CKA Practice Test 8 — 10 Questions

Question 1

You are troubleshooting DNS resolution from within a pod. You exec into the pod and run 'nslookup kubernetes.default.svc.cluster.local'. The command fails with 'connection timed out; no servers could be reached'. However, 'kubectl get svc -n kube-system' shows the kube-dns service with a ClusterIP. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CoreDNS pods are not running or are crashing. The error 'connection timed out; no servers could be reached' from nslookup indicates that the pod cannot reach any DNS server at all. Since the kube-dns service exists (as shown by kubectl), the most likely cause is that the backend CoreDNS pods are not running or are crashing, so there are no endpoints to forward traffic to. Without running CoreDNS pods, the service's ClusterIP has no backing pods, causing all DNS queries to time out.

Answer

The pod's /etc/resolv.conf has incorrect search domains

Answer

A network policy is blocking traffic to the kube-dns service

Answer

The DNS name does not exist

Question 2

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to use more memory without being killed by the Out-of-Memory (OOM) killer. This directly addresses the root cause of the CrashLoopBackOff state.

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Question 3

A cluster administrator creates a StorageClass with the following YAML:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: fast
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp2
reclaimPolicy: Delete
volumeBindingMode: Immediate

A developer creates a PVC using this StorageClass. The PVC is created and remains in Pending state. What is the most likely cause?

Accepted Answer

The cluster is not running on AWS or the AWS cloud provider is not configured.. The StorageClass uses the provisioner `kubernetes.io/aws-ebs`, which is specific to the AWS cloud provider. If the cluster is not running on AWS or the AWS cloud provider is not properly configured (e.g., missing IAM roles, cloud-controller-manager not running), the provisioner cannot create the underlying EBS volume, leaving the PVC in a Pending state indefinitely.

Answer

The volumeBindingMode is Immediate, which requires a different access mode.

Answer

The PVC does not specify an access mode.

Answer

The reclaim policy is Delete, which prevents binding.

Question 4

Which component on a worker node is responsible for maintaining network rules and forwarding traffic to the correct pod?

Accepted Answer

kube-proxy. kube-proxy is the correct component because it runs on each worker node and is responsible for implementing Kubernetes Service concepts by maintaining network rules (iptables or IPVS) that allow network communication to Pods from inside or outside the cluster. It forwards traffic to the correct Pod by load-balancing across the endpoints of a Service, using the cluster IP and port.

Answer

Container runtime

Answer

kubelet

Answer

kube-scheduler

Question 5

You have a DaemonSet that runs a logging agent. You want to ensure it only runs on nodes with GPU. Which field should you set in the DaemonSet's pod template spec?

Accepted Answer

spec.template.spec.nodeSelector. `spec.template.spec.nodeSelector` is a simple, direct field in the Pod template spec that constrains which nodes the DaemonSet's pods can be scheduled on. By setting a key-value pair like `gpu: true`, you ensure the logging agent only runs on nodes that have that label, which is the standard Kubernetes mechanism for node-level selection without complex expressions.

Answer

spec.selector

Answer

spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Answer

spec.template.spec.nodeName

Question 6

An administrator runs 'kubectl run test-pod --image=nginx' and the pod is created but stays in 'Pending' state. Which command would BEST help diagnose why the pod is not running?

Accepted Answer

kubectl describe pod test-pod. `kubectl describe pod test-pod` provides a detailed summary of the pod's current state, including events, conditions, and status messages that reveal why the pod is stuck in 'Pending'. The 'Pending' state typically indicates that the pod has not been scheduled to a node, often due to resource constraints (CPU/memory), persistent volume claims not being bound, or node selector mismatches. The 'Conditions' and 'Events' sections in the output directly expose these issues, making it the most effective diagnostic command.

Answer

kubectl logs test-pod

Answer

kubectl exec -it test-pod -- /bin/bash

Answer

kubectl get events

Question 7

A DevOps team needs to deploy a stateful application that requires persistent storage with ReadWriteMany access mode across multiple pods running on different nodes. Which Kubernetes resource should they use to provision the storage?

Accepted Answer

A PersistentVolume with access mode ReadWriteMany. ReadWriteMany (RWX) is the only access mode that allows multiple pods across different nodes to simultaneously read and write to the same persistent storage volume. A PersistentVolume with access mode ReadWriteMany meets the requirement for a stateful application needing concurrent access from pods running on different nodes, typically backed by network filesystems like NFS, GlusterFS, or CephFS.

Answer

A hostPath volume

Answer

A PersistentVolume with access mode ReadWriteOnce

Answer

An emptyDir volume

Question 8

You are a platform engineer managing a Kubernetes cluster with 5 worker nodes (node1-node5). The cluster runs a mix of stateless web services and stateful databases. Users report that a critical database Pod (part of a StatefulSet) is frequently evicted during node maintenance. The StatefulSet has a single replica. You need to improve the availability of this database Pod. The current configuration: the Pod has resource requests (2 CPU, 4Gi memory) and limits (4 CPU, 8Gi memory). The cluster uses the default scheduler with no custom policies. Nodes have varying capacities: node1 and node2 have 8 CPU/32Gi memory, node3-node5 have 4 CPU/16Gi memory. During rolling node reboots, the database Pod gets evicted and takes a long time to reschedule because no node has enough resources. What should you do to minimize downtime and ensure the Pod is rescheduled promptly after eviction?

Accepted Answer

Assign a high priority class to the database Pod.. Assigning a high priority class (Option C) ensures that when the database Pod is evicted during node maintenance, the scheduler treats it as a higher-priority workload than other Pods. This allows it to preempt lower-priority Pods on nodes with sufficient capacity (e.g., node1 or node2), even if those nodes appear fully allocated, thereby minimizing downtime and ensuring prompt rescheduling.

Answer

Add nodeAffinity to prefer node1 and node2.

Answer

Create a PodDisruptionBudget with minAvailable: 1.

Answer

Increase the resource requests to match the limits.

Question 9

You have a ResourceQuota in a namespace that sets limits: pods: 10, requests.cpu: 4, requests.memory: 8Gi. You try to create a Pod with requests.cpu: 1, requests.memory: 2Gi, and no limits. The namespace currently has 8 pods using 3 CPUs and 5Gi memory in total requests. What happens?

Accepted Answer

The pod is created successfully.. The ResourceQuota only enforces the total sum of requests across all pods in the namespace. Currently, the namespace has 8 pods using 3 CPUs and 5Gi memory. Adding a pod with requests.cpu: 1 and requests.memory: 2Gi would bring totals to 4 CPUs (3+1) and 7Gi memory (5+2), both within the quota limits of 4 CPUs and 8Gi. The pod does not specify limits, but ResourceQuota does not require limits unless a LimitRange enforces default limits; here, no LimitRange is mentioned, so the pod is allowed.

Answer

The pod is rejected because it exceeds the memory request quota.

Answer

The pod is rejected because it exceeds the CPU request quota.

Answer

The pod is rejected because it does not specify CPU and memory limits.

Question 10

You run 'kubectl get nodes' and see that a node is 'NotReady'. You SSH into the node and run 'systemctl status kubelet'. The output shows 'Active: inactive (dead)'. What is the most likely cause?

Accepted Answer

The kubelet service is stopped. The kubelet is the primary node agent that runs on every node and is responsible for maintaining pod lifecycles. When 'systemctl status kubelet' shows 'Active: inactive (dead)', it means the kubelet systemd service is not running. Since the kubelet must be active for the node to report its status to the control plane, a stopped kubelet directly causes the node to be 'NotReady'.

Answer

The network plugin is misconfigured

Answer

The node has been cordoned

Answer

The container runtime is not installed