CKA Practice Test 16 — 15 Questions

Question 1

You want to check the current resource usage (CPU and memory) of pods in the 'default' namespace. Which kubectl command should you use?

Accepted Answer

kubectl top pods. `kubectl top pods` retrieves real-time CPU and memory metrics for pods from the metrics server, which is the standard way to check current resource usage in a Kubernetes cluster. This command relies on the Metrics API and requires the metrics server to be deployed.

Answer

kubectl get pods -o wide

Answer

kubectl logs pods

Answer

kubectl describe pods

Question 2

Which command is used to backup etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save. `etcdctl snapshot save` is the official command in etcdctl v3 to create a point-in-time backup of the etcd data store. This command captures the entire key-value store and metadata into a snapshot file, which can later be restored using `etcdctl snapshot restore` to recover the cluster state.

Answer

etcdctl backup

Answer

etcdctl export

Answer

etcdctl dump

Question 3

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

Accepted Answer

IPVS supports multiple load balancing algorithms.. IPVS (IP Virtual Server) supports multiple load balancing algorithms, such as round-robin, least-connection, source-hashing, and others, which is a key advantage over iptables mode. This allows kube-proxy to distribute traffic across pods more flexibly and efficiently, especially in high-traffic environments.

Answer

IPVS uses iptables rules for service discovery.

Answer

IPVS is the default kube-proxy mode since Kubernetes 1.0.

Answer

IPVS cannot handle large numbers of services.

Question 4

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time batch task that runs to completion and then exits. It ensures a specified number of Pods terminate successfully, making it ideal for processing data and exiting without requiring continuous availability.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 5

You want to view the resource usage of all pods in the cluster. What command should you run?

Accepted Answer

kubectl top pods --all-namespaces. The `kubectl top pods --all-namespaces` command retrieves real-time CPU and memory usage metrics for all pods across every namespace in the cluster. This is the correct way to view resource usage of all pods, as it relies on the metrics server to collect and expose pod-level resource consumption data.

Answer

kubectl describe nodes

Answer

kubectl get pods -o wide

Answer

kubectl top nodes

Question 6

You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?

Accepted Answer

podSelector in spec.ingress.from. In a Kubernetes NetworkPolicy, the `spec.ingress.from` field specifies the sources allowed to send ingress traffic. To match pods with a specific label within the same namespace, you use a `podSelector` under `from`. This selects pods based on their labels, and since no `namespaceSelector` is specified, it defaults to the same namespace as the NetworkPolicy.

Answer

podSelector in spec.podSelector

Answer

podSelector in spec.egress.to

Answer

namespaceSelector in spec.ingress.from

Question 7

Which annotation is commonly used with ExternalDNS to specify the DNS hostname for a Service?

Accepted Answer

external-dns.alpha.kubernetes.io/hostname. `external-dns.alpha.kubernetes.io/hostname` is the annotation used by the ExternalDNS project to specify the desired DNS hostname for a Kubernetes Service or Ingress. ExternalDNS watches resources with this annotation and synchronizes the DNS records (e.g., A or CNAME) with a configured DNS provider like AWS Route53 or Google Cloud DNS.

Answer

service.beta.kubernetes.io/load-balancer-dns

Answer

dns.alpha.kubernetes.io/hostname

Answer

kubernetes.io/ingress.class

Question 8

To make a node unschedulable without evicting existing pods, which command should be used?

Accepted Answer

kubectl cordon node01. `kubectl cordon` marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the precise command for the task described, as it modifies the node's `spec.unschedulable` field to `true` without affecting running workloads.

Answer

kubectl taint node01 key=value:NoSchedule

Answer

kubectl drain node01

Answer

kubectl uncordon node01

Question 9

Which kubectl command correctly retrieves the list of EndpointSlices for a Service named 'my-svc' in the 'default' namespace?

Accepted Answer

kubectl get endpointslice -n default --selector=kubernetes.io/service-name=my-svc. EndpointSlices are the modern, scalable replacement for Endpoints, and they use a specific label `kubernetes.io/service-name` to associate them with a Service. The command `kubectl get endpointslice -n default --selector=kubernetes.io/service-name=my-svc` correctly filters EndpointSlices by that label, retrieving all slices belonging to 'my-svc'.

Answer

kubectl get endpoints my-svc -n default

Answer

kubectl describe svc my-svc -n default

Answer

kubectl get endpointslices my-svc -n default

Question 10

A pod is not able to communicate with another pod in the same namespace. Both pods are running and have IP addresses. Which command can you use to test connectivity from the first pod to the second pod's IP?

Accepted Answer

kubectl exec first-pod -- ping . `kubectl exec first-pod -- ping ` runs the `ping` command inside the first pod, which uses ICMP to test IP-level connectivity to the second pod's IP address. This directly verifies whether the network path between the two pods is functional, including any CNI plugin, overlay network, or network policy rules.

Answer

kubectl logs first-pod

Answer

kubectl top pod first-pod

Answer

kubectl exec second-pod -- ping <first-pod-ip>

Question 11

What is the default pod phase when a pod is first created but not yet running?

Accepted Answer

Pending. When a Pod is first created, it enters the Pending phase before it is scheduled onto a node and its containers are started. The Pending phase indicates that the Pod has been accepted by the Kubernetes API server but one or more containers are not yet running, often because the image is being pulled or the node is not ready. This is the default initial phase as defined in the Kubernetes Pod lifecycle.

Answer

Running

Answer

Succeeded

Answer

Unknown

Question 12

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.

Answer

kubeadm upgrade plan --certificate-expiration

Answer

kubectl config view --raw | grep client-certificate

Answer

openssl x509 -in /etc/kubernetes/admin.conf -text -noout

Question 13

You have a Deployment with the following resource limits for containers: memory: 256Mi. The pod is repeatedly killed with OOMKilled. You need to change the limit to 512Mi. Which field should you modify in the Deployment YAML?

Accepted Answer

spec.template.spec.containers[].resources.limits.memory. The OOMKilled error occurs when a container exceeds its memory limit. To resolve this, you must increase the memory limit in the Deployment's pod template. Option A correctly identifies the field `spec.template.spec.containers[].resources.limits.memory`, which directly controls the maximum memory the container can use before being killed by the OOM killer.

Answer

spec.template.spec.containers[].resources.requests.memory

Answer

spec.template.spec.containers[].resources.requests.cpu

Answer

spec.template.spec.containers[].resources.limits.cpu

Question 14

A pod is in ImagePullBackOff state. Which command would give you the most information about why the image pull failed?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed event logs, including the exact error message from the kubelet when it failed to pull the container image. This output includes the reason for the ImagePullBackOff state, such as authentication failures, image not found, or network issues, which is the most comprehensive information for troubleshooting.

Answer

kubectl get pod

Answer

kubectl logs <pod-name>

Answer

kubectl edit pod <pod-name>

Question 15

You create a StorageClass with volumeBindingMode: WaitForFirstConsumer. A PVC using this StorageClass is created but remains in 'Pending' state. The PVC expects a node with label 'disktype=ssd'. A suitable node exists. What is the MOST likely reason the PVC is still Pending?

Accepted Answer

No pod has been created that uses this PVC.. With volumeBindingMode: WaitForFirstConsumer, the PVC will not be bound to a PV until a pod that uses the PVC is scheduled. The PVC remains Pending because no pod has been created that references it, even though a matching node exists. The scheduler defers volume binding to ensure the PV is provisioned on the same node where the pod lands.

Answer

The node selector on the PVC is incorrect.

Answer

The PVC requests a storage size larger than available.

Answer

The persistentVolumeReclaimPolicy is set to Retain.