Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Workload context: Two full application stacks run in parallel and the team switches the primary Service selector after validating the idle green stack.

Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. This action addresses kubectl exec diagnostic boundaries instead of the controlling requirement. kubectl exec runs a process in an existing container; it does not persist edits across new image-based replacements. For this scenario prefer: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Workload context: Two full application stacks run in parallel and the team switches the primary Service selector after validating the idle green stack.

Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. This action addresses Progressive delivery and release metrics instead of the controlling requirement. Automated analysis requires representative telemetry and guardrails; an unchanged rollout status does not prove user experience is healthy. For this scenario prefer: Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. Workload context: Two full application stacks run in parallel and the team switches the primary Service selector after validating the idle green stack.

Approved workloads can access required credentials while unauthorized viewers cannot recover plaintext through the API. This step belongs to Secret base64 encoding versus encryption rather than the complementary implementation and evidence pair. The intended approach is: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Validate with: Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. Workload context: Two replicas on different worker nodes need to edit shared files but the selected volume supports only ReadWriteOnce.

Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. This step belongs to StorageClass dynamic provisioning rather than the complementary implementation and evidence pair. The intended approach is: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Validate with: Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. Workload context: Two replicas on different worker nodes need to edit shared files but the selected volume supports only ReadWriteOnce.

Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. This step belongs to Ephemeral emptyDir versus persistent volumes rather than the complementary implementation and evidence pair. The intended approach is: Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. Validate with: Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. Workload context: Two replicas on different worker nodes need to edit shared files but the selected volume supports only ReadWriteOnce.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. This action addresses Ephemeral emptyDir versus persistent volumes instead of the controlling requirement. emptyDir exists for the lifetime of a Pod on a node and is lost when the Pod is removed. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Diagnose memory limit terminations using lastState and observed working-set growth rather than assuming every restart is application logic. This action addresses Container OOMKilled and resource pressure instead of the controlling requirement. Container memory exceeding its cgroup limit can trigger OOMKilled even when node aggregate memory seems available. For this scenario prefer: Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. Workload context: A PVC-backed workload remains unscheduled and engineers inspect application logs instead of waiting for binding prerequisites.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: A cache should run near a matching API Pod but its required affinity selector refers to a label no API Pods carry.

Pods schedule based on requests and stay within resource policy without avoidable throttling or memory termination. That result validates CPU requests and memory limits rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: A cache should run near a matching API Pod but its required affinity selector refers to a label no API Pods carry.

Feasible Pods are scheduled after resource or policy conflicts are resolved without overcommitting critical nodes. That result validates Pending Pods and resource-fit checks rather than the requirement here. Verify instead: Replicas spread or co-locate according to declared constraints with predictable behavior when no feasible topology exists. Workload context: A cache should run near a matching API Pod but its required affinity selector refers to a label no API Pods carry.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. This action addresses Image provenance and admission policies instead of the controlling requirement. An image scanner alone does not prove publisher identity; signed provenance and admission enforcement address different guarantees. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Inspect restart history and previous-container logs to diagnose repeatedly exiting containers and fix startup or runtime failures. This action addresses CrashLoopBackOff and previous logs instead of the controlling requirement. CrashLoopBackOff indicates repeated container exits and restart delays, not a scheduler placement failure. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: An application uses an emptyDir for large temporary data and cannot recover after eviction because it expected the directory to be persistent.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. That result validates PriorityClass and preemption rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Clients reach the intended healthy backends through a stable Service name despite Pod replacement. That result validates Service stable virtual endpoint rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A regional control-plane upgrade changes the API endpoint but workers continue running and administrators need to verify client access.

Inspect PV/PVC accessModes, actual mount failures, driver support and multi-node workload placement. These observations are more relevant to ReadWriteOnce and ReadWriteMany semantics, not this case. The distinguishing check is: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. These observations are more relevant to NetworkPolicy ingress egress isolation, not this case. The distinguishing check is: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

Inspect kubectl describe Pod events, requests, node taints, PVC claims and node affinity. These observations are more relevant to Pending pod FailedScheduling events, not this case. The distinguishing check is: Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. Workload context: An engineer expects setting storageClassName on a claim to create usable storage even when the provisioner controller is unavailable.

Inspect traffic split, Service selectors or routing weights, version identity and representative user metrics. This step belongs to Blue-green versus canary release patterns rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Package related Kubernetes resources as a Helm chart and manage per-environment configuration with reviewed values and release history. This step belongs to Helm charts templates and values rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Public requests reach the intended application host and path with a valid certificate and matching backends. This step belongs to Ingress route and TLS mismatch diagnosis rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A canary passes readiness checks but its checkout endpoint produces twice the normal error rate under real traffic.

Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. These observations are more relevant to Kubernetes upgrades and version skew, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A Pod remains Pending and the operator reads only logs even though no container ever started.

Review node taint key/effect, Pod toleration key/operator and associated scheduler events. These observations are more relevant to Taints tolerations and node protection, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A Pod remains Pending and the operator reads only logs even though no container ever started.

Review Pod scheduling reasons, node group templates, provisioning limits and autoscaler scale-up decisions. These observations are more relevant to Scheduler versus autoscaler responsibility, not this case. The distinguishing check is: Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. Workload context: A Pod remains Pending and the operator reads only logs even though no container ever started.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This action addresses Artifact promotion by digest instead of the controlling requirement. An image digest identifies the immutable artifact; matching labels or Git SHAs alone do not prove identical layers. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Choose blue-green for switching between full environments and canary for gradually exposing a small percentage of users to a new version. This action addresses Blue-green versus canary release patterns instead of the controlling requirement. Blue-green switches environments, whereas canary ramps exposure; a basic Deployment alone may not provide precise traffic percentages. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Use time-aligned metrics, structured logs and distributed traces to isolate root causes across Kubernetes components and services. This action addresses Correlating metrics logs and traces instead of the controlling requirement. Metrics show trends, logs show event details, and traces show request spans; reliable correlation benefits from consistent identifiers. For this scenario prefer: Distinguish readiness endpoint failures from application process exits before deciding whether to restart or change service routing. Workload context: During database migration, the container remains live but readiness fails appropriately until the dependency becomes usable.

Containers launch the intended process with arguments preserved and failures remain visible through status. That result validates Container command entrypoint and arguments rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Eligible Pending Pods trigger appropriate capacity increases and then receive scheduler bindings. That result validates Scheduler versus autoscaler responsibility rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: The container sees the intended isolated resources while usage limits are reflected in host accounting. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.