Pass Linux Foundation KCNA Exam in First Attempt Guaranteed!

Resource pressure is resolved without sustained involuntary eviction or unsafe removal of application persistent data. That result validates Node pressure and Pod eviction analysis rather than the requirement here. Verify instead: The container remains running or completes as intended without repeated backoff cycles after a targeted correction. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Each stateful replica retains its expected identity and corresponding durable storage through controlled replacement. That result validates StatefulSet identity and volume templates rather than the requirement here. Verify instead: The container remains running or completes as intended without repeated backoff cycles after a targeted correction. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Eligible nodes retrieve the intended immutable artifact and Pods progress beyond image pull. That result validates ImagePullBackOff registry and auth errors rather than the requirement here. Verify instead: The container remains running or completes as intended without repeated backoff cycles after a targeted correction. Workload context: An app starts correctly but crashes after a few seconds, leaving the last failing stack trace only in the previous container logs.

Use kubectl get, describe and logs as complementary views of object state, events and container output before changing resources. This action addresses kubectl inspect and describe diagnostics instead of the controlling requirement. kubectl get summarizes objects; describe reveals events and details; logs reveals container stdout/stderr, not complete API diagnostics. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Store non-sensitive configuration in ConfigMaps and sensitive values in Secrets with access control and encryption controls. This action addresses ConfigMap and Secret boundaries instead of the controlling requirement. Kubernetes Secret data is base64-encoded by default, not inherently encrypted or a substitute for managed secret governance. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Model tightly coupled containers inside a Pod when they must share a network namespace and lifecycle, not as unrelated separate Pods. This action addresses Pod shared network namespace and lifecycle instead of the controlling requirement. Containers in one Pod share networking and selected volumes; Kubernetes schedules Pods rather than independent containers. For this scenario prefer: Use kubectl apply or a governed reconciliation workflow for repeatable desired-state changes, reviewing diffs before high-impact updates. Workload context: A preproduction job applies an invalid pod template without using server dry-run and catches failure only after traffic is affected.

Diagnose NotReady nodes and distinguish node health from Pod-level readiness before reopening scheduling. This step belongs to Node readiness and scheduling exclusion rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. This step belongs to PersistentVolume zone binding and placement rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Only reviewed images with accepted risk enter production and later findings can be traced to deployed digests. This step belongs to Image scanning and software bills of materials rather than the complementary implementation and evidence pair. The intended approach is: Choose requiredDuringSchedulingIgnoredDuringExecution for a hard node preference and preferred rules for soft placement choices. Validate with: Inspect affinity terms, matchExpressions, node labels, scheduler feasibility and fallback placement. Workload context: An app owner wants data locality preference but writes a hard node affinity that excludes healthy zones during failover.

Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. This action addresses Prometheus pull scraping and metrics endpoints instead of the controlling requirement. Prometheus primarily scrapes targets on an interval; instrumentation must expose values and high-cardinality labels can overload storage. For this scenario prefer: Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. This action addresses SLIs SLOs and golden signals instead of the controlling requirement. An SLI is a measurement, an SLO is a target and an SLA is a contractual commitment; they should not be conflated. For this scenario prefer: Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Distinguish Kubernetes orchestration responsibilities from ecosystem projects that add service mesh, telemetry, delivery and storage capabilities. This action addresses CNCF ecosystem and Kubernetes roles instead of the controlling requirement. The CNCF ecosystem contains complementary projects; Kubernetes itself is not a complete application observability or delivery platform. For this scenario prefer: Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. Workload context: A collector receives spans but fails export because the observability backend endpoint expects TLS and the configured exporter uses plaintext.

Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. This step belongs to SLIs SLOs and golden signals rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A team deploys a proprietary cloud load-balancer annotation and assumes the same manifest will work unchanged on bare metal.

Evaluate CNCF sandbox, incubating and graduated projects in context of maintenance, community adoption and technical fit. This step belongs to CNCF project maturity and adoption decisions rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A team deploys a proprietary cloud load-balancer annotation and assumes the same manifest will work unchanged on bare metal.

Project maintainers receive actionable confidential reports and releases can be coordinated without exposing affected users prematurely. This step belongs to Responsible vulnerability disclosure in communities rather than the complementary implementation and evidence pair. The intended approach is: Prefer open APIs, OCI images and Kubernetes-compatible deployment contracts where portability matters while accounting for provider-specific extensions. Validate with: Inspect manifests for proprietary resources, storage/network API dependencies, image compatibility and migration cost. Workload context: A team deploys a proprietary cloud load-balancer annotation and assumes the same manifest will work unchanged on bare metal.

Project maintainers receive actionable confidential reports and releases can be coordinated without exposing affected users prematurely. This step belongs to Responsible vulnerability disclosure in communities rather than the complementary implementation and evidence pair. The intended approach is: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Validate with: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Inspect ServiceMonitor or scrape config, /metrics endpoint, target health, scrape interval and sample labels. This step belongs to Prometheus pull scraping and metrics endpoints rather than the complementary implementation and evidence pair. The intended approach is: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Validate with: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Choose metrics for measurements over time, logs for detailed events and traces for end-to-end request execution analysis. This step belongs to Metrics logs and traces distinctions rather than the complementary implementation and evidence pair. The intended approach is: Define user-relevant service-level indicators and objectives for availability, error rate or latency with practical alert thresholds. Validate with: Inspect SLI queries, SLO target/window, request populations, error budgets and alert rule outcomes. Workload context: A web team reports CPU below 50% as its sole SLO despite users seeing frequent payment failures.

Report suspected project security vulnerabilities through the designated private security channel before public reproduction details or exploit examples. This action addresses Responsible vulnerability disclosure in communities instead of the controlling requirement. Public bug trackers are not always the right venue for undisclosed security issues; project security policies define channels. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A team installs Prometheus but does not expose application counters and assumes it can derive request errors from Pod status alone.

Instrument services with OpenTelemetry APIs or SDKs and route collected signals through configured exporters or collectors. This action addresses OpenTelemetry instrumentation and exporters instead of the controlling requirement. OpenTelemetry standardizes collection and export; a collector is not itself the storage/query backend for all signals. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A team installs Prometheus but does not expose application counters and assumes it can derive request errors from Pod status alone.

Design bounded microservice interfaces with timeouts, retries and independently deployable service contracts where modularity is useful. This action addresses Microservices contracts and failure isolation instead of the controlling requirement. Microservices improve modularity but add network and operational overhead; splitting code does not automatically yield reliability. For this scenario prefer: Expose application metrics in supported Prometheus format and configure authorized scrape targets and label cardinality. Workload context: A team installs Prometheus but does not expose application counters and assumes it can derive request errors from Pod status alone.

Inspect PVC status, volume nodeAffinity, StorageClass volumeBindingMode and node/zone eligibility. These observations are more relevant to PersistentVolume zone binding and placement, not this case. The distinguishing check is: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Inspect Pod ephemeralContainers entries, RBAC privileges, target process namespace and active diagnostic sessions. These observations are more relevant to Ephemeral debugging containers, not this case. The distinguishing check is: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Compare Deployment spec, ReplicaSet ownership, rollout history and updated/available replica conditions. These observations are more relevant to Deployment and ReplicaSet ownership, not this case. The distinguishing check is: Compare host kernel sharing, namespace isolation, hypervisor boundaries and workload trust requirements. Workload context: A team states that every Linux container runs a separate operating-system kernel and budgets memory accordingly.

Configure PodDisruptionBudgets for voluntary disruptions while distinguishing eviction safety from normal scheduling decisions. This action addresses PodDisruptionBudget during voluntary eviction instead of the controlling requirement. A PodDisruptionBudget governs voluntary eviction; it does not guarantee protection against hardware failure or create new replicas. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: A three-replica app lands entirely in one zone because topology spread was configured for hostname rather than zone.

Choose imagePullPolicy based on tag immutability and cluster delivery needs, checking runtime cache and registry accessibility. This action addresses Image pull policy and cached images instead of the controlling requirement. Always pulls or checks the registry when needed, while IfNotPresent may use cache; pull policy is not image provenance. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: A three-replica app lands entirely in one zone because topology spread was configured for hostname rather than zone.

Use nodeSelector for straightforward required label equality and confirm matching nodes exist in the cluster. This action addresses nodeSelector equality placement instead of the controlling requirement. nodeSelector requires matching labels; it does not create labels or express weighted preferences by itself. For this scenario prefer: Set topologySpreadConstraints to balance replicated Pods across zones or nodes with an explicit maxSkew and unsatisfiable action. Workload context: A three-replica app lands entirely in one zone because topology spread was configured for hostname rather than zone.

Each workload can invoke only required API verbs without accessing unrelated namespaces or cluster secrets. This step belongs to ServiceAccount and workload RBAC boundaries rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Review namespace pod-security labels, admission warnings, violations and workload securityContext. This step belongs to Pod Security Admission and namespaces rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Check Service selectors and EndpointSlices to distinguish backend discovery from kube-proxy or data-plane forwarding faults. This step belongs to Service endpoint routing and kube-proxy rather than the complementary implementation and evidence pair. The intended approach is: Use a Service type LoadBalancer with a supported cloud or in-cluster load-balancer controller to provide an approved external endpoint. Validate with: Inspect external IP status, controller events, security groups, health checks and upstream target availability. Workload context: A cloud load balancer receives an address but internet requests fail because the provider firewall denies the listener port.

Inspect DaemonSet desired/current/ready counts, node eligibility, tolerations and per-node Pod placement. These observations are more relevant to DaemonSet node-local workloads, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A team rebuilds a container and assumes the entire image changes even though a cached dependency layer contains an outdated package.

Inspect SBOM package inventory, CVE applicability, signature validation and approved exception decisions. These observations are more relevant to Image scanning and software bills of materials, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A team rebuilds a container and assumes the entire image changes even though a cached dependency layer contains an outdated package.

Compare imagePullPolicy, local image cache, registry digest, pull events and Pod imageID. These observations are more relevant to Image pull policy and cached images, not this case. The distinguishing check is: Inspect Dockerfile layer history, build context, cache usage, image size and scanner findings. Workload context: A team rebuilds a container and assumes the entire image changes even though a cached dependency layer contains an outdated package.