CKA Practice Test 22 — 15 Questions

Question 1

Which command can be used to view resource usage of nodes in a cluster?

Accepted Answer

kubectl top nodes. 'kubectl top nodes', correctly displays CPU and memory usage for all nodes in the cluster, provided the metrics server is deployed. Option A, 'kubectl describe nodes', shows detailed node information but not resource usage metrics. Option B, 'kubectl top pods', shows pod resource usage, not nodes. Option C, 'kubectl get pods --show-resources', is not a valid command in kubectl.

Answer

kubectl describe nodes

Answer

kubectl top pods

Answer

kubectl get pods --show-resources

Question 2

Which of the following is the default DNS name for a Service named 'api' in namespace 'production'?

Accepted Answer

api.production.svc.cluster.local. In Kubernetes, the default DNS name for a Service follows the pattern `..svc.cluster.local`. For a Service named 'api' in namespace 'production', this resolves to `api.production.svc.cluster.local`. The `svc` subdomain is a fixed component that distinguishes Service DNS records from Pod DNS records, and `cluster.local` is the default cluster domain.

Answer

api.production.cluster.local

Answer

production.api.svc.cluster.local

Answer

api.svc.production.cluster.local

Question 3

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

Accepted Answer

Role and RoleBinding. A Role grants permissions within a specific namespace, and a RoleBinding binds that Role to a user or service account within the same namespace. To restrict a user to creating and managing deployments only in the 'development' namespace, you need a Role (scoped to that namespace) and a RoleBinding (also scoped to that namespace). ClusterRole and ClusterRoleBinding are cluster-scoped and would grant permissions across all namespaces, which is not desired here.

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Answer

ClusterRole and RoleBinding

Question 4

A developer reports that a Pod named 'web-pod' in namespace 'frontend' is crashing repeatedly. You run 'kubectl logs web-pod -n frontend' but see no output. Which command should you run next to see the logs from the previous, crashed container instance?

Accepted Answer

kubectl logs web-pod -n frontend --previous. The `kubectl logs --previous` flag retrieves logs from the previous instance of a container in a Pod, which is exactly what you need when the current container has crashed and restarted, leaving no logs from the current instance. Since `kubectl logs web-pod -n frontend` returned no output, the current container likely started fresh after a crash, and the logs from the crashed container are stored in the terminated container's log file. This flag accesses those logs without needing to specify a container name explicitly when there is only one container in the Pod.

Answer

kubectl get events -n frontend --sort-by=.metadata.creationTimestamp

Answer

kubectl logs web-pod -n frontend -c web-pod

Answer

kubectl exec -it web-pod -n frontend -- sh

Question 5

A cluster administrator needs to create a PersistentVolume that can be mounted as a block device (not a filesystem) by a Pod. Which field in the PersistentVolume spec must be set to enable this?

Accepted Answer

volumeMode: Block. Setting `volumeMode: Block` in the PersistentVolume spec specifies that the volume is to be presented as a raw block device, without a filesystem. This allows a Pod to mount the volume as a block device (e.g., `/dev/sdb`) rather than a mounted directory, which is required for applications that need direct access to the underlying storage, such as databases or custom storage engines.

Answer

persistentVolumeReclaimPolicy: Retain

Answer

volumeMode: Filesystem

Answer

accessModes: ReadWriteOnce

Question 6

You create a PriorityClass named 'high-priority' with value 1000000 (one million). A pod uses this PriorityClass. The cluster has limited resources. What scheduling behavior is most likely?

Accepted Answer

The pod may preempt lower-priority pods to be scheduled. PriorityClass with value 1000000 is extremely high (the default max is 1 billion). When a pod with this PriorityClass is submitted and the cluster has limited resources, the Kubernetes scheduler may preempt (evict) lower-priority pods to free resources and schedule this high-priority pod. This is the core behavior of PriorityClass and preemption in Kubernetes.

Answer

The pod will never be preempted by other pods

Answer

The pod will be scheduled only after all lower-priority pods have been scheduled

Answer

The pod will be assigned a higher CPU priority in the kernel

Question 7

You run 'kubectl get pods' and see a pod in 'CrashLoopBackOff'. You want to see the logs of the last crashed instance. Which command should you run?

Accepted Answer

kubectl logs pod-name --previous. The `--previous` flag (or its shorthand `-p`) tells `kubectl logs` to retrieve logs from the previous instance of a container that has crashed and restarted. Since the pod is in `CrashLoopBackOff`, the current container has already exited, and you need to inspect the logs of the last terminated container to diagnose the crash. To avoid having two correct answers, Option C has been changed to an invalid flag.

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name --last

Answer

kubectl logs pod-name

Question 8

You need to back up etcd on a single control plane node. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/etcd-snapshot.db. It uses the required `ETCDCTL_API=3` environment variable and specifies the necessary TLS client certificates (`--cacert`, `--cert`, `--key`) to authenticate to the etcd server, which by default listens on `https://127.0.0.1:2379` with mutual TLS enabled. The `snapshot save` command creates a point-in-time backup of the etcd data store, essential for disaster recovery in a Kubernetes control plane.

Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 snapshot save /backup/etcd-snapshot.db

Answer

ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db

Answer

etcdctl snapshot save /backup/etcd-snapshot.db

Question 9

You want to expose an application running in the cluster on a public IP address. Which Service type should you use?

Accepted Answer

LoadBalancer. The LoadBalancer service type provisions an external load balancer (e.g., from a cloud provider) that assigns a public IP address to the service, directing external traffic to the application pods. This is the correct choice when you need a publicly accessible IP address without manual node-level configuration.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 10

A developer creates a YAML manifest for a pod that uses a PersistentVolumeClaim. The PVC requests 5Gi of storage but the only available PV has 10Gi. What will happen when the pod is created?

Accepted Answer

The PVC will bind to the PV and the pod will run.. PersistentVolumeClaims (PVCs) bind to PersistentVolumes (PVs) based on satisfying the requested storage size and access modes. Kubernetes allows a PVC to bind to a PV that has equal or greater capacity than requested; the PVC will consume only its requested amount (5Gi) from the larger PV (10Gi). Once bound, the pod referencing the PVC can start successfully because the storage claim is satisfied.

Answer

The PV will be resized to 5Gi to match the PVC.

Answer

The PVC will not bind and the pod will remain Pending.

Answer

The PVC will bind but the pod will be OOMKilled.

Question 11

Which THREE components are part of the Gateway API resource model? (Select THREE)

Accepted Answer

Gateway. A Gateway is a top-level resource in the Gateway API resource model that represents a specific point where traffic is received and processed, typically backed by a load balancer or proxy. It defines listeners (protocol, port, hostname) and references a GatewayClass to indicate the implementation.

Answer

LoadBalancer

Answer

Ingress

Question 12

A developer wants to deploy a pod that will run only once to initialize a database schema. Which Kubernetes resource should they use?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time task that runs to completion, such as initializing a database schema. Unlike controllers that maintain a desired number of replicas, a Job creates one or more Pods and ensures they successfully terminate, making it ideal for batch or initialization workloads.

Answer

DaemonSet

Answer

Deployment

Answer

CronJob

Question 13

What is the purpose of a PriorityClass in Kubernetes?

Accepted Answer

To ensure that high-priority pods can preempt lower-priority pods. PriorityClass in Kubernetes is used to assign a priority value to pods, which the scheduler uses to determine scheduling order and, critically, to enable preemption. When the cluster is under resource pressure, the scheduler can preempt (evict) lower-priority pods to make room for higher-priority pods that cannot be scheduled. This ensures that critical workloads can run even when resources are scarce, which is the core purpose of PriorityClass.

Answer

To define which nodes a pod can be scheduled on based on priority

Answer

To set the order in which pods are started

Answer

To give a pod a higher share of CPU cycles

Question 14

Which component is responsible for assigning pods to nodes?

Accepted Answer

kube-scheduler. The kube-scheduler is responsible for assigning pods to nodes based on resource requirements, constraints, and policies. It watches for newly created pods that have no node assignment and selects an optimal node for each pod to run on.

Answer

kubelet

Answer

kube-apiserver

Answer

kube-controller-manager

Question 15

A Pod is running but cannot connect to a Service. You have verified that the Service endpoints are correct. Which of the following is the most likely cause if the Pod is using hostNetwork: true?

Accepted Answer

The Pod uses hostNetwork and cannot resolve the ClusterIP due to DNS configuration. When a Pod uses `hostNetwork: true`, it shares the node's network namespace and directly uses the host's network stack. ClusterIP Services are virtual IPs managed by iptables or IPVS rules on the node, but these rules are typically applied only to the host's network namespace. However, the most common issue is that the Pod's DNS resolver (e.g., `/etc/resolv.conf`) is configured to resolve the Service name via the cluster's DNS (CoreDNS/kube-dns), which returns a ClusterIP. Since the Pod is on the host network, it may not have the necessary iptables rules to route traffic to the ClusterIP, or the DNS configuration may point to a DNS server that is not reachable from the host network (e.g., the cluster DNS service IP itself). Option D correctly identifies that the Pod cannot resolve the ClusterIP due to DNS configuration, as the Pod's DNS settings are inherited from the node but may not include the cluster DNS server, or the cluster DNS is not accessible from the host network.

Answer

The kube-proxy is not running on the node

Answer

The Service is not defined correctly

Answer

The container image is missing networking tools