CKA Practice Test 15 — 15 Questions

Question 1

Which kubectl command is used to view the logs of a container that has previously crashed in a pod?

Accepted Answer

kubectl logs pod-name --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has crashed and been restarted. This is essential for debugging crash loops, as the current container may have no logs or only startup logs, while the crashed container's logs contain the error.

Answer

kubectl logs pod-name -c container-name --tail=100

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name

Question 2

You attempt to schedule a pod but it remains 'Pending'. 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) didn't match node selector.' What is the MOST likely cause?

Accepted Answer

The pod's nodeSelector does not match any node labels. The event '0/3 nodes are available: 3 node(s) didn't match node selector' explicitly indicates that the pod's nodeSelector field specifies labels that no node in the cluster possesses. The scheduler filters nodes based on the nodeSelector, and since none match, the pod remains Pending. The fix is to either label a node to match the selector or correct the pod's nodeSelector.

Answer

A PersistentVolumeClaim is not bound

Answer

All nodes have insufficient memory or CPU

Answer

The nodes have taints that the pod does not tolerate

Question 3

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

Accepted Answer

Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon. Kubernetes requires the control plane to be upgraded first, as it is the source of truth for the cluster state and API version compatibility. After the control plane is upgraded, each worker node must be drained (to evict pods gracefully), upgraded (kubelet and kube-proxy), and then uncordoned to resume scheduling. This sequential process ensures that the cluster remains functional and that kubelet versions never exceed the kube-apiserver version, which is a strict compatibility requirement.

Answer

Upgrade all worker nodes first, then upgrade the control plane

Answer

Drain all nodes simultaneously, upgrade the control plane, then upgrade worker nodes

Answer

Upgrade the control plane and worker nodes at the same time

Question 4

You have a Deployment named 'web-app' in the 'default' namespace. You run the following command: kubectl rollout history deployment web-app. The output shows: revision 1, revision 2, revision 3. You want to roll back to revision 1. Which command achieves this?

Accepted Answer

kubectl rollout undo deployment web-app --to-revision=1. `kubectl rollout undo` with the `--to-revision` flag is the proper syntax to roll back a Deployment to a specific revision. The command `kubectl rollout undo deployment web-app --to-revision=1` reverts the Deployment to revision 1, as shown in the rollout history output.

Answer

kubectl rollout undo deployment web-app --revision=1

Answer

kubectl rollback deployment web-app --to-revision=1

Answer

kubectl rollout undo deployment web-app

Question 5

You apply the following NetworkPolicy to namespace 'ns1':
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []
What effect does this policy have?

Accepted Answer

Denies all ingress traffic to all pods in namespace ns1.. This NetworkPolicy selects all pods in namespace 'ns1' (via empty `podSelector: {}`), specifies `policyTypes: [Ingress]`, and defines an empty `ingress: []` rule list. In Kubernetes, an empty `ingress: []` explicitly denies all ingress traffic because no allow rules are present, overriding the default allow-all behavior. Therefore, all ingress traffic to any pod in ns1 is denied.

Answer

Denies all egress traffic as well.

Answer

Allows ingress traffic only from pods in the same namespace.

Answer

Allows all ingress traffic because no explicit deny rules are defined.

Question 6

You suspect a DNS issue inside a pod. Which command can you run to test DNS resolution from within a pod?

Accepted Answer

kubectl exec -- nslookup kubernetes.default. The correct command is `kubectl exec -- nslookup kubernetes.default`, which runs the DNS lookup from inside the existing pod's network namespace, using the pod's own /etc/resolv.conf and DNS policy. This directly tests whether the pod can resolve cluster DNS names through kube-dns/CoreDNS, which is exactly what a DNS issue inside a pod requires. Running nslookup from within the affected pod isolates the problem to that pod's DNS configuration rather than the cluster DNS service as a whole.

Answer

kubectl logs coredns -n kube-system

Answer

kubectl describe svc kubernetes

Answer

kubectl run test --image=busybox -- nslookup kubernetes.default

Question 7

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

Accepted Answer

kubeadm certs renew apiserver. `kubeadm certs renew apiserver` is the standard command in modern kubeadm (v1.15+) to renew a specific certificate without affecting others. It regenerates the apiserver certificate using the existing CA key, updating the expiration date while keeping the same Subject and SANs.

Answer

kubeadm alpha certs renew apiserver

Answer

kubeadm init phase certs apiserver --renew

Answer

kubectl create certificate apiserver

Question 8

Which THREE of the following are CNI plugins?

Accepted Answer

Flannel. Flannel is a CNI plugin that provides a simple overlay network for Kubernetes clusters, typically using VXLAN or host-gw to encapsulate and route pod traffic across nodes. It implements the Container Network Interface (CNI) specification by installing a binary and configuration file on each node, enabling pod-to-pod communication without requiring a separate network daemon.

Answer

kube-proxy

Answer

CoreDNS

Question 9

After deploying a new Deployment, you notice that the pods are stuck in ImagePullBackOff. What is the most common cause?

Accepted Answer

The container image name or tag is incorrect. The ImagePullBackOff status indicates that the kubelet is unable to pull the container image from the registry. The most common cause is an incorrect image name or tag, which results in a manifest not found error. This triggers an exponential backoff retry loop, leading to the ImagePullBackOff state.

Answer

The liveness probe is misconfigured

Answer

The node has insufficient resources

Answer

The container command fails on startup

Question 10

You run 'kubectl get events --sort-by=.lastTimestamp' and see the following events for a pod: 'Warning FailedScheduling 0/3 nodes are available: 3 Insufficient cpu'. What is the most likely solution?

Accepted Answer

Reduce the CPU request for the pod or remove other workloads to free CPU. The event '0/3 nodes are available: 3 Insufficient cpu' indicates that all three nodes in the cluster lack sufficient allocatable CPU to satisfy the pod's CPU request. The most direct solution is to either reduce the pod's CPU request (so it fits on an existing node) or remove other workloads to free up CPU capacity. This aligns with Kubernetes resource scheduling, where the scheduler only considers requests (not limits) when placing pods.

Answer

Change the scheduler to a different one

Answer

Increase the CPU limit for the pod

Answer

Add more nodes to the cluster

Question 11

A StatefulSet named 'web' uses volumeClaimTemplates to dynamically provision PersistentVolumeClaims for each replica. The cluster runs on AWS with the EBS CSI driver. How many PersistentVolumeClaims will be created if the StatefulSet has 3 replicas and the volumeClaimTemplates specify a single template?

Accepted Answer

3. A StatefulSet with 3 replicas and a single volumeClaimTemplate creates one PersistentVolumeClaim per replica, resulting in exactly 3 PVCs. Each replica gets its own PVC based on the template, and the EBS CSI driver provisions a distinct EBS volume for each PVC, independent of the storage class configuration.

Answer

9

Answer

1

Answer

Depends on the storage class

Question 12

You want to forward local port 8080 to port 80 of a pod named 'nginx-pod'. Which command should you use?

Accepted Answer

kubectl port-forward pod/nginx-pod 8080:80. `kubectl port-forward` is the Kubernetes command used to forward a local port to a port on a specific pod. The syntax `kubectl port-forward pod/nginx-pod 8080:80` correctly specifies the pod resource, the local port (8080), and the target pod port (80), enabling access to the pod's port 80 from the local machine.

Answer

kubectl proxy pod/nginx-pod 8080:80

Answer

kubectl forward pod/nginx-pod 8080 80

Answer

kubectl port-forward service/nginx-pod 8080:80

Question 13

You run 'kubectl get pods' and see a pod with status 'Init:CrashLoopBackOff'. What does this indicate?

Accepted Answer

An init container in the pod is failing and restarting. The status 'Init:CrashLoopBackOff' indicates that an init container within the pod is failing and being repeatedly restarted by Kubernetes. Init containers run sequentially before any main containers start, and if one exits with a non-zero exit code, Kubernetes retries it with an exponential backoff delay, leading to the CrashLoopBackOff state. This is distinct from a main container crash, which would show 'CrashLoopBackOff' without the 'Init:' prefix.

Answer

The pod's init container ran successfully but the main container has not started yet

Answer

The pod is still initializing but will eventually run

Answer

The main container is crashing and the pod is restarting

Question 14

You are applying the following RBAC manifest:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Which TWO statements are true about this Role? (Choose TWO.)

Accepted Answer

It allows reading pod details in the 'development' namespace. The Role explicitly defines rules for the 'pods' resource with verbs 'get', 'watch', and 'list' in the 'development' namespace. These verbs allow reading pod details such as their specifications, status, and metadata. The Role is scoped to the 'development' namespace, so it only grants these read permissions within that namespace.

Answer

It also grants access to secrets in the 'development' namespace

Answer

It grants permissions across all namespaces

Answer

It allows creating pods in the 'development' namespace

Question 15

A DaemonSet named 'fluentd' is configured to run on all nodes. After adding a new node to the cluster, you notice that the DaemonSet pod is not running on the new node. What could be the cause?

Accepted Answer

The new node has a taint that the DaemonSet pod does not tolerate. A DaemonSet ensures that a copy of a pod runs on all (or a subset of) nodes. When a new node is added, the DaemonSet controller automatically schedules a pod on it unless the node has a taint that the pod does not tolerate. By default, the new node may have a taint (e.g., `node.kubernetes.io/unschedulable` or a custom taint) that prevents the DaemonSet pod from being scheduled unless the pod's spec includes a matching toleration.

Answer

The new node does not have enough resources to run the DaemonSet pod

Answer

The DaemonSet has a nodeSelector that does not match the new node's labels

Answer

The DaemonSet's update strategy is set to OnDelete