Security, Troubleshooting and Health
KCNA candidates need baseline security and troubleshooting concepts: RBAC, Secrets, probes, logs, events, image pulls, crash loops, and readiness.
How to study for Kubernetes and Cloud Native Associate
Treat each question as a foundation check: identify the Kubernetes primitive, connect it to the cloud native pattern, then choose the least surprising operational behavior.
Core concepts
Concept 1
Cluster security combines identity and RBAC, admission policy, Pod hardening, network controls, and trusted artifacts.
Exam cue: For authorization, identify the identity, verb, resource, subresource, and Namespace scope.
Concept 2
Startup gates initialization, readiness gates traffic, and liveness restarts a container only when restart is a useful recovery.
Exam cue: For health, ask whether the desired outcome is delay startup, stop traffic, or restart the process.
Concept 3
Troubleshooting preserves evidence and identifies whether failure occurred at scheduling, image pull, configuration, runtime, health, discovery, or policy.
Exam cue: Use Pod status, conditions, Events, current and previous logs, and the exact referenced configuration before changing anything.
Risk pitfalls and guardrails
Treating base64 in a Secret as encryption or granting broad Secret read access casually.
Guardrail: Avoid answers that rely only on habit, ignore the stated source, skip safety or compliance steps, or choose convenience over the professional standard.
Using an external dependency as liveness and creating a restart storm during that dependency's outage.
Guardrail: Avoid answers that rely only on habit, ignore the stated source, skip safety or compliance steps, or choose convenience over the professional standard.
Making several speculative changes at once and destroying the evidence needed to isolate cause.
Guardrail: Avoid answers that rely only on habit, ignore the stated source, skip safety or compliance steps, or choose convenience over the professional standard.
Memory anchors
RBAC
RBAC grants Kubernetes API permissions through Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings.
Secret
A Secret stores sensitive configuration for workloads, though access and encryption still require care.
Liveness Probe
A liveness probe detects when Kubernetes should restart a container.
Readiness Probe
A readiness probe controls whether a Pod should receive Service traffic.
Event
An event records recent scheduling, pulling, mounting, probing, and controller behavior.
Container Logs
Container logs show stdout and stderr and often provide the first application-level clue.
CrashLoopBackOff
CrashLoopBackOff means a container repeatedly exits and Kubernetes delays restart attempts.
ImagePullBackOff
ImagePullBackOff means Kubernetes cannot pull the requested image after retrying.
Startup Probe
A startup probe protects slow initialization from premature liveness restarts.
Pod Security
Pod Security Admission can enforce, audit, or warn against Baseline and Restricted workload profiles.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
Which security principle recommends granting a controller only the API verbs and resources it actually needs?
A Role permits get, list, and watch on Secrets. Why is this a high-impact grant?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”