CKA Cluster Architecture, Installation and Configuration Practice Test 10 — 15 Questions

Question 1

Which TWO commands can be used to view the configuration of a kubeconfig file?

Accepted Answer

kubectl config get-contexts. Option E, `kubectl config view`, is correct because it prints the merged kubeconfig settings (clusters, contexts, users, and current-context) from the kubeconfig file, optionally with `--minify` or `--raw`. Option D, `kubectl config get-contexts`, is correct because it lists the contexts defined in the kubeconfig, showing NAME, CLUSTER, AUTHINFO, and NAMESPACE, which is a way to view part of the configuration. Option A is wrong because a kubeconfig is a client-side file, not a ConfigMap object, so `kubectl describe configmap kubeconfig` would only work if such a ConfigMap existed in the cluster. Option B is wrong because `kubectl config set-context` modifies a context rather than displaying configuration. Option C is wrong because `kubectl config current-context` only displays the name of the active context, not the configuration itself.

Answer

kubectl describe configmap kubeconfig

Answer

kubectl config set-context

Answer

kubectl config current-context

Question 2

Which of the following is a core control plane component responsible for persisting cluster state?

Accepted Answer

etcd. etcd is the core control plane component responsible for persisting cluster state. It is a distributed, consistent key-value store that stores all cluster data, including configuration, state, and metadata. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes are recorded durably.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 3

An administrator runs 'kubectl get pods' and sees a pod in 'Pending' state. The output of 'kubectl describe pod pod-name' shows '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate'. What is the most likely cause?

Accepted Answer

The node has a taint that repels the pod, and the pod lacks the corresponding toleration. The pod is in 'Pending' state because the scheduler cannot find a node that satisfies the pod's scheduling constraints. The 'kubectl describe pod' output explicitly states '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate', which means the node has a taint (e.g., a key-value pair with an effect like NoSchedule) and the pod does not have a matching toleration in its spec. This prevents the pod from being scheduled onto that node, leaving it stuck in Pending.

Answer

The pod's container image is not found

Answer

The pod has a resource request that exceeds available resources

Answer

The pod's namespace does not exist

Question 4

You need to back up etcd on a single control plane node. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/etcd-snapshot.db. It uses the required `ETCDCTL_API=3` environment variable and specifies the necessary TLS client certificates (`--cacert`, `--cert`, `--key`) to authenticate to the etcd server, which by default listens on `https://127.0.0.1:2379` with mutual TLS enabled. The `snapshot save` command creates a point-in-time backup of the etcd data store, essential for disaster recovery in a Kubernetes control plane.

Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 snapshot save /backup/etcd-snapshot.db

Answer

ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db

Answer

etcdctl snapshot save /backup/etcd-snapshot.db

Question 5

A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?

Accepted Answer

RoleBinding 'john-pod-reader' in namespace 'development' referencing ClusterRole 'pod-reader' and user 'john'. A RoleBinding in a specific namespace can reference a ClusterRole to grant its permissions only within that namespace. Since the requirement is to bind the existing 'pod-reader' ClusterRole to user 'john' exclusively in the 'development' namespace, a RoleBinding named 'john-pod-reader' in the 'development' namespace is the correct resource. This allows the ClusterRole's pod read permissions to be scoped down to a single namespace.

Answer

Add user 'john' to the 'pod-reader' ClusterRole definition

Answer

Role 'pod-reader' in namespace 'development'

Answer

ClusterRoleBinding 'john-pod-reader' binding 'pod-reader' to user 'john'

Question 6

Which command is used to mark a node as unschedulable and evict its pods?

Accepted Answer

kubectl drain node-name --ignore-daemonsets. `kubectl drain` marks a node as unschedulable (similar to `cordon`) and then evicts all pods from the node, respecting PodDisruptionBudgets. The `--ignore-daemonsets` flag is required because DaemonSet pods cannot be evicted via drain (they are managed by the DaemonSet controller and would be immediately rescheduled on the same node), so the command would fail without this flag.

Answer

kubectl delete node node-name

Answer

kubectl cordon node-name

Answer

kubectl taint node node-name key=value:NoSchedule

Question 7

You have a kubeconfig file with multiple contexts. You want to temporarily switch to a different context for a single kubectl command. Which flag should you use?

Accepted Answer

--context. The `--context` flag allows you to override the current context from the kubeconfig file for a single kubectl command. This is the correct way to temporarily switch contexts without modifying the kubeconfig file's current-context field. The flag accepts the context name as defined in the kubeconfig's contexts array.

Answer

--user

Answer

--cluster

Answer

--kubeconfig

Question 8

Which component is responsible for running containers on a node and reporting their status to the control plane?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd) to start, stop, and monitor containers. The kubelet then reports the status of the node and its Pods back to the control plane via the Kubernetes API server, using heartbeats (NodeStatus updates) and Pod status updates.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Answer

kube-scheduler

Question 9

You initialize a cluster with 'kubeadm init' and want to join a worker node. What is the correct command to generate the join command?

Accepted Answer

kubeadm token create --print-join-command. `kubeadm token create --print-join-command` generates a new bootstrap token and immediately outputs the full `kubeadm join` command, including the token, control-plane endpoint, and discovery token CA cert hash. This is the recommended way to obtain a ready-to-use join command after initializing the cluster with `kubeadm init`.

Answer

kubeadm join --token

:6443

Answer

kubeadm init phase upload-config kubelet

Answer

kubeadm token list

Question 10

You need to renew all certificates on a kubeadm-managed cluster. Which command accomplishes this?

Accepted Answer

kubeadm certs renew all. `kubeadm certs renew all` is the dedicated command to renew all PKI certificates in a kubeadm-managed cluster. It regenerates each certificate using the existing CA key, updating the certificate files in `/etc/kubernetes/pki/` without restarting control plane components; a manual restart or kubelet reload is required afterward.

Answer

kubeadm certs renew apiserver

Answer

kubeadm certs check-expiration

Answer

kubeadm upgrade apply

Question 11

Which TWO of the following are valid ways to create a Role in the 'default' namespace that grants get and list on pods?

Accepted Answer

kubectl create role pod-reader --verb=get,list --resource=pods -n default. Option A is correct because `kubectl create role` is the imperative command for creating a namespaced Role, and `--verb=get,list --resource=pods -n default` precisely specifies the get and list verbs on pods in the default namespace. Option D is correct because a declarative YAML manifest with `apiVersion: rbac.authorization.k8s.io/v1`, `kind: Role`, and a rule using the core API group (`apiGroups: [""]`), `resources: ["pods"]`, and `verbs: ["get", "list"]` defines exactly the required namespaced Role. Option B is wrong because `discover` is not a valid RBAC verb for granting pod access. Option C is wrong because `delete` grants deletion, not get/list. Option E is wrong because `kubectl create clusterrole` creates a ClusterRole (cluster-scoped), not a Role in the default namespace.

Answer

kubectl create role pod-reader --verb=discover --resource=pods -n default

Answer

kubectl create role pod-reader --verb=delete --resource=pods -n default

Answer

kubectl create clusterrole pod-reader --verb=get,list --resource=pods

Question 12

Which TWO commands can be used to check the expiration of certificates managed by kubeadm?

Accepted Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A2 Validity. Option E, `kubeadm certs check-expiration`, is correct because it is the dedicated kubeadm subcommand that lists all kubeadm-managed certificates (in /etc/kubernetes/pki and /etc/kubernetes/pki/etcd) along with their expiration dates, residual time, and CA certificate validity. Option C, `openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A2 Validity`, is correct because it directly parses the X.509 certificate file and prints its Validity period (Not Before / Not After), which is a valid way to inspect the expiration of any individual kubeadm-managed certificate. Option A, `kubeadm upgrade plan`, is not correct because it reports available Kubernetes version upgrades and only incidentally warns about certificate expiry, not as its purpose. Option B, `kubectl get certificates`, is not correct because there is no built-in `certificates` resource in Kubernetes (that would require cert-manager CRDs, which are unrelated to kubeadm PKI). Option D, `kubeadm certs renew --all`, is not correct because it renews certificates rather than checking their expiration.

Answer

kubeadm upgrade plan

Answer

kubectl get certificates

Answer

kubeadm certs renew --all

Question 13

Which command initializes a Kubernetes control plane node using kubeadm?

Accepted Answer

kubeadm init. `kubeadm init` is the specific command used to bootstrap and initialize a Kubernetes control plane node. It performs pre-flight checks, generates certificates, creates the static Pod manifests for core control plane components (API server, controller manager, scheduler, etcd), and configures the admin kubeconfig file. This is the standard kubeadm workflow for setting up a new cluster.

Answer

kubeadm create

Answer

kubeadm setup

Answer

kubeadm start

Question 14

Which component is responsible for maintaining network rules on worker nodes?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for maintaining network rules on worker nodes. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or userspace rules on the node to route traffic to the correct Pods. This ensures that network traffic directed at a Service's ClusterIP or NodePort is properly forwarded to the backend Pods.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-controller-manager

Question 15

A node named 'worker-1' is unhealthy. You want to mark it as unschedulable and move workloads to other nodes. Which command sequence is correct?

Accepted Answer

kubectl cordon worker-1; kubectl drain worker-1. `kubectl cordon worker-1` marks the node as unschedulable, preventing new pods from being scheduled onto it, and `kubectl drain worker-1` safely evicts all existing pods from the node, respecting PodDisruptionBudgets and terminating pods gracefully. This sequence ensures workloads are moved to other nodes without disrupting running services.

Answer

kubectl uncordon worker-1; kubectl drain worker-1

Answer

kubectl delete node worker-1; kubectl cordon worker-1

Answer

kubectl drain worker-1; kubectl cordon worker-1