CKA Practice Test 17 — 15 Questions

Question 1

You want to dynamically provision storage for a PVC using a StorageClass named 'fast-ssd'. Which field in the PVC YAML specifies the StorageClass?

Accepted Answer

storageClassName. In Kubernetes, the field that specifies which StorageClass to use for dynamic provisioning in a PersistentVolumeClaim (PVC) is `storageClassName`. When this field is set to a valid StorageClass name (e.g., 'fast-ssd'), the system will dynamically provision a PersistentVolume using the provisioner and parameters defined in that StorageClass. If omitted, the default StorageClass (if one exists) is used.

Answer

class

Answer

storageClass

Answer

className

Question 2

Which two statements about HorizontalPodAutoscaler (HPA) are correct?

Accepted Answer

HPA is a namespaced resource. HorizontalPodAutoscaler (HPA) is a namespaced resource in Kubernetes, meaning it exists within a specific namespace and can only target resources (like Deployments or StatefulSets) in that same namespace. This is defined in the Kubernetes API under the `autoscaling/v2` group, where HPA objects are scoped to a namespace, not cluster-wide.

Answer

HPA can only target Deployments

Answer

HPA requires the metrics-server to be installed

Answer

HPA can scale down to zero replicas

Question 3

You suspect a DNS issue inside a pod. Which command can you run to test DNS resolution from within a pod?

Accepted Answer

kubectl exec -- nslookup kubernetes.default. The correct command to test DNS resolution from within a pod is `kubectl exec -- nslookup kubernetes.default`. This runs the nslookup command inside an existing pod, directly testing DNS resolution from that pod's perspective. Option A (kubectl logs coredns) shows CoreDNS logs, not a DNS test. Option B (kubectl describe svc kubernetes) shows service details, not DNS resolution. Option C (kubectl run test --image=busybox -- nslookup kubernetes.default) creates a new pod to run the command, but the question asks for testing from within an existing pod, so exec is appropriate.

Answer

kubectl logs coredns -n kube-system

Answer

kubectl describe svc kubernetes

Answer

kubectl run test --image=busybox -- nslookup kubernetes.default

Question 4

What is the default DNS name for a Service named 'my-service' in namespace 'my-ns'?

Accepted Answer

my-service.my-ns.svc.cluster.local. In Kubernetes, the default DNS name for a Service follows the pattern `..svc.cluster.local`. This is defined by the cluster DNS specification (CoreDNS or kube-dns). For a Service named 'my-service' in namespace 'my-ns', the fully qualified domain name (FQDN) is `my-service.my-ns.svc.cluster.local`. The `.svc` subdomain is a fixed part of the DNS schema, distinguishing Services from other resource types like Pods.

Answer

my-service.my-ns.cluster.local

Answer

my-service.svc.my-ns.cluster.local

Answer

my-service.cluster.local

Question 5

Which of the following is a valid CNI plugin for Kubernetes networking?

Accepted Answer

Calico. Calico is a valid CNI plugin that implements the Container Network Interface specification to provide networking and network policy for Kubernetes clusters. It uses BGP (Border Gateway Protocol) to route packets between nodes and supports overlay or non-overlay networking modes, making it a widely adopted choice for production environments.

Answer

etcd

Answer

Docker

Answer

Kubelet

Question 6

A pod has been in Pending state for a long time. 'kubectl describe pod' shows the event: '0/3 nodes are available: 1 node(s) had taint {node.kubernetes.io/not-ready: }, that the pod didn't tolerate, 2 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

The kubelet on each node is not running. The taints `node.kubernetes.io/not-ready` and `node.kubernetes.io/unreachable` are automatically added by the node controller when a node's kubelet stops reporting its status (the `node-monitor-grace-period`, default 40s, is exceeded). Since all three nodes exhibit these taints, the kubelet is not running on any of them, preventing the node from being marked `Ready` and causing the scheduler to find no suitable node for the pod.

Answer

The pod's image is incorrect

Answer

The pod has resource requests that exceed node capacity

Answer

The nodes are all cordoned

Question 7

A Pod with a restartPolicy of 'OnFailure' exits with code 0. What will happen?

Accepted Answer

The container will not restart, and the Pod will be in Succeeded phase.. When a Pod has a restartPolicy of 'OnFailure' and its container exits with code 0 (indicating successful completion), the container will not be restarted. Instead, the Pod transitions to the Succeeded phase, as defined by Kubernetes Pod lifecycle semantics. This is because 'OnFailure' only triggers a restart on a non-zero exit code, which signifies a failure.

Answer

The container will restart immediately.

Answer

The Pod will be terminated.

Answer

The Pod will remain in Running state.

Question 8

You need to allow a pod to use a specific device from the host node (e.g., /dev/sdb) as a raw block device. Which volume mode should you set in the PVC?

Accepted Answer

Block. To use a host device like /dev/sdb as a raw block device inside a pod, the PersistentVolumeClaim (PVC) must specify `volumeMode: Block`. This tells Kubernetes to expose the volume as a raw block device (e.g., /dev/xxx) inside the container, rather than mounting a filesystem. Only the `Block` volume mode supports this behavior, as defined in the Kubernetes PersistentVolume API.

Answer

Device

Answer

Raw

Answer

Filesystem

Question 9

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

Accepted Answer

The service account can read pods in all namespaces. ClusterRoleBindings are cluster-scoped, meaning they grant permissions across all namespaces. Since the ClusterRoleBinding 'read-pods-global' binds the 'pod-reader' ClusterRole to the service account 'sa-pod-reader', the service account can get and list pods in every namespace, not just the 'default' namespace.

Answer

The service account can only read pods in the 'default' namespace

Answer

The service account can only list pods, not get them

Answer

The service account cannot read pods in any namespace

Question 10

Which kubectl command will show the rollout history of a Deployment named 'web-app'?

Accepted Answer

kubectl rollout history deployment web-app. `kubectl rollout history deployment web-app` is the dedicated command to display the rollout history of a Deployment, including revision numbers and change-cause annotations. This command retrieves the stored ReplicaSet revisions associated with the Deployment, allowing you to see past rollout states.

Answer

kubectl describe deployment web-app

Answer

kubectl rollout status deployment web-app

Answer

kubectl get deployment web-app -o yaml

Question 11

Which command allows you to view the current context in a kubeconfig file?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. It reads the `current-context` field from the kubeconfig (typically `~/.kube/config`) and outputs its name, making it the most direct way to view the current context.

Answer

kubectl config get-contexts

Answer

kubectl cluster-info

Answer

kubectl config view

Question 12

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

Accepted Answer

kubectl config set-credentials. The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.

Answer

kubectl config set-context

Answer

kubectl config create-user

Answer

kubectl config set-cluster

Question 13

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` creates a direct tunnel from a local port to a specified port on a pod, allowing access to the pod's service without exposing it externally. The syntax `pod/web-pod 8080:80` forwards localhost:8080 to port 80 of the pod named 'web-pod'.

Answer

kubectl exec -it web-pod -- nc -l -p 8080

Answer

kubectl proxy --port=8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Question 14

A pod is running but cannot be accessed via its ClusterIP service from another pod in the same namespace. The service endpoints list shows the pod's IP. What is the most likely cause?

Accepted Answer

A NetworkPolicy is blocking the traffic. A NetworkPolicy can explicitly deny ingress traffic to a pod even when the service endpoints are correctly populated. Since the endpoints list shows the pod's IP, the service and pod are communicating at the network layer, but a NetworkPolicy with an ingress rule that does not allow traffic from the source pod's labels or CIDR will cause the packet to be dropped by the node's iptables or eBPF rules, resulting in a connection timeout or reset from the client pod.

Answer

The kube-proxy is not running on the node

Answer

The service's targetPort is incorrect

Answer

The pod is running on a different node without proper routing

Question 15

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

Accepted Answer

Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes. The kubeadm upgrade process requires the control plane node to be upgraded first, as it hosts the core cluster components (API server, scheduler, controller-manager). Draining the node ensures workloads are evicted, then kubeadm and kubelet are upgraded on the control plane, followed by uncordoning. Worker nodes are upgraded afterward to maintain cluster stability and compatibility.

Answer

Drain each node, upgrade control plane, then upgrade worker nodes

Answer

Upgrade worker nodes first, then control plane nodes

Answer

Upgrade all nodes simultaneously