CKA Practice Test 20 — 15 Questions

Question 1

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

Accepted Answer

kubeadm certs renew apiserver. `kubeadm certs renew apiserver` is the standard command in modern kubeadm (v1.15+) to renew a specific certificate without affecting others. It regenerates the apiserver certificate using the existing CA key, updating the expiration date while keeping the same Subject and SANs.

Answer

kubeadm alpha certs renew apiserver

Answer

kubeadm init phase certs apiserver --renew

Answer

kubectl create certificate apiserver

Question 2

Which TWO of the following are valid reclaim policies for a PersistentVolume? (Select TWO)

Accepted Answer

Retain. A is correct because the Retain reclaim policy is one of the two valid policies for PersistentVolumes in Kubernetes. When a PersistentVolume is released from its claim, the Retain policy leaves the volume and its data intact, requiring manual administrator intervention to reclaim the storage. This is defined in the PersistentVolume spec under the `persistentVolumeReclaimPolicy` field.

Answer

Recycle

Answer

Preserve

Answer

Archive

Question 3

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Accepted Answer

kubectl drain <node> --ignore-daemonsets. `kubectl drain` safely evicts all pods from a node before maintenance, and the `--ignore-daemonsets` flag is necessary because DaemonSet pods cannot be evicted (they are managed by the node controller). Option D is correct because `kubectl cordon` marks the node as unschedulable, preventing new pods from being scheduled onto it, which is a prerequisite before draining to avoid race conditions.

Answer

kubectl delete node <node>

Answer

kubectl uncordon <node>

Answer

kubectl taint nodes <node> key=value:NoSchedule

Question 4

Which kubectl command is used to view the logs of a container that has previously crashed in a pod?

Accepted Answer

kubectl logs pod-name --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has crashed and been restarted. This is essential for debugging crash loops, as the current container may have no logs or only startup logs, while the crashed container's logs contain the error.

Answer

kubectl logs pod-name -c container-name --tail=100

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name

Question 5

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

Accepted Answer

spec.serviceAccountName. Setting `spec.serviceAccountName` to 'my-sa' in the pod spec automatically mounts the service account token as a volume at `/var/run/secrets/kubernetes.io/serviceaccount/`. This is the standard way to associate a service account with a pod, and Kubernetes automatically handles token projection and mounting for that service account.

Answer

spec.serviceAccount

Answer

spec.containers[].env[].valueFrom.secretKeyRef

Answer

spec.automountServiceAccountToken

Question 6

Which TWO statements about emptyDir volumes are correct?

Accepted Answer

An emptyDir volume is created empty when a Pod is assigned to a node.. An emptyDir volume is created as an empty directory on the node when a Pod is first assigned to that node. It requires no pre-existing storage and is provisioned on the node's local filesystem (or memory if type is 'Memory').

Answer

An emptyDir volume can be shared between Pods on different nodes.

Answer

An emptyDir volume persists across pod restarts.

Answer

An emptyDir volume requires a PersistentVolume.

Question 7

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 8

A ClusterRoleBinding grants cluster-admin access to a user. Which field in the ClusterRoleBinding specifies the user?

Accepted Answer

subjects. In Kubernetes RBAC, the `subjects` field in a ClusterRoleBinding (or RoleBinding) specifies the users, groups, or service accounts that the binding applies to. The `subjects` array contains objects with `kind`, `name`, and optionally `apiGroup` or `namespace`, allowing you to reference a specific user by name. Option B is correct because `subjects` is the only field that defines the identity of the principal receiving the permissions.

Answer

users

Answer

roleRef

Answer

bindings

Question 9

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff with an OOMKilled message, which indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to allocate more memory without being killed by the Out-Of-Memory (OOM) killer.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Question 10

You are upgrading a cluster from v1.28 to v1.29. You have already drained and upgraded all worker nodes. The control plane nodes have not been upgraded yet. 'kubectl get nodes' shows the control plane nodes are still v1.28. What is the correct next step?

Accepted Answer

Upgrade the control plane nodes to v1.29. The correct next step is to upgrade the control plane nodes to v1.29. In a Kubernetes cluster upgrade, the control plane must be upgraded before or in conjunction with the worker nodes, but since the worker nodes have already been upgraded and drained, the control plane nodes are still running v1.28. Upgrading the control plane nodes ensures that the API server, scheduler, and controller manager are at the target version, which is required for cluster stability and to support the upgraded kubelets on the worker nodes.

Answer

Drain the worker nodes and downgrade them to v1.28

Answer

Uncordon the worker nodes

Answer

Restart the kubelet on all nodes

Question 11

A pod runs but you cannot connect to its container port from another pod in the same namespace. 'kubectl exec' into the pod and 'curl localhost:8080' works. What is the MOST likely cause?

Accepted Answer

The pod is bound to localhost only, not 0.0.0.0. When `curl localhost:8080` works inside the pod but connections from other pods fail, the most likely cause is that the application is listening only on the loopback interface (127.0.0.1) instead of 0.0.0.0 (all interfaces). This means the container process binds to localhost, which is only reachable from within the same network namespace (the pod itself), not from external sources like other pods. Kubernetes networking relies on the container listening on 0.0.0.0 so that traffic arriving via the pod's eth0 interface (which has its own IP) can be accepted.

Answer

There is a NetworkPolicy blocking ingress

Answer

The container's port is not exposed in the pod spec

Answer

The Service selector does not match the pod labels

Question 12

Which TWO of the following are valid ways to expose environment variables from a ConfigMap to a pod? (Select TWO.)

Accepted Answer

Using envFrom with configMapRef. `envFrom` with `configMapRef` allows you to inject all key-value pairs from a ConfigMap as environment variables into a pod, which is a concise way to expose ConfigMap data without specifying each key individually. This is a native Kubernetes feature that automatically creates environment variables for each entry in the ConfigMap.

Answer

Using envFrom with secretRef

Answer

Using env field with configMapKeyRef directly

Answer

Mounting the ConfigMap as a volume, which automatically sets environment variables

Question 13

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are the correct combination because the CI/CD pipeline needs to create and delete pods only within the 'ci' namespace. A Role defines permissions scoped to a specific namespace, and a RoleBinding grants those permissions to a user or service account within that same namespace. This ensures the pipeline cannot affect resources in other namespaces.

Answer

ClusterRole and RoleBinding

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Question 14

A pod needs to share data between two containers during their lifecycle, but the data does not need to persist after the pod is deleted. Which volume type is most appropriate?

Accepted Answer

emptyDir. The emptyDir volume type is the correct choice because it creates an empty directory when a pod is assigned to a node, and it exists as long as the pod runs. Containers within the same pod can read and write to this shared volume, making it ideal for temporary data exchange (e.g., sidecar log shipping or file-based IPC). When the pod is deleted, the emptyDir and its contents are permanently removed, matching the requirement that data does not need to persist.

Answer

PersistentVolumeClaim

Answer

hostPath

Answer

configMap

Question 15

Which of the following Service types exposes a Service on a static port on each node's IP address?

Accepted Answer

NodePort. NodePort is the Service type that exposes a Service on a static port (in the range 30000-32767) on each node's IP address. When a NodePort Service is created, Kubernetes allocates a port from that range and opens that port on every node in the cluster, forwarding traffic to the Service's ClusterIP and then to the pods. This allows external traffic to reach the Service by hitting any node's IP address and the allocated NodePort.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP