CKA Practice Test 21 — 15 Questions

Question 1

A pod has resource requests: cpu: 250m, memory: 128Mi. The node has 2 CPU cores and 4Gi memory. What is the maximum number of such pods that can fit on this node based solely on CPU requests?

Accepted Answer

8. The node has 2 CPU cores, which equals 2000m (2000 milliCPU). Each pod requests 250m CPU. Dividing 2000m by 250m gives 8 pods. This calculation assumes no other pods or system overhead, and only considers CPU requests, not limits or other resources.

Answer

32

Answer

16

Answer

4

Question 2

Which of the following service types exposes a service on a static port on each node's IP address?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a service on a static port (in the range 30000-32767) on every node's IP address. When you create a NodePort service, Kubernetes allocates a port from that range and opens that port on all nodes, forwarding traffic to the service's ClusterIP and then to the pods.

Answer

ExternalName

Answer

LoadBalancer

Answer

ClusterIP

Question 3

A pod with priorityClassName: high is pending. You describe the pod and see the event: '0/3 nodes are available: 3 node(s) didn't match pod affinity/anti-affinity, 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate.' The pod has required anti-affinity to avoid co-location with pods from the same app. How can you get the pod scheduled?

Accepted Answer

Change the anti-affinity rule from requiredDuringSchedulingIgnoredDuringExecution to preferredDuringSchedulingIgnoredDuringExecution.. The pod is pending because its required anti-affinity rule cannot be satisfied on any node: all 3 nodes either have a control-plane taint (which the pod doesn't tolerate) or already host pods from the same app, violating the anti-affinity. Changing the rule from requiredDuringSchedulingIgnoredDuringExecution to preferredDuringSchedulingIgnoredDuringExecution makes the anti-affinity a soft constraint, allowing the scheduler to place the pod on a node even if it means co-locating with same-app pods, thus resolving the scheduling conflict.

Answer

Add a toleration for the control-plane taint.

Answer

Increase the number of replicas of the app to spread the pods.

Answer

Delete the existing pods of the same app to free up nodes.

Question 4

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

Accepted Answer

ipvs. (ipvs) is correct because kube-proxy in IPVS mode uses the Linux kernel's IP Virtual Server (IPVS) to implement Layer 4 load balancing, which supports sophisticated scheduling algorithms such as 'least connection' (lc), round-robin, and others. IPVS operates in kernel space with a hash table structure, providing better performance and scalability compared to iptables, especially in clusters with thousands of services.

Answer

iptables

Answer

kernelnet

Answer

userspace

Question 5

A Pod has an init container that writes a configuration file, and the main container reads that file. The init container runs successfully, but the main container fails with 'file not found'. What is the most likely cause?

Accepted Answer

The init container wrote the file to a different volume than the one mounted in the main container.. The most likely cause is that the init container wrote the configuration file to a volume that is not shared with the main container. In Kubernetes, init containers and main containers in the same Pod share the same filesystem only if they mount the same Volume. If the init container writes to a volume that is not mounted in the main container, or writes to a different path within the same volume, the main container will not see the file. This is a common misconfiguration when using emptyDir or hostPath volumes.

Answer

The main container restarted and the init container did not rerun.

Answer

The main container's command is incorrect.

Answer

The init container did not complete before the main container started.

Question 6

An admin runs 'kubectl get pods' and sees a pod in 'Pending' state for a long time. 'kubectl describe pod' shows '0/1 nodes are available: 1 node has memory pressure'. Which is the most likely cause?

Accepted Answer

The node is under memory pressure and cannot admit the pod.. The '0/1 nodes are available: 1 node has memory pressure' message in `kubectl describe pod` indicates that the kubelet on the node has set a memory pressure condition, which triggers eviction thresholds. When a node is under memory pressure, the kubelet refuses to admit new pods (except those with QoS class Guaranteed) to prevent further resource exhaustion, leaving the pod stuck in Pending state. This matches option C exactly.

Answer

The node's disk is full.

Answer

The pod's image pull secret is missing.

Answer

The pod requires more CPU than any node can provide.

Question 7

A pod is in CrashLoopBackOff. You check the logs with 'kubectl logs my-pod --previous' and see 'Error: cannot connect to database at 10.0.0.1:3306'. The database service is named 'mysql' and runs on port 3306. What is the most likely cause?

Accepted Answer

The application is configured with an incorrect database hostname. The error message 'cannot connect to database at 10.0.0.1:3306' indicates the application is trying to connect to a hardcoded IP address (10.0.0.1) instead of the Kubernetes service name 'mysql'. In Kubernetes, services are accessed via DNS names (e.g., 'mysql.default.svc.cluster.local'), not static IPs, which are ephemeral and can change. This misconfiguration causes the connection failure, leading to the CrashLoopBackOff as the app repeatedly fails to start.

Answer

The pod does not have network access to the mysql service

Answer

The mysql service is not exposed on port 3306

Answer

The database pod is not running

Question 8

An administrator needs to grant a service account 'sa-monitor' in namespace 'monitoring' the ability to read pods and services cluster-wide. Which RBAC configuration is correct?

Accepted Answer

Create a ClusterRole with rules for pods and services (verbs: get, watch, list) and a ClusterRoleBinding binding it to sa-monitor. The service account 'sa-monitor' needs to read pods and services across all namespaces (cluster-wide). A ClusterRole with verbs get, watch, list for pods and services, combined with a ClusterRoleBinding, grants these permissions cluster-wide, which is the only way to achieve cross-namespace read access for a service account.

Answer

Create a Role with rules for pods and services (verbs: get, watch, list) and a RoleBinding binding it to sa-monitor in namespace monitoring

Answer

Create a ClusterRole with rules for pods and services (verbs: create) and a ClusterRoleBinding binding it to sa-monitor

Answer

Create a ClusterRole with rules for pods and services (verbs: get, watch, list) and a RoleBinding binding it to sa-monitor in namespace monitoring

Question 9

A cluster was upgraded from v1.28 to v1.29 using kubeadm. After upgrading the control plane, nodes remain at v1.28. What is the correct next step to upgrade a worker node?

Accepted Answer

SSH into the worker node and run 'kubeadm upgrade node', then upgrade kubelet and kubectl, then restart kubelet.. After upgrading the control plane with kubeadm, worker nodes must be upgraded individually. The correct sequence is to SSH into the worker node, run 'kubeadm upgrade node' to upgrade the kubelet configuration and static pod manifests, then upgrade the kubelet and kubectl binaries (typically via the package manager), and finally restart the kubelet to pick up the new version. This ensures the node runs the same Kubernetes version as the control plane.

Answer

Drain the node, then run 'kubeadm upgrade node' on the worker node.

Answer

Upgrade kubelet on the worker node using the package manager and restart kubelet.

Answer

Run 'kubeadm upgrade apply' on the worker node.

Question 10

After running 'kubeadm certs check-expiration', an admin sees that the 'apiserver' certificate expires in 30 days. Which command should be used to renew it?

Accepted Answer

kubeadm certs renew apiserver. `kubeadm certs renew apiserver` is the dedicated kubeadm command to renew the API server certificate without restarting the control plane. It updates the certificate in place using the existing CA, and the new certificate is automatically picked up after a static pod restart or kubelet reload.

Answer

kubeadm upgrade node

Answer

openssl req -new -x509 -days 365 -key /etc/kubernetes/pki/apiserver.key -out /etc/kubernetes/pki/apiserver.crt

Answer

kubectl certificate renew apiserver

Question 11

You create a Service with clusterIP: None. What is this called and what is its purpose?

Accepted Answer

Headless Service; it allows direct pod-to-pod DNS resolution.. A Service with `clusterIP: None` is called a Headless Service. Its purpose is to allow direct pod-to-pod DNS resolution by returning the IP addresses of the backing pods (via DNS A/AAAA records) rather than a single virtual ClusterIP, enabling stateful applications like databases to discover individual pod endpoints.

Answer

NodePort Service; it exposes on node ports.

Answer

ExternalName Service; it maps to an external DNS name.

Answer

ClusterIP Service; it provides a stable IP.

Question 12

You want to check the logs of a container that previously crashed. Which command should you use?

Accepted Answer

kubectl logs --previous <pod-name>. The `kubectl logs --previous` command retrieves logs from the previous instance of a container in a Pod that has crashed or been restarted. This is essential for debugging transient failures because the current container's logs may not contain the crash information. The `--previous` flag specifically accesses the terminated container's log stream, which is stored by the kubelet until the pod is deleted.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 13

Which of the following commands will list all PersistentVolumeClaims in a cluster?

Accepted Answer

kubectl get pvc. `kubectl get pvc` is the correct command to list PersistentVolumeClaims using the official short name. Option A lists PersistentVolumes (`pv`). Option C (`claims`) and Option D (`persistent-volume-claims` with hyphens) are invalid resource names and will result in an error.

Answer

kubectl get pv

Answer

kubectl get claims

Answer

kubectl get persistent-volume-claims

Question 14

Your cluster has three control plane nodes. You suspect the etcd cluster has a leader election issue. Which TWO commands can help diagnose the etcd cluster health and membership? (Choose TWO.)

Accepted Answer

etcdctl endpoint health --cluster. `etcdctl endpoint health --cluster` queries the health status of all etcd endpoints in the cluster, which directly reveals if any node is unreachable or unhealthy—a common symptom of leader election issues. Option E is correct because `etcdctl member list` displays the current cluster membership, including each member's ID, name, peer URLs, and client URLs, allowing you to verify that all expected control plane nodes are properly joined and that no split-brain or quorum loss has occurred.

Answer

etcdctl cluster-status

Answer

etcdctl version

Answer

etcdctl snapshot save snapshot.db

Question 15

A pod is in 'Pending' state. Which TWO of the following are possible causes? (Select 2)

Accepted Answer

Node has insufficient CPU or memory resources. Options A and C are correct. A pod remains in 'Pending' state when it cannot be scheduled or when required resources are not available. Insufficient CPU or memory resources (A) prevent the scheduler from placing the pod. An unbound PersistentVolumeClaim (C) causes the pod to wait until the claim is bound. Option B: container exited with non-zero exit code would result in a CrashLoopBackOff or error state, not Pending. Option D: container killed due to OOM would cause the container to restart and enter CrashLoopBackOff. Option E: misspelled image name leads to ImagePullBackOff, not Pending.

Answer

Container exited with non-zero exit code

Answer

Container was killed due to OOM

Answer

Image name is misspelled