CKA Practice Test 29 — 15 Questions

Question 1

What is the default DNS name for a service named 'my-svc' in namespace 'default'?

Accepted Answer

my-svc.default.svc.cluster.local. In Kubernetes, the default DNS name for a service follows the pattern `..svc.cluster.local`. For a service named 'my-svc' in the 'default' namespace, the fully qualified domain name (FQDN) is `my-svc.default.svc.cluster.local`. This is defined by the cluster DNS specification (CoreDNS or kube-dns) and allows pods to resolve the service by name within the cluster.

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Answer

my-svc.cluster.local

Question 2

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Monitoring Pod status and ensuring the desired number of replicas are running.. Option A is correct because the kube-controller-manager runs the ReplicaSet (and ReplicationController) controller, which continuously watches Pod status via the API server and creates or deletes Pods so that the actual number of replicas matches the desired count in the spec. Option E is correct because the kube-controller-manager also runs the endpoints controller (and endpointslice controller), which populates Endpoints/EndpointSlice objects for Services by tracking the readiness and IP addresses of the Pods selected by each Service's selector. Option B is wrong because maintaining network rules on nodes is the job of the kube-proxy component, not the kube-controller-manager. Option C is wrong because assigning Pods to nodes is the responsibility of the kube-scheduler, which filters and scores nodes based on resource availability and constraints. Option D is wrong because managing cloud provider-specific resources such as load balancers is handled by the cloud-controller-manager (cloud controller manager), which was split out from the kube-controller-manager.

Answer

Maintaining network rules on nodes.

Answer

Assigning Pods to nodes based on resource availability.

Answer

Managing cloud provider-specific resources like load balancers.

Question 3

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

Accepted Answer

IPVS supports multiple load balancing algorithms.. IPVS (IP Virtual Server) supports multiple load balancing algorithms, such as round-robin, least-connection, source-hashing, and others, which is a key advantage over iptables mode. This allows kube-proxy to distribute traffic across pods more flexibly and efficiently, especially in high-traffic environments.

Answer

IPVS uses iptables rules for service discovery.

Answer

IPVS is the default kube-proxy mode since Kubernetes 1.0.

Answer

IPVS cannot handle large numbers of services.

Question 4

Which THREE of the following are valid steps to troubleshoot a DNS issue within a Kubernetes cluster?

Accepted Answer

Verify that the kube-dns service has endpoints using 'kubectl get endpoints -n kube-system kube-dns'. Option A is correct because verifying that the kube-dns service has endpoints with 'kubectl get endpoints -n kube-system kube-dns' confirms that the DNS service is properly backed by CoreDNS pods; if the endpoint list is empty, DNS resolution will fail cluster-wide. Option B is correct because inspecting CoreDNS pod logs via 'kubectl logs -n kube-system -l k8s-app=kube-dns' reveals errors such as plugin failures, upstream timeouts, or configuration problems that directly explain DNS resolution issues. Option E is correct because running 'kubectl exec -it busybox -- nslookup kubernetes.default' from inside a pod tests actual in-cluster DNS resolution against the kubernetes.default service, isolating whether the problem is DNS-specific or broader networking. Option C is not a valid cluster DNS troubleshooting step because /etc/resolv.conf on the node governs the node's own resolver, not the DNS configuration injected into pods (which comes from the pod's dnsPolicy and kubelet settings). Option D is not valid because restarting all nodes is a disruptive, non-targeted action that does not address DNS misconfiguration and is not an accepted troubleshooting procedure.

Answer

Check the /etc/resolv.conf on the node

Answer

Restart all nodes to reset DNS settings

Question 5

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time batch task that runs to completion and then exits. It ensures a specified number of Pods terminate successfully, making it ideal for processing data and exiting without requiring continuous availability.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 6

You want to view the resource usage of all pods in the cluster. What command should you run?

Accepted Answer

kubectl top pods --all-namespaces. The `kubectl top pods --all-namespaces` command retrieves real-time CPU and memory usage metrics for all pods across every namespace in the cluster. This is the correct way to view resource usage of all pods, as it relies on the metrics server to collect and expose pod-level resource consumption data.

Answer

kubectl describe nodes

Answer

kubectl get pods -o wide

Answer

kubectl top nodes

Question 7

You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?

Accepted Answer

podSelector in spec.ingress.from. In a Kubernetes NetworkPolicy, the `spec.ingress.from` field specifies the sources allowed to send ingress traffic. To match pods with a specific label within the same namespace, you use a `podSelector` under `from`. This selects pods based on their labels, and since no `namespaceSelector` is specified, it defaults to the same namespace as the NetworkPolicy.

Answer

podSelector in spec.podSelector

Answer

podSelector in spec.egress.to

Answer

namespaceSelector in spec.ingress.from

Question 8

Which annotation is commonly used with ExternalDNS to specify the DNS hostname for a Service?

Accepted Answer

external-dns.alpha.kubernetes.io/hostname. `external-dns.alpha.kubernetes.io/hostname` is the annotation used by the ExternalDNS project to specify the desired DNS hostname for a Kubernetes Service or Ingress. ExternalDNS watches resources with this annotation and synchronizes the DNS records (e.g., A or CNAME) with a configured DNS provider like AWS Route53 or Google Cloud DNS.

Answer

service.beta.kubernetes.io/load-balancer-dns

Answer

dns.alpha.kubernetes.io/hostname

Answer

kubernetes.io/ingress.class

Question 9

A pod is in 'CrashLoopBackOff' state. Which THREE of the following are possible causes?

Accepted Answer

The container's startup command has invalid arguments. Option A is correct because if the container's startup command (ENTRYPOINT/CMD) contains invalid arguments, the process exits immediately with a non-zero code, causing kubelet to restart it repeatedly and enter CrashLoopBackOff. Option C is correct because if the application attempts to bind to a port already in use inside the container, it fails at startup and exits, triggering the same restart loop. Option E is correct because a missing required environment variable typically causes the application to fail fast during initialization, again producing repeated crashes. Option B is not a CrashLoopBackOff cause: a nonexistent image results in an ImagePullBackOff or ErrImagePull state, since the container never starts. Option D is also not correct: an unbound PVC leaves the pod stuck in Pending (or ContainerCreating) due to an unschedulable volume, not in CrashLoopBackOff.

Answer

The container image does not exist

Answer

The PersistentVolumeClaim is not bound

Question 10

To make a node unschedulable without evicting existing pods, which command should be used?

Accepted Answer

kubectl cordon node01. `kubectl cordon` marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the precise command for the task described, as it modifies the node's `spec.unschedulable` field to `true` without affecting running workloads.

Answer

kubectl taint node01 key=value:NoSchedule

Answer

kubectl drain node01

Answer

kubectl uncordon node01

Question 11

Which kubectl command correctly retrieves the list of EndpointSlices for a Service named 'my-svc' in the 'default' namespace?

Accepted Answer

kubectl get endpointslice -n default --selector=kubernetes.io/service-name=my-svc. EndpointSlices are the modern, scalable replacement for Endpoints, and they use a specific label `kubernetes.io/service-name` to associate them with a Service. The command `kubectl get endpointslice -n default --selector=kubernetes.io/service-name=my-svc` correctly filters EndpointSlices by that label, retrieving all slices belonging to 'my-svc'.

Answer

kubectl get endpoints my-svc -n default

Answer

kubectl describe svc my-svc -n default

Answer

kubectl get endpointslices my-svc -n default

Question 12

A pod is not able to communicate with another pod in the same namespace. Both pods are running and have IP addresses. Which command can you use to test connectivity from the first pod to the second pod's IP?

Accepted Answer

kubectl exec first-pod -- ping . `kubectl exec first-pod -- ping ` runs the `ping` command inside the first pod, which uses ICMP to test IP-level connectivity to the second pod's IP address. This directly verifies whether the network path between the two pods is functional, including any CNI plugin, overlay network, or network policy rules.

Answer

kubectl logs first-pod

Answer

kubectl top pod first-pod

Answer

kubectl exec second-pod -- ping <first-pod-ip>

Question 13

What is the default pod phase when a pod is first created but not yet running?

Accepted Answer

Pending. When a Pod is first created, it enters the Pending phase before it is scheduled onto a node and its containers are started. The Pending phase indicates that the Pod has been accepted by the Kubernetes API server but one or more containers are not yet running, often because the image is being pulled or the node is not ready. This is the default initial phase as defined in the Kubernetes Pod lifecycle.

Answer

Running

Answer

Succeeded

Answer

Unknown

Question 14

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.

Answer

kubeadm upgrade plan --certificate-expiration

Answer

kubectl config view --raw | grep client-certificate

Answer

openssl x509 -in /etc/kubernetes/admin.conf -text -noout

Question 15

You have a Deployment with the following resource limits for containers: memory: 256Mi. The pod is repeatedly killed with OOMKilled. You need to change the limit to 512Mi. Which field should you modify in the Deployment YAML?

Accepted Answer

spec.template.spec.containers[].resources.limits.memory. The OOMKilled error occurs when a container exceeds its memory limit. To resolve this, you must increase the memory limit in the Deployment's pod template. Option A correctly identifies the field `spec.template.spec.containers[].resources.limits.memory`, which directly controls the maximum memory the container can use before being killed by the OOM killer.

Answer

spec.template.spec.containers[].resources.requests.memory

Answer

spec.template.spec.containers[].resources.requests.cpu

Answer

spec.template.spec.containers[].resources.limits.cpu