Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This step belongs to ConfigMap and Secret boundaries rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Check registry path, pull Secret, tag or digest, IAM grant, TLS trust and registry audit logs. This step belongs to OCI registries and image distribution rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Planned node drains respect application availability requirements without confusing voluntary and involuntary disruptions. This step belongs to PodDisruptionBudget during voluntary eviction rather than the complementary implementation and evidence pair. The intended approach is: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Validate with: Inspect local-versus-server manifest diff, field ownership, admission rejection and resulting resource generation. Workload context: A deployment pipeline creates duplicate resources by regenerating names and calling create on every release.

Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. This action addresses Node affinity required vs preferred instead of the controlling requirement. Preferred affinity can be ignored to schedule a Pod; required affinity must be satisfied at scheduling time. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Build minimal images with reproducible layers and protect against secrets embedded in historical image layers. This action addresses Image layers and build cache instead of the controlling requirement. Deleting a file in a later image layer does not erase secrets committed into an earlier layer. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Explain how namespaces isolate process/network views and cgroups control CPU and memory resource accounting and enforcement. Workload context: A team sets a CPU request in Kubernetes and assumes it creates a new Linux network namespace for each process.

Trace requests through Service DNS, selector, EndpointSlice and targetPort before attributing all timeouts to network latency. This action addresses Service selector and port mismatch diagnostics instead of the controlling requirement. A Service can resolve in DNS yet have zero endpoints or forward to an incorrect port. For this scenario prefer: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Configure Pod Security Admission policy levels for namespaces to restrict unsafe Pod settings while documenting exceptions. This action addresses Pod Security Admission and namespaces instead of the controlling requirement. Pod Security Admission evaluates security standards at admission; it does not continuously sandbox existing containers after admission. For this scenario prefer: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Diagnose image-pull problems by validating image reference, registry availability, permissions and Secret scope. This action addresses ImagePullBackOff registry and auth errors instead of the controlling requirement. ImagePullBackOff is a retrieval or authorization problem; changing app readiness probes cannot fix a missing image. For this scenario prefer: Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. Workload context: An authorized manifest is rejected by a validating webhook because it requests a forbidden hostPath mount.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Use CoreDNS or the configured cluster DNS service to resolve Service and Pod naming in their correct namespaces. This action addresses Cluster DNS and service discovery instead of the controlling requirement. Kubernetes DNS uses namespace-aware search paths; a fully qualified Service name avoids ambiguity across namespaces. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Apply supported Kubernetes NetworkPolicies to restrict traffic using Pod/namespace selectors and explicit ingress/egress rules. Workload context: An app can receive requests from its frontend but cannot resolve DNS after egress is denied without allowing DNS traffic.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. These observations are more relevant to ClusterIP and NodePort Service exposure, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Inspect volume type, mount paths, Pod owner, node placement and data recovery requirements. These observations are more relevant to Ephemeral emptyDir versus persistent volumes, not this case. The distinguishing check is: Inspect Service selector, Pod readiness, EndpointSlice addresses, kube-proxy or eBPF service programming and target ports. Workload context: A platform team restarts CoreDNS for a Service request timeout even though DNS resolves and the selected endpoint port is wrong.

Inspect commit identity, build/test results, artifact digest, promotion approval and deployment events. These observations are more relevant to CI versus CD pipeline separation, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Compare Git revision, application sync status, live resource diff and reconciliation events. These observations are more relevant to GitOps reconciliation and source of truth, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Review ephemeralContainers spec, target container namespace, attach status and host-level privileges requested. These observations are more relevant to Ephemeral debug containers for minimal images, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: An API's p95 latency doubles while overall CPU stays normal and the team needs request-path traces to identify a slow database call.

Inspect pod/container name, restartCount, lastState, previous log output and log collector availability. These observations are more relevant to kubectl logs current versus previous instance, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.

Check registry digest, image signatures, deployment Pod imageID and provenance attestations across stages. These observations are more relevant to Artifact promotion by digest, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.

Review kubectl describe output, warning reasons, first/last timestamps and relevant controller ownership. These observations are more relevant to kubectl describe and event chronology, not this case. The distinguishing check is: Compare trace IDs, time synchronized log events, resource saturation metrics and span durations. Workload context: A Pod reports intermittent 502 errors and a nearby network proxy logs upstream timeouts with matching request IDs.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Inspect namespace labels, Pod selectors, network policy rules, RBAC permissions and effective connectivity tests. These observations are more relevant to Namespace segmentation with NetworkPolicies, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Inspect StorageClass provisioner name, allowed topology, PVC events and CSI controller logs. These observations are more relevant to StorageClass dynamic provisioning, not this case. The distinguishing check is: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: A cluster grants all developers list permission on Secrets, allowing them to read every application's encoded credentials.

Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. This action addresses LoadBalancer Service provisioning instead of the controlling requirement. A LoadBalancer Service depends on an implementation or provider controller; creating it does not guarantee an external address. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

Configure StorageClass WaitForFirstConsumer when scheduling topology must influence dynamic volume provisioning. This action addresses WaitForFirstConsumer volume binding instead of the controlling requirement. A PVC may legitimately remain unbound until a Pod consumes it under WaitForFirstConsumer. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

Use emptyDir for temporary Pod-scoped data and PVC-backed volumes when data must survive Pod replacement. This action addresses Ephemeral emptyDir versus persistent volumes instead of the controlling requirement. emptyDir exists for the lifetime of a Pod on a node and is lost when the Pod is removed. For this scenario prefer: Configure a supported StorageClass and CSI provisioner to dynamically create backing volumes for PVCs. Workload context: A Kubernetes cluster creates a PVC but no StorageClass or provisioner can satisfy it, leaving the claim Pending.

Keep etcd highly available and maintain secure, tested snapshots of Kubernetes API state rather than treating it as ordinary container storage. This action addresses etcd consistency and cluster state instead of the controlling requirement. etcd is a consistent key-value store for API state; it is not where persistent application volume data lives. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. This action addresses Taints tolerations and node protection instead of the controlling requirement. A toleration permits scheduling onto tainted nodes but does not force the scheduler to choose those nodes. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Evaluate image SBOMs, signed provenance and vulnerability reports before production promotion, separating detected packages from reachable risk. This action addresses Image scanning and software bills of materials instead of the controlling requirement. A scanner's package detection is evidence of inventory, not automatically proof of exploitation or complete image trust. For this scenario prefer: Pull images from approved OCI-compatible registries with controlled image credentials and documented access boundaries. Workload context: A private image pull returns Unauthorized because the namespace has no correctly scoped imagePullSecret.

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. These observations are more relevant to LoadBalancer Service provisioning, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.