CKA Practice Test 10 — 10 Questions

Question 1

Which access mode allows multiple pods on different nodes to mount a PersistentVolume as read-write?

Accepted Answer

ReadWriteMany (RWX). ReadWriteMany (RWX) is the only access mode that allows multiple pods across different nodes to mount a PersistentVolume as read-write simultaneously. This is achieved through shared filesystem protocols such as NFS, GlusterFS, or CephFS, which support concurrent access from multiple clients. The RWX mode is essential for workloads like clustered databases or shared storage applications where multiple instances need to write to the same volume.

Answer

ReadWriteOncePod (RWOP)

Answer

ReadWriteOnce (RWO)

Answer

ReadOnlyMany (ROX)

Question 2

You are troubleshooting a DNS issue. From within a pod, you run 'nslookup kubernetes.default.svc.cluster.local' and get 'connection timed out; no servers could be reached'. What is the most likely cause?

Accepted Answer

The kube-dns service is not running or is misconfigured. The error 'connection timed out; no servers could be reached' from nslookup indicates that the DNS resolver (typically the kube-dns or CoreDNS service) is unreachable. Since the query targets the standard Kubernetes service name 'kubernetes.default.svc.cluster.local', the most likely cause is that the kube-dns service (or its backend pods) is not running or is misconfigured, preventing the pod from resolving cluster-internal DNS names.

Answer

The pod's /etc/resolv.conf has incorrect nameservers

Answer

The node's network plugin is misconfigured

Answer

The pod's DNS policy is set to 'None'

Question 3

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

Accepted Answer

NetworkPolicy egress rules deny all traffic by default unless explicitly allowed. NetworkPolicy in Kubernetes follows a default-deny model for traffic. When any egress rule is added to a NetworkPolicy, it implicitly denies all egress traffic that is not explicitly allowed by that rule. Therefore, if the egress rule does not include a rule allowing traffic to external IPs (e.g., via an IPBlock or a namespace selector), those destinations become unreachable. This is by design, as NetworkPolicies are additive whitelists.

Answer

The egress rule has a typo in the IP block

Answer

The pods are not running

Answer

The CNI plugin does not support egress rules

Question 4

You create a ConfigMap named 'app-config' with key 'database.url'. Which command correctly creates a pod that injects this ConfigMap value as an environment variable named 'DB_URL'?

Accepted Answer

Create a pod YAML with env.valueFrom.configMapKeyRef. To inject a specific key from a ConfigMap as a pod environment variable with a custom name, you must use a pod YAML with `env.valueFrom.configMapKeyRef`. This allows you to reference the ConfigMap key `database.url` and map it to the environment variable `DB_URL`. The `kubectl run` command does not support directly mapping a ConfigMap key to a custom environment variable name in a single command.

Answer

kubectl run my-pod --image=nginx --envFrom=configmap/app-config

Answer

kubectl run my-pod --image=nginx --env="DB_URL=configmap:app-config:database.url"

Answer

kubectl run my-pod --image=nginx --from-configmap=app-config

Question 5

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

Accepted Answer

The endpoint flag is missing or incorrect, causing the client to timeout trying to connect. The error 'context deadline exceeded' indicates that the etcdctl client attempted to connect to the etcd endpoint but the request timed out before a connection could be established. This is most commonly caused by the --endpoints flag being omitted or pointing to an incorrect address (e.g., localhost:2379 instead of the actual etcd listener), so the client cannot reach the etcd server within the default timeout period.

Answer

The etcdctl version is incompatible with etcd

Answer

The etcd cluster is not running

Answer

The snapshot file already exists and is locked

Question 6

Which reclaim policy will cause the underlying storage to be deleted when the associated PersistentVolume is released from a PersistentVolumeClaim?

Accepted Answer

Delete. The Delete reclaim policy instructs the system to remove the underlying storage asset (e.g., an AWS EBS volume, GCE Persistent Disk, or NFS export) when the PersistentVolume is released from a PersistentVolumeClaim. This is the only policy that automatically cleans up the physical storage, ensuring no orphaned resources remain.

Answer

Recycle

Answer

Retain

Answer

Archive

Question 7

You are troubleshooting a pod that cannot start. Running 'kubectl describe pod' shows the event: 'Failed to pull image "myregistry.io/myapp:1.0": rpc error: code = Unknown desc = Error response from daemon: manifest for myregistry.io/myapp:1.0 not found'. What is the MOST likely cause?

Accepted Answer

The image tag '1.0' does not exist in the registry. The error message 'manifest for myregistry.io/myapp:1.0 not found' indicates that the registry successfully received the pull request but could not locate the specific image tag '1.0'. This is a manifest lookup failure, not a connectivity or authentication issue. The most likely cause is that the tag '1.0' does not exist in the repository, either because it was never pushed or was removed.

Answer

The registry is unreachable due to network issues

Answer

The image registry requires authentication and the imagePullSecret is missing

Answer

The image has been deleted from the registry

Question 8

You run `kubectl get pods` and get an error: 'error: You must be logged in to the server (Unauthorized)'. What is the most likely cause?

Accepted Answer

The kubeconfig file is missing or invalid.. The error 'You must be logged in to the server (Unauthorized)' indicates that the kubectl client successfully reached the API server, but the request was rejected because the client's credentials (typically from the kubeconfig file) are missing, expired, or invalid. The kubeconfig file contains the cluster, user, and context information required for authentication; if it is misconfigured or not present, kubectl cannot authenticate and returns this specific HTTP 401 Unauthorized error.

Answer

The API server is not running.

Answer

The pod does not exist.

Answer

The namespace does not exist.

Question 9

You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?

Accepted Answer

kubectl port-forward svc/my-service 8080:80. `kubectl port-forward svc/my-service 8080:80` creates a local TCP tunnel from port 8080 on your workstation to port 80 on a pod selected by the Service `my-service`. This allows you to reach the Service's backend pod directly without exposing it externally, which is a standard debugging technique for testing connectivity to a Service that appears unreachable.

Answer

kubectl expose deployment my-deployment --type=NodePort

Answer

kubectl exec -it my-pod -- curl localhost:80

Answer

kubectl proxy

Question 10

A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?

Accepted Answer

RoleBinding 'john-pod-reader' in namespace 'development' referencing ClusterRole 'pod-reader' and user 'john'. A RoleBinding in a specific namespace can reference a ClusterRole to grant its permissions only within that namespace. Since the requirement is to bind the existing 'pod-reader' ClusterRole to user 'john' exclusively in the 'development' namespace, a RoleBinding named 'john-pod-reader' in the 'development' namespace is the correct resource. This allows the ClusterRole's pod read permissions to be scoped down to a single namespace.

Answer

Add user 'john' to the 'pod-reader' ClusterRole definition

Answer

Role 'pod-reader' in namespace 'development'

Answer

ClusterRoleBinding 'john-pod-reader' binding 'pod-reader' to user 'john'