CKA Practice Test 14 — 15 Questions

Question 1

You want to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates a ClusterIP Service?

Accepted Answer

kubectl expose deployment web --port=80 --type=ClusterIP. `kubectl expose deployment web --port=80 --type=ClusterIP` creates a ClusterIP Service that exposes the Deployment named 'web' on port 80 internally within the cluster. The `--type=ClusterIP` is the default service type, making this command explicitly create a ClusterIP Service, which is only reachable from inside the Kubernetes cluster.

Answer

kubectl create deployment web --image=nginx --port=80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80

Question 2

Drag and drop the steps to troubleshoot a Node that is in NotReady state into the correct order.

Accepted Answer

Use kubectl to identify the node, SSH into the node, check kubelet and container runtime status, review logs, restart kubelet and/or container runtime. Start with kubectl to identify the node, then SSH, check kubelet and runtime, review logs, then restart.

Answer

SSH into the node, use kubectl to identify the node, check kubelet and container runtime, review logs, restart

Answer

Use kubectl to identify the node, SSH into the node, review logs, check kubelet and container runtime, restart

Answer

Use kubectl to identify the node, SSH into the node, restart kubelet and container runtime, check status, review logs

Question 3

You attempt to schedule a pod but it remains 'Pending'. 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) didn't match node selector.' What is the MOST likely cause?

Accepted Answer

The pod's nodeSelector does not match any node labels. The error '0/3 nodes are available: 3 node(s) didn't match node selector' directly indicates that the pod has a nodeSelector that does not match any node's labels. Option A (PVC not bound) would show a different error like 'persistentvolumeclaim not found'. Option B (insufficient resources) would show 'Insufficient memory/cpu'. Option C (taints not tolerated) would show 'node(s) had taints'. Therefore, the most likely cause is that the pod's nodeSelector does not match any node labels, which is Option D.

Answer

A PersistentVolumeClaim is not bound

Answer

All nodes have insufficient memory or CPU

Answer

The nodes have taints that the pod does not tolerate

Question 4

A pod is in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 1 node(s) had taint that the pod didn't tolerate, 2 node(s) didn't match pod's node affinity/selector, 1 node(s) had insufficient memory'. What does this indicate?

Accepted Answer

The pod is unschedulable due to multiple constraints. The 'Pending' state combined with the scheduler's message '0/4 nodes are available' and the listed reasons (taints, node affinity/selector mismatches, insufficient memory) indicates that the pod cannot be placed on any node due to multiple constraints. The scheduler evaluates all nodes and finds none that satisfy the pod's requirements, making the pod unschedulable. This is not a transient resource issue but a combination of scheduling constraints that must be resolved manually.

Answer

The pod's image pull failed on all nodes

Answer

The pod will eventually be scheduled when resources free up

Answer

The pod has a resource limit that prevents it from running

Question 5

Which TWO of the following are valid reclaim policies for a PersistentVolume?

Accepted Answer

Retain. The `Retain` reclaim policy is one of the three valid policies for a PersistentVolume in Kubernetes. When a PersistentVolumeClaim is deleted, a PV with `Retain` policy will not be automatically reclaimed; instead, the volume remains in a `Released` state, preserving its data for manual administrator intervention.

Answer

Snapshot

Answer

Reuse

Answer

Archive

Question 6

Which TWO statements are correct regarding DaemonSets?

Accepted Answer

DaemonSets are often used for cluster monitoring or logging agents.. DaemonSets are designed to run a copy of a pod on every node (or a subset of nodes based on node selectors), making them ideal for cluster-wide infrastructure services such as monitoring agents (e.g., Prometheus Node Exporter), logging agents (e.g., Fluentd), and network plugins (e.g., Calico). This pattern ensures that each node has the necessary agent running without manual intervention.

Answer

DaemonSets do not support rolling updates.

Answer

DaemonSets can be scaled up and down using kubectl scale.

Answer

DaemonSets use a replica count to determine how many pods to run.

Question 7

An administrator is tasked with setting up a new Kubernetes cluster using kubeadm. They have two nodes: one control plane and one worker. After initializing the control plane with 'kubeadm init', the worker node fails to join with the error 'error execution phase preflight: [preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running'. What should the administrator check first?

Accepted Answer

Ensure that containerd is installed and running on the worker node.. The error 'container runtime is not running' on the worker node indicates that the CRI (Container Runtime Interface) implementation, typically containerd, is not active. Since kubelet relies on a running container runtime to manage pods, the administrator must first check that containerd is installed and running on the worker node using commands like 'systemctl status containerd' or 'systemctl start containerd'.

Answer

Verify that the control plane node is healthy.

Answer

Check if the join token has expired.

Answer

Install a network plugin like Calico on the control plane.

Question 8

An administrator notices that traffic to a Service is not being forwarded to any pod. The Service has selector 'app: web' and there are pods with that label. However, 'kubectl get endpoints' shows no endpoints. What is the most likely cause?

Accepted Answer

The pods are not in Ready state (e.g., failing readiness probes).. The most likely cause is that the pods are not in Ready state, often due to failing readiness probes. Kubernetes endpoints are only populated for pods that pass their readiness checks; if a pod is not Ready, it is removed from the Service's endpoint list, even if it is running and has the correct labels.

Answer

The Service port name does not match the container port name.

Answer

The Service type is ClusterIP.

Answer

The Service targetPort is not specified.

Question 9

You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?

Accepted Answer

mkdir -p $HOME/.kube && sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config. After running 'kubeadm init', the admin kubeconfig file is generated at /etc/kubernetes/admin.conf. To use kubectl as a regular (non-root) user, you must copy this file to the user's $HOME/.kube/config directory and then change its ownership to the current user. This ensures kubectl can authenticate to the cluster using the admin certificate and key embedded in the config file.

Answer

sudo kubeadm reset --force

Answer

sudo cp /etc/kubernetes/admin.conf /root/.kube/config

Answer

sudo cp /etc/kubernetes/pki/admin.conf $HOME/.kube/config

Question 10

Which TWO of the following are valid commands to check the status of control plane components?

Accepted Answer

systemctl status kube-apiserver. `systemctl status kube-apiserver` directly queries the systemd service manager for the status of the kube-apiserver process, which is a core control plane component. Option C is correct because `kubectl get pods -n kube-system` lists all pods in the kube-system namespace, which includes control plane components like etcd, kube-scheduler, and kube-controller-manager when they run as static pods or Deployments. Both commands provide direct visibility into the health of control plane components.

Answer

kubectl get nodes

Answer

kubectl get events --all-namespaces

Answer

kubectl top nodes

Question 11

You have a Deployment with 3 replicas. One of the pods is in 'Pending' state. 'kubectl describe pod' shows: 'Warning FailedScheduling 0/4 nodes are available: 1 node(s) had taint {key1: value1}, that the pod didn't tolerate, 3 node(s) didn't match pod anti-affinity rules.' Which two issues are preventing the pod from being scheduled?

Accepted Answer

Taint toleration mismatch and pod anti-affinity conflicts. The error message explicitly states two distinct scheduling failures: '1 node(s) had taint {key1: value1}, that the pod didn't tolerate' and '3 node(s) didn't match pod anti-affinity rules.' These correspond directly to a taint toleration mismatch and pod anti-affinity conflicts. No other issues (node selector, resource constraints) are mentioned in the describe output.

Answer

Pod anti-affinity and node selector issues

Answer

Node selector and taint toleration mismatch

Answer

Resource constraints and taint toleration mismatch

Question 12

Which command can you run to see the events related to a specific pod?

Accepted Answer

kubectl describe pod pod-name. `kubectl describe pod pod-name` includes a dedicated 'Events' section that lists all lifecycle events for that specific pod, such as scheduling, container pulls, and restarts. This command filters events to only those relevant to the pod, making it the most direct way to view pod-specific events without needing to parse all cluster events.

Answer

kubectl logs pod-name

Answer

kubectl get pod pod-name

Answer

kubectl get events

Question 13

What is the default kube-proxy mode in modern Kubernetes clusters?

Accepted Answer

iptables. In modern Kubernetes clusters (v1.30+), the default kube-proxy mode is `iptables`. This mode uses Linux Netfilter rules to intercept and redirect traffic to backend pods, offering better performance and scalability than the legacy `userspace` mode while remaining the default for broad compatibility across distributions.

Answer

kernelspace

Answer

userspace

Answer

ipvs

Question 14

You are debugging a Pod that is in 'Pending' state. The output of 'kubectl describe pod' shows: Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning FailedScheduling 2m default-scheduler 0/3 nodes are available: 1 Insufficient cpu, 2 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate. What does this indicate?

Accepted Answer

The pod cannot be scheduled due to a combination of insufficient CPU and untolerated taints on different nodes. The event message explicitly states that 0/3 nodes are available due to two distinct issues: one node has insufficient CPU, and two nodes have a taint (node-role.kubernetes.io/master) that the pod does not tolerate. This means no single node satisfies all scheduling requirements, so the pod remains Pending. Option B correctly identifies that the scheduling failure is caused by a combination of resource insufficiency and untolerated taints across different nodes, not a single global problem.

Answer

The pod requires more memory than any node can provide

Answer

All nodes have taints that the pod does not tolerate

Answer

All nodes have insufficient CPU resources for the pod

Question 15

You need to check the logs of a kubelet on a node. Which command should you run on the node?

Accepted Answer

journalctl -u kubelet. The correct command to view kubelet logs on a systemd-based node is 'journalctl -u kubelet'. Option D is correct. Option A ('journalctl -u docker') shows Docker daemon logs, not kubelet. Option B ('dmesg') displays kernel ring buffer messages. Option C ('tail -f /var/log/apache2/access.log') shows Apache web server logs.

Answer

journalctl -u docker

Answer

dmesg

Answer

tail -f /var/log/apache2/access.log