe and the resulting cluster state matches the reviewed manifest. That result validates kubectl apply and declarative updates rather than the requirement here. Verify instead: Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. That result validates Pending Pods and resource-fit checks rather than the requirement here. Verify instead: Workloads honor hard constraints and fall back appropriately when optional affinity cannot be satisfied. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. This step belongs to Image layers and build cache rather than the complementary implementation and evidence pair. The intended approach is: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Validate with: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This step belongs to Image pull policy and cached images rather than the complementary implementation and evidence pair. The intended approach is: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Validate with: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Pods assigned to a healthy node start and report status with failed containers surfaced for diagnosis. This step belongs to Kubelet node agent responsibilities rather than the complementary implementation and evidence pair. The intended approach is: Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. Validate with: Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. Workload context: An application shuts down before its sidecar flushes logs because the Pod's termination lifecycle is not tested.

Contributions and distributions meet stated open-source terms without assuming every repository uses the same license. That result validates Open source licensing and contribution basics rather than the requirement here. Verify instead: Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

A single downstream failure degrades gracefully without causing an uncontrolled cascade across independent services. That result validates Microservices contracts and failure isolation rather than the requirement here. Verify instead: Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: Platform selections fit the actual problem without expecting one component to implement the whole cloud native stack. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This step belongs to Node cordon drain maintenance rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: Operators update control-plane binaries but ignore cluster DNS and CNI version compatibility during the change.

Compare object metadata labels, Service/Deployment selectors and selected object lists. This step belongs to Labels selectors and annotations rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: Operators update control-plane binaries but ignore cluster DNS and CNI version compatibility during the change.

Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. This step belongs to Image pull policy and cached images rather than the complementary implementation and evidence pair. The intended approach is: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Validate with: Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. Workload context: Operators update control-plane binaries but ignore cluster DNS and CNI version compatibility during the change.

The selected isolation model meets workload portability and security needs without claiming that containers include separate guest kernels. This step belongs to Container versus virtual machine isolation rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Check API endpoint connectivity, request audit records, resource authorization and response status. This step belongs to Kubernetes API server and API requests rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. This step belongs to Taints tolerations and node protection rather than the complementary implementation and evidence pair. The intended approach is: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Validate with: Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. That result validates PodDisruptionBudget during voluntary eviction rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Eligible nodes retrieve authorized images while unrelated namespaces and identities cannot pull private artifacts. That result validates OCI registries and image distribution rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

All intended replicas run the approved digest and upgrades trace back to a reviewed artifact. That result validates Immutable container images and digests rather than the requirement here. Verify instead: Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This step belongs to Role and ClusterRole authorization rather than the complementary implementation and evidence pair. The intended approach is: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Validate with: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.

Inspect process namespace, container cgroup limits, OOM events and host resource metrics. This step belongs to Linux namespaces and cgroups rather than the complementary implementation and evidence pair. The intended approach is: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Validate with: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.

The selected isolation model meets workload portability and security needs without claiming that containers include separate guest kernels. This step belongs to Container versus virtual machine isolation rather than the complementary implementation and evidence pair. The intended approach is: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Validate with: Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.