McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 2

Question 10

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The target namespace fulfillment is missing, and the team needs an owner label supply before workload creation. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject.
  2. The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore.
  3. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.
  4. A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Explanation

Correct Answer

D:

A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. This explains the stated condition. The corresponding action is: Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite. The direct acceptance evidence is: Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. It does not explain the facts described here, which follow from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

B:

This principle describes a separate cause: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The reported condition is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The two mechanisms should not be conflated.

C:

A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. That explanation applies to a different technical failure. Here the controlling principle is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Question 11

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The target namespace fulfillment is missing, and the team needs an owner label supply before workload creation. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist.
  2. Run kubectl describe node worker-c and inspect the Taints field for the intended key, value and effect.
  3. Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and expect yes.
  4. Run kubectl -n fulfillment get serviceaccount sync-bot and inspect the Deployment's serviceAccountName after binding it.

Explanation

Correct Answer

A:

Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The intended action is: Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite.

Incorrect Answers

B:

The alternative verifies a different condition: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The current case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Confirm that “Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist”.

C:

That test belongs to another control with this basis: A RoleBinding associates the service account subject with a Role inside the binding namespace. In the current case, the governing reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The direct verification is “Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist”.

D:

This observation would test a different technical dependency: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The current issue is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Its decisive check is “Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist”.

Question 12

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The target namespace fulfillment is missing, and the team needs an owner label supply before workload creation. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Require approval and periodic recertification for ClusterRoleBindings and group membership.
  2. Manage namespace creation and required labels through version-controlled bootstrap manifests.
  3. Review rendered diffs and pin bases to reproducible revisions before applying overlays.
  4. Document versioned release checkpoints and test rollbacks before production updates.

Explanation

Correct Answer

B:

Manage namespace creation and required labels through version-controlled bootstrap manifests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite. The relevant mechanism is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Here the sustained control must address: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Choose “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

C:

This routine guards against another mechanism: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. The recurring exposure in the current case is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The matching preventive check is “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

D:

The suggested review tracks a different technical risk: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. Here the sustained control must address: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Choose “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

Question 13

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The ledger namespace is consuming shared resources without a declared aggregate CPU request ceiling of 4. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger rollout status deployment/sample-operator and kubectl get crd samples.example.test.
  2. Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes.
  3. Run kubectl taint nodes worker-a special=dedicated:NoSchedule-.
  4. Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists.

Explanation

Correct Answer

D:

Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Validate the result with: Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. The case facts point instead to: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Implement “Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists” to address that specific condition.

B:

This alternative is a response to another technical cause: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The reported case instead depends on: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The action that directly addresses it is “Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists”.

C:

The proposed action belongs to the mechanism: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. Here the stated fault follows a different mechanism: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The corrective choice is “Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists”.

Question 14

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The ledger namespace is consuming shared resources without a declared aggregate CPU request ceiling of 4. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.
  2. Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there.
  3. Helm maintains release revisions and renders templates; an install-or-upgrade path avoids treating an existing release as a new deployment.
  4. Custom resources are reconciled only when their schemas are registered and the operator controller is healthy.

Explanation

Correct Answer

A:

A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. This explains the stated condition. The corresponding action is: Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists. The direct acceptance evidence is: Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests.

Incorrect Answers

B:

Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. That explanation applies to a different technical failure. Here the controlling principle is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

C:

The offered statement is true for this other mechanism: Helm maintains release revisions and renders templates; an install-or-upgrade path avoids treating an existing release as a new deployment. It does not explain the facts described here, which follow from: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

D:

This principle describes a separate cause: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. The reported condition is governed by: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The two mechanisms should not be conflated.

Question 15

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The ledger namespace is consuming shared resources without a declared aggregate CPU request ceiling of 4. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl auth can-i list pods -n ledger --as=system:serviceaccount:ledger:release-bot and expect yes.
  2. Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests.
  3. Run kubectl get node worker-a --show-labels and inspect workloads' node selectors.
  4. Run kubectl auth can-i list nodes --as=auditor --as-group=ops-observers using an authorized impersonation-capable admin context.

Explanation

Correct Answer

B:

Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The intended action is: Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists.

Incorrect Answers

A:

The alternative verifies a different condition: A RoleBinding associates the service account subject with a Role inside the binding namespace. The current case instead depends on: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Confirm that “Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests”.

C:

This observation would test a different technical dependency: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The current issue is governed by: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Its decisive check is “Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests”.

D:

The alternative verifies a different condition: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. The current case instead depends on: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Confirm that “Run kubectl -n ledger describe resourcequota invoice-api-cpu and compare hard and used CPU requests”.

Question 16

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The ledger namespace is consuming shared resources without a declared aggregate CPU request ceiling of 4. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Include schedulability restoration in maintenance completion checklists.
  2. Keep namespace-scoped read policies in version control and avoid wildcard verbs or resources.
  3. Review namespace quota headroom after material changes in workload size or tenancy.
  4. Use disruption budgets, replicated workloads and rollback plans before planned node drains.

Explanation

Correct Answer

C:

Review namespace quota headroom after material changes in workload size or tenancy. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists. The relevant mechanism is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

Incorrect Answers

A:

That safeguard is relevant to: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. The current failure instead follows from: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Its prevention measure is “Review namespace quota headroom after material changes in workload size or tenancy”.

B:

This routine guards against another mechanism: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The recurring exposure in the current case is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The matching preventive check is “Review namespace quota headroom after material changes in workload size or tenancy”.

D:

That safeguard is relevant to: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. The current failure instead follows from: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Its prevention measure is “Review namespace quota headroom after material changes in workload size or tenancy”.

Question 17

At Horizon observability, in a disposable simulated environment during a monitored release window: The observability namespace is consuming shared resources without a declared aggregate CPU request ceiling of 6. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists.
  2. Run kubectl cordon worker-b.
  3. Run kubectl taint nodes worker-b special=dedicated:NoSchedule-.
  4. Run kubectl apply --dry-run=server -f ./crds/metrics-api.yaml and review validation failures before any actual apply.

Explanation

Correct Answer

A:

Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Validate the result with: Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The proposed action belongs to the mechanism: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. Here the stated fault follows a different mechanism: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The corrective choice is “Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists”.

C:

The offered action targets: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. The case facts point instead to: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Implement “Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists” to address that specific condition.

D:

This alternative is a response to another technical cause: Server-side dry-run evaluates admission and resource schema without persisting the CRD when supported by the relevant admission stack. The reported case instead depends on: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The action that directly addresses it is “Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists”.

Question 18

At Horizon observability, in a disposable simulated environment during a monitored release window: The observability namespace is consuming shared resources without a declared aggregate CPU request ceiling of 6. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore.
  2. A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.
  3. Upgrade plan reports reachable upgrade targets and version skew considerations without applying a new control-plane version.
  4. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.

Explanation

Correct Answer

B:

A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. This explains the stated condition. The corresponding action is: Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists. The direct acceptance evidence is: Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests.

Incorrect Answers

A:

The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. That explanation applies to a different technical failure. Here the controlling principle is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

C:

This principle describes a separate cause: Upgrade plan reports reachable upgrade targets and version skew considerations without applying a new control-plane version. The reported condition is governed by: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The two mechanisms should not be conflated.

D:

A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. That explanation applies to a different technical failure. Here the controlling principle is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

Question 19

At Horizon observability, in a disposable simulated environment during a monitored release window: The observability namespace is consuming shared resources without a declared aggregate CPU request ceiling of 6. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist.
  2. Run kubectl get node worker-b --show-labels and inspect workloads' node selectors.
  3. Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests.
  4. Inspect the reported current and candidate versions, component compatibility and upgrade preflight warnings.

Explanation

Correct Answer

C:

Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The intended action is: Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists.

Incorrect Answers

A:

That test belongs to another control with this basis: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. In the current case, the governing reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The direct verification is “Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests”.

B:

This observation would test a different technical dependency: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The current issue is governed by: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Its decisive check is “Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests”.

D:

That test belongs to another control with this basis: Upgrade plan reports reachable upgrade targets and version skew considerations without applying a new control-plane version. In the current case, the governing reason is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The direct verification is “Run kubectl -n observability describe resourcequota metrics-api-cpu and compare hard and used CPU requests”.

Question 20

At Horizon observability, in a disposable simulated environment during a monitored release window: The observability namespace is consuming shared resources without a declared aggregate CPU request ceiling of 6. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Manage namespace creation and required labels through version-controlled bootstrap manifests.
  2. Reconcile taints with workload tolerations and document dedicated-node policies.
  3. Document versioned release checkpoints and test rollbacks before production updates.
  4. Review namespace quota headroom after material changes in workload size or tenancy.

Explanation

Correct Answer

D:

Review namespace quota headroom after material changes in workload size or tenancy. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability create quota metrics-api-cpu --hard=requests.cpu=6 after checking no conflicting quota exists. The relevant mechanism is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.

Incorrect Answers

A:

This routine guards against another mechanism: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The recurring exposure in the current case is: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The matching preventive check is “Review namespace quota headroom after material changes in workload size or tenancy”.

B:

The suggested review tracks a different technical risk: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. Here the sustained control must address: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Choose “Review namespace quota headroom after material changes in workload size or tenancy”.

C:

That safeguard is relevant to: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. The current failure instead follows from: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Its prevention measure is “Review namespace quota headroom after material changes in workload size or tenancy”.