Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This action addresses Ingress and Gateway API routing instead of the controlling requirement. Ingress and Gateway API resources describe routing intent; a controller implements data-plane forwarding. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Use StatefulSets for workloads needing stable ordinal identity and per-replica persistent claims rather than one shared ephemeral Deployment. This action addresses StatefulSet identity and volume templates instead of the controlling requirement. StatefulSets manage stable identities and can provision distinct PVCs; they do not automatically provide database replication correctness. For this scenario prefer: Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. Workload context: A remote test client tries to contact the private ClusterIP address from an external workstation without any permitted route.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. These observations are more relevant to Ingress route and TLS mismatch diagnosis, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. These observations are more relevant to CI versus CD pipeline separation, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: An operator changes the liveness check to fix a Deployment that is Running but never appears in Service EndpointSlices.

Review node taint key/effect, Pod toleration key/operator and associated scheduler events. These observations are more relevant to Taints tolerations and node protection, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Inspect quota hard/used counters, LimitRange defaults and API admission rejection messages. These observations are more relevant to ResourceQuota and LimitRange policies, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. These observations are more relevant to Node affinity required vs preferred, not this case. The distinguishing check is: Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. Workload context: A Deployment has a PDB that permits one disruption and maintenance engineers try to drain several nodes simultaneously.

Inspect maxSurge, maxUnavailable, rollout conditions, ReplicaSets, readiness and prior image revisions. These observations are more relevant to Deployment rolling updates and rollback, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. These observations are more relevant to Readiness-probe failure versus process crash, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. These observations are more relevant to Blue-green versus canary release patterns, not this case. The distinguishing check is: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This action addresses Pod affinity anti-affinity instead of the controlling requirement. Pod affinity references other Pods by labels, not node resource attributes, and required rules can make replicas Pending. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. Workload context: An engineer chooses a full VM for each tiny stateless process without considering container density or operational requirements.

Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. This action addresses Topology spread constraints instead of the controlling requirement. Spread constraints balance matching Pods across topology domains; missing topology labels and strict maxSkew can prevent placement. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. This action addresses Service stable virtual endpoint instead of the controlling requirement. A Service abstracts changing Pod endpoints; exposing a ClusterIP does not automatically create public Internet access. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A Pod stays Pending even though utilization is low because summed CPU requests exceed a node's allocatable capacity.

Inspect selected Pod/container, executed command, RBAC exec permission and audit records. These observations are more relevant to kubectl exec diagnostic boundaries, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: Developers believe storing YAML in Git is sufficient GitOps despite having no automated pull reconciliation or drift detection.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. These observations are more relevant to Blue-green versus canary release patterns, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: Developers believe storing YAML in Git is sufficient GitOps despite having no automated pull reconciliation or drift detection.

Examine trusted builder identity, attestation payload, artifact digest, SBOM and admission verification result. These observations are more relevant to Software supply chain attestations, not this case. The distinguishing check is: Compare Git revision, application sync status, live resource diff and reconciliation events. Workload context: Developers believe storing YAML in Git is sufficient GitOps despite having no automated pull reconciliation or drift detection.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This step belongs to Container runtime and CRI rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. This step belongs to Node cordon drain maintenance rather than the complementary implementation and evidence pair. The intended approach is: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Validate with: Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. This step belongs to Scheduler versus autoscaler responsibility rather than the complementary implementation and evidence pair. The intended approach is: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Validate with: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This step belongs to Pod shared network namespace and lifecycle rather than the complementary implementation and evidence pair. The intended approach is: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Validate with: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. This step belongs to Node readiness and scheduling exclusion rather than the complementary implementation and evidence pair. The intended approach is: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Validate with: Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. Workload context: After a node failure the Deployment stays below desired replicas and the platform team inspects only running application logs.

Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. This action addresses Ephemeral debugging containers instead of the controlling requirement. Ephemeral containers are intended for debugging and do not behave like ordinary replicated application containers. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A team sets a very low CPU limit and sees high throttling despite spare cluster capacity.

Confirm the active kubeconfig context and namespace before using kubectl on production clusters. This action addresses kubectl context and cluster selection instead of the controlling requirement. A context combines cluster, user and namespace settings; the current shell directory alone does not select a cluster. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A team sets a very low CPU limit and sees high throttling despite spare cluster capacity.

Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. This action addresses DaemonSet node-local workloads instead of the controlling requirement. A DaemonSet creates node-level replicas automatically rather than a fixed overall replica count like a Deployment. For this scenario prefer: Set workload requests for placement and limits for bounded runtime use based on measured application needs. Workload context: A team sets a very low CPU limit and sees high throttling despite spare cluster capacity.

Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. These observations are more relevant to Sidecar containers and shared Pod lifecycle, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.

Check resource namespace, role bindings, quotas and effective network enforcement across namespaces. These observations are more relevant to Namespace scope and limits, not this case. The distinguishing check is: Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. Workload context: A container passes a basic vulnerability scan but lacks a verified supplier signature and deploys an unapproved build.