CKA Practice Test 26 — 15 Questions

Question 1

Drag and drop the steps to troubleshoot a Node that is in NotReady state into the correct order.

Accepted Answer

Use kubectl to identify the node, SSH into the node, check kubelet and container runtime status, review logs, restart kubelet and/or container runtime. Start with kubectl to identify the node, then SSH, check kubelet and runtime, review logs, then restart.

Answer

SSH into the node, use kubectl to identify the node, check kubelet and container runtime, review logs, restart

Answer

Use kubectl to identify the node, SSH into the node, review logs, check kubelet and container runtime, restart

Answer

Use kubectl to identify the node, SSH into the node, restart kubelet and container runtime, check status, review logs

Question 2

You run 'kubectl cordon node1'. Which TWO statements describe the effect of this command? (Choose TWO.)

Accepted Answer

New pods will not be scheduled onto node1. Option D is correct because 'kubectl cordon node1' sets the node's spec.unschedulable field to true, which causes the Kubernetes scheduler to skip node1 when placing new pods, so no new pods will be scheduled onto it. Option E is correct because cordoning is precisely the operation that marks a node as unschedulable, which is reflected in the node's status and taints the scheduler's view of that node. The unmarked options do not belong: option A is wrong because cordoning does not remove the node from the cluster (that would require 'kubectl delete node'), option B is wrong because cordoning does not delete any pods, and option C is wrong because existing pods are not evicted by cordon—eviction requires 'kubectl drain' (with appropriate flags such as --ignore-daemonsets and --delete-emptydir-data).

Answer

The node is removed from the cluster

Answer

All pods on node1 are deleted

Answer

Existing pods on node1 are immediately evicted

Question 3

A pod is in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 1 node(s) had taint that the pod didn't tolerate, 2 node(s) didn't match pod's node affinity/selector, 1 node(s) had insufficient memory'. What does this indicate?

Accepted Answer

The pod is unschedulable due to multiple constraints. The 'Pending' state combined with the scheduler's message '0/4 nodes are available' and the listed reasons (taints, node affinity/selector mismatches, insufficient memory) indicates that the pod cannot be placed on any node due to multiple constraints. The scheduler evaluates all nodes and finds none that satisfy the pod's requirements, making the pod unschedulable. This is not a transient resource issue but a combination of scheduling constraints that must be resolved manually.

Answer

The pod's image pull failed on all nodes

Answer

The pod will eventually be scheduled when resources free up

Answer

The pod has a resource limit that prevents it from running

Question 4

Which TWO of the following are valid reclaim policies for a PersistentVolume?

Accepted Answer

Retain. The `Retain` reclaim policy is one of the three valid policies for a PersistentVolume in Kubernetes. When a PersistentVolumeClaim is deleted, a PV with `Retain` policy will not be automatically reclaimed; instead, the volume remains in a `Released` state, preserving its data for manual administrator intervention.

Answer

Snapshot

Answer

Reuse

Answer

Archive

Question 5

Which TWO statements are correct regarding DaemonSets?

Accepted Answer

DaemonSets are often used for cluster monitoring or logging agents.. DaemonSets are designed to run a copy of a pod on every node (or a subset of nodes based on node selectors), making them ideal for cluster-wide infrastructure services such as monitoring agents (e.g., Prometheus Node Exporter), logging agents (e.g., Fluentd), and network plugins (e.g., Calico). This pattern ensures that each node has the necessary agent running without manual intervention.

Answer

DaemonSets do not support rolling updates.

Answer

DaemonSets can be scaled up and down using kubectl scale.

Answer

DaemonSets use a replica count to determine how many pods to run.

Question 6

An administrator is tasked with setting up a new Kubernetes cluster using kubeadm. They have two nodes: one control plane and one worker. After initializing the control plane with 'kubeadm init', the worker node fails to join with the error 'error execution phase preflight: [preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running'. What should the administrator check first?

Accepted Answer

Ensure that containerd is installed and running on the worker node.. The error 'container runtime is not running' on the worker node indicates that the CRI (Container Runtime Interface) implementation, typically containerd, is not active. Since kubelet relies on a running container runtime to manage pods, the administrator must first check that containerd is installed and running on the worker node using commands like 'systemctl status containerd' or 'systemctl start containerd'.

Answer

Verify that the control plane node is healthy.

Answer

Check if the join token has expired.

Answer

Install a network plugin like Calico on the control plane.

Question 7

An administrator notices that traffic to a Service is not being forwarded to any pod. The Service has selector 'app: web' and there are pods with that label. However, 'kubectl get endpoints' shows no endpoints. What is the most likely cause?

Accepted Answer

The pods are not in Ready state (e.g., failing readiness probes).. The most likely cause is that the pods are not in Ready state, often due to failing readiness probes. Kubernetes endpoints are only populated for pods that pass their readiness checks; if a pod is not Ready, it is removed from the Service's endpoint list, even if it is running and has the correct labels.

Answer

The Service port name does not match the container port name.

Answer

The Service type is ClusterIP.

Answer

The Service targetPort is not specified.

Question 8

You run 'kubectl get pods' and see a pod with status 'ImagePullBackOff'. Which of the following is a possible cause?

Accepted Answer

The container image name is misspelled. The correct answer is C: the container image name is misspelled. ImagePullBackOff means the kubelet failed to pull the container image and is backing off before retrying, which commonly happens when the image reference is invalid, such as a typo in the image name or tag, or when the image does not exist in the registry. Option A is incorrect because disk pressure on a node typically causes Evicted pods or a DiskPressure node condition, not ImagePullBackOff. Option B is incorrect because insufficient resource limits usually lead to Pending scheduling or OOMKilled states, not image pull failures. Option D is incorrect because a failing liveness probe causes container restarts and a CrashLoopBackOff-like state, not an image pull error.

Answer

The node has a disk pressure condition

Answer

The pod's resource limits are too low

Answer

The pod's liveness probe is failing

Question 9

You are unable to resolve a Service DNS name from within a pod. To test DNS resolution, which command should you run inside the pod?

Accepted Answer

kubectl exec -- nslookup . The correct command is 'kubectl exec -- nslookup '. nslookup or dig are common DNS troubleshooting tools.

Answer

kubectl describe svc <service-name>

Answer

kubectl logs <pod>

Answer

kubectl attach <pod>

Question 10

Which volume type is typically used to share configuration data with a pod as files, where the data is stored in the cluster as a resource?

Accepted Answer

configMap. A ConfigMap volume mounts ConfigMap data as files inside the pod.

Answer

secret

Answer

hostPath

Answer

emptyDir

Question 11

You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?

Accepted Answer

mkdir -p $HOME/.kube && sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config. After running 'kubeadm init', the admin kubeconfig file is generated at /etc/kubernetes/admin.conf. To use kubectl as a regular (non-root) user, you must copy this file to the user's $HOME/.kube/config directory and then change its ownership to the current user. This ensures kubectl can authenticate to the cluster using the admin certificate and key embedded in the config file.

Answer

sudo kubeadm reset --force

Answer

sudo cp /etc/kubernetes/admin.conf /root/.kube/config

Answer

sudo cp /etc/kubernetes/pki/admin.conf $HOME/.kube/config

Question 12

A StatefulSet named 'web' uses volumeClaimTemplates to create PVCs for each replica. You scale the StatefulSet from 3 to 5 replicas. What happens to the PVCs?

Accepted Answer

New PVCs are created for the new replicas (web-3 and web-4).. When a StatefulSet is scaled up, each new replica (e.g., web-3, web-4) automatically gets a new PVC created from the volumeClaimTemplate. The PVC name follows the pattern --, and the new PVCs are bound to newly provisioned PersistentVolumes. This ensures each pod has its own dedicated storage, preserving the identity and state of each replica.

Answer

All PVCs are deleted and recreated.

Answer

The PVCs are not created; you must create them manually.

Answer

Existing PVCs are reused for the new replicas.

Question 13

Which TWO of the following are valid commands to check the status of control plane components?

Accepted Answer

systemctl status kube-apiserver. `systemctl status kube-apiserver` directly queries the systemd service manager for the status of the kube-apiserver process, which is a core control plane component. Option C is correct because `kubectl get pods -n kube-system` lists all pods in the kube-system namespace, which includes control plane components like etcd, kube-scheduler, and kube-controller-manager when they run as static pods or Deployments. Both commands provide direct visibility into the health of control plane components.

Answer

kubectl get nodes

Answer

kubectl get events --all-namespaces

Answer

kubectl top nodes

Question 14

A pod is in ImagePullBackOff state. Which command is MOST useful to diagnose the issue?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed pod status, including the exact reason for ImagePullBackOff (e.g., invalid image name, registry authentication failure, or network issues). It surfaces the underlying error message from the kubelet, such as 'Failed to pull image' or 'manifest not found', which directly points to the root cause.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- ls

Answer

kubectl get events --field-selector type=Warning

Question 15

Which command can you run to see the events related to a specific pod?

Accepted Answer

kubectl describe pod pod-name. `kubectl describe pod pod-name` includes a dedicated 'Events' section that lists all lifecycle events for that specific pod, such as scheduling, container pulls, and restarts. This command filters events to only those relevant to the pod, making it the most direct way to view pod-specific events without needing to parse all cluster events.

Answer

kubectl logs pod-name

Answer

kubectl get pod pod-name

Answer

kubectl get events