CKA Cluster Architecture, Installation and Configuration Practice Test 13 — 15 Questions

Question 1

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The endpoint flag is missing or incorrect, causing the client to timeout trying to connect. The error 'context deadline exceeded' indicates that the etcdctl client attempted to connect to the etcd endpoint but the request timed out before a connection could be established. This is most commonly caused by the --endpoints flag being omitted or pointing to an incorrect address (e.g., localhost:2379 instead of the actual etcd listener), so the client cannot reach the etcd server within the default timeout period.

Answer

The etcdctl version is incompatible with etcd

Answer

The etcd cluster is not running

Answer

The snapshot file already exists and is locked

Question 2

What is the function of the 'kube-scheduler' in Kubernetes?

Accepted Answer

It assigns pods to nodes. The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Answer

It runs the container runtime

Answer

It manages network rules for services

Answer

It stores cluster state

Question 3

Which THREE of the following are components of the Kubernetes control plane? (Choose THREE.)

Accepted Answer

kube-apiserver. The Kubernetes control plane consists of the components that make global cluster decisions and store cluster state. kube-apiserver (A) is correct because it exposes the Kubernetes API and serves as the front end of the control plane, handling all REST requests and validating/updating objects in etcd. kube-scheduler (B) is correct because it watches for newly created Pods with no assigned node and selects a suitable node for them to run on. etcd (C) is correct because it is the consistent, highly-available key-value store that persists all cluster data and is the backing store for the API server. kubelet (D) is not a control plane component; it is a node agent that runs on each worker node and manages Pods and containers on that node. kube-proxy (E) is also not a control plane component; it is a node-level network proxy that implements Service networking rules on each node.

Answer

kubelet

Answer

kube-proxy

Question 4

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Accepted Answer

kubectl drain <node> --ignore-daemonsets. `kubectl drain` safely evicts all pods from a node before maintenance, and the `--ignore-daemonsets` flag is necessary because DaemonSet pods cannot be evicted (they are managed by the node controller). Option D is correct because `kubectl cordon` marks the node as unschedulable, preventing new pods from being scheduled onto it, which is a prerequisite before draining to avoid race conditions.

Answer

kubectl delete node <node>

Answer

kubectl uncordon <node>

Answer

kubectl taint nodes <node> key=value:NoSchedule

Question 5

Which command correctly backs up etcd data using etcdctl with API version 3?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Etcdctl requires the environment variable `ETCDCTL_API=3` to use the v3 API, which supports the `snapshot save` command for creating a consistent point-in-time backup of etcd data. The command `ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db` correctly specifies the API version and the subcommand to save a snapshot to the given file path.

Answer

etcdctl backup /backup/snapshot.db

Answer

etcdctl snapshot-backup /backup/snapshot.db

Answer

ETCDCTL_API=3 etcdctl --snapshot /backup/snapshot.db

Question 6

A new Kubernetes administrator runs 'kubeadm join --token

:6443 --discovery-token-ca-cert-hash sha256:' on a worker node. The join fails with 'error execution phase preflight: couldn't validate the identity of the API Server'. What is the most likely cause?

Accepted Answer

The --discovery-token-ca-cert-hash value is incorrect. The error 'couldn't validate the identity of the API Server' indicates that the CA certificate hash provided with --discovery-token-ca-cert-hash does not match the actual hash of the API server's CA certificate. This hash is used to verify the API server's identity during the TLS bootstrap process. An incorrect hash value will cause the preflight check to fail, as the worker node cannot confirm it is connecting to the legitimate control plane.

Answer

The token has expired

Answer

The kubelet is not running on the worker node

Answer

The API server is not reachable on port 6443

Question 7

Which component is responsible for maintaining network rules on each worker node to enable service discovery and load balancing?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for maintaining network rules on each worker node. It implements the Kubernetes Service concept by managing IP tables or IPVS rules to route traffic to the correct Pods, enabling service discovery and load balancing across Pod endpoints.

Answer

kube-controller-manager

Answer

CoreDNS

Answer

kubelet

Question 8

An administrator runs 'kubectl cordon node1' and then 'kubectl drain node1 --ignore-daemonsets'. What is the effect on node1?

Accepted Answer

Node1 is marked as unschedulable and all pods except DaemonSets are evicted. The `kubectl cordon node1` command marks node1 as unschedulable, preventing new pods from being scheduled onto it. The subsequent `kubectl drain node1 --ignore-daemonsets` command evicts all pods from node1 except DaemonSets (which are ignored because they are managed by the DaemonSet controller and typically need to run on every node). This combination makes node1 unschedulable and removes all non-DaemonSet pods, preparing the node for maintenance.

Answer

Node1 is marked as unschedulable but no pods are evicted

Answer

New pods are scheduled onto node1 and existing pods are evicted

Answer

Node1 is marked as schedulable and all pods are evicted

Question 9

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate'. What does this indicate?

Accepted Answer

The node is not reachable by the control plane. The error message indicates that the node has a taint of `node.kubernetes.io/unreachable`, which is automatically added by the node controller when the control plane cannot communicate with the node (e.g., due to network failure or kubelet being down). The pod remains in 'Pending' because no node is available that tolerates this taint, meaning the node is unreachable from the control plane. This matches option C.

Answer

The pod has been successfully scheduled to the node

Answer

The node has insufficient resources and is tainted

Answer

The node does not exist

Question 10

Which command displays the expiration date of all certificates managed by kubeadm?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated command in kubeadm v1.15+ that inspects the expiration dates of all certificates managed by kubeadm, including those for the API server, kubelet, and etcd. It reads certificate files from `/etc/kubernetes/pki/` and displays their remaining validity period in a human-readable table.

Answer

kubeadm alpha certs check-expiration

Answer

kubeadm certs list

Answer

kubectl get certificates

Question 11

A cluster has multiple kubeconfig files. You want to set the current context to 'admin@production' for all future kubectl commands. Which command should you run?

Accepted Answer

kubectl config use-context admin@production. The `kubectl config use-context` command is used to set the current context in a kubeconfig file, which determines the cluster, user, and namespace that kubectl will use by default for all subsequent commands. Option B correctly specifies `admin@production` as the context to switch to, making it the active context for future kubectl operations.

Answer

kubectl config set-context admin@production

Answer

kubectl config set-cluster admin@production

Answer

kubectl config get-contexts admin@production

Question 12

During a cluster upgrade, what is the correct order of operations for upgrading a node?

Accepted Answer

Drain the node, upgrade kubelet and kube-proxy, then uncordon. During a node upgrade, the node must first be drained to safely evict all pods and ensure workloads are rescheduled. Then, the kubelet and kube-proxy (which run as system services) are upgraded to match the control plane version. Finally, the node is uncordoned to make it schedulable again, allowing new pods to be placed on it.

Answer

Upgrade kubelet, drain the node, then uncordon

Answer

Drain the node, uncordon, then upgrade kubelet

Answer

Uncordon the node, drain, then upgrade

Question 13

Which component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of replicas for a Deployment?

Accepted Answer

kube-controller-manager. The kube-controller-manager is responsible for running controller processes that regulate the state of the cluster. It includes the Deployment controller, which watches the API server for changes to Deployment objects and ensures the actual number of replicas matches the desired state by creating or deleting Pods via the ReplicaSet controller.

Answer

kube-apiserver

Answer

kubelet

Answer

kube-scheduler

Question 14

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Etcd v3 is the default and supported version in Kubernetes v1.29, and the `ETCDCTL_API=3` environment variable ensures the etcdctl client uses the v3 API, which provides the `snapshot save` command for creating consistent backups. The command `ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db` correctly captures a point-in-time snapshot of the etcd data store, which is essential for disaster recovery.

Answer

kubectl etcd snapshot save /backup/snapshot.db

Answer

etcdctl backup /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl snapshot save /backup/snapshot.db

Question 15

A developer created a ServiceAccount named 'app-sa' in the 'dev' namespace. They want a pod to use this ServiceAccount. Which field in the pod spec should be set?

Accepted Answer

spec.serviceAccountName. The `spec.serviceAccountName` field in a Pod spec is the standard way to assign a specific ServiceAccount to a Pod. When this field is set, the Pod's containers will use the token of that ServiceAccount for API authentication. If omitted, the Pod defaults to the `default` ServiceAccount in its namespace.

Answer

spec.serviceAccount

Answer

spec.authentication.serviceAccount

Answer

spec.accountName