Common KCNA Mistakes to Avoid
These are the most frequent mistakes students make on the KCNA exam. Learn them now so you don’t make them on exam day.
Mistake 1: Confusing Similar Concepts
etcd vs API Server
| Concept |
Role |
| etcd |
Key-value store that stores cluster state data |
| API Server |
The frontend that processes API requests and updates etcd |
Common confusion: “What stores cluster state?” → etcd, not the API Server.
Requests vs Limits
| Concept |
Role |
| Requests |
Minimum guaranteed resources — used for scheduling |
| Limits |
Maximum allowed resources — used for enforcement |
Common confusion: “What does the scheduler use to place pods?” → Requests, not limits.
Service Types
| Type |
Access |
| ClusterIP |
Internal only — within the cluster |
| NodePort |
External — via node IP + port (30000-32767) |
| LoadBalancer |
External — via cloud provider load balancer |
Common confusion: Thinking ClusterIP is accessible externally.
Mistake 2: Mixing Up CNCF Project Status
Students often confuse which projects are Graduated vs Incubating:
| Graduated (Know These!) |
Incubating (Know These!) |
| Kubernetes |
Knative |
| Prometheus |
OpenTelemetry |
| Envoy |
Backstage |
| containerd |
Cilium |
| Helm |
Kyverno |
| Argo |
Dapr |
| Flux |
|
| KEDA |
|
| Istio |
|
| Jaeger |
|
| Fluentd |
|
| etcd |
|
| CoreDNS |
|
| Linkerd |
|
Exam tip: If unsure, the better-known projects tend to be Graduated.
Mistake 3: Confusing Deployment Strategies
| Strategy |
Key Distinction |
| Rolling Update |
Gradual — some v1 and v2 run together (K8s default) |
| Recreate |
All-at-once — downtime (terminate v1, then start v2) |
| Blue-Green |
Two full environments — instant rollback (2x resources) |
| Canary |
Small percentage first — lowest risk |
Common mistakes:
- Thinking Rolling Update has zero overlap (it does — both versions run briefly)
- Thinking Blue-Green can scale down the old environment immediately (keep it for rollback!)
- Confusing Canary with A/B Testing (canary = percentage, A/B = user attributes)
Mistake 4: Misunderstanding GitOps
| Wrong Understanding |
Correct Understanding |
| “GitOps means using Git for version control” |
GitOps means Git is the single source of truth for desired state, with automated reconciliation |
| “GitOps pushes changes to the cluster” |
GitOps agents pull from Git — no external system needs cluster credentials |
| “Git changes trigger CI to deploy” |
The GitOps agent continuously monitors Git and reconciles — it’s pull-based, not push-based |
Mistake 5: Wrong Autoscaler for the Situation
| Situation |
Correct Autoscaler |
| “Need more pods when CPU is high” |
HPA |
| “Pods are requesting too much/too little CPU” |
VPA |
| “Pods are pending because no node has capacity” |
Cluster Autoscaler |
| “Need to scale based on Kafka queue depth” |
KEDA |
| “Need to scale to zero when no traffic” |
KEDA (HPA can’t scale to zero) |
Common mistake: Using HPA and VPA on the same metric — they conflict.
Mistake 6: Security Misconceptions
| Wrong |
Correct |
| “Base64 encoding in Secrets provides encryption” |
Base64 is encoding, not encryption — anyone can decode it |
| “Secrets are encrypted by default in K8s” |
Secrets are stored unencrypted in etcd by default — you must enable encryption at rest |
| “Container isolation equals VM-level isolation” |
Containers share the kernel — VMs provide stronger isolation |
“latest tag is fine for production” |
latest is mutable and not reproducible — use specific version tags |
Mistake 7: Observability Confusion
| Wrong |
Correct |
| “Monitoring and observability are the same” |
Monitoring checks known issues; observability helps understand unknown issues |
| “Prometheus pushes metrics from apps” |
Prometheus pulls (scrapes) metrics from targets |
| “OpenTelemetry is a monitoring tool” |
OpenTelemetry is a framework/standard for collecting telemetry data — it exports to tools like Prometheus, Jaeger |
| “SLA and SLO are the same” |
SLO = internal target; SLA = external contractual promise |
Mistake 8: Kubernetes Architecture
| Wrong |
Correct |
| “kubelet runs on the control plane” |
kubelet runs on worker nodes |
| “kube-proxy is the controller manager” |
kube-proxy handles network rules; controller manager runs control loops |
| “Pods and containers are the same thing” |
A pod can contain multiple containers |
| “etcd is a relational database” |
etcd is a distributed key-value store |
Mistake 9: Exam Technique Errors
| Mistake |
Better Approach |
| Spending 5+ minutes on one question |
Flag it and move on — come back later |
| Leaving questions blank |
Always guess — no penalty for wrong answers |
| Changing answers without a reason |
Trust your first instinct unless you’re sure |
| Running out of time |
Use the 60/80/90 strategy (first pass, review, final check) |
| Misreading “NOT” questions |
Underline/note keywords like NOT, EXCEPT, LEAST |
Quick Review: Most-Tested Facts
| Fact |
Value |
| Default Deployment strategy |
Rolling Update |
| Where cluster state is stored |
etcd |
| Prometheus collection model |
Pull (scrape) |
| CNCF maturity levels |
Sandbox → Incubating → Graduated |
| GitOps source of truth |
Git |
| HPA minimum replicas |
1 (cannot scale to zero) |
| KEDA minimum replicas |
0 (can scale to zero) |
| Kubernetes Secrets encoding |
Base64 (NOT encryption) |
| Container Runtime Interface |
CRI |
| Container Storage Interface |
CSI |
What’s Next?
Ready to test yourself? Take Mock Exam Part 1 covering Kubernetes Fundamentals and Container Orchestration.
Next: Mock Exam Part 1 →
