CKA Practice Test 13 — 15 Questions

Question 1

You are applying the following RBAC manifest:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Which TWO statements are true about this Role? (Choose TWO.)

Accepted Answer

It allows reading pod details in the 'development' namespace. Option B is correct because the Role explicitly defines rules for the 'pods' resource with verbs 'get', 'watch', and 'list' in the 'development' namespace. These verbs allow reading pod details such as their specifications, status, and metadata. The Role is scoped to the 'development' namespace, so it only grants these read permissions within that namespace.

Answer

It also grants access to secrets in the 'development' namespace

Answer

It grants permissions across all namespaces

Answer

It allows creating pods in the 'development' namespace

Question 2

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

Accepted Answer

Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon. The upgrade procedure requires upgrading the control plane first, then draining and upgrading each worker node. Draining a node before upgrading ensures that pods are rescheduled gracefully.

Answer

Upgrade all worker nodes first, then upgrade the control plane

Answer

Drain all nodes simultaneously, upgrade the control plane, then upgrade worker nodes

Answer

Upgrade the control plane and worker nodes at the same time

Question 3

Which command displays the expiration date of all certificates managed by kubeadm?

Accepted Answer

kubeadm certs check-expiration. Option A is correct because `kubeadm certs check-expiration` is the dedicated command in kubeadm v1.15+ that inspects the expiration dates of all certificates managed by kubeadm, including those for the API server, kubelet, and etcd. It reads certificate files from `/etc/kubernetes/pki/` and displays their remaining validity period in a human-readable table.

Answer

kubeadm alpha certs check-expiration

Answer

kubeadm certs list

Answer

kubectl get certificates

Question 4

Which TWO commands are used to set the current context in kubeconfig? (Choose TWO.)

Accepted Answer

kubectl config use-context . Option B is correct because `kubectl config use-context ` is the explicit command to switch the current context in your kubeconfig file. Option C is correct because the kubeconfig file is a YAML file that contains a `current-context` field; manually editing this field to the desired context name achieves the same result as the command.

Answer

kubectl config current-context

Answer

kubectl set-context <context-name>

Answer

kubectl config get-contexts

Question 5

Which TWO are true about taints and tolerations? (Select 2)

Accepted Answer

A node can have multiple taints. Option B is correct because a node can indeed have multiple taints applied to it, each with different effects (NoSchedule, PreferNoSchedule, or NoExecute). This allows fine-grained control over pod placement, such as dedicating nodes for specific workloads or isolating sensitive pods. Option E is correct because tolerations are applied to pods and allow them to be scheduled on nodes that have matching taints, effectively overriding the taint's restriction.

Answer

Taints prevent all pods from scheduling on a node

Answer

Taints are applied to pods

Answer

Tolerations are set on nodes

Question 6

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Option D is correct because etcd v3 is the default and supported version in Kubernetes v1.29, and the `ETCDCTL_API=3` environment variable ensures the etcdctl client uses the v3 API, which provides the `snapshot save` command for creating consistent backups. The command `ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db` correctly captures a point-in-time snapshot of the etcd data store, which is essential for disaster recovery.

Answer

kubectl etcd snapshot save /backup/snapshot.db

Answer

etcdctl backup /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl snapshot save /backup/snapshot.db

Question 7

You have a ClusterRole named 'deployer' that allows creating Deployments and Services. You want to grant a ServiceAccount 'ci-cd' in namespace 'app' the permissions defined in this ClusterRole. Which TWO resources are needed? (Choose TWO.)

Accepted Answer

The existing ClusterRole 'deployer'. Option A is correct because the ClusterRole 'deployer' already contains the necessary rules to allow creating Deployments and Services. You do not need to create a new ClusterRole; you can reuse the existing one. Option C is correct because a RoleBinding in namespace 'app' can reference a ClusterRole and bind it to a ServiceAccount within that namespace, granting the permissions only in that namespace. This is the standard method to grant cluster-scoped permissions to a namespaced subject.

Answer

Create a new ClusterRole with the same rules

Answer

ClusterRoleBinding with subject ServiceAccount 'ci-cd' in namespace 'app'

Answer

A Secret for the ServiceAccount

Question 8

A ClusterRole named 'pod-reader' grants get, list, watch on pods. You want to bind it to a user 'john' cluster-wide. Which resource should you create?

Accepted Answer

ClusterRoleBinding. A ClusterRoleBinding is the correct resource because it grants cluster-wide permissions to a user. While a ClusterRole defines the permissions (get, list, watch on pods), a ClusterRoleBinding binds that ClusterRole to a subject (user 'john') across all namespaces. This is the only way to achieve cluster-scoped authorization in Kubernetes RBAC.

Answer

Role

Answer

RoleBinding in default namespace

Answer

ClusterRole

Question 9

Which command is used to prevent a node from being scheduled with new pods?

Accepted Answer

kubectl cordon . The `kubectl cordon ` command marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the standard Kubernetes command for this purpose, directly setting the `spec.unschedulable` field to `true` on the node object.

Answer

kubectl taint <node> key=value:NoSchedule

Answer

kubectl patch node <node> -p '{"spec":{"unschedulable":true}}'

Answer

kubectl drain <node>

Question 10

Your cluster has three control plane nodes. You suspect the etcd cluster has a leader election issue. Which TWO commands can help diagnose the etcd cluster health and membership? (Choose TWO.)

Accepted Answer

etcdctl endpoint health --cluster. Option C is correct because `etcdctl endpoint health --cluster` queries the health status of all etcd endpoints in the cluster, which directly reveals if any node is unreachable or unhealthy—a common symptom of leader election issues. Option E is correct because `etcdctl member list` displays the current cluster membership, including each member's ID, name, peer URLs, and client URLs, allowing you to verify that all expected control plane nodes are properly joined and that no split-brain or quorum loss has occurred.

Answer

etcdctl cluster-status

Answer

etcdctl version

Answer

etcdctl snapshot save snapshot.db

Question 11

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

Accepted Answer

kubeadm certs renew apiserver. Option B is correct because `kubeadm certs renew apiserver` is the standard command in modern kubeadm (v1.15+) to renew a specific certificate without affecting others. It regenerates the apiserver certificate using the existing CA key, updating the expiration date while keeping the same Subject and SANs.

Answer

kubeadm alpha certs renew apiserver

Answer

kubeadm init phase certs apiserver --renew

Answer

kubectl create certificate apiserver

Question 12

Your kubeadm cluster was initialized with default certificates. You need to check the expiration of the API server certificate and renew it if necessary. Which TWO commands are appropriate? (Choose TWO.)

Accepted Answer

kubeadm certs renew all. Option A is correct because `kubeadm certs renew all` renews all PKI certificates in the cluster, including the API server certificate, without requiring a full cluster reinitialization. Option B is correct because `kubeadm certs check-expiration` displays the expiration dates of all certificates managed by kubeadm, allowing you to verify the API server certificate's expiry before deciding to renew.

Answer

kubectl config view

Answer

kubeadm upgrade plan

Answer

kubectl cluster-info

Question 13

A Deployment named 'app' has 3 replicas. The rolling update strategy is set with maxSurge=1 and maxUnavailable=1. During an update, a new ReplicaSet is created. How many pods will be in terminating state at the moment when the new ReplicaSet has 2 pods ready?

Accepted Answer

1. Option C is correct because with maxSurge=1 and maxUnavailable=1, the Deployment controller ensures that during a rolling update, the total number of pods across old and new ReplicaSets does not exceed desiredReplicas + maxSurge (3+1=4). When the new ReplicaSet has 2 pods ready, the controller will begin terminating old pods to bring the total down. At that exact moment, exactly 1 old pod will be in Terminating state, as the controller scales down the old ReplicaSet by 1 to maintain the surge limit.

Answer

3

Answer

0

Answer

2

Question 14

Which TWO statements about Kubernetes resource requests and limits are correct? (Select 2)

Accepted Answer

Limits can be set independently for CPU and memory.. Option A is correct because Kubernetes allows CPU and memory limits to be set independently via the `resources.limits` field in a container spec. CPU limits are defined in millicores (e.g., 500m) and memory limits in bytes (e.g., 256Mi), and they are not coupled — you can set a CPU limit without a memory limit and vice versa. This independence gives administrators fine-grained control over resource allocation per container.

Answer

Memory requests and limits are both compressible.

Answer

If a container exceeds its memory limit, it is throttled.

Answer

If no limits are specified, the pod can use unlimited resources.

Question 15

You have a Pod that needs to run a database migration before the main application container starts. Which Kubernetes concept should you use?

Accepted Answer

Init container. Init containers are designed to run to completion before the main application containers start, making them the ideal Kubernetes primitive for tasks like database migrations that must complete before the primary service begins. Unlike sidecars, init containers do not run concurrently with the main container, ensuring the migration finishes before the application container starts.

Answer

Sidecar container

Answer

PostStart hook

Answer

Job