CKA Practice Test 33 — 15 Questions

Question 1

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Etcd v3 is the default and supported version in Kubernetes v1.29, and the `ETCDCTL_API=3` environment variable ensures the etcdctl client uses the v3 API, which provides the `snapshot save` command for creating consistent backups. The command `ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db` correctly captures a point-in-time snapshot of the etcd data store, which is essential for disaster recovery.

Answer

kubectl etcd snapshot save /backup/snapshot.db

Answer

etcdctl backup /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl snapshot save /backup/snapshot.db

Question 2

A Kubernetes cluster has a node pool with GPU nodes labeled 'accelerator=nvidia-tesla'. A Pod requires a GPU. Which configuration is necessary?

Accepted Answer

Set nodeSelector to 'accelerator=nvidia-tesla' and request 'nvidia.com/gpu' in resources.. A Pod that requires a GPU must both be scheduled onto a node with the appropriate GPU label and explicitly request the GPU resource. The `nodeSelector` ensures the Pod lands on a node labeled `accelerator=nvidia-tesla`, and requesting `nvidia.com/gpu` in `resources.requests` or `resources.limits` (typically limits) tells the kubelet to allocate a GPU device to the container. Without the resource request, the scheduler has no way to account for GPU capacity, and without the nodeSelector, the Pod might be scheduled on a non-GPU node.

Answer

Use nodeAffinity with requiredDuringSchedulingIgnoredDuringExecution for the GPU label.

Answer

Set resources.limits for 'nvidia.com/gpu' only.

Answer

Add a toleration for GPU node taints.

Question 3

An administrator runs 'kubectl get pods' and sees a pod in 'Pending' state. The output of 'kubectl describe pod pod-name' shows '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate'. What is the most likely cause?

Accepted Answer

The node has a taint that repels the pod, and the pod lacks the corresponding toleration. The pod is in 'Pending' state because the scheduler cannot find a node that satisfies the pod's scheduling constraints. The 'kubectl describe pod' output explicitly states '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate', which means the node has a taint (e.g., a key-value pair with an effect like NoSchedule) and the pod does not have a matching toleration in its spec. This prevents the pod from being scheduled onto that node, leaving it stuck in Pending.

Answer

The pod's container image is not found

Answer

The pod has a resource request that exceeds available resources

Answer

The pod's namespace does not exist

Question 4

Which component runs on every node in a Kubernetes cluster and ensures containers are running in a pod?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers described in PodSpecs are running and healthy by communicating with the container runtime via the CRI (Container Runtime Interface). Without the kubelet, no pod or container lifecycle management can occur on that node.

Answer

kube-scheduler

Answer

container runtime

Answer

kube-proxy

Question 5

You are setting up a new Kubernetes cluster using kubeadm. You run 'kubeadm init --pod-network-cidr=10.244.0.0/16' on the control plane node. The command fails with: '[preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running: output: time="..." level=fatal msg="validate service connection: CRI v1 runtime API is not implemented for endpoint 'unix:///var/run/containerd/containerd.sock': rpc error: code = Unimplemented desc = unknown service runtime.v1.RuntimeService'"'. What is the most likely cause?

Accepted Answer

The containerd runtime does not support the CRI v1 API; it may be an older version that only supports v1alpha2. The error message indicates that the containerd socket is reachable but the CRI v1 API (runtime.v1.RuntimeService) is not implemented. This typically occurs when containerd is an older version that only supports the CRI v1alpha2 API. Kubernetes 1.24+ defaults to the CRI v1 API, so an older containerd without v1 support will fail during kubeadm init.

Answer

The --pod-network-cidr flag is incorrect

Answer

The kubelet version is incompatible with containerd

Answer

The containerd service is not running

Question 6

Which two of the following are valid methods for exposing a Service externally in Kubernetes? (Select TWO.)

Accepted Answer

LoadBalancer. Option C (LoadBalancer) is correct because a Service of type LoadBalancer provisions an external load balancer (via the cloud provider's controller, e.g., an AWS ELB or GCP LB) that exposes the Service on a publicly reachable IP, making it externally accessible. Option D (NodePort) is correct because it allocates a static port on every node's IP (default range 30000-32767) and forwards traffic to the Service, so external clients can reach the Service via :. Option A (Headless) is not a valid external exposure method; a headless Service (clusterIP: None) simply returns pod IPs directly via DNS for direct pod addressing, not external access. Option B (ExternalName) maps a Service to an external DNS name via a CNAME record and is used for accessing external resources from inside the cluster, not for exposing an internal Service externally. Option E (ClusterIP) is the default type and only provides an internal virtual IP reachable within the cluster, so it does not expose the Service externally.

Answer

Headless

Answer

ExternalName

Answer

ClusterIP

Question 7

Which component is responsible for implementing the NetworkPolicy rules?

Accepted Answer

CNI plugin. NetworkPolicy rules are enforced by the Container Network Interface (CNI) plugin, not by kube-proxy or any other Kubernetes control plane component. The CNI plugin (e.g., Calico, Cilium, Weave Net) implements the actual network policy by programming iptables, eBPF, or other data-plane mechanisms to allow or deny traffic between pods based on the policy selectors and rules defined in the NetworkPolicy resource.

Answer

CoreDNS

Answer

kube-controller-manager

Answer

kube-proxy

Question 8

Which TWO of the following are true about a HorizontalPodAutoscaler (HPA) using average CPU utilization? (Select TWO)

Accepted Answer

The HPA calculates utilization as the average CPU usage across all pods divided by the CPU request per pod. Option A is correct because the HPA computes average CPU utilization by taking the mean CPU usage across all targeted pods and dividing it by each pod's CPU request, expressing the result as a percentage of the request. Option B is correct because the utilization formula depends on the CPU request as its denominator; if a pod has no CPU request set, the HPA cannot compute a utilization percentage for it and will not act on that metric. Option C is wrong because the HPA target for CPU utilization is expressed as a percentage of the request (e.g., 50%), not an absolute CPU value. Option D is wrong because exceeding the target utilization triggers scale up, not scale down. Option E is wrong because the HPA uses CPU requests, not CPU limits, as the baseline for utilization calculations.

Answer

The HPA target is an absolute CPU value, not a percentage

Answer

If the average CPU utilization exceeds the target, the HPA will scale down

Answer

The HPA uses CPU limits in its calculation of average utilization

Question 9

Which kubectl command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' using the contents of the file 'config.properties'. The `--from-file` flag reads the file as-is and stores its content under a key that defaults to the filename (config.properties). This is the standard method for creating a ConfigMap from a single file.

Answer

kubectl apply configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 10

Which of the following is a valid command to create a PersistentVolume named 'pv-demo' using a YAML manifest file named 'pv.yaml'?

Accepted Answer

kubectl apply -f pv.yaml. `kubectl apply -f pv.yaml` is the standard Kubernetes command to create or update resources from a YAML manifest file. It reads the manifest, which defines a PersistentVolume named 'pv-demo', and sends it to the API server for creation. This command works for any resource type defined in the file, including PersistentVolumes.

Answer

kubectl create pv -f pv.yaml

Answer

kubectl create persistentvolume -f pv.yaml

Answer

kubectl run pv-demo --image=pv --restart=Never

Question 11

Refer to the exhibit. An administrator creates a token with TTL 0. What is the effect on the token?

Accepted Answer

The token will never expire.. Setting TTL to 0 means the token never expires (unless manually deleted). It will persist indefinitely.

Answer

The token will expire after the default TTL.

Answer

The token expires immediately.

Answer

The token is invalid and cannot be used.

Question 12

A pod has tolerations for a taint with key 'dedicated', value 'gpu', and effect 'NoSchedule'. The pod's nodeSelector is {disktype: ssd}. Which node(s) can this pod be scheduled on? (Assume node1 has taint dedicated=gpu:NoSchedule and label disktype=ssd; node2 has taint dedicated=gpu:NoSchedule and label disktype=hdd; node3 has no taint and label disktype=ssd)

Accepted Answer

node1 and node3. The pod has a toleration for the taint dedicated=gpu:NoSchedule, so it can tolerate that taint on any node. However, the pod also has a nodeSelector requiring disktype=ssd. Node1 has both the tolerated taint and the required label, so it qualifies. Node3 has no taint and the required label, so it also qualifies. Node2 has the tolerated taint but its label is disktype=hdd, which does not match the nodeSelector, so it is excluded. Therefore, only node1 and node3 can schedule the pod.

Answer

node1 only

Answer

node2 and node3

Answer

node1, node2, and node3

Question 13

Which TWO components are part of the Kubernetes control plane? (Select 2)

Accepted Answer

etcd. Option A, etcd, is correct because it is the control plane's distributed key-value store that persistently holds all cluster state and configuration data, which the API server reads and writes. Option E, kube-apiserver, is correct because it is the central control plane component that exposes the Kubernetes API, validates and processes REST requests, and is the entry point through which all other components interact with the cluster. The unmarked options do not belong: kubelet (B) is a node agent that runs on each worker node to manage pods and containers, kube-proxy (C) is a node-level network proxy implementing Service networking rules, and the container runtime (D) is the node software (e.g., containerd or CRI-O) that actually runs containers — all three are node components, not control plane components.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 14

You have a PriorityClass named 'high-priority' with value 1000 and 'low-priority' with value 100. A Pod with 'high-priority' is pending because no node has enough resources. Another Pod with 'low-priority' is running on a node. Will the high-priority Pod preempt the low-priority Pod?

Accepted Answer

Yes, because the high-priority Pod has a higher priority value and the scheduler will try to preempt lower-priority pods. Kubernetes Pod priority-based preemption is a built-in scheduler feature. When a high-priority Pod (value 1000) cannot be scheduled due to insufficient resources, the scheduler identifies and preempts (evicts) lower-priority Pods (value 100) to free up resources, regardless of taints or tolerations. This behavior is controlled by the `Priority` and `PriorityClass` objects, and preemption is enabled by default in the scheduler.

Answer

No, because preemption only works on nodes with taints

Answer

No, because preemption is disabled by default

Answer

Yes, but only if the high-priority Pod has tolerations for the node's taints

Question 15

Which of the following service types exposes a service on a static port on each node's IP address?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a service on a static port (in the range 30000-32767) on every node's IP address. When you create a NodePort service, Kubernetes allocates a port from that range and opens that port on all nodes, forwarding traffic to the service's ClusterIP and then to the pods.

Answer

ExternalName

Answer

LoadBalancer

Answer

ClusterIP