CKA Cluster Architecture, Installation and Configuration Practice Test 11 — 15 Questions

Question 1

You are using kubeadm to initialize a Kubernetes cluster. After running 'kubeadm init', the control-plane node is not ready. You run 'kubectl get nodes' and see the node status as 'NotReady'. Which component is most likely not functioning correctly?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node and is responsible for registering the node with the cluster and maintaining pod lifecycle. After 'kubeadm init', if the control-plane node shows 'NotReady', it almost always indicates that the kubelet is not running or is failing to communicate with the control plane, often due to missing or misconfigured container runtime (e.g., containerd, CRI-O) or network plugin (CNI).

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 2

Which command is used to take a snapshot of etcd data for backup?

Accepted Answer

etcdctl snapshot save. The correct command to take a snapshot of etcd data for backup is `etcdctl snapshot save`. This command creates a point-in-time snapshot of the etcd key-value store, which can be used to restore the cluster state. The `snapshot save` subcommand is the official method for backing up etcd data in Kubernetes environments.

Answer

etcdctl export

Answer

etcdctl backup

Answer

etcdctl dump

Question 3

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

Accepted Answer

Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon. The upgrade procedure requires upgrading the control plane first, then draining and upgrading each worker node. Draining a node before upgrading ensures that pods are rescheduled gracefully.

Answer

Upgrade all worker nodes first, then upgrade the control plane

Answer

Drain all nodes simultaneously, upgrade the control plane, then upgrade worker nodes

Answer

Upgrade the control plane and worker nodes at the same time

Question 4

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

Accepted Answer

The service account can read pods in all namespaces. ClusterRoleBindings are cluster-scoped, meaning they grant permissions across all namespaces. Since the ClusterRoleBinding 'read-pods-global' binds the 'pod-reader' ClusterRole to the service account 'sa-pod-reader', the service account can get and list pods in every namespace, not just the 'default' namespace.

Answer

The service account can only read pods in the 'default' namespace

Answer

The service account can only list pods, not get them

Answer

The service account cannot read pods in any namespace

Question 5

You are using kubeadm to initialize a cluster. After running 'kubeadm init', you follow the instructions to set up the kubeconfig for the regular user. Which of the following commands should you run to allow kubectl to communicate with the cluster?

Accepted Answer

sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config. After running 'kubeadm init', the admin.conf file is generated in /etc/kubernetes/ and contains the cluster CA certificate, client certificate, and API server endpoint. This is the only kubeconfig file that grants full administrative access to the cluster, making it the correct file to copy to the user's $HOME/.kube/config for kubectl to communicate with the cluster.

Answer

sudo cp /etc/kubernetes/controller-manager.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/scheduler.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/kubelet.conf $HOME/.kube/config

Question 6

What is the purpose of the kube-proxy component in a Kubernetes cluster?

Accepted Answer

It provides network proxy and load balancing for services. Option A is correct because kube-proxy is the component responsible for implementing the Kubernetes Service concept by maintaining network rules on each node. It performs connection forwarding and load balancing for Service endpoints using either iptables, IPVS, or userspace mode, ensuring that traffic destined for a Service's ClusterIP is correctly routed to healthy Pods.

Answer

It schedules pods to nodes

Answer

It manages the lifecycle of pods

Answer

It stores cluster configuration data

Question 7

You are troubleshooting a pod that is in 'Pending' state. Running 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate.' What is the most likely cause?

Accepted Answer

The pod is trying to schedule on the master node which has a taint that is not tolerated. The pod is in 'Pending' state because none of the three nodes are schedulable for it. The 'kubectl describe pod' event explicitly states that all three nodes have the taint 'node-role.kubernetes.io/master: ' and the pod does not have a corresponding toleration. Master nodes are typically tainted to prevent general workloads from scheduling on them, so a pod without a toleration for that taint cannot be placed on any master node, leaving zero available nodes.

Answer

The pod requires more CPU than any node can provide

Answer

The pod is using a hostPort that conflicts with another pod

Answer

The pod has a node selector that doesn't match any node

Question 8

Which command can you use to check the expiration date of certificates managed by kubeadm?

Accepted Answer

kubeadm certs check-expiration. The correct command is `kubeadm certs check-expiration`, which is a dedicated kubeadm subcommand that inspects all certificates managed by kubeadm and displays their expiration dates, remaining validity, and renewal status. This command reads the certificate files from `/etc/kubernetes/pki/` and parses their X.509 metadata, providing a concise summary without requiring external tools like OpenSSL.

Answer

kubectl get certificates

Answer

kubeadm certs list

Answer

kubeadm certs renew --check

Question 9

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

Accepted Answer

Role and RoleBinding. Option C is correct because a Role grants permissions within a specific namespace, and a RoleBinding binds that Role to a user or service account within the same namespace. To restrict a user to creating and managing deployments only in the 'development' namespace, you need a Role (scoped to that namespace) and a RoleBinding (also scoped to that namespace). ClusterRole and ClusterRoleBinding are cluster-scoped and would grant permissions across all namespaces, which is not desired here.

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Answer

ClusterRole and RoleBinding

Question 10

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

Accepted Answer

spec.serviceAccountName. Option A is correct because setting `spec.serviceAccountName` to 'my-sa' in the pod spec automatically mounts the service account token as a volume at `/var/run/secrets/kubernetes.io/serviceaccount/`. This is the standard way to associate a service account with a pod, and Kubernetes automatically handles token projection and mounting for that service account.

Answer

spec.serviceAccount

Answer

spec.containers[].env[].valueFrom.secretKeyRef

Answer

spec.automountServiceAccountToken

Question 11

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

Accepted Answer

The endpoint flag is missing or incorrect, causing the client to timeout trying to connect. The error 'context deadline exceeded' indicates that the etcdctl client attempted to connect to the etcd endpoint but the request timed out before a connection could be established. This is most commonly caused by the --endpoints flag being omitted or pointing to an incorrect address (e.g., localhost:2379 instead of the actual etcd listener), so the client cannot reach the etcd server within the default timeout period.

Answer

The etcdctl version is incompatible with etcd

Answer

The etcd cluster is not running

Answer

The snapshot file already exists and is locked

Question 12

What is the function of the 'kube-scheduler' in Kubernetes?

Accepted Answer

It assigns pods to nodes. The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Answer

It runs the container runtime

Answer

It manages network rules for services

Answer

It stores cluster state

Question 13

Which TWO of the following are valid methods to restore an etcd cluster from a snapshot? (Choose TWO.)

Accepted Answer

Stopping all etcd members, copying the snapshot to the data directory, and starting etcd. Option C is correct because restoring an etcd cluster from a snapshot can be done by stopping all etcd members, copying the snapshot file to the etcd data directory (typically `/var/lib/etcd`), and then restarting the etcd service. This manual method works when you replace the entire data directory with the snapshot content, allowing etcd to rebuild its state from the snapshot on startup.

Answer

etcdctl restore

Answer

kubectl apply -f etcd-backup.yaml

Answer

kubeadm reset

Question 14

Which THREE of the following are components of the Kubernetes control plane? (Choose THREE.)

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane, exposing the Kubernetes API. All administrative tasks and component interactions (e.g., from kubectl, the scheduler, the controller manager) go through the API server, which validates and processes RESTful requests before persisting state to etcd.

Answer

kubelet

Answer

kube-proxy

Question 15

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Accepted Answer

kubectl drain <node> --ignore-daemonsets. Option C is correct because `kubectl drain` safely evicts all pods from a node before maintenance, and the `--ignore-daemonsets` flag is necessary because DaemonSet pods cannot be evicted (they are managed by the node controller). Option D is correct because `kubectl cordon` marks the node as unschedulable, preventing new pods from being scheduled onto it, which is a prerequisite before draining to avoid race conditions.

Answer

kubectl delete node <node>

Answer

kubectl uncordon <node>

Answer

kubectl taint nodes <node> key=value:NoSchedule