Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Inspect securityContext, runAsUser, allowPrivilegeEscalation, capabilities, seccompProfile and startup errors. These observations are more relevant to Linux securityContext and seccomp basics, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Inspect external IP status, controller events, security groups, health checks and upstream target availability. These observations are more relevant to LoadBalancer Service provisioning, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect serviceAccountName, RoleBindings, projected tokens, audience and kubectl auth can-i permissions. Workload context: An application receives forbidden errors when listing ConfigMaps because its service account lacks get/list permissions.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Inspect node conditions, eviction events, kubelet logs, disk usage and QoS/resource request settings. These observations are more relevant to Node pressure and Pod eviction analysis, not this case. The distinguishing check is: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Review container lastState, exit code, restart count, previous logs and application configuration. These observations are more relevant to CrashLoopBackOff and previous logs, not this case. The distinguishing check is: Inspect probe paths, thresholds, failure conditions, Service endpoints and container restart events. Workload context: A slow-starting Java app passes readiness only after warm-up but its liveness check kills it every ten seconds during startup.

Use the scheduler to select feasible nodes and the cluster autoscaler to adjust node capacity when unschedulable Pods can fit a supported node group. This action addresses Scheduler versus autoscaler responsibility instead of the controlling requirement. The autoscaler provisions nodes; it does not assign Pod nodeName or fix impossible affinity or quota constraints by itself. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.

Maintain accurate node labels, allocatable resources and topology information to support workload placement and capacity analysis. This action addresses Node labels and allocatable inventory instead of the controlling requirement. Node allocatable excludes reservations from raw capacity; labels must reflect real node capabilities and administration. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Use a DaemonSet to run a supported node agent across eligible nodes, respecting taints and selectors. Workload context: A monitoring DaemonSet runs on control-plane nodes unexpectedly because it tolerates taints intended to exclude application Pods.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. These observations are more relevant to Prometheus pull scraping and metrics endpoints, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A company wants to understand which Kubernetes SIG owns a networking proposal and how contributors discuss compatibility concerns.

Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. These observations are more relevant to CNCF ecosystem and Kubernetes roles, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A company wants to understand which Kubernetes SIG owns a networking proposal and how contributors discuss compatibility concerns.

Review security policy, affected version, maintainer contact, severity evidence and coordinated disclosure plan. These observations are more relevant to Responsible vulnerability disclosure in communities, not this case. The distinguishing check is: Review SIG charter, KEP status, community meeting records and maintainer review responsibilities. Workload context: A company wants to understand which Kubernetes SIG owns a networking proposal and how contributors discuss compatibility concerns.

Only approved Pod flows pass and disallowed lateral or outbound connections fail reproducibly. That result validates NetworkPolicy ingress egress isolation rather than the requirement here. Verify instead: Pods on different eligible nodes communicate according to network design and report working network addresses. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

New claims provision compatible storage without requiring manual static PV creation for each request. That result validates StorageClass dynamic provisioning rather than the requirement here. Verify instead: Pods on different eligible nodes communicate according to network design and report working network addresses. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

Clients resolve the intended in-cluster Service name and external DNS forwarding operates as designed. That result validates Cluster DNS and service discovery rather than the requirement here. Verify instead: Pods on different eligible nodes communicate according to network design and report working network addresses. Workload context: An engineer deploys CoreDNS to fix packets being dropped between Pod IPs though cluster name resolution is already healthy.

Inspect container membership, localhost connectivity, Pod IP, restart policies and inter-container volumes. These observations are more relevant to Pod shared network namespace and lifecycle, not this case. The distinguishing check is: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Inspect Service type, selector, EndpointSlices, DNS name and backend Pod readiness. These observations are more relevant to Service stable virtual endpoint, not this case. The distinguishing check is: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Check Pod nodeSelector keys and values against node labels and scheduling events. These observations are more relevant to nodeSelector equality placement, not this case. The distinguishing check is: Check API endpoint connectivity, request audit records, resource authorization and response status. Workload context: A development team scripts direct writes to etcd for creating Pods because it assumes the API server is merely a web dashboard.

Assign readiness for traffic acceptance, liveness for unhealthy restarts and startup for slow initialization when appropriate. This action addresses Readiness liveness and startup probe behavior instead of the controlling requirement. Readiness failure removes a Pod from ready endpoints; liveness failure may restart a container. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Assign dedicated Kubernetes service accounts and least-privilege RBAC for workloads accessing the API. This action addresses ServiceAccount and workload RBAC boundaries instead of the controlling requirement. A service account is an API identity; granting Pods a namespace does not automatically limit an overbroad ClusterRoleBinding. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This action addresses Authentication authorization and admission order instead of the controlling requirement. Authentication answers who called, authorization answers what may be done, and admission can apply policy to allowed requests. For this scenario prefer: Require approved registry artifacts and verifiable signatures or digests before admitting production workloads. Workload context: A validating admission rule rejects an image from an untrusted registry while the node would otherwise be able to pull it.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Record artifact provenance, dependency inventories and signed attestations so deployment policy can trace a build to authorized source. This action addresses Software supply chain attestations instead of the controlling requirement. SBOM inventory and signed provenance provide different evidence; neither replaces vulnerability and security-policy review. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This action addresses Artifact promotion by digest instead of the controlling requirement. An image digest identifies the immutable artifact; matching labels or Git SHAs alone do not prove identical layers. For this scenario prefer: Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. Workload context: An Ingress references a TLS Secret for the wrong hostname and browsers reject the certificate despite successful Pod readiness.

Configure Deployment rollout strategy with availability bounds and use rollout history when an update requires controlled rollback. This step belongs to Deployment rolling updates and rollback rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

Inspect Deployment observedGeneration, rollout status, revision annotations, ReplicaSet ownership and release events. This step belongs to Rollout history status and change correlation rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

Engineers identify the failing process message associated with the correct container instance and time window. This step belongs to kubectl logs current versus previous instance rather than the complementary implementation and evidence pair. The intended approach is: Gate rollout progression on suitable error, latency and business metrics with explicit thresholds and rollback authorization. Validate with: Inspect error-budget impact, traffic exposure, request latency, alert window and controller decisions. Workload context: A service shows acceptable cluster CPU but users have elevated checkout latency and the release gate ignores request-level metrics.

The team selects a suitable maintained project based on requirements rather than mistaking ecosystem status for a warranty. That result validates CNCF project maturity and adoption decisions rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Operators find the latency or failure cause using combined telemetry without mistaking metrics for individual request evidence. That result validates Metrics logs and traces distinctions rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Metrics are collected from intended targets at expected intervals with bounded label series and useful alerts. That result validates Prometheus pull scraping and metrics endpoints rather than the requirement here. Verify instead: Alerts identify meaningful user-impacting regressions before the service spends an unacceptable error budget. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This action addresses PV reclaim policy Retain versus Delete instead of the controlling requirement. Retain leaves storage for deliberate recovery; Delete usually removes underlying dynamically provisioned storage when supported. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.