CKA Practice Test 31 — 15 Questions

Question 1

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

Accepted Answer

kubectl config set-credentials. The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.

Answer

kubectl config set-context

Answer

kubectl config create-user

Answer

kubectl config set-cluster

Question 2

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` creates a direct tunnel from a local port to a specified port on a pod, allowing access to the pod's service without exposing it externally. The syntax `pod/web-pod 8080:80` forwards localhost:8080 to port 80 of the pod named 'web-pod'.

Answer

kubectl exec -it web-pod -- nc -l -p 8080

Answer

kubectl proxy --port=8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Question 3

A pod is running but cannot be accessed via its ClusterIP service from another pod in the same namespace. The service endpoints list shows the pod's IP. What is the most likely cause?

Accepted Answer

A NetworkPolicy is blocking the traffic. A NetworkPolicy can explicitly deny ingress traffic to a pod even when the service endpoints are correctly populated. Since the endpoints list shows the pod's IP, the service and pod are communicating at the network layer, but a NetworkPolicy with an ingress rule that does not allow traffic from the source pod's labels or CIDR will cause the packet to be dropped by the node's iptables or eBPF rules, resulting in a connection timeout or reset from the client pod.

Answer

The kube-proxy is not running on the node

Answer

The service's targetPort is incorrect

Answer

The pod is running on a different node without proper routing

Question 4

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

Accepted Answer

Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes. The kubeadm upgrade process requires the control plane node to be upgraded first, as it hosts the core cluster components (API server, scheduler, controller-manager). Draining the node ensures workloads are evicted, then kubeadm and kubelet are upgraded on the control plane, followed by uncordoning. Worker nodes are upgraded afterward to maintain cluster stability and compatibility.

Answer

Drain each node, upgrade control plane, then upgrade worker nodes

Answer

Upgrade worker nodes first, then control plane nodes

Answer

Upgrade all nodes simultaneously

Question 5

You need to check the current resource usage of nodes in your cluster. Which command should you use?

Accepted Answer

kubectl top nodes. `kubectl top nodes` retrieves and displays real-time CPU and memory usage metrics for all nodes in the cluster, directly answering the question about current resource usage. This command relies on the metrics server being deployed in the cluster to collect resource utilization data from kubelets via the Summary API.

Answer

kubectl top pods

Answer

kubectl get events

Answer

kubectl get nodes -o wide

Question 6

Which component is responsible for maintaining network rules on worker nodes?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for maintaining network rules on worker nodes. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or userspace rules on the node to route traffic to the correct Pods. This ensures that network traffic directed at a Service's ClusterIP or NodePort is properly forwarded to the backend Pods.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-controller-manager

Question 7

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

Accepted Answer

The pod cannot be scheduled due to insufficient resources. A pod in 'Pending' state indicates that the pod has been accepted by the Kubernetes API server but is not yet running. The most common cause is that the scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other scheduling constraints (taints, node selector, affinity rules). This results in the pod remaining unscheduled, hence 'Pending'.

Answer

The pod has been deleted

Answer

The pod is waiting for a container to start

Answer

The container image is invalid

Question 8

A pod has status 'Init:Error'. What does this indicate?

Accepted Answer

An init container failed. The 'Init:Error' status indicates that a pod's init container has failed to complete successfully. Init containers run sequentially before any main containers start, and if one exits with a non-zero exit code, the pod enters this error state. This is distinct from a main container crash, which would show as 'CrashLoopBackOff' or 'Error' after the pod has started.

Answer

The main container has crashed

Answer

The pod is being initialized

Answer

There is a network error during initialization

Question 9

Which THREE of the following are valid ways to restrict or influence pod scheduling using taints and tolerations? (Select THREE.)

Accepted Answer

Adding a taint with effect NoSchedule to a node. Adding a taint with effect NoSchedule (option A) prevents scheduling of pods without matching tolerations onto the node. Adding a taint with effect PreferNoSchedule (option C) is a soft preference that tries to avoid scheduling pods without tolerations onto the node but does not guarantee it. Adding a taint with effect NoExecute (option E) not only prevents scheduling but also evicts any existing pods that do not tolerate the taint. Options B and D are not valid uses of taints and tolerations: tolerations allow pods to be scheduled on tainted nodes, not prevent scheduling, and nodeSelector is a separate mechanism not based on taints and tolerations.

Answer

Adding a toleration to a pod to prevent it from being scheduled on certain nodes

Answer

Applying a nodeSelector to a pod to match node labels

Question 10

A developer accidentally runs 'kubectl delete pvc data-claim'. What is the immediate effect on the PersistentVolume pv-data?

Accepted Answer

The PV pv-data enters the Released state and is not deleted.. When a PVC is deleted, the associated PV enters the 'Released' state, not 'Available'. This is because the PV still contains data from the previous claim (the retain policy is 'Retain' by default), and Kubernetes does not automatically delete or reuse it. The PV remains in 'Released' until an administrator manually clears the claimRef or deletes the PV.

Answer

The PV pv-data is automatically deleted.

Answer

The PV pv-data remains Bound to the deleted PVC.

Answer

The PV pv-data immediately becomes Available and can be reused.

Question 11

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

Accepted Answer

etcdctl snapshot restore /backup/etcd-snapshot.db --data-dir=/var/lib/etcd-restored. `etcdctl snapshot restore` is the proper command to restore an etcd snapshot to a new data directory. The `--data-dir` flag specifies where the restored data should be placed, allowing the new etcd instance to use that directory. This command recreates the etcd member's data from the snapshot file, which is essential for disaster recovery.

Answer

kubectl apply -f /backup/etcd-snapshot.db

Answer

etcdctl snapshot load /backup/etcd-snapshot.db

Answer

ETCDCTL_API=3 etcdctl restore /backup/etcd-snapshot.db

Question 12

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

Accepted Answer

Ingress. Ingress is the correct resource because it provides HTTP/HTTPS layer-7 routing to multiple services based on hostnames or paths, all exposed on a single IP address. Services of type ClusterIP, NodePort, or LoadBalancer operate at layer 4 and cannot perform path-based routing. An Ingress controller (e.g., NGINX, HAProxy) implements the rules defined in the Ingress resource to direct traffic to the appropriate backend services.

Answer

Service of type ClusterIP

Answer

NetworkPolicy

Answer

Service of type NodePort

Question 13

Based on the exhibit, the pod is in CrashLoopBackOff. Which command should you run NEXT to identify the root cause?

Accepted Answer

kubectl logs api-6f4d7b9d4c-abcde -n production --previous. The pod is in CrashLoopBackOff, which means the container starts, crashes, and restarts repeatedly. The `kubectl logs --previous` command retrieves the logs from the previous (crashed) container instance, which is the fastest way to see the error that caused the crash. This directly reveals the root cause, such as a missing dependency, configuration error, or application panic.

Answer

kubectl describe node node-1

Answer

kubectl top pod api-6f4d7b9d4c-abcde -n production

Answer

kubectl get deployment api -n production -o yaml

Question 14

An application requires a persistent volume that can be shared across multiple Pods running on different nodes, with read-write access from all Pods simultaneously. Which access mode should be specified in the PersistentVolumeClaim?

Accepted Answer

ReadWriteMany. The correct access mode is ReadWriteMany (RWX), which allows the volume to be mounted as read-write by multiple Pods across different nodes simultaneously. This matches the requirement for shared concurrent read-write access from all Pods.

Answer

ReadWriteOncePod

Answer

ReadOnlyMany

Answer

ReadWriteOnce

Question 15

Which THREE statements about StorageClasses are true?

Accepted Answer

A StorageClass can specify a provisioner to enable dynamic volume provisioning.. Option C is correct because a StorageClass defines a provisioner field (for example, kubernetes.io/aws-ebs or a CSI driver name) that tells Kubernetes which plugin should dynamically provision PersistentVolumes when a matching PVC is created. Option D is correct because setting volumeBindingMode: WaitForFirstConsumer defers both PV provisioning and binding until a pod that uses the PVC is scheduled, which allows topology-aware scheduling decisions. Option E is correct because the reclaimPolicy field in a StorageClass (values such as Delete or Retain) sets the reclaim policy applied to PVs that are dynamically provisioned by that class. Option A is not correct because creating StorageClasses is governed by RBAC, not restricted to cluster administrators; any subject granted the appropriate permissions on the storageclasses resource can create them. Option B is not correct because StorageClasses are cluster-scoped resources, not namespaced, and are referenced by PVCs across namespaces.

Answer

Only cluster administrators can create StorageClasses.

Answer

StorageClasses are namespaced resources.