CKA Practice Test 10 — 10 Questions

Question 1

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Accepted Answer

kubeadm certs check-expiration. Option D is correct because `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.

Answer

kubeadm upgrade plan --certificate-expiration

Answer

kubectl config view --raw | grep client-certificate

Answer

openssl x509 -in /etc/kubernetes/admin.conf -text -noout

Question 2

You want to upgrade the control plane from v1.28.0 to v1.29.0 using kubeadm. After upgrading kubeadm on the control plane node, which command should you run first?

Accepted Answer

kubeadm upgrade plan. After upgrading kubeadm on the control plane node, the first command to run is `kubeadm upgrade plan`. This command checks the current cluster version, validates that the upgrade path is supported (e.g., from v1.28.0 to v1.29.0), and displays the available versions to upgrade to, along with any manual steps required. It is a prerequisite to ensure the upgrade is safe before proceeding with `kubeadm upgrade apply`.

Answer

kubeadm upgrade apply v1.29.0

Answer

kubeadm upgrade node

Answer

kubeadm upgrade diff

Question 3

Which component is responsible for managing the lifecycle of pods on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a pod as expected, managing the pod lifecycle by communicating with the container runtime (e.g., containerd or CRI-O) and reporting the node and pod status back to the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-proxy

Question 4

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

Accepted Answer

kubectl cordon <node-name>. The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

Answer

kubectl uncordon <node-name>

Answer

kubectl drain <node-name>

Answer

kubectl taint nodes <node-name> key=value:NoSchedule

Question 5

Which command is used to backup etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save. Option C is correct because `etcdctl snapshot save` is the official command in etcdctl v3 to create a point-in-time backup of the etcd data store. This command captures the entire key-value store and metadata into a snapshot file, which can later be restored using `etcdctl snapshot restore` to recover the cluster state.

Answer

etcdctl backup

Answer

etcdctl export

Answer

etcdctl dump

Question 6

A cluster was upgraded from v1.28 to v1.29 using kubeadm. After upgrading the control plane, nodes remain at v1.28. What is the correct next step to upgrade a worker node?

Accepted Answer

SSH into the worker node and run 'kubeadm upgrade node', then upgrade kubelet and kubectl, then restart kubelet.. Option B is correct because after upgrading the control plane with kubeadm, worker nodes must be upgraded individually. The correct sequence is to SSH into the worker node, run 'kubeadm upgrade node' to upgrade the kubelet configuration and static pod manifests, then upgrade the kubelet and kubectl binaries (typically via the package manager), and finally restart the kubelet to pick up the new version. This ensures the node runs the same Kubernetes version as the control plane.

Answer

Drain the node, then run 'kubeadm upgrade node' on the worker node.

Answer

Upgrade kubelet on the worker node using the package manager and restart kubelet.

Answer

Run 'kubeadm upgrade apply' on the worker node.

Question 7

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

Accepted Answer

Client certificates. Client certificates are a valid authentication method for the Kubernetes API server. The API server can be configured with the `--client-ca-file` flag to trust a Certificate Authority (CA), and then clients present a TLS certificate signed by that CA to authenticate. This is a common and secure method for user and component authentication.

Answer

Username and password

Answer

SSH keys

Question 8

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

Accepted Answer

Upgrade the first control plane node, then upgrade the remaining control plane nodes, then upgrade worker nodes.. Option B is correct because the recommended upgrade order for a kubeadm-managed cluster is to upgrade the first control plane node (using `kubeadm upgrade apply`), then the remaining control plane nodes (using `kubeadm upgrade node`), and finally the worker nodes. This ensures the cluster's control plane components (etcd, kube-apiserver, kube-controller-manager, kube-scheduler) are updated first, maintaining cluster stability and API server availability during the process.

Answer

Upgrade all worker nodes first, then upgrade the control plane nodes.

Answer

Upgrade all nodes simultaneously by running kubeadm upgrade apply on all nodes at once.

Answer

Upgrade worker nodes, then upgrade the control plane nodes, then drain the worker nodes.

Question 9

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Option C is correct because etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 10

A cluster is running etcd without TLS. The admin wants to take a snapshot backup. Which command is correct?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Option B is correct because `ETCDCTL_API=3 etcdctl snapshot save` is the proper command to take a snapshot backup of an etcd cluster using the v3 API. Since the cluster is running without TLS, the command does not require additional flags like `--cacert` or `--cert`, but the default endpoint is `http://127.0.0.1:2379`, which is used implicitly. The v3 API is required because etcd v3 stores data in a different format than v2, and `snapshot save` captures the full key-value store for disaster recovery.

Answer

etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl export --data-dir /var/lib/etcd

Answer

etcdctl snapshot save --endpoints=http://127.0.0.1:2379 /backup/snapshot.db