CKA Practice Test 35 — 15 Questions

Question 1

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Accepted Answer

kubectl drain <node> --ignore-daemonsets. `kubectl drain` safely evicts all pods from a node before maintenance, and the `--ignore-daemonsets` flag is necessary because DaemonSet pods cannot be evicted (they are managed by the node controller). Option D is correct because `kubectl cordon` marks the node as unschedulable, preventing new pods from being scheduled onto it, which is a prerequisite before draining to avoid race conditions.

Answer

kubectl delete node <node>

Answer

kubectl uncordon <node>

Answer

kubectl taint nodes <node> key=value:NoSchedule

Question 2

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

Accepted Answer

spec.serviceAccountName. Setting `spec.serviceAccountName` to 'my-sa' in the pod spec automatically mounts the service account token as a volume at `/var/run/secrets/kubernetes.io/serviceaccount/`. This is the standard way to associate a service account with a pod, and Kubernetes automatically handles token projection and mounting for that service account.

Answer

spec.serviceAccount

Answer

spec.containers[].env[].valueFrom.secretKeyRef

Answer

spec.automountServiceAccountToken

Question 3

Which TWO statements about emptyDir volumes are correct?

Accepted Answer

An emptyDir volume is created empty when a Pod is assigned to a node.. An emptyDir volume is created as an empty directory on the node when a Pod is first assigned to that node. It requires no pre-existing storage and is provisioned on the node's local filesystem (or memory if type is 'Memory').

Answer

An emptyDir volume can be shared between Pods on different nodes.

Answer

An emptyDir volume persists across pod restarts.

Answer

An emptyDir volume requires a PersistentVolume.

Question 4

Which THREE of the following are common causes for a Pod to remain in Pending state? (Select THREE.)

Accepted Answer

Insufficient CPU or memory resources in the cluster. Option A is correct because when no node has enough allocatable CPU or memory to satisfy the Pod's resource requests, the scheduler cannot place the Pod and it stays in Pending. Option B is correct because taints on nodes that the Pod does not tolerate cause the scheduler to reject those nodes, leaving the Pod unscheduled and Pending. Option C is correct because a PersistentVolumeClaim that is not yet bound to a PersistentVolume blocks scheduling of Pods that reference it, keeping them in Pending. Option D does not belong because OOMKilled is a container termination reason that occurs after the Pod has been scheduled and started, producing a CrashLoopBackOff or Error state rather than Pending. Option E does not belong because an image pull error happens during kubelet container creation after scheduling, resulting in ImagePullBackOff or ErrImagePull, not Pending.

Answer

Container exits with OOMKilled

Answer

Image pull error due to incorrect image name

Question 5

A ClusterRoleBinding grants cluster-admin access to a user. Which field in the ClusterRoleBinding specifies the user?

Accepted Answer

subjects. In Kubernetes RBAC, the `subjects` field in a ClusterRoleBinding (or RoleBinding) specifies the users, groups, or service accounts that the binding applies to. The `subjects` array contains objects with `kind`, `name`, and optionally `apiGroup` or `namespace`, allowing you to reference a specific user by name. Option B is correct because `subjects` is the only field that defines the identity of the principal receiving the permissions.

Answer

users

Answer

roleRef

Answer

bindings

Question 6

You want to mount a Secret named 'db-secret' as a volume in a pod. Which volume type should you use in the pod spec?

Accepted Answer

secret. Kubernetes provides a dedicated 'secret' volume type specifically designed to mount Secret objects (like 'db-secret') as files into a pod. This volume type automatically handles decryption and projection of the secret data into the container's filesystem, ensuring sensitive information is securely exposed without being stored in the pod definition or environment variables.

Answer

hostPath

Answer

configMap

Answer

emptyDir

Question 7

A pod is failing to start with the error 'CrashLoopBackOff'. You check the logs with 'kubectl logs pod' and see nothing. What is the most likely reason?

Accepted Answer

The container crashed before generating any log output. The 'CrashLoopBackOff' error indicates the container in the pod starts, crashes, and is repeatedly restarted by the kubelet. If 'kubectl logs pod' returns nothing, it means the container exited before writing any output to stdout/stderr, which is the default logging target for Kubernetes. Option B is correct because the container likely failed during initialization or startup, before any application code produced log entries.

Answer

The pod's log path is misconfigured

Answer

The kubelet has logging disabled

Answer

The pod is using a sidecar container for logging

Question 8

Which THREE components are part of the Gateway API resource model? (Select THREE)

Accepted Answer

Gateway. The Gateway API resource model is built around three primary role-oriented resources: GatewayClass, Gateway, and Route objects such as HTTPRoute. Option B (GatewayClass) is correct because it defines a cluster-scoped template that identifies the controller implementing the gateway, analogous to an IngressClass but for the Gateway API. Option A (Gateway) is correct because it represents a specific instance of infrastructure (a load balancer or proxy) provisioned by a GatewayClass controller, and it defines listeners for protocols like HTTP, HTTPS, or TLS. Option D (HTTPRoute) is correct because Route resources attach to a Gateway's listeners and specify how traffic is matched and forwarded to backend Services, with HTTPRoute being the HTTP/HTTPS-specific route type. Option C (LoadBalancer) is not part of the Gateway API resource model; it is a Kubernetes Service type (spec.type: LoadBalancer) used for exposing workloads, not a Gateway API kind. Option E (Ingress) is the older, separate Kubernetes API for HTTP routing and is not a Gateway API resource, though Gateway API is designed as its successor.

Answer

LoadBalancer

Answer

Ingress

Question 9

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

Accepted Answer

Role and RoleBinding. A Role grants permissions within a specific namespace, and a RoleBinding binds that Role to a user or service account within the same namespace. To restrict a user to creating and managing deployments only in the 'development' namespace, you need a Role (scoped to that namespace) and a RoleBinding (also scoped to that namespace). ClusterRole and ClusterRoleBinding are cluster-scoped and would grant permissions across all namespaces, which is not desired here.

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Answer

ClusterRole and RoleBinding

Question 10

You want to see the last 50 lines of logs from a pod named 'api-pod' for the container 'api-container'. Which command accomplishes this?

Accepted Answer

kubectl logs api-pod -c api-container --tail=50. 'kubectl logs api-pod -c api-container --tail=50' shows the last 50 lines for the specified container.

Answer

kubectl logs -l app=api --tail=50

Answer

kubectl logs api-pod --tail=50

Answer

kubectl logs api-container -p api-pod --tail 50

Question 11

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key. It uses the etcdctl v3 API with the `snapshot save` command, which is the proper method for creating a consistent point-in-time backup of an etcd cluster. The command includes mandatory TLS authentication flags (`--cacert`, `--cert`, `--key`) and the `--endpoints` flag to target a specific etcd member, ensuring a secure and successful snapshot operation.

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl snapshot save /backup/snapshot.db

Question 12

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

To allow traffic from a specific namespace, you can use a namespaceSelector in the ingress rule.. Option A is correct because an ingress rule's 'from' clause can include a namespaceSelector that matches namespaces by their labels, thereby permitting traffic originating from pods in those namespaces. Option C is correct because an empty podSelector (podSelector: {}) matches every pod in the NetworkPolicy's own namespace, effectively applying the policy to all pods there. Option D is correct because podSelector uses a LabelSelector whose matchLabels field selects pods by exact key/value label pairs. Option B is wrong because the absence of any NetworkPolicy means all ingress and egress traffic is allowed by default; traffic is only denied once a policy selects the pod. Option E is wrong because NetworkPolicy is a namespaced resource, not cluster-scoped, and only affects pods within its own namespace.

Answer

If no NetworkPolicy exists, all traffic is denied by default.

Answer

NetworkPolicy is a cluster-scoped resource.

Question 13

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

Accepted Answer

Denies all ingress and egress traffic to all pods in the namespace. A NetworkPolicy with an empty `podSelector` selects all pods in the namespace. When no rules are specified, the policy defaults to denying all ingress and egress traffic because NetworkPolicy rules are whitelist-based: if no rule allows traffic, all traffic is denied. This effectively isolates the namespace by blocking all network traffic to and from every pod.

Answer

Has no effect because NetworkPolicy requires at least one rule

Answer

Denies only ingress traffic to pods labeled 'app: denied'

Answer

Allows all traffic because no rules are specified

Question 14

You try to run 'kubectl logs mypod' and get the error: 'Error from server (BadRequest): container "myapp" in pod "mypod" is waiting to start: PodInitializing'. What does this mean?

Accepted Answer

The pod is still being initialized and the container has not started yet.. The error message 'container "myapp" in pod "mypod" is waiting to start: PodInitializing' indicates that the pod's init containers (if any) are still running or the container runtime is pulling the image and setting up the container. The container has not yet entered the 'Running' state, so logs cannot be retrieved until it starts. This is a standard Kubernetes lifecycle phase where the pod is in 'PodInitializing' status, meaning the main container is not ready to serve logs.

Answer

The pod has crashed and is restarting.

Answer

The kubelet is not running on the node.

Answer

The container has a different name than specified.

Question 15

You have a pod that is in 'CrashLoopBackOff' state. Which command should you use to view the logs from the previous instance of the container?

Accepted Answer

kubectl logs pod-name --previous. The correct option is A, `kubectl logs pod-name --previous`, because when a container is in CrashLoopBackOff the current container instance may not have started or may have already been replaced, so the `--previous` (or `-p`) flag retrieves the logs from the last terminated instance of that container in the pod. This is the standard way to inspect why the container crashed on its prior run. Option D, `kubectl logs pod-name`, only shows logs from the currently running container instance, which may be empty or unavailable during a crash loop. Option B, `kubectl get events`, shows cluster-level event messages but not the container's stdout/stderr logs, and option C, `kubectl describe pod pod-name`, shows pod status, conditions, and recent events but not the previous container's application logs.

Answer

kubectl get events

Answer

kubectl describe pod pod-name

Answer

kubectl logs pod-name