CKA Practice Test 38 — 15 Questions

Question 1

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

Accepted Answer

ipvs. (ipvs) is correct because kube-proxy in IPVS mode uses the Linux kernel's IP Virtual Server (IPVS) to implement Layer 4 load balancing, which supports sophisticated scheduling algorithms such as 'least connection' (lc), round-robin, and others. IPVS operates in kernel space with a hash table structure, providing better performance and scalability compared to iptables, especially in clusters with thousands of services.

Answer

iptables

Answer

kernelnet

Answer

userspace

Question 2

A Pod has an init container that writes a configuration file, and the main container reads that file. The init container runs successfully, but the main container fails with 'file not found'. What is the most likely cause?

Accepted Answer

The init container wrote the file to a different volume than the one mounted in the main container.. The most likely cause is that the init container wrote the configuration file to a volume that is not shared with the main container. In Kubernetes, init containers and main containers in the same Pod share the same filesystem only if they mount the same Volume. If the init container writes to a volume that is not mounted in the main container, or writes to a different path within the same volume, the main container will not see the file. This is a common misconfiguration when using emptyDir or hostPath volumes.

Answer

The main container restarted and the init container did not rerun.

Answer

The main container's command is incorrect.

Answer

The init container did not complete before the main container started.

Question 3

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Accepted Answer

kubectl cordon node1. The `kubectl cordon node1` command marks the node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the correct approach when you need to isolate a node for maintenance without disrupting current workloads.

Answer

kubectl drain node1

Answer

kubectl taint nodes node1 key=value:NoSchedule

Answer

kubectl delete node node1

Question 4

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 5

Which component is responsible for managing the lifecycle of pods on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a pod as expected, managing the pod lifecycle by communicating with the container runtime (e.g., containerd or CRI-O) and reporting the node and pod status back to the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-proxy

Question 6

Given the following YAML manifests in the same namespace:
```yaml
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
  labels:
    app: my-app
spec:
  containers:
  - name: app
    image: nginx
    ports:
    - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
```
A pod in the same namespace tries to reach my-service on port 80. What is the most likely outcome?

Accepted Answer

The connection succeeds and reaches the pod on port 8080.. The Service my-service is configured with port: 80 and targetPort: 8080. Therefore, traffic sent to the Service on port 80 is forwarded to the pod's container port 8080, and the connection succeeds, reaching the pod on port 8080. If targetPort were not set, it would default to port 80, causing the connection to fail because the pod listens on 8080.

Answer

The connection succeeds but reaches the pod on port 80.

Answer

The connection fails because the endpoints list is empty.

Answer

The connection is randomly dropped due to missing port specification.

Question 7

An administrator creates a ServiceAccount named 'monitor' in the 'default' namespace. They want any pod using this ServiceAccount to be able to list pods cluster-wide. Which RBAC resource should be created and bound to this ServiceAccount?

Accepted Answer

ClusterRole and ClusterRoleBinding. A ClusterRole is required because listing pods cluster-wide is a cluster-scoped operation, not limited to a single namespace. A ClusterRoleBinding is needed to bind the ClusterRole to the ServiceAccount 'monitor' at the cluster level, granting permissions across all namespaces. RoleBindings can only grant permissions within a single namespace, so they cannot achieve cluster-wide access.

Answer

ClusterRole and RoleBinding in the default namespace

Answer

ClusterRole and RoleBinding in kube-system

Answer

Role and RoleBinding in the default namespace

Question 8

A pod is in CrashLoopBackOff. You check the logs with 'kubectl logs my-pod --previous' and see 'Error: cannot connect to database at 10.0.0.1:3306'. The database service is named 'mysql' and runs on port 3306. What is the most likely cause?

Accepted Answer

The application is configured with an incorrect database hostname. The error message 'cannot connect to database at 10.0.0.1:3306' indicates the application is trying to connect to a hardcoded IP address (10.0.0.1) instead of the Kubernetes service name 'mysql'. In Kubernetes, services are accessed via DNS names (e.g., 'mysql.default.svc.cluster.local'), not static IPs, which are ephemeral and can change. This misconfiguration causes the connection failure, leading to the CrashLoopBackOff as the app repeatedly fails to start.

Answer

The pod does not have network access to the mysql service

Answer

The mysql service is not exposed on port 3306

Answer

The database pod is not running

Question 9

A cluster uses Flannel as the CNI plugin. Which of the following best describes Flannel's networking model?

Accepted Answer

It assigns a /24 subnet to each node and uses VXLAN encapsulation.. Flannel's default networking model assigns a /24 subnet to each node and uses VXLAN encapsulation to create an overlay network. This allows pods on different nodes to communicate without requiring changes to the underlying physical network, as VXLAN tunnels traffic between nodes using UDP encapsulation.

Answer

It requires an external etcd to store network state.

Answer

It uses BGP to distribute routes across the cluster.

Answer

It provides network policies with full support for ingress and egress rules.

Question 10

Which kube-proxy mode uses iptables rules to handle service traffic and is the default in many distributions?

Accepted Answer

iptables. The iptables mode is the default kube-proxy mode in many Kubernetes distributions, including kubeadm-based clusters. In this mode, kube-proxy watches the Kubernetes API server for Service and Endpoint changes and programs iptables rules in the kernel's netfilter framework to direct traffic to the appropriate backend Pods, providing efficient NAT-based load balancing without requiring a userspace proxy.

Answer

userspace

Answer

ipvs

Answer

nftables

Question 11

You create a Service with clusterIP: None. What is this called and what is its purpose?

Accepted Answer

Headless Service; it allows direct pod-to-pod DNS resolution.. A Service with `clusterIP: None` is called a Headless Service. Its purpose is to allow direct pod-to-pod DNS resolution by returning the IP addresses of the backing pods (via DNS A/AAAA records) rather than a single virtual ClusterIP, enabling stateful applications like databases to discover individual pod endpoints.

Answer

NodePort Service; it exposes on node ports.

Answer

ExternalName Service; it maps to an external DNS name.

Answer

ClusterIP Service; it provides a stable IP.

Question 12

You want to check the logs of a container that previously crashed. Which command should you use?

Accepted Answer

kubectl logs --previous <pod-name>. The `kubectl logs --previous` command retrieves logs from the previous instance of a container in a Pod that has crashed or been restarted. This is essential for debugging transient failures because the current container's logs may not contain the crash information. The `--previous` flag specifically accesses the terminated container's log stream, which is stored by the kubelet until the pod is deleted.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- cat /var/log/app.log

Answer

kubectl describe pod <pod-name>

Question 13

You have a kubeconfig file with multiple contexts. You want to temporarily switch to a different context for a single kubectl command. Which flag should you use?

Accepted Answer

--context. The `--context` flag allows you to override the current context from the kubeconfig file for a single kubectl command. This is the correct way to temporarily switch contexts without modifying the kubeconfig file's current-context field. The flag accepts the context name as defined in the kubeconfig's contexts array.

Answer

--user

Answer

--cluster

Answer

--kubeconfig

Question 14

Which of the following is NOT a control plane component?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node, not on the control plane. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., containerd or CRI-O). Control plane components are those that manage the cluster's state and scheduling decisions, which run on the control plane nodes.

Answer

kube-apiserver

Answer

kube-controller-manager

Answer

kube-scheduler

Question 15

You have multiple kubeconfig files. Which command merges them into a single config file?

Accepted Answer

KUBECONFIG=config1:config2 kubectl config view --flatten > merged-config. The `KUBECONFIG` environment variable can accept a colon-separated list of kubeconfig files, and `kubectl config view --flatten` merges them into a single configuration, outputting the combined result to stdout, which can be redirected to a new file. This is the standard method for merging multiple kubeconfig files in Kubernetes.

Answer

kubectl config merge config1 config2 > merged-config

Answer

cat config1 config2 > merged-config && kubectl config use-context merged-config

Answer

kubectl merge-config config1 config2