CKA Practice Test 27 — 15 Questions

Question 1

You need to check the memory usage of all pods in the 'production' namespace. Which command fulfills this requirement?

Accepted Answer

kubectl top pod --namespace=production. `kubectl top pod --namespace=production` directly queries the metrics-server to retrieve real-time CPU and memory usage for each pod in the specified namespace. This command leverages the Kubernetes Metrics API to display resource consumption, making it the precise tool for checking memory usage of pods.

Answer

kubectl get pod --namespace=production -o wide

Answer

kubectl describe pod --namespace=production

Answer

kubectl top node

Question 2

What is the default kube-proxy mode in modern Kubernetes clusters?

Accepted Answer

iptables. In modern Kubernetes clusters (v1.30+), the default kube-proxy mode is `iptables`. This mode uses Linux Netfilter rules to intercept and redirect traffic to backend pods, offering better performance and scalability than the legacy `userspace` mode while remaining the default for broad compatibility across distributions.

Answer

kernelspace

Answer

userspace

Answer

ipvs

Question 3

You are debugging a Pod that is in 'Pending' state. The output of 'kubectl describe pod' shows: Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning FailedScheduling 2m default-scheduler 0/3 nodes are available: 1 Insufficient cpu, 2 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate. What does this indicate?

Accepted Answer

The pod cannot be scheduled due to a combination of insufficient CPU and untolerated taints on different nodes. The event message explicitly states that 0/3 nodes are available due to two distinct issues: one node has insufficient CPU, and two nodes have a taint (node-role.kubernetes.io/master) that the pod does not tolerate. This means no single node satisfies all scheduling requirements, so the pod remains Pending. Option B correctly identifies that the scheduling failure is caused by a combination of resource insufficiency and untolerated taints across different nodes, not a single global problem.

Answer

The pod requires more memory than any node can provide

Answer

All nodes have taints that the pod does not tolerate

Answer

All nodes have insufficient CPU resources for the pod

Question 4

A DevOps engineer notices that the kubelet on a node is unable to register with the Kubernetes API server. The kubelet logs show 'Failed to get bootstrap CA certificate' and the node is not yet part of the cluster. What is the most likely cause?

Accepted Answer

The bootstrap token used for TLS bootstrapping has expired.. The bootstrap token used for TLS bootstrapping has expired. During the TLS bootstrap process, the kubelet uses a limited-time bootstrap token to authenticate with the API server and request a client certificate. If the token expires before the kubelet completes registration, the kubelet will fail to obtain the bootstrap CA certificate and cannot join the cluster, as indicated by the error 'Failed to get bootstrap CA certificate'.

Answer

The kubelet configuration file has incorrect node IP.

Answer

The node's RBAC permissions are misconfigured.

Answer

The API server is not running.

Question 5

What is the function of the 'kube-scheduler' in Kubernetes?

Accepted Answer

It assigns pods to nodes. The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Answer

It runs the container runtime

Answer

It manages network rules for services

Answer

It stores cluster state

Question 6

You need to expose a Deployment named 'web' on port 80 inside the cluster. Which kubectl command creates a ClusterIP service?

Accepted Answer

kubectl expose deployment web --port=80. The `kubectl expose deployment web --port=80` command creates a ClusterIP service by default, which exposes the deployment on port 80 within the cluster. The `expose` command without specifying `--type` defaults to ClusterIP, making it the appropriate choice for internal cluster access.

Answer

kubectl expose deployment web --type=NodePort --port=80

Answer

kubectl create service clusterip web --tcp=80

Answer

kubectl port-forward deployment/web 80:80

Question 7

You run kubectl get nodes and see one node is NotReady. The kubelet is running on the node. What is the most likely cause?

Accepted Answer

Network connectivity issue between kubelet and API server. When a node is NotReady but the kubelet is running, the most common cause is a network connectivity issue between the kubelet and the API server. The kubelet reports node status via periodic heartbeats (node-status-update-frequency, default 10s) and if the API server cannot receive these updates due to network problems (e.g., firewall rules, DNS resolution failure, or dropped packets), the node controller marks the node as NotReady after the node-monitor-grace-period (default 40s). The kubelet being running eliminates installation issues, and the API server being down would affect all nodes, not just one.

Answer

The kubelet is not installed

Answer

The node has been cordoned

Answer

The API server is down

Question 8

Which THREE of the following are characteristics of a StatefulSet? (Select 3)

Accepted Answer

Pods are started and terminated in a controlled order (sequentially). Option A is correct because a StatefulSet creates and deletes pods in a strict ordinal sequence (0, 1, 2, ... for creation and reverse order for termination), which is essential for stateful workloads that need ordered startup/shutdown. Option B is correct because StatefulSets use volumeClaimTemplates to give each replica its own PersistentVolumeClaim, so every pod gets dedicated storage that persists across rescheduling. Option E is correct because each pod in a StatefulSet receives a stable, unique hostname derived from the StatefulSet name plus ordinal index (e.g., web-0, web-1), backed by a governing headless Service. Option C is not a StatefulSet characteristic; pod placement across nodes is handled by the scheduler for all workload types, not specifically by StatefulSets. Option D is inaccurate because stable network identities require a headless Service (clusterIP: None), not a regular ClusterIP Service.

Answer

Pods are automatically distributed across all nodes in the cluster

Answer

StatefulSets require a ClusterIP service for stable network identities

Question 9

Which command can you use to view the logs of a container that has crashed and been restarted?

Accepted Answer

kubectl logs pod-name --previous. The --previous flag retrieves logs from the previous instance of the container.

Answer

kubectl describe pod pod-name

Answer

kubectl exec pod-name -- cat /var/log/crash.log

Answer

kubectl logs pod-name

Question 10

You have an Ingress resource with the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

A client sends a request to http://example.com/api/v1/users. Which path is matched?

Accepted Answer

/api. The Ingress rule uses `pathType: Prefix` with a path of `/api`. According to the Kubernetes Ingress specification, a Prefix pathType matches any URL path that has the specified path as its prefix. The request `/api/v1/users` starts with `/api`, so it matches the rule, and the traffic is forwarded to the `api-service` on port 80.

Answer

/api/v1/users

Answer

ImplementationSpecific: depends on the Ingress controller

Answer

No match, returns 404

Question 11

Which THREE components are required for a pod to resolve a Service DNS name?

Accepted Answer

The Service exists in the cluster. A Pod resolves a Service DNS name by querying the cluster's DNS service, which only returns an A/AAAA record if the Service object exists. Without the Service, the DNS name has no corresponding cluster IP to resolve, so the query fails with NXDOMAIN.

Answer

kube-proxy is running in iptables mode

Answer

A CNI plugin is installed

Question 12

Which command creates a Job that runs a single pod to execute the command 'echo Hello'?

Accepted Answer

kubectl create job hello --image=busybox -- echo Hello. `kubectl create job` is the dedicated command to create a Kubernetes Job object, which runs a pod to completion. The `--image=busybox` specifies the container image, and the `-- echo Hello` passes the command and its arguments to the container's entrypoint. This creates a non-repeating Job that executes the command once.

Answer

kubectl create cronjob hello --image=busybox -- echo Hello

Answer

kubectl create deployment hello --image=busybox -- echo Hello

Answer

kubectl run job hello --image=busybox -- echo Hello

Question 13

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Accepted Answer

NodePort. A NodePort service exposes the application on a static port (30000–32767) on every node's IP address, making it accessible externally via `:`. A LoadBalancer service provisions an external load balancer (e.g., from a cloud provider) that routes traffic to the service, typically using a public IP. Both are explicitly designed for external access, unlike ClusterIP which is internal only.

Answer

Headless

Answer

ExternalName

Answer

ClusterIP

Question 14

You have a kubeconfig file with multiple contexts. How do you switch to the context named 'prod-cluster'?

Accepted Answer

kubectl config use-context prod-cluster. `kubectl config use-context` is the command specifically designed to switch the current context in a kubeconfig file. It updates the `current-context` field in the kubeconfig to point to the specified context, which then determines which cluster, user, and namespace are used by default for subsequent `kubectl` commands.

Answer

kubectl config set-cluster prod-cluster

Answer

kubectl config set-context prod-cluster

Answer

kubectl config view prod-cluster

Question 15

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Accepted Answer

No pods match the service selector, so the service has no endpoints.. B is correct because if no pods match the service selector 'app: my-app', the service will have no endpoints. Without endpoints, the service cannot route traffic, and kubectl port-forward will fail to establish a connection to localhost:8080. The port-forward command relies on the service having at least one endpoint to forward traffic to.

Answer

The service type is ClusterIP, which does not support port forwarding.

Answer

kubectl port-forward cannot forward to services, only to pods.

Answer

The port forward command requires the --address flag to bind to localhost.