CKA Practice Test 21 — 15 Questions

Question 1

You create a Deployment with 3 replicas and a ClusterIP Service. You notice that some pods are not receiving traffic. What is the most likely cause?

Accepted Answer

The Service's selector does not match the pod labels. The most likely cause is that the Service's selector does not match the pod labels. A ClusterIP Service uses label selectors to identify which pods should receive traffic; if the selector does not match the labels defined on the pods, the Service's endpoints controller will not populate the endpoints object, and traffic will not be forwarded to any pod. This is a common misconfiguration that results in some or all pods not receiving traffic, even though the pods themselves are healthy.

Answer

The pods are in CrashLoopBackOff

Answer

The Deployment has a revision history limit set too low

Answer

The Service type is NodePort instead of ClusterIP

Question 2

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

Accepted Answer

kubectl expose deployment web-app --type=NodePort --port=80. The `kubectl expose deployment web-app --type=NodePort --port=80` command creates a Service from an existing Deployment named 'web-app', setting the service type to NodePort and mapping port 80 on the node to the target port on the pods. This is the standard way to expose a Deployment as a NodePort service in Kubernetes.

Answer

kubectl expose pod web-app --type=NodePort --port=80

Answer

kubectl create deployment web-app --expose --port=80

Answer

kubectl create service nodeport web-app --port=80

Question 3

Which kubectl command is used to mark a node as unschedulable so that no new pods are scheduled onto it?

Accepted Answer

kubectl cordon . The `kubectl cordon ` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing any new pods onto that node, while existing pods continue to run unaffected. This is the correct command for the described task.

Answer

kubectl taint <node>

Answer

kubectl uncordon <node>

Answer

kubectl drain <node>

Question 4

You create a CronJob that should run every day at midnight. The CronJob has a startingDeadlineSeconds of 100. If the CronJob controller is down for 2 minutes, what happens?

Accepted Answer

The job is missed and will not run until the next scheduled time.. The CronJob controller was down for 2 minutes (120 seconds), which exceeds the `startingDeadlineSeconds` of 100. According to Kubernetes CronJob behavior, if the controller misses the scheduled start time by more than `startingDeadlineSeconds`, the job is considered missed and will not be retroactively created. The controller will only run the next scheduled instance.

Answer

The job runs as soon as the controller recovers.

Answer

The controller creates a Job with a backoff limit.

Answer

The job runs immediately but is delayed by 2 minutes.

Question 5

Which access mode allows multiple pods running on different nodes to read from and write to a PersistentVolume at the same time?

Accepted Answer

ReadWriteMany. ReadWriteMany (RWM) is the access mode that allows multiple pods running on different nodes to simultaneously read from and write to a PersistentVolume. This is defined in the Kubernetes PersistentVolume specification and is supported by storage backends like NFS, GlusterFS, or CephFS, which provide shared filesystem semantics across network-attached storage.

Answer

ReadOnlyMany

Answer

ReadWriteOnce

Answer

ReadWriteOncePod

Question 6

A container requests 256Mi memory and has a limit of 512Mi. The container tries to allocate 600Mi. What happens?

Accepted Answer

The container is killed with OOMKilled and restarted. The container's memory limit is 512Mi, and it attempts to allocate 600Mi, which exceeds the limit. Kubernetes enforces memory limits via cgroups; when a container exceeds its memory limit, the kernel's OOM killer terminates the process, resulting in an OOMKilled status. The container will then be restarted according to its restart policy (e.g., Always).

Answer

The container is allowed to use up to 600Mi if the node has free memory

Answer

The kernel throttles the container's memory usage

Answer

The container is evicted from the node

Question 7

Which component is responsible for running containers on a node and reporting their status to the control plane?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd) to start, stop, and monitor containers. The kubelet then reports the status of the node and its Pods back to the control plane via the Kubernetes API server, using heartbeats (NodeStatus updates) and Pod status updates.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Answer

kube-scheduler

Question 8

You have a Pod that is stuck in Pending state. Which command should you use to get detailed information about why the Pod is not running?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed event logs, status conditions, and resource constraints (e.g., insufficient CPU/memory, persistent volume claims pending, node selector mismatches) that explain why the Pod is stuck in Pending state. The Pending state indicates the Pod has been accepted by the API server but not yet scheduled or started, and `describe` surfaces the exact scheduler or admission controller failures.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- /bin/sh

Answer

kubectl get pod <pod-name>

Question 9

Which component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of replicas for a Deployment?

Accepted Answer

kube-controller-manager. The kube-controller-manager is responsible for running controller processes that regulate the state of the cluster. It includes the Deployment controller, which watches the API server for changes to Deployment objects and ensures the actual number of replicas matches the desired state by creating or deleting Pods via the ReplicaSet controller.

Answer

kube-apiserver

Answer

kubelet

Answer

kube-scheduler

Question 10

Which Service type exposes a Service on each Node's IP at a static port in the range 30000-32767?

Accepted Answer

NodePort. A NodePort Service exposes the Service on each Node's IP at a static port in the range 30000-32767. When you create a NodePort Service, Kubernetes allocates a port from that range (or you can specify one) and opens that port on every node in the cluster, forwarding traffic to the Service's ClusterIP and then to the selected Pods.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 11

A pod named 'app' is not starting. You run 'kubectl describe pod app' and see the event: 'MountVolume.SetUp failed for volume "pvc-volume" : rpc error: code = NotFound desc = volume not found'. What is the most likely issue?

Accepted Answer

The PersistentVolumeClaim (PVC) referenced by the pod does not exist or is not bound. The error 'volume not found' indicates that the PersistentVolumeClaim (PVC) named 'pvc-volume' does not exist or is not bound to a PersistentVolume (PV). Kubernetes requires a PVC to be in 'Bound' state before a pod can mount it; if the PVC is missing or unbound, the volume mount fails at pod startup.

Answer

The container image is not found in the registry

Answer

The node running the pod is out of disk space

Answer

The pod has insufficient CPU resources

Question 12

A developer runs 'kubectl run nginx --image=nginx --expose --port=80'. What Kubernetes resources are created?

Accepted Answer

A pod named 'nginx' and a ClusterIP service named 'nginx'. The `kubectl run nginx --image=nginx --expose --port=80` command creates a pod named 'nginx' and automatically generates a ClusterIP service named 'nginx' that exposes port 80. The `--expose` flag triggers the creation of a service of type ClusterIP (the default service type) to provide stable network access to the pod.

Answer

Only a pod named 'nginx'

Answer

A pod named 'nginx' and a LoadBalancer service named 'nginx'

Answer

A deployment named 'nginx' and a NodePort service named 'nginx'

Question 13

You have an Ingress resource with a TLS section specifying a secret named 'tls-secret'. The certificate in 'tls-secret' is expired. What happens when a client connects via HTTPS to the Ingress host?

Accepted Answer

TLS handshake succeeds but the client receives a warning about the expired certificate. When a client connects via HTTPS to an Ingress host with an expired TLS certificate, the Ingress controller (e.g., NGINX) still terminates the TLS handshake successfully because TLS termination does not validate certificate expiration at the server side. The expired certificate is presented to the client, and the client's browser or tool (e.g., curl) will show a warning about the expired certificate but the connection proceeds unless the client is configured to reject expired certificates. The Ingress controller does not enforce certificate validity; it only serves the configured secret.

Answer

The Ingress controller returns an error and refuses to terminate TLS

Answer

The Ingress controller automatically renews the certificate

Answer

The secret is ignored and HTTP is used instead

Question 14

You have a HorizontalPodAutoscaler targeting a Deployment with minReplicas=2 and maxReplicas=10. currentReplicas is 2. The HPA uses average CPU utilization across pods, targetting 80% of the requested CPU. Pod CPU request is 500m. The current average CPU utilization is 90%. What will the HPA do?

Accepted Answer

Scale up to 3 replicas. The HPA calculates the desired number of replicas as ceil(currentReplicas * (currentUtilization / targetUtilization)). Here, currentUtilization is 90% and targetUtilization is 80%, so desiredReplicas = ceil(2 * (90/80)) = ceil(2.25) = 3. Since 3 is within the min/max range (2–10) and differs from currentReplicas (2), the HPA will scale up to 3 replicas immediately (no stabilization window for scale-up by default).

Answer

Do nothing; wait for stabilization

Answer

Scale up to 4 replicas

Answer

Scale down to 1 replica because utilization is too high

Question 15

Which command rolls back a Deployment named 'web' to the previous revision?

Accepted Answer

kubectl rollout undo deployment web. The correct command to roll back a Deployment to the previous revision is `kubectl rollout undo deployment web`. This command reverts the Deployment to the last known stable revision by decrementing the revision number in the rollout history, effectively undoing the most recent change. It is the standard Kubernetes mechanism for rollback operations on Deployments, DaemonSets, and StatefulSets.

Answer

kubectl rollout restart deployment web

Answer

kubectl rollout history deployment web --revision=previous

Answer

kubectl rollout revert deployment web