CKA Practice Test 49 — 15 Questions

Question 1

You need to back up etcd data for a cluster with etcd running as a static Pod. Which command should you use?

Accepted Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/snapshot.db. It uses the `etcdctl` command with the required API version 3, specifies the etcd endpoint, and provides the necessary TLS certificates (CA, server cert, and key) to authenticate to the etcd server. When etcd runs as a static Pod, it uses TLS for client-server communication, so these flags are mandatory for a successful snapshot.

Answer

kubectl cp etcd-master:/var/lib/etcd /backup/

Answer

etcdctl snapshot save /backup/snapshot.db

Answer

kubectl exec -n kube-system etcd-master -- etcdctl snapshot save /backup/snapshot.db

Question 2

You need to check the expiration date of certificates used by the kube-apiserver. Which command should you use?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display the expiration dates of all certificates managed by kubeadm in the cluster, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period for each, making it the most direct and accurate method for checking certificate expiration in a kubeadm-deployed cluster.

Answer

kubeadm certs renew

Answer

kubectl get secrets -n kube-system

Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

Question 3

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

Accepted Answer

kubectl cordon <node-name>. The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

Answer

kubectl uncordon <node-name>

Answer

kubectl drain <node-name>

Answer

kubectl taint nodes <node-name> key=value:NoSchedule

Question 4

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

Accepted Answer

Succeeded. When a pod's restartPolicy is set to 'Never' and its container exits with code 0 (indicating a successful termination), the pod transitions to the 'Succeeded' phase. This is because Kubernetes treats a zero exit code as a successful completion, and with restartPolicy: Never, no restart is attempted, leaving the pod in a terminal Succeeded state.

Answer

Completed

Answer

Failed

Answer

Running

Question 5

You have configured a ServiceAccount with an associated image pull secret. The Pod referencing this ServiceAccount still fails with ImagePullBackOff due to authentication errors. What is the most likely misconfiguration?

Accepted Answer

The secret is not in the same namespace as the Pod.. Secrets in Kubernetes are namespace-scoped. When you configure `imagePullSecrets` on a ServiceAccount, the ServiceAccount admission controller automatically injects these secrets into any Pod referencing that ServiceAccount. However, because Secrets are namespace-scoped, the secret must exist in the same namespace as the ServiceAccount and the Pod. If the secret was created in a different namespace, the Pod will fail to pull the image with an authentication error (ImagePullBackOff).

Answer

The secret type is wrong; it should be kubernetes.io/dockercfg.

Answer

The ServiceAccount does not have the imagePullSecrets field configured.

Answer

The Pod spec must set the secret in imagePullSecrets directly.

Question 6

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

Accepted Answer

kubeadm certs check-expiration. The `kubeadm certs check-expiration` command is the correct tool to inspect the expiration dates of all certificates generated by kubeadm for cluster components, such as the API server, controller-manager, scheduler, and etcd. It reads the certificate files from the default kubeadm certificate directory (`/etc/kubernetes/pki`) and displays their remaining validity period in a human-readable table. This command is part of the kubeadm certificate management suite and is specifically designed for this purpose.

Answer

kubeadm upgrade plan

Answer

kubeadm certs renew

Answer

kubectl get certificates

Question 7

What is the default port for the Kubernetes API server?

Accepted Answer

6443. The Kubernetes API server defaults to port 6443 for secure HTTPS traffic. This is the standard port used by kubectl and other clients to communicate with the control plane over TLS-encrypted connections, as defined in the Kubernetes documentation and default kube-apiserver configuration.

Answer

10250

Answer

8080

Answer

2379

Question 8

An administrator runs 'kubectl get pods' and sees a pod stuck in 'Pending' state. Which of the following is NOT a typical cause?

Accepted Answer

A required ConfigMap does not exist. A missing ConfigMap does not prevent a pod from being scheduled; it only causes the pod to fail at runtime when it tries to mount or use the ConfigMap. The 'Pending' state specifically indicates that the pod has not been scheduled to a node, which is a scheduling issue, not a runtime configuration issue. Therefore, a missing ConfigMap is not a typical cause of a pod stuck in 'Pending'.

Answer

Insufficient CPU or memory resources on any node

Answer

PersistentVolumeClaim is pending and not bound

Answer

Node selector labels do not match any node

Question 9

An administrator needs to allow a service account 'monitor-sa' in namespace 'monitoring' to read pods across all namespaces. Which RBAC resources should be created?

Accepted Answer

Create a ClusterRole with pod read permissions and a ClusterRoleBinding to monitor-sa. A ClusterRole is required because the service account needs to read pods across all namespaces, which is a cluster-scoped permission. A ClusterRoleBinding binds that ClusterRole to the service account 'monitor-sa', granting the permissions cluster-wide. This is the correct approach for cross-namespace access.

Answer

Create a ClusterRole with pod read permissions and a RoleBinding in each namespace

Answer

Create a Role in the monitoring namespace and a RoleBinding to monitor-sa

Answer

Create a Role with pod read permissions and a ClusterRoleBinding to monitor-sa

Question 10

You have a pod with resource requests: cpu: 500m, memory: 128Mi. The node has 4 CPU cores and 8Gi memory. What is the maximum number of such pods that can be scheduled on this node based on CPU only?

Accepted Answer

8. The node has 4 CPU cores, which equals 4000m (millicores). Each pod requests 500m CPU. Dividing 4000m by 500m gives 8 pods. This is the maximum number that can be scheduled based on CPU alone, assuming no other pods or system overhead. Option D is correct.

Answer

4

Answer

16

Answer

6

Question 11

A developer needs to create a Role that allows listing pods in the 'dev' namespace. Which YAML snippet correctly defines this Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-lister
  namespace: dev
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It defines a Role (not ClusterRole) scoped to the 'dev' namespace with the 'list' verb on 'pods', which matches the requirement exactly. In Kubernetes RBAC, a Role grants permissions within a specific namespace, and the empty apiGroups string [""] refers to the core API group where pods reside.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-lister
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-lister-binding
  namespace: dev
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: Role
  name: pod-lister
  apiGroup: rbac.authorization.k8s.io

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-lister
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get"]

Question 12

Which of the following is a core control plane component of Kubernetes?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that directly interacts with the etcd datastore. It validates and processes all REST API requests, making it the core control plane component responsible for exposing the Kubernetes API and managing the cluster state.

Answer

kubelet

Answer

CoreDNS

Answer

CRI-O

Question 13

Which of the following is a core control plane component responsible for persisting cluster state?

Accepted Answer

etcd. etcd is the core control plane component responsible for persisting cluster state. It is a distributed, consistent key-value store that stores all cluster data, including configuration, state, and metadata. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes are recorded durably.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 14

You need to create a RoleBinding that grants a user access to read Pods in the 'dev' namespace. Which YAML manifest is correct?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: Role
  name: pod-reader. It defines a RoleBinding in the 'dev' namespace that binds a User named 'dev-user' to a Role named 'pod-reader'. This grants the user read access to Pods within that specific namespace, which is exactly what the question requires. RoleBindings are namespace-scoped and must specify the target namespace in metadata.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
...
subjects:
- kind: ServiceAccount
  name: dev-user
roleRef:
  kind: Role
  name: pod-reader

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: ClusterRole
  name: pod-reader

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: ClusterRole
  name: pod-reader

Question 15

Which component is responsible for maintaining network rules on each worker node to enable service discovery and load balancing?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for maintaining network rules on each worker node. It implements the Kubernetes Service concept by managing IP tables or IPVS rules to route traffic to the correct Pods, enabling service discovery and load balancing across Pod endpoints.

Answer

kube-controller-manager

Answer

CoreDNS

Answer

kubelet