Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. That result validates DaemonSet node-local workloads rather than the requirement here. Verify instead: Teams receive predictable defaults and cannot consume more namespace resources than policy permits. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. That result validates Deployment and ReplicaSet ownership rather than the requirement here. Verify instead: Teams receive predictable defaults and cannot consume more namespace resources than policy permits. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. That result validates Pod affinity anti-affinity rather than the requirement here. Verify instead: Teams receive predictable defaults and cannot consume more namespace resources than policy permits. Workload context: A team's sixth Pod is rejected although nodes have CPU headroom because namespace quota is exhausted.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

Define podAffinity for desired co-location and podAntiAffinity to separate replicas across appropriate topology domains. This action addresses Pod affinity anti-affinity instead of the controlling requirement. Pod affinity references other Pods by labels, not node resource attributes, and required rules can make replicas Pending. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Plan component upgrades using the currently supported version-skew policy and validated addon compatibility rather than upgrading arbitrarily. Workload context: A team upgrades workers two minor versions ahead of an older API server without consulting supported skew policy.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This action addresses CNCF project maturity and adoption decisions instead of the controlling requirement. CNCF maturity levels indicate aspects of governance and adoption, not a guarantee of security or perfect product fit. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: An operator greps every Pod log to calculate cluster-wide request-rate trends that a suitable metric would show directly.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This action addresses Prometheus pull scraping and metrics endpoints instead of the controlling requirement. Prometheus primarily scrapes targets on an interval; instrumentation must expose values and high-cardinality labels can overload storage. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: An operator greps every Pod log to calculate cluster-wide request-rate trends that a suitable metric would show directly.

Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. This action addresses SLIs SLOs and golden signals instead of the controlling requirement. An SLI is a measurement, an SLO is a target and an SLA is a contractual commitment; they should not be conflated. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: An operator greps every Pod log to calculate cluster-wide request-rate trends that a suitable metric would show directly.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This step belongs to Cluster DNS and service discovery rather than the complementary implementation and evidence pair. The intended approach is: Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. Validate with: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

Review container lastState, exit code, restart count, previous logs and application configuration. This step belongs to CrashLoopBackOff and previous logs rather than the complementary implementation and evidence pair. The intended approach is: Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. Validate with: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

The application operates within measured memory budgets or receives justified capacity changes without repeated OOM restarts. This step belongs to Container OOMKilled and resource pressure rather than the complementary implementation and evidence pair. The intended approach is: Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. Validate with: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

The precise scheduling blocker is removed and the workload binds to an eligible node. This step belongs to Pending pod FailedScheduling events rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. This step belongs to ClusterIP and NodePort Service exposure rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A team deletes unhealthy Pods repeatedly while provider load-balancer health checks target an incorrect Service node port.

Use supported Ingress or Gateway API resources together with a running controller to route HTTP traffic by host and path. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. This step belongs to StatefulSet identity and volume templates rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Validate with: Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. These observations are more relevant to kubectl describe and event chronology, not this case. The distinguishing check is: Inspect rendered helm template output, values merge order, chart dependency versions and release status. Workload context: A Helm template references a missing value and deployment emits a malformed image name only after rendering.

Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. These observations are more relevant to Correlating metrics logs and traces, not this case. The distinguishing check is: Inspect rendered helm template output, values merge order, chart dependency versions and release status. Workload context: A Helm template references a missing value and deployment emits a malformed image name only after rendering.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. These observations are more relevant to CI versus CD pipeline separation, not this case. The distinguishing check is: Inspect rendered helm template output, values merge order, chart dependency versions and release status. Workload context: A Helm template references a missing value and deployment emits a malformed image name only after rendering.

Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. This step belongs to OpenTelemetry instrumentation and exporters rather than the complementary implementation and evidence pair. The intended approach is: Design bounded microservice interfaces with timeouts, retries and independently deployable service contracts where modularity is useful. Validate with: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Metrics are collected from intended targets at expected intervals with bounded label series and useful alerts. This step belongs to Prometheus pull scraping and metrics endpoints rather than the complementary implementation and evidence pair. The intended approach is: Design bounded microservice interfaces with timeouts, retries and independently deployable service contracts where modularity is useful. Validate with: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This step belongs to CNCF project maturity and adoption decisions rather than the complementary implementation and evidence pair. The intended approach is: Design bounded microservice interfaces with timeouts, retries and independently deployable service contracts where modularity is useful. Validate with: Inspect service ownership, API contract, timeout/retry behavior, communication coupling and failure domains. Workload context: A shopping service synchronously calls six downstream APIs with no timeout and one slow inventory service stalls all checkouts.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This action addresses Deployment rolling updates and rollback instead of the controlling requirement. A rolling update controls replacement pacing but application correctness still requires probes and release validation. For this scenario prefer: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Use continuous integration to build and test changes and controlled delivery or deployment to promote validated artifacts to target environments. This action addresses CI versus CD pipeline separation instead of the controlling requirement. CI validates and packages changes while CD handles delivery or deployment; a successful build is not proof of production rollout. For this scenario prefer: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. This action addresses Ingress route and TLS mismatch diagnosis instead of the controlling requirement. A healthy Service does not guarantee correct edge routing; ingress controllers and TLS bindings add separate layers. For this scenario prefer: Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. Workload context: An internal image scanner finds no high CVEs but auditors cannot identify which CI workflow produced the image.

Review topology key labels, eligible domains, maxSkew, labelSelector and DoNotSchedule versus ScheduleAnyway. These observations are more relevant to Topology spread constraints, not this case. The distinguishing check is: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Check NodeReady condition, kubelet heartbeats, network connectivity, pressure conditions and scheduler events. These observations are more relevant to Node readiness and scheduling exclusion, not this case. The distinguishing check is: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Compare image digest, registry manifest, Pod imageID, rollout timestamp and supply-chain approval. These observations are more relevant to Immutable container images and digests, not this case. The distinguishing check is: Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. Workload context: A disconnected cluster repeatedly tries imagePullPolicy Always and cannot launch workloads despite a cached prior digest.

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This step belongs to Progressive delivery and release metrics rather than the complementary implementation and evidence pair. The intended approach is: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Validate with: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A pipeline rebuilds from the same source commit for each environment and receives newer transitive dependencies in production.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. This step belongs to Blue-green versus canary release patterns rather than the complementary implementation and evidence pair. The intended approach is: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Validate with: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A pipeline rebuilds from the same source commit for each environment and receives newer transitive dependencies in production.

Root-cause hypotheses align with recorded warning events and targeted corrective actions. This step belongs to kubectl describe and event chronology rather than the complementary implementation and evidence pair. The intended approach is: Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. Validate with: Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. Workload context: A pipeline rebuilds from the same source commit for each environment and receives newer transitive dependencies in production.