CKA Practice Exam 3 — 20 Questions

Question 1

An administrator needs to initialize a new Kubernetes control plane node using kubeadm. Which of the following is the correct command to initialize the control plane with a specific pod network CIDR of 10.244.0.0/16?

Accepted Answer

kubeadm init --pod-network-cidr=10.244.0.0/16. Option A is correct because `kubeadm init` uses the `--pod-network-cidr` flag to specify the CIDR range for the pod network, which is required by many CNI plugins (e.g., Flannel defaults to 10.244.0.0/16). This flag tells kubeadm to configure the control plane components (like the controller manager) to allocate pod IPs from this range.

Answer

kubeadm init --cidr=10.244.0.0/16

Answer

kubeadm init --network-cidr=10.244.0.0/16

Answer

kubeadm init --service-cidr=10.244.0.0/16

Question 2

Which TWO of the following are valid methods to add a worker node to an existing Kubernetes cluster that was initialized with kubeadm?

Accepted Answer

Use kubeadm token create and then kubeadm join with the token. Option A is correct because `kubeadm token create` generates a bootstrap token that is used by `kubeadm join` to authenticate the new node with the control plane. This is the standard, documented method for adding worker nodes to a cluster initialized with kubeadm, leveraging TLS bootstrap and the Bootstrap Token Authentication protocol.

Answer

Use kubectl create node command from the control plane

Answer

Install kubelet on the worker node and it will automatically join the cluster

Answer

Run kubeadm init on the worker node and then join

Question 3

A company deploys a web application with multiple replicas in a Kubernetes cluster. Users report intermittent connectivity issues. The application pods are exposed via a ClusterIP Service. To ensure stable connectivity, which action should be taken?

Accepted Answer

Set service.spec.sessionAffinity to ClientIP. Intermittent connectivity issues with multiple replicas often stem from requests being distributed across different pods, which can break session state if the application is not stateless. Setting `service.spec.sessionAffinity` to `ClientIP` ensures that all requests from a given client IP are routed to the same pod, providing stable connectivity for stateful sessions without changing the service type or removing the ClusterIP.

Answer

Change the Service type to NodePort

Answer

Remove the ClusterIP Service and use headless service

Answer

Add a readiness probe to the pods

Question 4

Which TWO of the following are valid reasons to use a Headless Service?

Accepted Answer

To enable a client to discover all pod IPs for a StatefulSet.. Option C is correct because a Headless Service (with `clusterIP: None`) does not provide a single stable IP or load balancing. Instead, it returns DNS A/AAAA records for all pod IPs that match the service's selector. This is essential for StatefulSets, where each pod has a unique identity and clients need to discover and connect to specific pods directly, such as in a database cluster.

Answer

To provide a single stable IP address for the service.

Answer

To expose a service externally via a cloud load balancer.

Answer

To provide load-balanced access to a set of pods.

Question 5

A DevOps team wants to ensure that a critical application Pod is always scheduled on a node that has SSD storage. They have labeled one node with 'disk=ssd'. Which scheduling approach should they use to guarantee this placement?

Accepted Answer

Add a nodeSelector with disk=ssd to the Pod spec.. Option D is correct because a `nodeSelector` is the simplest and most direct way to guarantee that a Pod is scheduled only on nodes that have a specific label. By adding `nodeSelector: disk: ssd` to the Pod spec, Kubernetes will ensure the Pod is placed exclusively on nodes with the `disk=ssd` label, which matches the labeled node. This approach is straightforward and meets the requirement without additional complexity.

Answer

Set nodeName in the Pod spec to the node name.

Answer

Use nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution and a matchExpression for disk=ssd.

Answer

Add a toleration for a taint that the node has.

Question 6

Which THREE of the following are true about Network Policies in Kubernetes?

Accepted Answer

They are namespaced resources.. Network Policies are namespaced resources in Kubernetes, meaning they are defined within a specific namespace and only apply to pods in that namespace. This is confirmed by the Kubernetes API, where NetworkPolicy is a namespaced resource under the networking.k8s.io/v1 API group, and it cannot be applied cluster-wide without additional tooling like a cluster-scoped policy engine.

Answer

They can block traffic at the node level.

Answer

They can modify packet contents.

Question 7

After applying this NetworkPolicy, a pod in the default namespace tries to curl an external website (e.g., google.com) and fails. What is the reason?

Accepted Answer

The Egress rule is defined but has no allow rules, so all egress is denied.. Option A is correct because the NetworkPolicy defines an Egress rule with an empty `rules` array, which means no egress traffic is explicitly allowed. In Kubernetes, when a NetworkPolicy selects a pod, it defaults to denying all traffic of the specified direction unless explicitly allowed. Since the Egress rule has no allow rules, all outbound traffic from the selected pods, including HTTP/HTTPS requests to external websites like google.com, is blocked by the policy.

Answer

The Ingress rule blocks all incoming traffic, preventing DNS responses.

Answer

The policy is applied to all namespaces, causing a conflict.

Answer

The policy only applies to pods with specific labels.

Question 8

Drag and drop the steps to upgrade a Kubernetes cluster using kubeadm into the correct order.

Question 9

Drag and drop the steps to troubleshoot a CrashLoopBackOff pod into the correct order.

Question 10

Drag and drop the steps to troubleshoot a Node that is in NotReady state into the correct order.

Question 11

Drag and drop the steps to create a Kubernetes cluster using kubeadm into the correct order.

Question 12

Drag and drop the steps to configure RBAC for a user to list pods in a specific namespace into the correct order.

Question 13

A system administrator needs to install a Kubernetes cluster using kubeadm. The control plane node must be initialized with a specific Pod network CIDR of 10.244.0.0/16 for Flannel. Which command should be used?

Accepted Answer

kubeadm init --pod-network-cidr 10.244.0.0/16. Option B is correct because `kubeadm init` uses the `--pod-network-cidr` flag to specify the CIDR range for Pod IP addresses, which is required by Flannel and other CNI plugins to allocate subnets to nodes. The 10.244.0.0/16 range is the default Pod network CIDR for Flannel, ensuring proper network configuration without conflicts.

Answer

kubeadm init --service-cidr 10.244.0.0/16

Answer

kubeadm init --network-cidr 10.244.0.0/16

Answer

kubeadm init --apiserver-advertise-address 10.244.0.0

Question 14

A cluster administrator notices that nodes are not joining the cluster after a kubeadm init. The kubelet logs show: 'failed to run Kubelet: could not init service: open /var/lib/kubelet/config.yaml: permission denied'. What is the most likely cause?

Accepted Answer

The kubelet configuration file has incorrect ownership or permissions.. The error message 'open /var/lib/kubelet/config.yaml: permission denied' indicates that the kubelet process does not have the necessary read permissions to access its configuration file. This is typically caused by incorrect file ownership (e.g., owned by root instead of the kubelet user) or restrictive file permissions (e.g., 600 instead of 644). Since kubelet runs as a systemd service, it requires appropriate access to this file to initialize properly.

Answer

The kubelet is running out of disk space.

Answer

The kubelet is not able to reach the API server.

Answer

The kubelet binary is missing.

Question 15

A company wants to install Kubernetes on a set of bare-metal servers with no existing orchestration tools. They need a solution that supports high availability for the control plane and uses etcd operators for cluster management. Which tool should they use?

Accepted Answer

kubeadm. kubeadm is the correct choice because it is the official Kubernetes tool for bootstrapping production-grade clusters on bare-metal servers, supporting high availability (HA) for the control plane via stacked or external etcd topologies. It integrates with etcd operators (e.g., etcdadm or the etcd-operator project) for cluster management, allowing automated etcd cluster lifecycle operations. Other tools either lack HA control plane support, are not designed for bare-metal, or do not use etcd operators.

Answer

kube-spray

Answer

minikube

Answer

kops

Question 16

A cluster administrator has configured a PodSecurityPolicy (PSP) that requires all pods to run with read-only root filesystem. However, a newly deployed pod is failing to start with the error 'container has runAsNonRoot and image will run as root'. The PSP is designed to prevent running as root. What is the most likely cause?

Accepted Answer

The container image is configured to run as root user.. The error message 'container has runAsNonRoot and image will run as root' indicates that the PodSecurityPolicy (PSP) is configured with `runAsNonRoot: true`, but the container image itself is built to run as the root user (UID 0). The PSP enforces that the container must not run as root, but the image's default user is root, causing the admission controller to reject the pod. Option C correctly identifies this mismatch as the most likely cause.

Answer

The PodSecurityPolicy admission controller is not enabled.

Answer

The PSP is not set to enforce read-only root filesystem.

Answer

The PSP is not being applied to the pod's service account.

Question 17

Which THREE of the following are valid steps to enable audit logging in a Kubernetes cluster?

Accepted Answer

Create an audit policy file defining what events to log.. Option B is correct because audit logging in Kubernetes requires an audit policy file that defines which events (e.g., RequestResponse, Metadata) should be logged. This policy file must be created and then passed to the kube-apiserver via the --audit-policy-file flag. Without a policy file, the apiserver will not know what to log, even if other flags are set.

Answer

Store the audit policy in a ConfigMap and reference it via --audit-policy-configmap.

Answer

Restart the kubelet on the control plane node.

Question 18

A team is configuring etcd for a multi-node Kubernetes cluster. They want to ensure that etcd data is encrypted at rest. Which approach should they use?

Accepted Answer

Create an EncryptionConfiguration resource specifying a provider like 'aescbc' and configure the kube-apiserver with --encryption-provider-config.. Option B is correct because Kubernetes supports encrypting secrets and other resources at rest via an EncryptionConfiguration object, which is passed to the kube-apiserver using the --encryption-provider-config flag. This mechanism encrypts data before it is written to etcd, ensuring that even if the etcd storage is compromised, the data remains unreadable without the encryption key.

Answer

Use LUKS to encrypt the disk partition where etcd data is stored.

Answer

Use TLS certificates to encrypt communication between etcd and the API server.

Answer

Configure etcd to use encryption at rest by setting --experimental-encryption-provider.

Question 19

Which TWO of the following are valid methods to configure the kubelet's node IP address?

Accepted Answer

Setting the --node-ip flag in kubelet command line.. Option B is correct because the `--node-ip` flag explicitly sets the IP address that the kubelet uses to identify itself to the API server and other components. This flag directly configures the node's primary IP for kubelet-to-apiserver communication and is a standard method in both standalone kubelet and kubeadm-deployed clusters.

Answer

Using the --hostname-override flag.

Answer

Setting the --address flag in kubelet command line.

Answer

Setting the node-ip in the kubeadm-config ConfigMap.

Question 20

A user creates a Deployment with replicas=3. Two Pods are running, but the third is stuck in ContainerCreating. 'kubectl describe pod' shows 'Failed to create pod sandbox: rpc error: code = Unknown desc = failed to create containerd task: OCI runtime create failed: container_linux.go:349: starting container process caused: exec: "/app": stat /app: no such file or directory'. What is the most likely cause?

Accepted Answer

The container image does not have the /app executable at the specified path.. The error message 'exec: "/app": stat /app: no such file or directory' indicates that the container runtime (containerd) successfully created the sandbox and started the container process, but the command specified in the container's entrypoint or command tried to execute '/app', which does not exist inside the container image. This is a classic misconfiguration where the image lacks the expected binary or script at the given path, causing the container to fail immediately after creation.

Answer

The container image is not pulled due to authentication failure.

Answer

The container exceeds its memory limit and is killed.

Answer

The node is not schedulable due to taints.