Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Match Pod CPU/memory requests to node allocatable resources and scheduling constraints before blaming a container image. This action addresses Pending Pods and resource-fit checks instead of the controlling requirement. A Pending unscheduled Pod has no running container logs; scheduler events reveal placement failures. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: A node loses a label after scheduling and the team assumes IgnoredDuringExecution will automatically evict the existing Pod.

Use a compatible container runtime via the Kubernetes Container Runtime Interface to create and manage containers on nodes. This action addresses Container runtime and CRI instead of the controlling requirement. A runtime executes containers; the CRI is its API integration with kubelet rather than the Kubernetes API server. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: A node loses a label after scheduling and the team assumes IgnoredDuringExecution will automatically evict the existing Pod.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Workload context: A node loses a label after scheduling and the team assumes IgnoredDuringExecution will automatically evict the existing Pod.

Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. These observations are more relevant to NetworkPolicy ingress egress isolation, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: Two apps share one ingress endpoint and a catch-all path shadows the specific API route intended for a second hostname.

Test DNS names, search suffixes, CoreDNS logs, upstream forwarders and service records. These observations are more relevant to Cluster DNS and service discovery, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: Two apps share one ingress endpoint and a catch-all path shadows the specific API route intended for a second hostname.

Inspect Pod pull events, image tag existence, registry TLS, imagePullSecrets and service-account references. These observations are more relevant to ImagePullBackOff registry and auth errors, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: Two apps share one ingress endpoint and a catch-all path shadows the specific API route intended for a second hostname.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. That result validates Image scanning and software bills of materials rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

The container sees the intended isolated resources while usage limits are reflected in host accounting. That result validates Linux namespaces and cgroups rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Controllers and Services select exactly the intended Pods while audit annotations retain descriptive notes. That result validates Labels selectors and annotations rather than the requirement here. Verify instead: Authorized clients create or read resources through the API and unauthorized calls fail consistently. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Applications reach their authorized peers while unrelated Pods cannot read secrets or contact protected services. This step belongs to Namespace segmentation with NetworkPolicies rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Use PVCs to request persistent storage and PVs to represent volumes whose lifecycle is separate from ephemeral Pods. This step belongs to PersistentVolume and claim bindings rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. This step belongs to LoadBalancer Service provisioning rather than the complementary implementation and evidence pair. The intended approach is: Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. Validate with: Review storageClass volumeBindingMode, PVC condition, Pod node constraints and CSI topology events. Workload context: A stateful Pod requires a particular zone but an Immediate-binding StorageClass allocated a disk elsewhere.

Pods with persistent volumes schedule to nodes capable of mounting the selected storage without zone conflicts. That result validates PersistentVolume zone binding and placement rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: An engineer applies a namespaced Role expecting it to grant permission to modify all cluster Nodes.

Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. That result validates Controller manager reconciliation loops rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: An engineer applies a namespaced Role expecting it to grant permission to modify all cluster Nodes.

The container sees the intended isolated resources while usage limits are reflected in host accounting. That result validates Linux namespaces and cgroups rather than the requirement here. Verify instead: Teams see only permitted namespaced resources and network access is constrained by explicit policies. Workload context: An engineer applies a namespaced Role expecting it to grant permission to modify all cluster Nodes.

File reproducible issues with versions, expected/actual behavior, logs and minimal sanitized reproduction steps to support project maintainers. This action addresses Upstream issue reporting and review collaboration instead of the controlling requirement. High-quality issue reports help distributed open-source teams collaborate, and a public issue is not a safe place to paste secrets. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Follow Kubernetes Special Interest Group ownership and enhancement processes when proposing changes to core functionality. This action addresses Kubernetes SIG and community governance instead of the controlling requirement. Kubernetes development is governed through open community processes rather than a single cloud vendor's private roadmap. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. This action addresses SLIs SLOs and golden signals instead of the controlling requirement. An SLI is a measurement, an SLO is a target and an SLA is a contractual commitment; they should not be conflated. For this scenario prefer: Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. Workload context: A team stores distributed traces without matching service names or trace IDs and cannot reconstruct an end-user request.

Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. This action addresses kubectl apply and declarative updates instead of the controlling requirement. Declarative apply merges intended fields but conflicts and imperative edits require field ownership review. For this scenario prefer: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Assign stable labels for matching workload membership, and use annotations for nonselecting descriptive metadata. This action addresses Labels selectors and annotations instead of the controlling requirement. Labels support equality and set-based selectors; annotations do not become Service selectors automatically. For this scenario prefer: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. Workload context: A security team attaches a broad ClusterRoleBinding to a service account intended to read only one namespace's ConfigMaps.

Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. This step belongs to kubectl apply and declarative updates rather than the complementary implementation and evidence pair. The intended approach is: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Validate with: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Critical workloads gain capacity when eligible without uncontrolled eviction of unrelated protected services. This step belongs to PriorityClass and preemption rather than the complementary implementation and evidence pair. The intended approach is: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Validate with: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Cordon a node before planned maintenance, then use drain with workload safety checks and restore scheduling after validation. Validate with: Check node unschedulable state, PodDisruptionBudgets, DaemonSets, local storage and eviction events. Workload context: A maintenance drain refuses eviction because the only healthy replica is protected by a PodDisruptionBudget.

An operator investigates a running Pod without modifying its immutable application image or replacing production workload containers. That result validates Ephemeral debugging containers rather than the requirement here. Verify instead: Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.

Each eligible node runs the intended agent and newly added eligible nodes receive it automatically. That result validates DaemonSet node-local workloads rather than the requirement here. Verify instead: Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.

Cluster state can be recovered from a tested snapshot with quorum intact and application volumes handled separately. That result validates etcd consistency and cluster state rather than the requirement here. Verify instead: Missing workload replicas are recreated from their controllers and desired counts converge after disruptions. Workload context: A workload owner edits the replica count but the controller has not created replacements due to a controller-plane failure.

Combine RBAC with NetworkPolicy to control both Kubernetes API permissions and east-west workload traffic. This action addresses Namespace segmentation with NetworkPolicies instead of the controlling requirement. NetworkPolicy governs data-plane traffic, whereas RBAC governs API actions; neither alone replaces the other. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Use Pod events and scheduler reasons to diagnose Pending workloads before changing application images or reading nonexistent logs. This action addresses Pending pod FailedScheduling events instead of the controlling requirement. Pending may mean unschedulable or image preparation; distinguish whether node assignment occurred before choosing next checks. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Investigate node disk, memory and PID pressure conditions and distinguish eviction from application-probe restarts. Workload context: A cluster's node memory pressure increases during log bursts and a team blames the scheduler for already-running Pods terminating.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. This step belongs to OCI registries and image distribution rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. This step belongs to PodDisruptionBudget during voluntary eviction rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.