Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. These observations are more relevant to Secret base64 encoding versus encryption, not this case. The distinguishing check is: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. These observations are more relevant to ReadWriteOnce and ReadWriteMany semantics, not this case. The distinguishing check is: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect PV persistentVolumeReclaimPolicy, underlying disk state, claim release and storage provisioner behavior. Workload context: A production dataset's PV uses Delete and its administrator removes the claim assuming the raw disk must be retained.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

Use a versioned Git repository as declarative desired state and a reconciler to detect and correct drift with approved change controls. This action addresses GitOps reconciliation and source of truth instead of the controlling requirement. GitOps is a pull/reconciliation operating model rather than merely running kubectl from a CI server. For this scenario prefer: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

Use ephemeral containers to inspect a running Pod when its application image lacks debug tools, with approved access to sensitive process namespaces. This action addresses Ephemeral debug containers for minimal images instead of the controlling requirement. Ephemeral containers are for diagnostics and cannot be treated as permanent workload replicas or restarted like ordinary containers. For this scenario prefer: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This step belongs to Service selector and port mismatch diagnostics rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. This step belongs to ReadWriteOnce and ReadWriteMany semantics rather than the complementary implementation and evidence pair. The intended approach is: Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. Validate with: Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. Workload context: A worker has available RAM but a Pod with a 128Mi limit repeatedly exits OOMKilled during image processing.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. This step belongs to Controller manager reconciliation loops rather than the complementary implementation and evidence pair. The intended approach is: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Validate with: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Inspect allowedDisruptions, healthy replicas, minAvailable/maxUnavailable and drain eviction results. This step belongs to PodDisruptionBudget during voluntary eviction rather than the complementary implementation and evidence pair. The intended approach is: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Validate with: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Align volume topology with Pod scheduling, using StorageClass binding behavior appropriate for zonal storage. This step belongs to PersistentVolume zone binding and placement rather than the complementary implementation and evidence pair. The intended approach is: Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. Validate with: Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. Workload context: A developer tries to repair a NotReady node by changing one application's readinessProbe configuration.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

Use a Deployment to manage stateless replicas, controlled updates and ReplicaSets rather than hand-editing Pod instances. This action addresses Deployment and ReplicaSet ownership instead of the controlling requirement. A Deployment manages ReplicaSets and rolling changes; direct edits to controlled Pods are transient. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: An analyst confuses a container's private process ID namespace with a limit on its maximum memory use.

The PVC binds to a suitable volume and survives recreation of the application Pod as designed. That result validates PersistentVolume and claim bindings rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Pods on different eligible nodes communicate according to network design and report working network addresses. That result validates CNI Pod networking implementation rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. That result validates Namespace segmentation with NetworkPolicies rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. These observations are more relevant to CNCF ecosystem and Kubernetes roles, not this case. The distinguishing check is: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Inspect LICENSE files, contribution guidelines, DCO or CLA requirements and third-party dependency notices. These observations are more relevant to Open source licensing and contribution basics, not this case. The distinguishing check is: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A team splits a monolith into twenty containers but deploys every service together and changes shared database tables without contracts.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: A namespace contains a LimitRange but a platform lead expects it to enforce a total cluster-wide storage budget.

Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. This action addresses Pending Pods and resource-fit checks instead of the controlling requirement. A Pending unscheduled Pod has no running container logs; scheduler events reveal placement failures. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: A namespace contains a LimitRange but a platform lead expects it to enforce a total cluster-wide storage budget.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. Workload context: A namespace contains a LimitRange but a platform lead expects it to enforce a total cluster-wide storage budget.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. This step belongs to Blue-green versus canary release patterns rather than the complementary implementation and evidence pair. The intended approach is: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Validate with: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. This step belongs to kubectl logs current versus previous instance rather than the complementary implementation and evidence pair. The intended approach is: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Validate with: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

New replicas become Ready before old capacity is removed and a failed rollout can return to a known revision. This step belongs to Deployment rolling updates and rollback rather than the complementary implementation and evidence pair. The intended approach is: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Validate with: Inspect host/path rules, route attachment, listener TLS, backend port and controller access logs. Workload context: A Gateway returns 404 for /api because HTTPRoute matches /app while the backend Service is healthy.

Design bounded microservice interfaces with timeouts, retries and independently deployable service contracts where modularity is useful. This step belongs to Microservices contracts and failure isolation rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. This step belongs to Open standards vendor-neutral portability rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. This step belongs to Metrics logs and traces distinctions rather than the complementary implementation and evidence pair. The intended approach is: Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. Validate with: Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. Workload context: An architect equates container runtime, Kubernetes orchestrator and CNCF foundation governance as the same type of technology.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.

Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. This action addresses etcd consistency and cluster state instead of the controlling requirement. etcd is a consistent key-value store for API state; it is not where persistent application volume data lives. For this scenario prefer: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.

Choose containers for isolated application processes sharing a host kernel and use VMs when a stronger separate-kernel boundary is needed. This action addresses Container versus virtual machine isolation instead of the controlling requirement. Ordinary containers share the host kernel, whereas a VM normally runs its own guest kernel. For this scenario prefer: Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.