CKA Practice Test 19 — 15 Questions

Question 1

You are troubleshooting a pod that cannot start. Running 'kubectl describe pod' shows the event: 'Failed to pull image "myregistry.io/myapp:1.0": rpc error: code = Unknown desc = Error response from daemon: manifest for myregistry.io/myapp:1.0 not found'. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The image tag '1.0' does not exist in the registry. The error message 'manifest for myregistry.io/myapp:1.0 not found' indicates that the registry successfully received the pull request but could not locate the specific image tag '1.0'. This is a manifest lookup failure, not a connectivity or authentication issue. The most likely cause is that the tag '1.0' does not exist in the repository, either because it was never pushed or was removed.

Answer

The registry is unreachable due to network issues

Answer

The image registry requires authentication and the imagePullSecret is missing

Answer

The image has been deleted from the registry

Question 2

You run `kubectl get pods` and get an error: 'error: You must be logged in to the server (Unauthorized)'. What is the most likely cause?

Accepted Answer

The kubeconfig file is missing or invalid.. The error 'You must be logged in to the server (Unauthorized)' indicates that the kubectl client successfully reached the API server, but the request was rejected because the client's credentials (typically from the kubeconfig file) are missing, expired, or invalid. The kubeconfig file contains the cluster, user, and context information required for authentication; if it is misconfigured or not present, kubectl cannot authenticate and returns this specific HTTP 401 Unauthorized error.

Answer

The API server is not running.

Answer

The pod does not exist.

Answer

The namespace does not exist.

Question 3

You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?

Accepted Answer

kubectl port-forward svc/my-service 8080:80. `kubectl port-forward svc/my-service 8080:80` creates a local TCP tunnel from port 8080 on your workstation to port 80 on a pod selected by the Service `my-service`. This allows you to reach the Service's backend pod directly without exposing it externally, which is a standard debugging technique for testing connectivity to a Service that appears unreachable.

Answer

kubectl expose deployment my-deployment --type=NodePort

Answer

kubectl exec -it my-pod -- curl localhost:80

Answer

kubectl proxy

Question 4

A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?

Accepted Answer

RoleBinding 'john-pod-reader' in namespace 'development' referencing ClusterRole 'pod-reader' and user 'john'. A RoleBinding in a specific namespace can reference a ClusterRole to grant its permissions only within that namespace. Since the requirement is to bind the existing 'pod-reader' ClusterRole to user 'john' exclusively in the 'development' namespace, a RoleBinding named 'john-pod-reader' in the 'development' namespace is the correct resource. This allows the ClusterRole's pod read permissions to be scoped down to a single namespace.

Answer

Add user 'john' to the 'pod-reader' ClusterRole definition

Answer

Role 'pod-reader' in namespace 'development'

Answer

ClusterRoleBinding 'john-pod-reader' binding 'pod-reader' to user 'john'

Question 5

You have a Service named 'my-service' in namespace 'ns1'. Another pod in namespace 'ns2' needs to resolve 'my-service' using DNS. What FQDN should the pod use?

Accepted Answer

my-service.ns1.svc.cluster.local. Kubernetes DNS resolves services using the FQDN format `..svc.cluster.local`. Since the pod in namespace 'ns2' needs to resolve 'my-service' which resides in namespace 'ns1', the FQDN must include the target namespace 'ns1' to perform a cross-namespace DNS lookup. Omitting the namespace would default to the pod's own namespace, which would fail to resolve the service.

Answer

my-service.svc.cluster.local

Answer

my-service.cluster.local

Answer

my-service.ns2.svc.cluster.local

Question 6

A NetworkPolicy named 'deny-all' has only a podSelector matching all pods and no rules. What is the effect?

Accepted Answer

Denies all ingress traffic to all pods in the namespace. A NetworkPolicy with a podSelector matching all pods and no rules defaults to denying all ingress traffic because the policy's empty `ingress` rules array means no traffic is allowed. This implements a default-deny ingress behavior for the selected pods, as Kubernetes NetworkPolicy rules are whitelist-based: any traffic not explicitly allowed is denied.

Answer

Has no effect because NetworkPolicy requires at least one rule

Answer

Allows all traffic because there are no explicit deny rules

Answer

Denies all egress traffic from all pods in the namespace

Question 7

You want to run a batch job that processes a queue and then terminates. The job should be run only once. Which Kubernetes resource should you use?

Accepted Answer

Job. A Kubernetes Job is designed to run a specified number of pods to completion, making it the correct choice for a batch process that runs once and then terminates. Unlike controllers that maintain a desired state (like Deployments or DaemonSets), a Job tracks pod completion and will not restart the pod once it succeeds, perfectly matching the requirement of a single execution.

Answer

CronJob

Answer

DaemonSet

Answer

Deployment

Question 8

You have a Deployment 'db' with 3 replicas. Each pod writes to a PersistentVolumeClaim (PVC). A StatefulSet is required for stable network identities and ordered pod management. Which of the following is a key characteristic that differentiates a StatefulSet from a Deployment?

Accepted Answer

StatefulSets maintain a sticky identity for each pod, including stable hostnames and persistent storage. StatefulSets assign each pod a unique, stable network identity (e.g., a hostname derived from the StatefulSet name and ordinal index) and guarantee that each pod's PersistentVolumeClaim is bound to the same PersistentVolume across rescheduling. This ensures that each pod retains its identity and data, which is critical for stateful applications like databases. Deployments, in contrast, treat pods as interchangeable and do not guarantee stable hostnames or persistent storage binding.

Answer

StatefulSets support rolling updates but not canary deployments

Answer

StatefulSets automatically create a Service for each pod

Answer

StatefulSets cannot use PersistentVolumeClaims

Question 9

You run 'kubectl get pods' and see a pod with status 'CrashLoopBackOff'. You check the logs with 'kubectl logs <pod> --previous' and see: 'Error: unable to connect to database at db-svc:5432 (connection refused)'. What is the most likely cause?

Accepted Answer

The database service is not running or is unreachable. The error message 'connection refused' indicates that the pod is attempting to connect to the database at 'db-svc:5432' but the target service is not accepting TCP connections on port 5432. This typically means the database pod or service is not running, or a network policy is blocking the connection. The 'CrashLoopBackOff' status confirms the application container repeatedly fails due to this startup dependency.

Answer

The pod's liveness probe is misconfigured

Answer

The pod's container image is missing

Answer

The pod has a memory limit that is too low

Question 10

A new Kubernetes administrator runs 'kubeadm join --token

:6443 --discovery-token-ca-cert-hash sha256:' on a worker node. The join fails with 'error execution phase preflight: couldn't validate the identity of the API Server'. What is the most likely cause?

Accepted Answer

The --discovery-token-ca-cert-hash value is incorrect. The error 'couldn't validate the identity of the API Server' indicates that the CA certificate hash provided with --discovery-token-ca-cert-hash does not match the actual hash of the API server's CA certificate. This hash is used to verify the API server's identity during the TLS bootstrap process. An incorrect hash value will cause the preflight check to fail, as the worker node cannot confirm it is connecting to the legitimate control plane.

Answer

The token has expired

Answer

The kubelet is not running on the worker node

Answer

The API server is not reachable on port 6443

Question 11

You are troubleshooting a scenario where a pod cannot communicate with another pod in the same namespace via service name. Which THREE steps would you take to diagnose the issue? (Select 3)

Accepted Answer

Run 'kubectl get endpoints' to verify the service has healthy endpoints. Options B, C, and E are correct. Checking endpoints (B) verifies the service has healthy pods. Exec into the pod and using curl (C) tests connectivity to the service's cluster IP. Exec into the pod and running nslookup (E) checks DNS resolution of the service name. Option A checks node status, which is not directly related to pod-to-pod communication via service name. Option D checks logs of the target pod, which may not reveal network issues.

Answer

Run 'kubectl get nodes' to check node status

Answer

Run 'kubectl logs' on the target pod to check application logs

Question 12

Which annotation is commonly used to trigger a rollout restart of a Deployment when a ConfigMap is updated?

Accepted Answer

kubectl.kubernetes.io/restartedAt. The annotation `kubectl.kubernetes.io/restartedAt` is commonly used with `kubectl rollout restart` to trigger a rolling restart of a Deployment. When a ConfigMap is updated, Pods using it via `envFrom` or `volumes` are not automatically updated; adding or updating this annotation on the Deployment's pod template forces a new ReplicaSet to be created, picking up the latest ConfigMap data.

Answer

configmap.kubernetes.io/update-trigger

Answer

field.cattle.io/updateStrategy

Answer

kubectl.kubernetes.io/last-applied-configuration

Question 13

You are troubleshooting a node that is in 'NotReady' state. Which command should you use to check the kubelet logs for errors?

Accepted Answer

journalctl -u kubelet. The kubelet is the primary node agent that communicates with the control plane and manages pods. When a node is in 'NotReady' state, checking the kubelet logs is the first step to diagnose issues such as certificate errors, resource pressure, or network problems. The command `journalctl -u kubelet` retrieves logs from the systemd unit for the kubelet service, which is the correct way to view its output on systems using systemd.

Answer

journalctl -u docker

Answer

journalctl -u kube-apiserver

Answer

journalctl -u kube-controller-manager

Question 14

A DevOps engineer is designing a Kubernetes cluster for a production environment. Which of the following is a best practice for etcd deployment?

Accepted Answer

Deploy etcd on dedicated nodes with SSD storage.. Etcd is the Kubernetes cluster's primary data store, and its performance directly impacts the entire cluster's stability and responsiveness. Dedicated nodes prevent resource contention from other workloads, while SSD storage provides the low-latency, high-IOPS performance required for etcd's frequent write operations (especially with the default 1 MB write-ahead log). This isolation is a recommended best practice in the official Kubernetes documentation for production clusters.

Answer

Deploy etcd on exactly 2 nodes for simplicity.

Answer

Deploy etcd on all worker nodes to maximize redundancy.

Answer

Deploy etcd on the same nodes as GPU-accelerated workloads.

Question 15

A StatefulSet named 'db' has 3 replicas. You need to update the pod template to change the resource limits. After applying the change, you run 'kubectl rollout status sts db' and it hangs. What is the most likely reason?

Accepted Answer

The StatefulSet's pod management policy is OrderedReady, and the first pod to update (db-2) is not becoming Ready.. StatefulSets with the default OrderedReady pod management policy update pods sequentially in reverse order (from highest ordinal to lowest). When `kubectl rollout status sts db` hangs, it indicates that the update is stuck waiting for the first pod in the update sequence (db-2) to become Ready. If db-2 fails to become Ready due to the new resource limits (e.g., insufficient cluster resources or misconfigured limits), the rollout cannot proceed to update db-1 and db-0, causing the command to hang indefinitely.

Answer

The update strategy is set to OnDelete, and you need to delete pods manually.

Answer

The maxSurge setting is preventing the update from starting.

Answer

The StatefulSet's service name is incorrect, causing DNS resolution failures.