Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. These observations are more relevant to kubectl logs current versus previous instance, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Inspect rendered helm template output, values merge order, chart dependency versions and release status. These observations are more relevant to Helm charts templates and values, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. These observations are more relevant to kubectl describe and event chronology, not this case. The distinguishing check is: Inspect Pod Ready condition, container restart count, probe event, endpoint membership and HTTP response details. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Compare desired and observed replicas, controller events, ReplicaSet ownership and controller-manager health. These observations are more relevant to Controller manager reconciliation loops, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Inspect kubectl config current-context, cluster server, user identity and namespace field. These observations are more relevant to kubectl context and cluster selection, not this case. The distinguishing check is: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. This action addresses Secret base64 encoding versus encryption instead of the controlling requirement. Base64 is a reversible encoding, not encryption; Secret storage and access policies require separate protection. For this scenario prefer: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. Workload context: A namespace is labeled enforce=restricted and a Pod requesting privileged host networking fails to create.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Confirm the active kubeconfig context and namespace before using kubectl on production clusters. This action addresses kubectl context and cluster selection instead of the controlling requirement. A context combines cluster, user and namespace settings; the current shell directory alone does not select a cluster. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. This action addresses PodDisruptionBudget during voluntary eviction instead of the controlling requirement. A PodDisruptionBudget governs voluntary eviction; it does not guarantee protection against hardware failure or create new replicas. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: A Pending workload requires GPU resources but the autoscaler is allowed to expand only CPU-only nodes.

Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. That result validates ServiceAccount and workload RBAC boundaries rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Client connections reach healthy backing Pods and troubleshooters isolate selection from routing problems. That result validates Service endpoint routing and kube-proxy rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Valid identities perform only allowed actions and rejected resource specifications do not reach persistent state. Workload context: A client receives 401 after presenting an expired token, and the operator attempts to fix it by granting cluster-admin rights.

Declare Kubernetes resource kind, apiVersion, metadata and spec using a supported schema and reconcile changes through the API. This action addresses Declarative resource manifests and API versions instead of the controlling requirement. Kubernetes API versions are resource-specific and evolve; a valid YAML file does not guarantee the API accepts its kind or schema. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. This action addresses Pending Pods and resource-fit checks instead of the controlling requirement. A Pending unscheduled Pod has no running container logs; scheduler events reveal placement failures. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. Workload context: A security review finds unencrypted etcd peer traffic and stale snapshots on a shared administrative workstation.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. This action addresses Pending Pods and resource-fit checks instead of the controlling requirement. A Pending unscheduled Pod has no running container logs; scheduler events reveal placement failures. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Control-plane and node upgrades complete within supported skew with workload compatibility checks passing. That result validates Kubernetes upgrades and version skew rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: An app with preemptionPolicy Never is given a high numeric priority and operators mistakenly expect it to evict running workloads.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: An app with preemptionPolicy Never is given a high numeric priority and operators mistakenly expect it to evict running workloads.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. Workload context: An app with preemptionPolicy Never is given a high numeric priority and operators mistakenly expect it to evict running workloads.

Examine authentication identity, RBAC decision, admission webhook result and API response status. These observations are more relevant to Authentication authorization and admission order, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. These observations are more relevant to Node pressure and Pod eviction analysis, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Inspect OOMKilled exit reason, memory limit, heap behavior, node pressure and container metrics. These observations are more relevant to Container OOMKilled and resource pressure, not this case. The distinguishing check is: Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. Workload context: An application team scales a Deployment but some replicas remain Pending due to a dedicated-node taint.

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.