CKA Practice Test 30 — 15 Questions

Question 1

A pod is in ImagePullBackOff state. Which command would give you the most information about why the image pull failed?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed event logs, including the exact error message from the kubelet when it failed to pull the container image. This output includes the reason for the ImagePullBackOff state, such as authentication failures, image not found, or network issues, which is the most comprehensive information for troubleshooting.

Answer

kubectl get pod

Answer

kubectl logs <pod-name>

Answer

kubectl edit pod <pod-name>

Question 2

You create a StorageClass with volumeBindingMode: WaitForFirstConsumer. A PVC using this StorageClass is created but remains in 'Pending' state. The PVC expects a node with label 'disktype=ssd'. A suitable node exists. What is the MOST likely reason the PVC is still Pending?

Accepted Answer

No pod has been created that uses this PVC.. With volumeBindingMode: WaitForFirstConsumer, the PVC will not be bound to a PV until a pod that uses the PVC is scheduled. The PVC remains Pending because no pod has been created that references it, even though a matching node exists. The scheduler defers volume binding to ensure the PV is provisioned on the same node where the pod lands.

Answer

The node selector on the PVC is incorrect.

Answer

The PVC requests a storage size larger than available.

Answer

The persistentVolumeReclaimPolicy is set to Retain.

Question 3

You want to dynamically provision storage for a PVC using a StorageClass named 'fast-ssd'. Which field in the PVC YAML specifies the StorageClass?

Accepted Answer

storageClassName. In Kubernetes, the field that specifies which StorageClass to use for dynamic provisioning in a PersistentVolumeClaim (PVC) is `storageClassName`. When this field is set to a valid StorageClass name (e.g., 'fast-ssd'), the system will dynamically provision a PersistentVolume using the provisioner and parameters defined in that StorageClass. If omitted, the default StorageClass (if one exists) is used.

Answer

class

Answer

storageClass

Answer

className

Question 4

Which CSI driver feature must be supported by the driver to allow expanding a PVC while the pod using it is still running?

Accepted Answer

Volume expansion. To allow expanding a PVC while the pod is still running, the CSI driver must support volume expansion (e.g., ControllerExpandVolume and NodeExpandVolume RPCs). The in-use expansion capability is also controlled by the Kubernetes feature gate `ExpandInUsePersistentVolumes`, but that is not a CSI driver feature. Therefore, the correct answer is 'Volume expansion'.

Answer

Volume attach

Answer

Mount options

Answer

ExpandInUsePersistentVolume

Question 5

Which two statements about HorizontalPodAutoscaler (HPA) are correct?

Accepted Answer

HPA is a namespaced resource. HorizontalPodAutoscaler (HPA) is a namespaced resource in Kubernetes, meaning it exists within a specific namespace and can only target resources (like Deployments or StatefulSets) in that same namespace. This is defined in the Kubernetes API under the `autoscaling/v2` group, where HPA objects are scoped to a namespace, not cluster-wide.

Answer

HPA can only target Deployments

Answer

HPA requires the metrics-server to be installed

Answer

HPA can scale down to zero replicas

Question 6

Which THREE of the following are characteristics of a StatefulSet's volumeClaimTemplates?

Accepted Answer

The PVCs are created in the same namespace as the StatefulSet.. Option B is correct because volumeClaimTemplates generate PersistentVolumeClaims within the same namespace as the owning StatefulSet, since PVCs are namespaced resources and cannot cross namespace boundaries. Option C is correct because each generated PVC follows the naming convention --, giving every replica a unique, stable PVC tied to its Pod ordinal. Option D is correct because the core purpose of volumeClaimTemplates is to automatically provision a PersistentVolumeClaim for each StatefulSet replica, ensuring stable per-Pod storage. Option A is not correct because StatefulSet PVCs are retained by default when a Pod is deleted (only scale-down or deletion with the right policy may remove them), so automatic deletion is not a characteristic. Option E is not correct because storageClassName is optional in a volumeClaimTemplate; if omitted, the cluster's default StorageClass is used.

Answer

When a Pod is deleted, the corresponding PVC is automatically deleted.

Answer

The volumeClaimTemplate must specify a storageClassName.

Question 7

What is the default DNS name for a Service named 'my-service' in namespace 'my-ns'?

Accepted Answer

my-service.my-ns.svc.cluster.local. In Kubernetes, the default DNS name for a Service follows the pattern `..svc.cluster.local`. This is defined by the cluster DNS specification (CoreDNS or kube-dns). For a Service named 'my-service' in namespace 'my-ns', the fully qualified domain name (FQDN) is `my-service.my-ns.svc.cluster.local`. The `.svc` subdomain is a fixed part of the DNS schema, distinguishing Services from other resource types like Pods.

Answer

my-service.my-ns.cluster.local

Answer

my-service.svc.my-ns.cluster.local

Answer

my-service.cluster.local

Question 8

Which THREE of the following are valid steps to troubleshoot a Node in NotReady state? (Choose three)

Accepted Answer

Run 'systemctl status kubelet' on the node. Option A is correct because a Node in NotReady state is most often caused by the kubelet service being stopped or failed, and 'systemctl status kubelet' on the node quickly reveals whether the kubelet is active, inactive, or in a failed state. Option C is correct because the kubelet requires a working CRI container runtime such as containerd (or CRI-O) to report node health; if containerd is down, the kubelet cannot manage pods and the node transitions to NotReady, so verifying the runtime is running is a valid troubleshooting step. Option E is correct because 'journalctl -u kubelet' surfaces the kubelet's own error messages (e.g., failed to get node status, CRI connection errors, certificate or cgroup driver problems) that explain why the node is NotReady. Option B is not a valid step because restarting the kube-apiserver on the control plane does not fix a node-local kubelet or runtime failure and would disrupt the whole cluster. Option D is not valid because 'kubectl delete node <node-name>' removes the Node object from the API server rather than re-registering it; the kubelet re-registers only when it restarts and reconnects, so deleting the node is not a troubleshooting step for NotReady.

Answer

Restart the kube-apiserver on the control plane

Answer

Run 'kubectl delete node <node-name>' to re-register

Question 9

Which of the following is a valid CNI plugin for Kubernetes networking?

Accepted Answer

Calico. Calico is a valid CNI plugin that implements the Container Network Interface specification to provide networking and network policy for Kubernetes clusters. It uses BGP (Border Gateway Protocol) to route packets between nodes and supports overlay or non-overlay networking modes, making it a widely adopted choice for production environments.

Answer

etcd

Answer

Docker

Answer

Kubelet

Question 10

A pod has been in Pending state for a long time. 'kubectl describe pod' shows the event: '0/3 nodes are available: 1 node(s) had taint {node.kubernetes.io/not-ready: }, that the pod didn't tolerate, 2 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

The kubelet on each node is not running. The taints `node.kubernetes.io/not-ready` and `node.kubernetes.io/unreachable` are automatically added by the node controller when a node's kubelet stops reporting its status (the `node-monitor-grace-period`, default 40s, is exceeded). Since all three nodes exhibit these taints, the kubelet is not running on any of them, preventing the node from being marked `Ready` and causing the scheduler to find no suitable node for the pod.

Answer

The pod's image is incorrect

Answer

The pod has resource requests that exceed node capacity

Answer

The nodes are all cordoned

Question 11

A Pod with a restartPolicy of 'OnFailure' exits with code 0. What will happen?

Accepted Answer

The container will not restart, and the Pod will be in Succeeded phase.. When a Pod has a restartPolicy of 'OnFailure' and its container exits with code 0 (indicating successful completion), the container will not be restarted. Instead, the Pod transitions to the Succeeded phase, as defined by Kubernetes Pod lifecycle semantics. This is because 'OnFailure' only triggers a restart on a non-zero exit code, which signifies a failure.

Answer

The container will restart immediately.

Answer

The Pod will be terminated.

Answer

The Pod will remain in Running state.

Question 12

You need to allow a pod to use a specific device from the host node (e.g., /dev/sdb) as a raw block device. Which volume mode should you set in the PVC?

Accepted Answer

Block. To use a host device like /dev/sdb as a raw block device inside a pod, the PersistentVolumeClaim (PVC) must specify `volumeMode: Block`. This tells Kubernetes to expose the volume as a raw block device (e.g., /dev/xxx) inside the container, rather than mounting a filesystem. Only the `Block` volume mode supports this behavior, as defined in the Kubernetes PersistentVolume API.

Answer

Device

Answer

Raw

Answer

Filesystem

Question 13

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

Accepted Answer

The service account can read pods in all namespaces. ClusterRoleBindings are cluster-scoped, meaning they grant permissions across all namespaces. Since the ClusterRoleBinding 'read-pods-global' binds the 'pod-reader' ClusterRole to the service account 'sa-pod-reader', the service account can get and list pods in every namespace, not just the 'default' namespace.

Answer

The service account can only read pods in the 'default' namespace

Answer

The service account can only list pods, not get them

Answer

The service account cannot read pods in any namespace

Question 14

Which kubectl command will show the rollout history of a Deployment named 'web-app'?

Accepted Answer

kubectl rollout history deployment web-app. `kubectl rollout history deployment web-app` is the dedicated command to display the rollout history of a Deployment, including revision numbers and change-cause annotations. This command retrieves the stored ReplicaSet revisions associated with the Deployment, allowing you to see past rollout states.

Answer

kubectl describe deployment web-app

Answer

kubectl rollout status deployment web-app

Answer

kubectl get deployment web-app -o yaml

Question 15

Which command allows you to view the current context in a kubeconfig file?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. It reads the `current-context` field from the kubeconfig (typically `~/.kube/config`) and outputs its name, making it the most direct way to view the current context.

Answer

kubectl config get-contexts

Answer

kubectl cluster-info

Answer

kubectl config view