CKA Practice Test 36 — 15 Questions

Question 1

You deploy a pod with resource limits but no requests. The pod gets OOMKilled. What is the most likely reason?

Accepted Answer

The container tried to use more memory than the limit. When a pod has a memory limit set but no memory request, the Linux kernel enforces the limit via cgroups. If the container's processes attempt to allocate more memory than the limit, the kernel's Out-Of-Memory (OOM) killer terminates the container, resulting in an OOMKilled status. This is the most direct cause of the OOMKilled event.

Answer

The pod's liveness probe is failing

Answer

The container's entrypoint command is invalid

Answer

The node does not have enough memory for the limit

Question 2

You are upgrading a cluster from v1.28 to v1.29. You have already drained and upgraded all worker nodes. The control plane nodes have not been upgraded yet. 'kubectl get nodes' shows the control plane nodes are still v1.28. What is the correct next step?

Accepted Answer

Upgrade the control plane nodes to v1.29. The correct next step is to upgrade the control plane nodes to v1.29. In a Kubernetes cluster upgrade, the control plane must be upgraded before or in conjunction with the worker nodes, but since the worker nodes have already been upgraded and drained, the control plane nodes are still running v1.28. Upgrading the control plane nodes ensures that the API server, scheduler, and controller manager are at the target version, which is required for cluster stability and to support the upgraded kubelets on the worker nodes.

Answer

Drain the worker nodes and downgrade them to v1.28

Answer

Uncordon the worker nodes

Answer

Restart the kubelet on all nodes

Question 3

Which component is responsible for maintaining network rules on each node?

Accepted Answer

kube-proxy. C is correct because kube-proxy is the component responsible for maintaining network rules on each node. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or other rules to route traffic to the appropriate Pods. This ensures that network policies and service load balancing are enforced at the node level.

Answer

kube-controller-manager

Answer

etcd

Answer

kubelet

Question 4

An administrator runs 'kubectl get nodes' and sees that a worker node is in the 'Ready,SchedulingDisabled' state. Which command was most likely executed on that node?

Accepted Answer

kubectl cordon node01. The 'Ready,SchedulingDisabled' state indicates the node has been marked as unschedulable using the 'kubectl cordon' command. Cordon marks the node as unschedulable, preventing new pods from being scheduled onto it while existing pods continue running. This matches the observed state exactly.

Answer

kubectl drain node01

Answer

kubectl taint nodes node01 key=value:NoSchedule

Answer

kubectl uncordon node01

Question 5

A pod runs but you cannot connect to its container port from another pod in the same namespace. 'kubectl exec' into the pod and 'curl localhost:8080' works. What is the MOST likely cause?

Accepted Answer

The pod is bound to localhost only, not 0.0.0.0. When `curl localhost:8080` works inside the pod but connections from other pods fail, the most likely cause is that the application is listening only on the loopback interface (127.0.0.1) instead of 0.0.0.0 (all interfaces). This means the container process binds to localhost, which is only reachable from within the same network namespace (the pod itself), not from external sources like other pods. Kubernetes networking relies on the container listening on 0.0.0.0 so that traffic arriving via the pod's eth0 interface (which has its own IP) can be accepted.

Answer

There is a NetworkPolicy blocking ingress

Answer

The container's port is not exposed in the pod spec

Answer

The Service selector does not match the pod labels

Question 6

Which TWO of the following are valid ways to expose environment variables from a ConfigMap to a pod? (Select TWO.)

Accepted Answer

Using envFrom with configMapRef. `envFrom` with `configMapRef` allows you to inject all key-value pairs from a ConfigMap as environment variables into a pod, which is a concise way to expose ConfigMap data without specifying each key individually. This is a native Kubernetes feature that automatically creates environment variables for each entry in the ConfigMap.

Answer

Using envFrom with secretRef

Answer

Using env field with configMapKeyRef directly

Answer

Mounting the ConfigMap as a volume, which automatically sets environment variables

Question 7

Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that maintains network rules (e.g., iptables, IPVS) and enables service abstraction by proxying traffic to the correct Pods. It watches the Kubernetes API server for Service and EndpointSlice changes, then updates the node's packet filtering rules to route cluster IP traffic to healthy backend Pods.

Answer

kube-scheduler

Answer

container runtime

Answer

kubelet

Question 8

A node in the cluster has been cordoned. Which of the following is true about the node?

Accepted Answer

The node is marked as unschedulable, but existing pods continue to run.. When a node is cordoned using `kubectl cordon`, it is marked as unschedulable by setting the `node.Spec.Unschedulable` field to true. This prevents new pods from being scheduled onto the node, but existing pods continue to run normally. The node remains part of the cluster and is not removed or drained automatically.

Answer

The node is removed from the cluster.

Answer

kubectl drain is automatically performed on the node.

Answer

Existing pods on the node are immediately evicted.

Question 9

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd, CRI-O) via the Container Runtime Interface (CRI). It receives Pod specifications from the API server and manages the lifecycle of the containers accordingly.

Answer

kube-proxy

Answer

kube-scheduler

Answer

kube-controller-manager

Question 10

An administrator needs to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which of the following steps is performed FIRST?

Accepted Answer

Run 'kubeadm upgrade plan' on the first control plane node. Before any upgrade operations, kubeadm requires an assessment of the cluster's upgrade path and potential issues. 'kubeadm upgrade plan' on the first control plane node checks the current and target versions, validates the upgrade feasibility, and displays the upgrade steps and any manual interventions needed. This must be done first to ensure the upgrade is safe and to identify any version skew or configuration problems before proceeding.

Answer

Drain all worker nodes

Answer

Run 'kubectl cordon' on all nodes

Answer

Upgrade kubelet on the first control plane node

Question 11

A CKA candidate runs 'kubectl get nodes' and sees that a worker node is in the 'NotReady' state. Which command should be used to diagnose the node's kubelet health?

Accepted Answer

journalctl -u kubelet. The kubelet is the primary node agent that registers the node with the cluster and reports its status via periodic heartbeats. When a node is NotReady, the most direct way to diagnose kubelet health is to inspect its systemd unit logs using 'journalctl -u kubelet', which shows startup errors, certificate issues, or resource exhaustion that prevent the kubelet from functioning correctly.

Answer

systemctl status docker

Answer

kubectl get events --all-namespaces

Answer

kubectl logs -n kube-system kubelet-<node>

Question 12

An administrator creates a PersistentVolume with the following YAML:

```yaml
apiVersion: v1
kind: PersistentVolume
metadata:
  name: pv-example
spec:
  capacity:
    storage: 5Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  hostPath:
    path: /mnt/data
```

Which of the following is true about this PersistentVolume?

Accepted Answer

It can be mounted as read-write by only one node at a time.. The PersistentVolume specifies `accessModes: ReadWriteOnce`, which means the volume can be mounted as read-write by only a single node at a time. This is a Kubernetes access mode that restricts the volume to a single consumer (node) for read-write operations, preventing concurrent access from multiple nodes.

Answer

It can be mounted as read-write by multiple nodes simultaneously.

Answer

The PV will be automatically deleted when its PVC is released.

Answer

The PV supports dynamic provisioning.

Question 13

To check the expiration date of all certificates managed by kubeadm, which command should you run?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all certificates managed by kubeadm in the cluster. This command reads the certificate files from the default kubeadm certificate directory (typically `/etc/kubernetes/pki`) and parses their `NotAfter` field to show remaining validity.

Answer

kubectl get certificates

Answer

kubeadm certs renew

Answer

kubeadm alpha certs check-expiration

Question 14

Which command initializes a new Kubernetes control plane node using kubeadm?

Accepted Answer

kubeadm init. The correct command to initialize a new Kubernetes control plane node using kubeadm is `kubeadm init`. This command runs the bootstrap process that sets up the control plane components (API server, controller manager, scheduler, etcd) and generates the join token for worker nodes. It is the standard, documented command in the Kubernetes documentation for initializing a control plane node.

Answer

kubeadm bootstrap

Answer

kubeadm create cluster

Answer

kubeadm start

Question 15

Which resource is used to configure TLS termination and path-based routing for HTTP(S) traffic into a cluster?

Accepted Answer

Ingress. An Ingress resource provides HTTP and HTTPS routing to services within a Kubernetes cluster, enabling TLS termination and path-based routing. It acts as a layer 7 load balancer, directing external traffic to the appropriate backend Service based on hostnames and paths defined in its rules.

Answer

Service

Answer

NetworkPolicy

Answer

Gateway