Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Choose PV access modes based on how nodes and workloads must mount storage and verify CSI driver capability. This action addresses ReadWriteOnce and ReadWriteMany semantics instead of the controlling requirement. ReadWriteOnce normally limits read-write mounting to one node, not necessarily exactly one Pod; driver behavior matters. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.

Use ClusterIP for private service access and NodePort only when node-level external ports are intentionally needed. This action addresses ClusterIP and NodePort Service exposure instead of the controlling requirement. ClusterIP does not automatically provide an external endpoint; NodePort opens a port on eligible nodes with network policy constraints. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.

Select PV reclaim policies according to retention requirements and verify storage cleanup or recovery steps after PVC deletion. This action addresses PV reclaim policy Retain versus Delete instead of the controlling requirement. Retain leaves storage for deliberate recovery; Delete usually removes underlying dynamically provisioned storage when supported. For this scenario prefer: Select and operate a Kubernetes-compatible CNI implementation to provide Pod IP connectivity and required network capabilities. Workload context: A cluster contains Pods on two workers but cross-node traffic fails after a routed Pod CIDR is omitted.

Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. This action addresses kubectl apply and declarative updates instead of the controlling requirement. Declarative apply merges intended fields but conflicts and imperative edits require field ownership review. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Allow Kubernetes controllers to reconcile declared desired object state instead of manually replacing each Pod after failure. This action addresses Controller manager reconciliation loops instead of the controlling requirement. Controllers continuously reconcile desired state; an isolated manually created Pod lacks a Deployment's replica management. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Use namespaces to group namespaced resources and policies, and add explicit RBAC and network controls for isolation. This action addresses Namespace scope and limits instead of the controlling requirement. Namespaces organize resource names but are not automatically strong security boundaries or separate clusters. For this scenario prefer: Place a Kubernetes Service in front of ephemeral Pods when callers need stable discovery independent of individual Pod IP changes. Workload context: A client hardcodes a Pod IP and its connection fails each time the Deployment restarts a replica.

Review CNCF landscape category, project governance, release cadence, support ecosystem and security disclosures. These observations are more relevant to CNCF project maturity and adoption decisions, not this case. The distinguishing check is: Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. These observations are more relevant to SLIs SLOs and golden signals, not this case. The distinguishing check is: Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Identify each project role, integration point, maintainer documentation and whether it belongs to Kubernetes core. These observations are more relevant to CNCF ecosystem and Kubernetes roles, not this case. The distinguishing check is: Inspect tracer/provider setup, context propagation, collector pipeline, resource attributes and exporter endpoint health. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Review initContainers/sidecar restart behavior, shared volumes, localhost traffic and termination events. These observations are more relevant to Sidecar containers and shared Pod lifecycle, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: An app's database password is committed into a ConfigMap because it seems convenient to review configuration changes.

Inspect resource status, conditions, events, generation, owner references and logs from the relevant container. These observations are more relevant to kubectl inspect and describe diagnostics, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: An app's database password is committed into a ConfigMap because it seems convenient to review configuration changes.

Check server and kubelet versions, deprecated APIs, CNI/CSI compatibility, maintenance order and rollback limits. These observations are more relevant to Kubernetes upgrades and version skew, not this case. The distinguishing check is: Inspect ConfigMap/Secret references, RBAC, API audit records, encryption-at-rest settings and mount or environment behavior. Workload context: An app's database password is committed into a ConfigMap because it seems convenient to review configuration changes.

Assign a Role to namespaced permissions and a ClusterRole where appropriate for cluster-scoped or reusable rules, binding least privilege. This action addresses Role and ClusterRole authorization instead of the controlling requirement. A RoleBinding can bind a ClusterRole within its namespace; a ClusterRoleBinding grants its rules at cluster scope. For this scenario prefer: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Assign PriorityClasses carefully and understand when the scheduler may preempt lower-priority Pods to place urgent workloads. This action addresses PriorityClass and preemption instead of the controlling requirement. Priority influences scheduling and potential preemption but does not bypass hard affinity or lack of suitable hardware. For this scenario prefer: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Let kubelet on each node reconcile assigned Pod specifications with the container runtime and report node and Pod status. This action addresses Kubelet node agent responsibilities instead of the controlling requirement. kubelet manages Pod execution on a node; it does not serve the central Kubernetes API or select new nodes. For this scenario prefer: Apply taints to repel unauthorized scheduling and give only intended workloads matching tolerations. Workload context: A node gains a NoExecute taint and running Pods without the right toleration are evicted rather than simply blocked from new scheduling.

Compare rollout history and resource generations to identify whether application failures correlate with a new deployment revision. This action addresses Rollout history status and change correlation instead of the controlling requirement. A Deployment being Available does not prove all new replicas are healthy or that a rollout has fully progressed. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: A developer receives forbidden for pods/exec although able to get and list Pods, revealing separate RBAC verbs.

Trace external HTTP requests through DNS, ingress/Gateway association, TLS configuration, Service and Pod endpoints. This action addresses Ingress route and TLS mismatch diagnosis instead of the controlling requirement. A healthy Service does not guarantee correct edge routing; ingress controllers and TLS bindings add separate layers. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: A developer receives forbidden for pods/exec although able to get and list Pods, revealing separate RBAC verbs.

Promote the same reviewed container image digest between environments instead of rebuilding mutable tags at each stage. This action addresses Artifact promotion by digest instead of the controlling requirement. An image digest identifies the immutable artifact; matching labels or Git SHAs alone do not prove identical layers. For this scenario prefer: Use kubectl exec with least privilege for approved diagnostics in running containers, avoiding permanent production mutations. Workload context: A developer receives forbidden for pods/exec although able to get and list Pods, revealing separate RBAC verbs.

Teams receive predictable defaults and cannot consume more namespace resources than policy permits. That result validates ResourceQuota and LimitRange policies rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Pods run the intended image build and failed pulls are diagnosed without silently relying on stale artifacts. That result validates Image pull policy and cached images rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Teams see only permitted namespaced resources and network access is constrained by explicit policies. That result validates Namespace scope and limits rather than the requirement here. Verify instead: Stateless replicas converge to the declared count and rolling updates progress without manual Pod recreation. Workload context: A rollout stalls with old and new ReplicaSets and developers delete the Deployment instead of checking readiness and progress.

Workloads function under least privilege and operations needing prohibited capabilities are rejected or explicitly reviewed. That result validates Linux securityContext and seccomp basics rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Applications mount volumes with the requested access pattern without unsupported simultaneous access assumptions. That result validates ReadWriteOnce and ReadWriteMany semantics rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Storage is provisioned in a suitable placement domain after the first eligible consumer is considered. That result validates WaitForFirstConsumer volume binding rather than the requirement here. Verify instead: New claims provision compatible storage without requiring manual static PV creation for each request. Workload context: A cloud team migrates CSI drivers and older StorageClass provisioner names begin failing to create volumes.

Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. This step belongs to Ingress and Gateway API routing rather than the complementary implementation and evidence pair. The intended approach is: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Validate with: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Distinguish authenticating a Kubernetes API caller from authorizing verbs and validating or mutating admission behavior. This step belongs to Authentication authorization and admission order rather than the complementary implementation and evidence pair. The intended approach is: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Validate with: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Healthy but initializing Pods avoid traffic and genuinely stuck workloads recover without unnecessary restart loops. This step belongs to Readiness liveness and startup probe behavior rather than the complementary implementation and evidence pair. The intended approach is: Apply RBAC and encryption-at-rest controls to Kubernetes Secrets and avoid exposing decoded values in logs or public manifests. Validate with: Inspect Secret read permissions, encryption configuration, encoded manifest values and audit trails. Workload context: An auditor sees secret data encrypted at rest but users with wildcard RBAC can still retrieve it through the API.

Inspect PVC phase, PV claimRef, capacity, accessModes, storageClassName and volume-mount events. These observations are more relevant to PersistentVolume and claim bindings, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

Inspect NetworkPolicy podSelector, namespaces, allowed ports, CNI enforcement support and packet test results. These observations are more relevant to NetworkPolicy ingress egress isolation, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

Examine authentication identity, RBAC decision, admission webhook result and API response status. These observations are more relevant to Authentication authorization and admission order, not this case. The distinguishing check is: Inspect controller readiness, class or Gateway association, route attachment status, TLS Secret and backend Service mapping. Workload context: A Gateway HTTPRoute has an invalid parent reference, leaving it unattached even though backend Service endpoints are healthy.

Inspect Service metadata, selected Pod labels, EndpointSlice readiness, containerPort and actual listening sockets. These observations are more relevant to Service selector and port mismatch diagnostics, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Compare Service type, clusterIP, nodePort, targetPort, node addresses and backend EndpointSlices. These observations are more relevant to ClusterIP and NodePort Service exposure, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Inspect CNI configuration, Pod CIDRs, node route tables, overlay/underlay links and CNI daemon logs. These observations are more relevant to CNI Pod networking implementation, not this case. The distinguishing check is: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.