CKA Cluster Architecture, Installation and Configuration Practice Test 10 — 15 Questions

Question 1

An admin runs 'kubectl get pods' and sees a pod in 'Pending' state for a long time. 'kubectl describe pod' shows '0/1 nodes are available: 1 node has memory pressure'. Which is the most likely cause?

Accepted Answer

The node is under memory pressure and cannot admit the pod.. The '0/1 nodes are available: 1 node has memory pressure' message in `kubectl describe pod` indicates that the kubelet on the node has set a memory pressure condition, which triggers eviction thresholds. When a node is under memory pressure, the kubelet refuses to admit new pods (except those with QoS class Guaranteed) to prevent further resource exhaustion, leaving the pod stuck in Pending state. This matches option C exactly.

Answer

The node's disk is full.

Answer

The pod's image pull secret is missing.

Answer

The pod requires more CPU than any node can provide.

Question 2

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

Accepted Answer

kubectl config set-credentials. The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.

Answer

kubectl config set-context

Answer

kubectl config create-user

Answer

kubectl config set-cluster

Question 3

To make a node unschedulable without evicting existing pods, which command should be used?

Accepted Answer

kubectl cordon node01. `kubectl cordon` marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the precise command for the task described, as it modifies the node's `spec.unschedulable` field to `true` without affecting running workloads.

Answer

kubectl taint node01 key=value:NoSchedule

Answer

kubectl drain node01

Answer

kubectl uncordon node01

Question 4

Which TWO components are part of the Kubernetes control plane? (Select 2)

Accepted Answer

etcd. etcd is a distributed key-value store that holds the cluster's state and configuration data. It is a core component of the Kubernetes control plane because the kube-apiserver reads from and writes to etcd to maintain cluster consistency, and without it the control plane cannot function.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 5

Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)

Accepted Answer

Upgrade kubelet and kubectl on the node.. After upgrading kubeadm on the control plane, you must upgrade kubelet and kubectl on each node to match the target Kubernetes version. The kubelet is the primary node agent that communicates with the control plane, and kubectl is the CLI tool used to interact with the cluster. Without upgrading these components, the node may fail to register or report an incompatible version, causing the node to be in a NotReady state.

Answer

Upgrade the container runtime to a compatible version.

Answer

Run 'kubeadm upgrade apply' on the worker node.

Question 6

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

Accepted Answer

kubelet on the worker node. The kubelet is the primary node agent that runs on every worker node and is responsible for registering the node with the cluster and periodically reporting its status via NodeStatus updates. When a node is in 'NotReady' state, it means the kubelet has failed to send heartbeats or report readiness to the control plane, typically due to a crash, misconfiguration, or resource exhaustion. Checking the kubelet's logs and service status (e.g., 'systemctl status kubelet' or 'journalctl -u kubelet') is the first diagnostic step because it directly controls node health reporting.

Answer

kube-apiserver on the control plane

Answer

kube-controller-manager

Answer

etcd cluster health

Question 7

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

Accepted Answer

ServiceAccount. A ServiceAccount is the correct resource because Kubernetes automatically mounts a projected volume containing a JWT token into pods that use the default or a specified ServiceAccount. This token is used by the pod to authenticate against the Kubernetes API server, enabling secure in-cluster communication without manual credential management.

Answer

Secret

Answer

ConfigMap

Answer

ClusterRoleBinding

Question 8

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are the correct combination because the CI/CD pipeline needs to create and delete pods only within the 'ci' namespace. A Role defines permissions scoped to a specific namespace, and a RoleBinding grants those permissions to a user or service account within that same namespace. This ensures the pipeline cannot affect resources in other namespaces.

Answer

ClusterRole and RoleBinding

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Question 9

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time batch task that runs to completion and then exits. It ensures a specified number of Pods terminate successfully, making it ideal for processing data and exiting without requiring continuous availability.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 10

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

Accepted Answer

The pod cannot be scheduled due to insufficient resources. A pod in 'Pending' state indicates that the pod has been accepted by the Kubernetes API server but is not yet running. The most common cause is that the scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other scheduling constraints (taints, node selector, affinity rules). This results in the pod remaining unscheduled, hence 'Pending'.

Answer

The pod has been deleted

Answer

The pod is waiting for a container to start

Answer

The container image is invalid

Question 11

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 12

Which TWO components are part of the Kubernetes control plane? (Select two.)

Accepted Answer

etcd. etcd is a distributed key-value store that serves as the primary datastore for the Kubernetes cluster, storing all cluster state and configuration data. The kube-controller-manager runs controller processes that regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. Both are core control plane components that run on the master node(s).

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 13

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

Accepted Answer

Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes. The kubeadm upgrade process requires the control plane node to be upgraded first, as it hosts the core cluster components (API server, scheduler, controller-manager). Draining the node ensures workloads are evicted, then kubeadm and kubelet are upgraded on the control plane, followed by uncordoning. Worker nodes are upgraded afterward to maintain cluster stability and compatibility.

Answer

Drain each node, upgrade control plane, then upgrade worker nodes

Answer

Upgrade worker nodes first, then control plane nodes

Answer

Upgrade all nodes simultaneously

Question 14

Which command allows you to view the current context in a kubeconfig file?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. It reads the `current-context` field from the kubeconfig (typically `~/.kube/config`) and outputs its name, making it the most direct way to view the current context.

Answer

kubectl config get-contexts

Answer

kubectl cluster-info

Answer

kubectl config view

Question 15

Which command is used to backup etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save. `etcdctl snapshot save` is the official command in etcdctl v3 to create a point-in-time backup of the etcd data store. This command captures the entire key-value store and metadata into a snapshot file, which can later be restored using `etcdctl snapshot restore` to recover the cluster state.

Answer

etcdctl backup

Answer

etcdctl export

Answer

etcdctl dump