CKA Practice Test 15 — 15 Questions

Question 1

A DevOps engineer notices that the kubelet on a node is unable to register with the Kubernetes API server. The kubelet logs show 'Failed to get bootstrap CA certificate' and the node is not yet part of the cluster. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bootstrap token used for TLS bootstrapping has expired.. The bootstrap token used for TLS bootstrapping has expired. During the TLS bootstrap process, the kubelet uses a limited-time bootstrap token to authenticate with the API server and request a client certificate. If the token expires before the kubelet completes registration, the kubelet will fail to obtain the bootstrap CA certificate and cannot join the cluster, as indicated by the error 'Failed to get bootstrap CA certificate'.

Answer

The kubelet configuration file has incorrect node IP.

Answer

The node's RBAC permissions are misconfigured.

Answer

The API server is not running.

Question 2

What is the function of the 'kube-scheduler' in Kubernetes?

Accepted Answer

It assigns pods to nodes. The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Answer

It runs the container runtime

Answer

It manages network rules for services

Answer

It stores cluster state

Question 3

You are using kubeadm to initialize a cluster. After running 'kubeadm init', you follow the instructions to set up the kubeconfig for the regular user. Which of the following commands should you run to allow kubectl to communicate with the cluster?

Accepted Answer

sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config. After running 'kubeadm init', the admin.conf file is generated in /etc/kubernetes/ and contains the cluster CA certificate, client certificate, and API server endpoint. This is the only kubeconfig file that grants full administrative access to the cluster, making it the correct file to copy to the user's $HOME/.kube/config for kubectl to communicate with the cluster.

Answer

sudo cp /etc/kubernetes/controller-manager.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/scheduler.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/kubelet.conf $HOME/.kube/config

Question 4

You have an Ingress resource with the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

A client sends a request to http://example.com/api/v1/users. Which path is matched?

Accepted Answer

/api. The Ingress rule uses `pathType: Prefix` with a path of `/api`. According to the Kubernetes Ingress specification, a Prefix pathType matches any URL path that has the specified path as its prefix. The request `/api/v1/users` starts with `/api`, so it matches the rule, and the traffic is forwarded to the `api-service` on port 80.

Answer

/api/v1/users

Answer

ImplementationSpecific: depends on the Ingress controller

Answer

No match, returns 404

Question 5

Which THREE components are required for a pod to resolve a Service DNS name?

Accepted Answer

The Service exists in the cluster. A Pod resolves a Service DNS name by querying the cluster's DNS service, which only returns an A/AAAA record if the Service object exists. Without the Service, the DNS name has no corresponding cluster IP to resolve, so the query fails with NXDOMAIN.

Answer

kube-proxy is running in iptables mode

Answer

A CNI plugin is installed

Question 6

Which command creates a Job that runs a single pod to execute the command 'echo Hello'?

Accepted Answer

kubectl create job hello --image=busybox -- echo Hello. `kubectl create job` is the dedicated command to create a Kubernetes Job object, which runs a pod to completion. The `--image=busybox` specifies the container image, and the `-- echo Hello` passes the command and its arguments to the container's entrypoint. This creates a non-repeating Job that executes the command once.

Answer

kubectl create cronjob hello --image=busybox -- echo Hello

Answer

kubectl create deployment hello --image=busybox -- echo Hello

Answer

kubectl run job hello --image=busybox -- echo Hello

Question 7

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Accepted Answer

NodePort. A NodePort service exposes the application on a static port (30000–32767) on every node's IP address, making it accessible externally via `:`. A LoadBalancer service provisions an external load balancer (e.g., from a cloud provider) that routes traffic to the service, typically using a public IP. Both are explicitly designed for external access, unlike ClusterIP which is internal only.

Answer

Headless

Answer

ExternalName

Answer

ClusterIP

Question 8

You have a kubeconfig file with multiple contexts. How do you switch to the context named 'prod-cluster'?

Accepted Answer

kubectl config use-context prod-cluster. `kubectl config use-context` is the command specifically designed to switch the current context in a kubeconfig file. It updates the `current-context` field in the kubeconfig to point to the specified context, which then determines which cluster, user, and namespace are used by default for subsequent `kubectl` commands.

Answer

kubectl config set-cluster prod-cluster

Answer

kubectl config set-context prod-cluster

Answer

kubectl config view prod-cluster

Question 9

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Accepted Answer

No pods match the service selector, so the service has no endpoints.. B is correct because if no pods match the service selector 'app: my-app', the service will have no endpoints. Without endpoints, the service cannot route traffic, and kubectl port-forward will fail to establish a connection to localhost:8080. The port-forward command relies on the service having at least one endpoint to forward traffic to.

Answer

The service type is ClusterIP, which does not support port forwarding.

Answer

kubectl port-forward cannot forward to services, only to pods.

Answer

The port forward command requires the --address flag to bind to localhost.

Question 10

A pod is in Pending state. You see the event: '0/2 nodes are available: 2 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate'. What should you do to schedule the pod on one of the control-plane nodes?

Accepted Answer

Add a toleration to the pod spec matching the taint. The pod is in Pending state because the control-plane nodes have a taint (node-role.kubernetes.io/control-plane) that the pod does not tolerate. By default, pods are not scheduled on control-plane nodes unless they explicitly tolerate that taint. Adding a toleration to the pod spec that matches the taint's key, effect, and optionally value allows the scheduler to place the pod on a control-plane node.

Answer

Increase the pod's resource requests

Answer

Remove the taint from the control-plane node

Answer

Use a different namespace

Question 11

What is the purpose of the kube-proxy component?

Accepted Answer

It manages network rules for Services and endpoints. B is correct because kube-proxy is the component responsible for implementing the network rules that enable Kubernetes Services to function. It runs on each node and maintains iptables or IPVS rules to route traffic to the correct backend Pods based on the Service's endpoints, handling load balancing and service discovery at the network layer.

Answer

It proxies API requests to the kube-apiserver

Answer

It stores cluster state

Answer

It schedules pods to nodes

Question 12

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Accepted Answer

DNS returns the IP addresses of all pods that match the selector.. A headless service (clusterIP: None) does not allocate a ClusterIP. Instead, DNS returns the IP addresses of all pods matching the label selector via A/AAAA records. This allows direct pod-to-pod communication without load balancing, commonly used for stateful workloads like databases.

Answer

DNS does not resolve the service name at all.

Answer

DNS returns the service name as a CNAME to the pod names.

Answer

DNS resolves the service name to a single ClusterIP.

Question 13

A pod is stuck in 'Pending' state. Which command would you run FIRST to diagnose the issue?

Accepted Answer

kubectl describe pod <pod-name>. A pod stuck in 'Pending' state means it has not been scheduled to a node yet. The `kubectl describe pod` command provides detailed event logs, scheduler decisions, and resource constraints (e.g., insufficient CPU/memory, persistent volume claims not bound, node selector mismatches) that reveal why scheduling failed. This is the first diagnostic step because it surfaces the root cause without requiring the pod to be running.

Answer

kubectl logs <pod-name>

Answer

kubectl top pod <pod-name>

Answer

kubectl exec -it <pod-name> -- sh

Question 14

You have a headless service named 'my-headless' with clusterIP: None. A pod in the same namespace queries the DNS name 'my-headless'. What will the DNS response contain?

Accepted Answer

A list of A records for each pod matching the service selector.. A headless service (clusterIP: None) does not have a ClusterIP or load-balance traffic. Instead, DNS queries for the service name return A records for the individual pod IPs that match the service's selector. This allows direct pod-to-pod communication without a proxy, as defined by Kubernetes DNS specification.

Answer

An error because headless services cannot be queried by DNS.

Answer

A single A record with the service's IP.

Answer

The ClusterIP of the service (which is None).

Question 15

A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?

Accepted Answer

from.podSelector. In a Kubernetes NetworkPolicy, the `from.podSelector` field under `ingress` specifies the source pods from which traffic is allowed. When you set `from.podSelector.matchLabels` with `role: frontend`, only pods with that label can send ingress traffic to the pods selected by `spec.podSelector`. This is defined in the Kubernetes networking API under `networking.k8s.io/v1`.

Answer

spec.podSelector

Answer

ingress.podSelector

Answer

to.podSelector