CKA Practice Test 3 — 25 Questions

Question 1

A pod is stuck in Pending state. Running 'kubectl describe pod mypod' reveals the event '0/4 nodes are available: 3 Insufficient memory, 1 node(s) had taints that the pod didn't tolerate'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The pod requests more memory than available on any node and does not tolerate a node taint. The pod is pending because no node can satisfy its resource requirements or tolerate the node taints. The event indicates insufficient memory and a taint issue. The correct answer is that the pod requests more memory than any node can allocate and also does not tolerate a node taint.

Answer

The kubelet on all nodes is not running

Answer

The pod's container image is not pullable

Answer

The pod is using a hostPort that conflicts with an existing pod

Question 2

A pod uses a PVC with access mode RWO. The pod is scheduled on node A. You want to schedule another pod on node B that uses the same PVC. What will happen?

Accepted Answer

The second pod will be stuck in ContainerCreating state until the first pod releases the volume. A PVC with access mode RWO (ReadWriteOnce) can only be mounted as a block device or filesystem by a single node at a time. When the first pod on node A has the volume attached, the second pod on node B cannot attach the same volume because the underlying storage (e.g., an AWS EBS volume or GCE Persistent Disk) does not support multi-node attachment. The second pod will remain in ContainerCreating state with a 'Multi-Attach error' until the first pod releases the volume (e.g., by being deleted or rescheduled).

Answer

Both pods will mount the volume and share it without issues

Answer

The second pod will successfully mount the volume as read-only

Answer

The first pod will be evicted to allow the second pod to use the volume

Question 3

Which command shows resource usage (CPU/memory) of all pods in the default namespace?

Accepted Answer

kubectl top pods. kubectl top pod shows CPU and memory metrics for pods.

Answer

kubectl describe pods

Answer

kubectl logs pods

Answer

kubectl get pods -o wide

Question 4

During a 'kubeadm init', the administrator sees the message 'Your Kubernetes control-plane has been initialized successfully!' but the 'kubectl get nodes' shows the control plane node as 'NotReady'. What is the most likely missing step?

Accepted Answer

Install a CNI plugin such as Calico or Flannel.. The 'NotReady' status indicates that the kubelet on the control plane node is running but cannot report readiness because the node's network is not configured. A CNI plugin (e.g., Calico, Flannel, Weave) must be installed to set up the pod network, which is required for the kubelet to register the node as 'Ready'. Without a CNI plugin, the node's network conditions remain unmet, and the control plane cannot function properly.

Answer

Generate a join token for worker nodes.

Answer

Copy the kubeconfig to the user's home directory.

Answer

Check that the kubelet is running on the control plane node.

Question 5

A node in your cluster is marked as NotReady. You SSH into the node and run 'systemctl status kubelet'. The output shows the kubelet is inactive (dead). What should you do FIRST to restore the node?

Accepted Answer

Run 'systemctl start kubelet'. The kubelet service is stopped. The first step is to start it with 'systemctl start kubelet'. If it fails to start, further investigation with journalctl is needed.

Answer

Reboot the node

Answer

Delete the node object from the cluster

Answer

Reinstall the kubelet package

Question 6

You run 'kubectl get nodes' and one node shows 'NotReady'. Which command should you run first to check the kubelet status on that node?

Accepted Answer

journalctl -u kubelet. The kubelet is responsible for node status. On the node, you can check its logs with journalctl.

Answer

kubectl describe node <node-name>

Answer

cat /var/log/syslog | grep kubelet

Answer

systemctl status kube-apiserver

Question 7

Which command lists all events in the cluster sorted by timestamp?

Accepted Answer

kubectl get events --sort-by=.metadata.creationTimestamp. 'kubectl get events --sort-by=.metadata.creationTimestamp' shows events sorted by creation time. Alternatively, 'kubectl get events -w' watches events but does not sort.

Answer

kubectl get events --watch

Answer

kubectl logs --events

Answer

kubectl describe events

Question 8

You run 'kubectl get pods' and see a pod in 'CrashLoopBackOff'. What command would you run to see the reason for the crash?

Accepted Answer

kubectl describe pod . B is correct because `kubectl describe pod ` provides detailed information about the pod, including the container state, restart count, and the last termination reason (e.g., 'Error' or 'OOMKilled') along with its exit code. To view the actual stdout/stderr logs of the crashed container, you would use `kubectl logs --previous`.

Answer

kubectl top pod <pod-name>

Answer

kubectl rollout status deployment <deployment-name>

Answer

kubectl get events --field-selector involvedObject.name=<pod-name>

Question 9

You have a Deployment with livenessProbe configured. The pod restarts every few minutes. 'kubectl describe pod' shows the liveness probe is failing with 'HTTP probe failed with statuscode: 503'. The application's /healthz endpoint returns 200 from within the pod using 'kubectl exec'. What could be the issue?

Accepted Answer

The livenessProbe is configured with the wrong port. The liveness probe is failing externally but the endpoint works internally. This suggests the probe is hitting the wrong port or the network path is different. The most likely cause is that the livenessProbe is configured with a wrong port number.

Answer

The readinessProbe is interfering with the livenessProbe

Answer

The application has a memory leak

Answer

The kubelet on the node is misconfigured

Question 10

You need to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. After upgrading the control plane, what should you do on each worker node?

Accepted Answer

kubectl drain ; kubeadm upgrade node; kubectl uncordon . The standard kubeadm upgrade workflow for worker nodes requires first draining the node to safely evict all pods, then running 'kubeadm upgrade node' to upgrade the kubelet and kube-proxy configuration, and finally uncordoning the node to make it schedulable again. This sequence ensures minimal disruption to workloads and follows the official Kubernetes upgrade documentation.

Answer

kubeadm upgrade node config --kubelet-version v1.29.0

Answer

kubectl delete node <node>; kubeadm upgrade node

Answer

kubeadm upgrade node; kubectl uncordon <node>

Question 11

You have a StatefulSet with 5 pods, each requiring a unique stable network identity. The StatefulSet is scaled down from 5 to 3. Which pods will be terminated?

Accepted Answer

Pods with the highest ordinals (4 and 3). When a StatefulSet is scaled down, Kubernetes terminates pods in reverse order of their ordinal indices, starting from the highest. For a StatefulSet with 5 pods (ordinals 0-4) scaled to 3, pods with ordinals 4 and 3 are terminated first, ensuring that the remaining pods (0, 1, 2) maintain their stable network identities and storage.

Answer

Random pods

Answer

Pods with the lowest ordinals (0 and 1)

Answer

Pods with the highest resource usage

Question 12

A DevOps team is deploying a stateful application that requires persistent storage with ReadWriteMany access mode across multiple pods running on different nodes in a Kubernetes cluster. Which storage solution should they choose to meet this requirement?

Accepted Answer

Configure a PersistentVolume backed by NFS and a PersistentVolumeClaim with accessModes: ReadWriteMany. NFS supports ReadWriteMany (RWX) access mode, allowing multiple pods across different nodes to read and write to the same persistent storage simultaneously. A PersistentVolume backed by NFS, combined with a PersistentVolumeClaim specifying accessModes: ReadWriteMany, meets the requirement for a stateful application needing shared storage across nodes.

Answer

Use an emptyDir volume and share it among pods via a service

Answer

Create a local PersistentVolume on each node and use nodeSelector to pin pods

Answer

Use a hostPath volume mounted in each pod with the same path on each node

Question 13

A node is NotReady. You ssh into the node and run 'systemctl status kubelet'. It shows 'Active: inactive (dead)'. What is the most appropriate next step?

Accepted Answer

systemctl start kubelet. Starting the kubelet service with systemctl start kubelet is the correct action. Investigating logs may be needed if it fails to start.

Answer

journalctl -u kubelet

Answer

kubectl delete node <node-name>

Answer

systemctl restart docker

Question 14

A Deployment's pod is stuck in Pending state. 'kubectl describe pod' shows Events: '0/4 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient memory'. What is the likely fix?

Accepted Answer

Increase the memory limit of the pod or add more worker nodes. The error '3 Insufficient memory' indicates that three worker nodes lack the required memory to schedule the pod. Increasing the pod's memory limit (if it's set too high) or adding more worker nodes directly addresses the resource shortage. The control-plane node's taint is irrelevant because the pod is not trying to schedule there; the issue is insufficient memory on the available worker nodes.

Answer

Remove the taint from the control-plane node

Answer

Add a toleration for the control-plane taint to the pod spec

Answer

Set nodeSelector to schedule on control-plane nodes

Question 15

A user creates a PersistentVolumeClaim with a storage class 'ssd' that does not exist in the cluster. What will happen when the PVC is created?

Accepted Answer

The PVC will remain in Pending state.. When a PersistentVolumeClaim (PVC) references a StorageClass that does not exist in the cluster, the PVC cannot be dynamically provisioned because the provisioner associated with that StorageClass is missing. Without a matching StorageClass, the system cannot create a new PersistentVolume (PV) for the PVC, and since no existing PV matches the claim (or the PVC is set to use dynamic provisioning), the PVC will remain in a Pending state indefinitely until the StorageClass is created or the PVC is deleted.

Answer

The PVC will be deleted automatically after a timeout.

Answer

The PVC will be automatically bound to any available PV.

Answer

The cluster will create the storage class automatically.

Question 16

A developer deployed a Pod that is stuck in Pending state. The cluster has one worker node with taint 'node.kubernetes.io/disk-pressure:NoSchedule'. The Pod does not specify any tolerations. What is the most likely cause?

Accepted Answer

The node has a taint that the Pod does not tolerate.. A Pod stuck in Pending state indicates the scheduler cannot find a suitable node. The cluster has a worker node with the taint 'node.kubernetes.io/disk-pressure:NoSchedule', and the Pod has no tolerations. Since taints with effect NoSchedule prevent scheduling of Pods that do not tolerate them, the Pod cannot be placed on that node, leaving it in Pending.

Answer

The Pod was evicted due to resource pressure.

Answer

The Pod requests more CPU than available on the node.

Answer

The scheduler failed to communicate with the API server.

Question 17

Which command retrieves the rollout history of a Deployment named 'web'?

Accepted Answer

kubectl rollout history deployment web. The `kubectl rollout history deployment web` command retrieves the revision history of the specified Deployment, showing each revision number and, with the `--revision` flag, the details of a specific revision. This is the standard Kubernetes command for viewing rollout history, as defined in the kubectl reference.

Answer

kubectl describe deployment web

Answer

kubectl get events --field-selector involvedObject.name=web

Answer

kubectl rollout status deployment web

Question 18

A StatefulSet named 'mysql' is deployed with 3 replicas. A developer reports that the pod 'mysql-0' is failing due to persistent volume issues. After fixing the underlying storage, they want to recreate 'mysql-0' while preserving its stable network identity. What is the correct approach?

Accepted Answer

Delete the pod 'mysql-0' using kubectl delete pod mysql-0, and let the StatefulSet controller recreate it. StatefulSet pods are managed by a controller that automatically recreates a pod with the same identity (name, hostname, and stable network identity) when it is deleted. Deleting the pod 'mysql-0' triggers the StatefulSet controller to create a new pod with the same ordinal index and persistent storage binding, preserving its stable network identity.

Answer

Delete the StatefulSet and recreate it with the same configuration

Answer

Use kubectl replace --force on the StatefulSet to recreate the pod

Answer

Scale the StatefulSet down to 0 replicas, then scale back up to 3

Question 19

A HorizontalPodAutoscaler (HPA) is configured for a Deployment with targetCPUUtilizationPercentage: 80. The current CPU utilization is 90%. The deployment has minReplicas: 3 and maxReplicas: 10. What will the HPA do?

Accepted Answer

It increases the number of replicas.. The HPA increases the number of replicas because the current CPU utilization (90%) exceeds the target of 80%. The HPA calculates the desired replica count using the formula: desiredReplicas = ceil[currentReplicas * (currentMetricValue / targetMetricValue)], which yields ceil[3 * (90/80)] = ceil[3.375] = 4 replicas. This scales the deployment up to reduce per-pod CPU load, staying within the configured minReplicas (3) and maxReplicas (10).

Answer

It does nothing because the utilization is within the acceptable range.

Answer

It adds a new node to the cluster.

Answer

It decreases the number of replicas to reduce CPU usage.

Question 20

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

Accepted Answer

db-service.production.svc.cluster.local. Kubernetes DNS resolves services across namespaces using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since 'my-pod' is in the 'default' namespace and 'db-service' is in the 'production' namespace, the short name 'db-service' will not resolve; the FQDN must include the namespace and the cluster domain suffix to reach the service.

Answer

db-service

Answer

db-service.production.pod.cluster.local

Answer

production.db-service.svc.cluster.local