Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Use supported sidecar containers for tightly coupled helper functions and verify lifecycle coordination within the Pod. This action addresses Sidecar containers and shared Pod lifecycle instead of the controlling requirement. Sidecars share a Pod network context; careless start or termination ordering can block a workload. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. This action addresses Node cordon drain maintenance instead of the controlling requirement. cordon prevents new scheduling while drain attempts safe evictions; existing Pods are not deleted by cordon alone. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. Workload context: An engineer disables scheduling constraints and assumes this is the only way to trigger a scale-up for large jobs.

Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. This action addresses Kubernetes upgrades and version skew instead of the controlling requirement. API compatibility and supported component skew determine upgrade sequencing; not every Kubernetes version jump is supported. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A cluster operator force-applies an updated manifest and overwrites another controller's managed fields without checking conflicts.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A cluster operator force-applies an updated manifest and overwrites another controller's managed fields without checking conflicts.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A cluster operator force-applies an updated manifest and overwrites another controller's managed fields without checking conflicts.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This action addresses Node readiness and scheduling exclusion instead of the controlling requirement. Node readiness affects cluster placement and lifecycle; a single Pod readiness-probe failure does not make the entire node NotReady. For this scenario prefer: Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. Workload context: An operator sees a base64 Secret in a manifest and assumes its value cannot be recovered by a repository reader.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. This step belongs to ImagePullBackOff registry and auth errors rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

The container remains running or completes as intended without repeated backoff cycles after a targeted correction. This step belongs to CrashLoopBackOff and previous logs rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This step belongs to PV reclaim policy Retain versus Delete rather than the complementary implementation and evidence pair. The intended approach is: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Validate with: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

An incident timeline pinpoints the failing dependency rather than relying on one generic readiness or CPU signal. That result validates Correlating metrics logs and traces rather than the requirement here. Verify instead: Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Template rendering produces intended resources and upgrades or rollbacks remain tied to specific chart revisions. That result validates Helm charts templates and values rather than the requirement here. Verify instead: Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

The faulty revision is identified and rollback or correction restores the intended application version. That result validates Rollout history status and change correlation rather than the requirement here. Verify instead: Release artifacts have verifiable origin and unapproved build paths are rejected before application rollout. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Inspect kubectl config current-context, cluster server, user identity and namespace field. This step belongs to kubectl context and cluster selection rather than the complementary implementation and evidence pair. The intended approach is: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Validate with: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Apply namespace ResourceQuota and LimitRange policies to govern aggregate consumption and default/request bounds. This step belongs to ResourceQuota and LimitRange policies rather than the complementary implementation and evidence pair. The intended approach is: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Validate with: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Replica placement stays within the intended skew or reports clear scheduling limits. This step belongs to Topology spread constraints rather than the complementary implementation and evidence pair. The intended approach is: Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. Validate with: Review node labels, conditions, capacity versus allocatable, topology zones and node allocatable metrics. Workload context: A capacity spreadsheet uses physical RAM instead of node allocatable and overestimates room for application Pods.

Examine object conditions and timestamped Events to understand image, scheduling, mount and admission failures before applying speculative fixes. This action addresses kubectl describe and event chronology instead of the controlling requirement. Events describe control-plane and kubelet observations but are not a permanent complete incident log. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: An app restarted twice and the current logs show only successful initialization while the failure trace is in previous logs.

Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. This action addresses Blue-green versus canary release patterns instead of the controlling requirement. Blue-green switches environments, whereas canary ramps exposure; a basic Deployment alone may not provide precise traffic percentages. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: An app restarted twice and the current logs show only successful initialization while the failure trace is in previous logs.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. Workload context: An app restarted twice and the current logs show only successful initialization while the failure trace is in previous logs.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This action addresses Artifact promotion by digest instead of the controlling requirement. An image digest identifies the immutable artifact; matching labels or Git SHAs alone do not prove identical layers. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. This action addresses Readiness-probe failure versus process crash instead of the controlling requirement. Readiness-probe failure normally removes endpoint traffic without killing the container; liveness changes restart behavior. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Use container logs and --previous for restarted containers while preserving central logs for evicted or moved workloads. This action addresses kubectl logs current versus previous instance instead of the controlling requirement. kubectl logs streams container stdout/stderr, and --previous selects the prior terminated instance if available. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: A change from Service port 80 to 8080 breaks external routing because the Ingress backend still points to the old port.

Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. Validate with: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. Validate with: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Use an authorized ephemeral container for live Pod diagnostics when the original image lacks troubleshooting tools. This step belongs to Ephemeral debugging containers rather than the complementary implementation and evidence pair. The intended approach is: Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. Validate with: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A developer copies a private signing key into an early build stage and deletes it in the last line of the same image.

Inspect process namespace, container cgroup limits, OOM events and host resource metrics. These observations are more relevant to Linux namespaces and cgroups, not this case. The distinguishing check is: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

Inspect Pod requests/limits, node allocatable capacity, usage history, throttling and OOMKilled events. These observations are more relevant to CPU requests and memory limits, not this case. The distinguishing check is: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. These observations are more relevant to Node affinity required vs preferred, not this case. The distinguishing check is: Inspect Pod label selectors, namespaces, topologyKey and actual placement of matching peer Pods. Workload context: An operator scopes anti-affinity to hostname yet expects strict distribution across distinct availability zones.

Pods on different eligible nodes communicate according to network design and report working network addresses. That result validates CNI Pod networking implementation rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. That result validates StatefulSet identity and volume templates rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.

Only authorized artifacts enter the cluster and each workload is traceable to a reviewed build. That result validates Image provenance and admission policies rather than the requirement here. Verify instead: Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. Workload context: A team creates a default-deny policy but still sees unrestricted traffic because its CNI plugin does not implement NetworkPolicy.