CKA Practice Test 18 — 15 Questions

Question 1

What is the purpose of a Headless Service (clusterIP: None)?

Accepted Answer

To allow DNS queries to return all pod IPs for a StatefulSet. A Headless Service (clusterIP: None) is used when you want to discover individual pod IPs directly, rather than having a single virtual IP load-balance traffic. When a Service has clusterIP set to None, DNS queries return the A/AAAA records for all ready pod IPs, which is essential for StatefulSets where each pod has a unique identity and needs to be addressed individually, such as in clustered databases like Cassandra or Kafka.

Answer

To expose the Service externally via a cloud load balancer

Answer

To provide load balancing across pods

Answer

To assign a static ClusterIP

Question 2

You need to check the current resource usage of nodes in your cluster. Which command should you use?

Accepted Answer

kubectl top nodes. `kubectl top nodes` retrieves and displays real-time CPU and memory usage metrics for all nodes in the cluster, directly answering the question about current resource usage. This command relies on the metrics server being deployed in the cluster to collect resource utilization data from kubelets via the Summary API.

Answer

kubectl top pods

Answer

kubectl get events

Answer

kubectl get nodes -o wide

Question 3

Which component is responsible for maintaining network rules on worker nodes?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for maintaining network rules on worker nodes. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or userspace rules on the node to route traffic to the correct Pods. This ensures that network traffic directed at a Service's ClusterIP or NodePort is properly forwarded to the backend Pods.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-controller-manager

Question 4

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

Accepted Answer

The pod cannot be scheduled due to insufficient resources. A pod in 'Pending' state indicates that the pod has been accepted by the Kubernetes API server but is not yet running. The most common cause is that the scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other scheduling constraints (taints, node selector, affinity rules). This results in the pod remaining unscheduled, hence 'Pending'.

Answer

The pod has been deleted

Answer

The pod is waiting for a container to start

Answer

The container image is invalid

Question 5

A pod has status 'Init:Error'. What does this indicate?

Accepted Answer

An init container failed. The 'Init:Error' status indicates that a pod's init container has failed to complete successfully. Init containers run sequentially before any main containers start, and if one exits with a non-zero exit code, the pod enters this error state. This is distinct from a main container crash, which would show as 'CrashLoopBackOff' or 'Error' after the pod has started.

Answer

The main container has crashed

Answer

The pod is being initialized

Answer

There is a network error during initialization

Question 6

Which THREE of the following are valid ways to restrict or influence pod scheduling using taints and tolerations? (Select THREE.)

Accepted Answer

Adding a taint with effect NoSchedule to a node. Adding a taint with effect NoSchedule (option A) prevents scheduling of pods without matching tolerations onto the node. Adding a taint with effect PreferNoSchedule (option C) is a soft preference that tries to avoid scheduling pods without tolerations onto the node but does not guarantee it. Adding a taint with effect NoExecute (option E) not only prevents scheduling but also evicts any existing pods that do not tolerate the taint. Options B and D are not valid uses of taints and tolerations: tolerations allow pods to be scheduled on tainted nodes, not prevent scheduling, and nodeSelector is a separate mechanism not based on taints and tolerations.

Answer

Adding a toleration to a pod to prevent it from being scheduled on certain nodes

Answer

Applying a nodeSelector to a pod to match node labels

Question 7

A developer accidentally runs 'kubectl delete pvc data-claim'. What is the immediate effect on the PersistentVolume pv-data?

Accepted Answer

The PV pv-data enters the Released state and is not deleted.. When a PVC is deleted, the associated PV enters the 'Released' state, not 'Available'. This is because the PV still contains data from the previous claim (the retain policy is 'Retain' by default), and Kubernetes does not automatically delete or reuse it. The PV remains in 'Released' until an administrator manually clears the claimRef or deletes the PV.

Answer

The PV pv-data is automatically deleted.

Answer

The PV pv-data remains Bound to the deleted PVC.

Answer

The PV pv-data immediately becomes Available and can be reused.

Question 8

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

Accepted Answer

etcdctl snapshot restore /backup/etcd-snapshot.db --data-dir=/var/lib/etcd-restored. `etcdctl snapshot restore` is the proper command to restore an etcd snapshot to a new data directory. The `--data-dir` flag specifies where the restored data should be placed, allowing the new etcd instance to use that directory. This command recreates the etcd member's data from the snapshot file, which is essential for disaster recovery.

Answer

kubectl apply -f /backup/etcd-snapshot.db

Answer

etcdctl snapshot load /backup/etcd-snapshot.db

Answer

ETCDCTL_API=3 etcdctl restore /backup/etcd-snapshot.db

Question 9

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

Accepted Answer

Ingress. Ingress is the correct resource because it provides HTTP/HTTPS layer-7 routing to multiple services based on hostnames or paths, all exposed on a single IP address. Services of type ClusterIP, NodePort, or LoadBalancer operate at layer 4 and cannot perform path-based routing. An Ingress controller (e.g., NGINX, HAProxy) implements the rules defined in the Ingress resource to direct traffic to the appropriate backend services.

Answer

Service of type ClusterIP

Answer

NetworkPolicy

Answer

Service of type NodePort

Question 10

Based on the exhibit, the pod is in CrashLoopBackOff. Which command should you run NEXT to identify the root cause?

Accepted Answer

kubectl logs api-6f4d7b9d4c-abcde -n production --previous. The pod is in CrashLoopBackOff, which means the container starts, crashes, and restarts repeatedly. The `kubectl logs --previous` command retrieves the logs from the previous (crashed) container instance, which is the fastest way to see the error that caused the crash. This directly reveals the root cause, such as a missing dependency, configuration error, or application panic.

Answer

kubectl describe node node-1

Answer

kubectl top pod api-6f4d7b9d4c-abcde -n production

Answer

kubectl get deployment api -n production -o yaml

Question 11

An application requires a persistent volume that can be shared across multiple Pods running on different nodes, with read-write access from all Pods simultaneously. Which access mode should be specified in the PersistentVolumeClaim?

Accepted Answer

ReadWriteMany. The correct access mode is ReadWriteMany (RWX), which allows the volume to be mounted as read-write by multiple Pods across different nodes simultaneously. This matches the requirement for shared concurrent read-write access from all Pods.

Answer

ReadWriteOncePod

Answer

ReadOnlyMany

Answer

ReadWriteOnce

Question 12

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Accepted Answer

Forwards local port 8080 to port 80 on the Service. `kubectl port-forward` creates a tunnel from a local port to a pod (or service) in the cluster. When targeting a Service, it selects one of the Service's endpoints (a pod) and forwards traffic from localhost:8080 to port 80 on that pod. This allows direct access to the Service without exposing it externally.

Answer

Creates a new Service with port mapping 8080:80

Answer

Forwards port 8080 from the Service to port 80 on the local machine

Answer

Forwards port 80 from the local machine to port 8080 on the Service

Question 13

You need to create a Kubernetes ServiceAccount named 'build-bot' and ensure that pods using this ServiceAccount can authenticate to the Kubernetes API using a long-lived token. Which TWO steps are necessary? (Choose TWO.)

Accepted Answer

Create a ServiceAccount object named 'build-bot'. Creating a ServiceAccount named 'build-bot' is the foundational step; without the ServiceAccount object, no pods can be assigned a service account identity. Option E is correct because a Secret of type 'kubernetes.io/service-account-token' with an annotation referencing the ServiceAccount causes the Kubernetes controller manager to automatically generate and populate a long-lived token, which pods can mount and use to authenticate to the API server.

Answer

Create a Secret of type 'Opaque' with the token data

Answer

Run 'kubectl create token build-bot'

Answer

Use the TokenRequest API to generate a token

Question 14

You are troubleshooting a pod that is in 'CrashLoopBackOff' state. You run 'kubectl logs mypod' and get no output. You then run 'kubectl logs mypod --previous' and see an error: 'Error: failed to start container: context deadline exceeded'. What is the MOST likely cause?

Accepted Answer

The container runtime is unable to start the container due to a timeout. The error 'context deadline exceeded' indicates that the container runtime failed to start the container within the allowed time. This can happen if the container image takes too long to pull, the runtime is slow, or there is a network issue. Option A would produce an 'executable file not found' error. Option B would result in the application crashing, but logs would show output before the crash. Option C would also show a similar error to A. Therefore, D is the most likely cause.

Answer

The container image is missing the entrypoint

Answer

The application inside the container is crashing immediately

Answer

The container command is incorrectly specified

Question 15

Which THREE are valid ways to inject configuration data into a pod?

Accepted Answer

Mount a ConfigMap as a volume.. A ConfigMap can be mounted as a volume in a Pod, allowing files to be created or updated in the container's filesystem with configuration data. This is a standard Kubernetes feature where the ConfigMap's data keys become filenames and values become file contents, and updates to the ConfigMap can be reflected in the mounted volume without restarting the Pod (depending on the mount type).

Answer

Use a Secret as a ConfigMap data source.

Answer

Use 'kubectl inject configmap' to inject data at runtime.