Cluster Architecture, Installation and Configuration

Which control plane component is responsible for storing the cluster state and configuration?

An administrator creates a ServiceAccount named 'monitor' in the 'default' namespace. They want any pod using this ServiceAccount to be able to list pods cluster-wide. Which RBAC resource should be created and bound to this ServiceAccount?

You want to upgrade the control plane from v1.28.0 to v1.29.0 using kubeadm. After upgrading kubeadm on the control plane node, which command should you run first?

Which component runs on every node in a Kubernetes cluster and ensures containers are running in a pod?

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

An admin runs 'kubectl get pods' and sees a pod in 'Pending' state for a long time. 'kubectl describe pod' shows '0/1 nodes are available: 1 node has memory pressure'. Which is the most likely cause?

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

To make a node unschedulable without evicting existing pods, which command should be used?

Which TWO components are part of the Kubernetes control plane? (Select 2)

Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

Which command is used to take a snapshot of etcd using etcdctl?

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Which of the following is NOT a control plane component in Kubernetes?

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Which component is responsible for managing the network rules and forwarding on each node?

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

Which TWO components are part of the Kubernetes control plane? (Select two.)

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

Which component is responsible for managing the lifecycle of pods on a node?

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Which command allows you to view the current context in a kubeconfig file?

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Which control plane component stores the entire cluster state?

After upgrading the control plane using kubeadm, you need to update the kubelet configuration on the node. Which command should you run on the node?

You need to back up the etcd database for a kubeadm-created cluster. Which directory contains the etcd data?

Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?

Which TWO commands can be used to interact with etcd snapshot operations? (Select TWO.)

Which command initializes a new Kubernetes control plane node using kubeadm?

An administrator runs 'kubectl get nodes' and sees that a worker node is in the 'Ready,SchedulingDisabled' state. Which command was most likely executed on that node?

Which command is used to backup etcd data using etcdctl?

A developer needs to create a Role that allows listing pods in the 'dev' namespace. Which YAML snippet correctly defines this Role?

Which component is responsible for running containers on a node?

An admin wants to view the current context in their kubeconfig. Which command should they use?

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely cause?

Which kubectl command is used to drain a node before performing maintenance?

A ClusterRoleBinding grants cluster-admin access to a user. Which field in the ClusterRoleBinding specifies the user?

Which TWO of the following are control plane components? (Select 2)

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Which of the following is a core control plane component of Kubernetes?

You have a cluster with multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0 using kubeadm. What is the correct sequence of steps?

Which command is used to create a backup of etcd data using etcdctl?

You run 'kubectl get nodes' and see that one node is marked as 'NotReady'. Which component is likely failing on that node?

An administrator runs 'kubectl run test-pod --image=nginx' and the pod is created but stays in 'Pending' state. Which command would BEST help diagnose why the pod is not running?

Which of the following YAML snippets correctly defines a Kubernetes Deployment with 3 replicas and a rolling update strategy?

Which kubectl command is used to mark a node as unschedulable so that no new pods are scheduled onto it?

You have a kubeconfig file with multiple contexts. How do you switch to the context named 'prod-cluster'?

A user reports that they cannot access a Service of type ClusterIP from within the cluster. The Service selects pods that are running and responding. Which of the following is the MOST likely cause?

Which TWO of the following are valid methods to authenticate to the Kubernetes API server?

A CKA candidate runs 'kubectl get nodes' and sees that a worker node is in the 'NotReady' state. Which command should be used to diagnose the node's kubelet health?

An administrator needs to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which of the following steps is performed FIRST?

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

A developer is creating a Pod with a single container that should restart only if the process exits with non-zero. Which restartPolicy should be used?

A ServiceAccount 'monitor-sa' needs to be able to list Pods in namespace 'monitoring'. Which RBAC configuration is appropriate?

Which component is responsible for running containers on a Kubernetes node?

You need to drain a node 'node1' and ensure that pods are evicted gracefully. Which command should you use?

An administrator runs 'kubectl get pods' and sees a pod stuck in 'Pending' state. Which of the following is NOT a typical cause?

You have multiple kubeconfig files. Which command merges them into a single config file?

Which TWO of the following are valid methods to configure kubectl to use a specific context?

Which THREE components must be present in a high-availability control plane setup?

A Kubernetes cluster was upgraded from v1.28 to v1.29. After the upgrade, nodes report NotReady. You check kubelet logs and see: 'error: failed to run Kubelet: misconfiguration: kubelet cgroup driver: "systemd" is different from docker cgroup driver: "cgroupfs"'. What is the most likely cause?

You are setting up a new Kubernetes cluster using kubeadm. You run 'kubeadm init --pod-network-cidr=10.244.0.0/16' on the control plane node. The command fails with: '[preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running: output: time="..." level=fatal msg="validate service connection: CRI v1 runtime API is not implemented for endpoint 'unix:///var/run/containerd/containerd.sock': rpc error: code = Unimplemented desc = unknown service runtime.v1.RuntimeService'"'. What is the most likely cause?

Which kubectl command is used to view the current context in the kubeconfig file?

An administrator needs to allow a service account 'monitor-sa' in namespace 'monitoring' to read pods across all namespaces. Which RBAC resources should be created?

You are asked to backup the etcd database on a control plane node. The etcd is running as a static pod. Which command sequence will create a consistent snapshot?

Which component on a worker node is responsible for maintaining network rules and forwarding traffic to the correct pod?

A node has been cordoned. Which statement about the node is true?

You are upgrading a cluster from v1.28 to v1.29. You have already drained and upgraded all worker nodes. The control plane nodes have not been upgraded yet. 'kubectl get nodes' shows the control plane nodes are still v1.28. What is the correct next step?

Which of the following is NOT a control plane component?

You need to create a ServiceAccount named 'deployer' and grant it permission to create Deployments in namespace 'app'. Which YAML snippet correctly creates the necessary RBAC resources?

You need to check the expiration date of certificates used by the kube-apiserver. Which command should you use?

What is the purpose of the 'kubeadm reset' command?

Which TWO commands can be used to view the configuration of a kubeconfig file?

Which of the following is a core control plane component responsible for persisting cluster state?

An administrator runs 'kubectl get pods' and sees a pod in 'Pending' state. The output of 'kubectl describe pod pod-name' shows '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate'. What is the most likely cause?

You need to back up etcd on a single control plane node. Which command correctly creates a snapshot?

A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?

Which command is used to mark a node as unschedulable and evict its pods?

You have a kubeconfig file with multiple contexts. You want to temporarily switch to a different context for a single kubectl command. Which flag should you use?

Which component is responsible for running containers on a node and reporting their status to the control plane?

You initialize a cluster with 'kubeadm init' and want to join a worker node. What is the correct command to generate the join command?

You need to renew all certificates on a kubeadm-managed cluster. Which command accomplishes this?

Which TWO of the following are valid ways to create a Role in the 'default' namespace that grants get and list on pods?

Which TWO commands can be used to check the expiration of certificates managed by kubeadm?

Which command initializes a Kubernetes control plane node using kubeadm?

Which component is responsible for maintaining network rules on worker nodes?

A node named 'worker-1' is unhealthy. You want to mark it as unschedulable and move workloads to other nodes. Which command sequence is correct?

You need to back up etcd data for a cluster with etcd running as a static Pod. Which command should you use?

You run `kubectl get pods` and get an error: 'error: You must be logged in to the server (Unauthorized)'. What is the most likely cause?

You need to create a RoleBinding that grants a user access to read Pods in the 'dev' namespace. Which YAML manifest is correct?

You have configured a ServiceAccount with an associated image pull secret. The Pod referencing this ServiceAccount still fails with ImagePullBackOff due to authentication errors. What is the most likely misconfiguration?

To check the expiration date of all certificates managed by kubeadm, which command should you run?

A Pod is stuck in Pending state. Running 'kubectl describe pod' shows '0/3 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, 2 node(s) had taint {node-role.kubernetes.io/master: }'. The Pod does not have tolerations. What is the most likely cause?

Which kubeconfig context field defines the set of users, clusters, and namespaces for kubectl operations?

You need to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. After upgrading the control plane, what should you do on each worker node?

Which TWO of the following are responsibilities of the kube-controller-manager?

Which command is used to initialize a Kubernetes cluster using kubeadm?

A node in the cluster has been cordoned. Which of the following is true about the node?

You are upgrading a Kubernetes cluster from version 1.28 to 1.29. What is the correct order of steps?

Which component is responsible for maintaining network rules on each node?

What is the default port for the Kubernetes API server?

Which command is used to check the expiration of certificates managed by kubeadm?

A developer needs to access the Kubernetes API from a pod using a ServiceAccount. Which of the following is the recommended way to mount the ServiceAccount token into a pod?

Which subcommand of 'kubectl config' is used to switch between different contexts?

Which component is responsible for assigning pods to nodes?

To back up etcd, which command should be used with etcdctl?

What is the purpose of 'kubeadm reset'?

Which TWO of the following are control plane components?

Which command is used to take a snapshot of etcd data for backup?

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

You are using kubeadm to initialize a cluster. After running 'kubeadm init', you follow the instructions to set up the kubeconfig for the regular user. Which of the following commands should you run to allow kubectl to communicate with the cluster?

What is the purpose of the kube-proxy component in a Kubernetes cluster?

You are troubleshooting a pod that is in 'Pending' state. Running 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate.' What is the most likely cause?

Which command can you use to check the expiration date of certificates managed by kubeadm?

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

What is the function of the 'kube-scheduler' in Kubernetes?

Which THREE of the following are components of the Kubernetes control plane? (Choose THREE.)

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Which command correctly backs up etcd data using etcdctl with API version 3?

A new Kubernetes administrator runs 'kubeadm join --token <token> <control-plane-ip>:6443 --discovery-token-ca-cert-hash sha256:<hash>' on a worker node. The join fails with 'error execution phase preflight: couldn't validate the identity of the API Server'. What is the most likely cause?

Which component is responsible for maintaining network rules on each worker node to enable service discovery and load balancing?

An administrator runs 'kubectl cordon node1' and then 'kubectl drain node1 --ignore-daemonsets'. What is the effect on node1?

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate'. What does this indicate?

Which command displays the expiration date of all certificates managed by kubeadm?

A cluster has multiple kubeconfig files. You want to set the current context to 'admin@production' for all future kubectl commands. Which command should you run?

During a cluster upgrade, what is the correct order of operations for upgrading a node?

Which component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of replicas for a Deployment?

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

A developer created a ServiceAccount named 'app-sa' in the 'dev' namespace. They want a pod to use this ServiceAccount. Which field in the pod spec should be set?

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

Which kubeconfig context is currently active?

What is the purpose of the kube-proxy component?

Which command initializes a new Kubernetes cluster using kubeadm?

Which TWO components run on worker nodes? (Select 2)

Which TWO are true about taints and tolerations? (Select 2)

You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?

Which TWO components are part of the Kubernetes control plane? (Choose TWO.)

You have taken an etcd snapshot using 'ETCDCTL_API=3 etcdctl snapshot save snapshot.db'. Which TWO commands are needed to restore this snapshot to a new etcd member? (Choose TWO.)

You are applying the following RBAC manifest: --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: development name: pod-reader rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch", "list"] Which TWO statements are true about this Role? (Choose TWO.)

Your cluster has three control plane nodes. You suspect the etcd cluster has a leader election issue. Which TWO commands can help diagnose the etcd cluster health and membership? (Choose TWO.)

Which THREE components run on every worker node in a Kubernetes cluster? (Choose THREE.)

You need to grant a ServiceAccount named 'monitor-sa' in namespace 'monitoring' the ability to read Pods and Services across all namespaces. Which TWO resources are needed? (Choose TWO.)

You run 'kubectl cordon node1'. Which TWO statements describe the effect of this command? (Choose TWO.)

You need to create a Kubernetes ServiceAccount named 'build-bot' and ensure that pods using this ServiceAccount can authenticate to the Kubernetes API using a long-lived token. Which TWO steps are necessary? (Choose TWO.)

You have a multi-node Kubernetes cluster. After upgrading the kubelet on a worker node, the node remains in 'NotReady' state. Which TWO actions should you take to troubleshoot? (Choose TWO.)

You have a ClusterRole named 'deployer' that allows creating Deployments and Services. You want to grant a ServiceAccount 'ci-cd' in namespace 'app' the permissions defined in this ClusterRole. Which TWO resources are needed? (Choose TWO.)

Your kubeadm cluster was initialized with default certificates. You need to check the expiration of the API server certificate and renew it if necessary. Which TWO commands are appropriate? (Choose TWO.)

You are the administrator of a cluster that uses an external etcd cluster. The kube-apiserver manifest on the control-plane node contains the flag `--etcd-servers=https://10.0.0.5:2379`. You need to add a second etcd endpoint at `https://10.0.0.6:2379` to increase availability. Where should you make this change?