CKA Practice Test 9 — 10 Questions

Question 1

You run 'kubectl get svc my-service -o yaml' and see 'type: ClusterIP'. The service has no endpoints. What is the most likely cause?

Accepted Answer

No pods with labels matching the service selector are running and ready.. A Kubernetes Service of type ClusterIP relies on a label selector to identify target Pods. If no Pods match the selector and are in the Ready state, the Service will have no endpoints, causing traffic to be dropped. The absence of endpoints directly indicates a mismatch or absence of matching, ready Pods.

Answer

The service type is ClusterIP, which does not support endpoints.

Answer

The service's port does not match the container port.

Answer

The service is misconfigured and needs to be deleted and recreated.

Question 2

Which of the following CNI plugins typically uses BGP to distribute routing information across nodes?

Accepted Answer

Calico. Calico uses BGP (Border Gateway Protocol) to exchange routing information between nodes, enabling direct pod-to-pod communication without overlays. Each node runs a BGP client that advertises the pod CIDRs assigned to that node, allowing the underlying network infrastructure to route traffic at Layer 3.

Answer

Flannel

Answer

Weave

Answer

Cilium

Question 3

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

Accepted Answer

spec.rules. In the 'networking.k8s.io/v1' Ingress API, the 'spec.rules' field is where you define an array of routing rules, each containing a 'host' field for the hostname and an 'http' subfield with 'paths' that specify path-based routing to backend services. This is the primary mechanism for directing traffic based on hostname and path.

Answer

spec.ingress

Answer

spec.tls

Answer

spec.backend

Question 4

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Accepted Answer

my-svc.default.svc.cluster.local. The standard FQDN for a Kubernetes service in the default namespace is `..svc.cluster.local`. This is the DNS record created by CoreDNS (or kube-dns) for ClusterIP services, allowing pods to resolve the service by its fully qualified domain name. The pod can also use the shorter form `my-svc` because the DNS search path includes the service's namespace and the `svc.cluster.local` suffix, but the FQDN ensures unambiguous resolution.

Answer

my-svc.default.svc.cluster

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Question 5

Which of the following Service types does NOT assign a ClusterIP to the Service?

Accepted Answer

Headless. A Headless Service is created by setting the `clusterIP` field to `None` in the Service specification. This tells Kubernetes not to allocate a ClusterIP, making the Service headless. Instead of a virtual IP, DNS queries for the Service name return the IP addresses of all matching Pods directly, enabling stateful workloads like databases to discover individual Pod endpoints.

Answer

LoadBalancer

Answer

ClusterIP

Answer

NodePort

Question 6

Which of the following Service types exposes a Service on a static port on each node's IP?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a Service on a static port (in the range 30000–32767) on every node's IP address. Traffic sent to any node's IP on that port is forwarded to the Service's ClusterIP and then to the backing pods. This is defined in the Service's `spec.ports[].nodePort` field.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 7

Which of the following is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

Accepted Answer

my-svc.my-ns.svc.cluster.local. A is correct because Kubernetes uses a built-in DNS system (CoreDNS) that automatically creates DNS records for Services. The fully qualified domain name (FQDN) for a Service follows the pattern `..svc.cluster.local`, where `svc` is a fixed label indicating it's a Service record, and `cluster.local` is the default cluster domain. This allows pods to resolve the Service by name within the cluster.

Answer

my-svc.my-ns.cluster.local

Answer

my-svc.my-ns.svc

Answer

my-svc.my-ns.pod.cluster.local

Question 8

An ingress resource is defined with the following snippet:
```yaml
spec:
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80
```
The secret 'app-tls' exists and contains a valid certificate. However, accessing https://app.example.com returns a certificate warning in the browser. What is the most likely cause?

Accepted Answer

The TLS secret is in a different namespace than the ingress resource. The TLS secret must reside in the same namespace as the Ingress resource because the Ingress controller reads the secret from the Ingress's namespace. If the secret is in a different namespace, the controller cannot access it, causing it to fall back to its default (untrusted) certificate or fail to serve the correct certificate, which results in a browser certificate warning.

Answer

The ingress controller does not support TLS termination

Answer

The path type is Prefix but should be Exact

Answer

The secret name does not match the TLS section host

Question 9

Which resource type is used to configure HTTP/HTTPS routing to Services?

Accepted Answer

Ingress. Ingress is the Kubernetes resource that provides HTTP and HTTPS routing from outside the cluster to Services within the cluster. It defines rules for host-based and path-based routing, TLS termination, and load balancing, making it the correct choice for configuring external HTTP/HTTPS access.

Answer

EndpointSlice

Answer

NetworkPolicy

Answer

Service

Question 10

You have a Service with endpoints for pods in different zones. You want kube-proxy to use a mode that provides better performance for large clusters and supports scheduling algorithms like least-connection. Which mode should you use?

Accepted Answer

ipvs mode. IPVS (IP Virtual Server) mode is correct because it uses the LVS (Linux Virtual Server) kernel module to provide a transport-layer load balancer that supports multiple scheduling algorithms, including least-connection (lc), round-robin (rr), and source hashing (sh). Unlike iptables, IPVS uses a hash table as the underlying data structure, which scales linearly with the number of services and endpoints, making it far more performant in large clusters with thousands of services.

Answer

userspace mode

Answer

iptables mode

Answer

kernelspace mode