CKA Cluster Architecture, Installation and Configuration Practice Test 13 — 15 Questions

Question 1

Which kubeconfig context field defines the set of users, clusters, and namespaces for kubectl operations?

Accepted Answer

contexts. The `contexts` field in a kubeconfig file defines a named context that bundles together a specific cluster, user, and default namespace. When you run `kubectl` commands, the current context determines which cluster to authenticate against, which user credentials to use, and which namespace to operate in by default. This is why option A is correct.

Answer

namespaces

Answer

clusters

Answer

users

Question 2

You need to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. After upgrading the control plane, what should you do on each worker node?

Accepted Answer

kubectl drain ; kubeadm upgrade node; kubectl uncordon . The standard kubeadm upgrade workflow for worker nodes requires first draining the node to safely evict all pods, then running 'kubeadm upgrade node' to upgrade the kubelet and kube-proxy configuration, and finally uncordoning the node to make it schedulable again. This sequence ensures minimal disruption to workloads and follows the official Kubernetes upgrade documentation.

Answer

kubeadm upgrade node config --kubelet-version v1.29.0

Answer

kubectl delete node <node>; kubeadm upgrade node

Answer

kubeadm upgrade node; kubectl uncordon <node>

Question 3

Which command is used to initialize a Kubernetes cluster using kubeadm?

Accepted Answer

kubeadm init. The correct command to initialize a Kubernetes cluster using kubeadm is `kubeadm init`. This command performs the bootstrap process by setting up the control plane components (e.g., API server, etcd, controller manager, scheduler) on the node, generating certificates, and creating the necessary configuration files in `/etc/kubernetes/`. It is the standard first step after installing kubeadm, kubelet, and a container runtime.

Answer

kubeadm create cluster

Answer

kubeadm start

Answer

kubeadm bootstrap

Question 4

A node in the cluster has been cordoned. Which of the following is true about the node?

Accepted Answer

The node is marked as unschedulable, but existing pods continue to run.. When a node is cordoned using `kubectl cordon`, it is marked as unschedulable by setting the `node.Spec.Unschedulable` field to true. This prevents new pods from being scheduled onto the node, but existing pods continue to run normally. The node remains part of the cluster and is not removed or drained automatically.

Answer

The node is removed from the cluster.

Answer

kubectl drain is automatically performed on the node.

Answer

Existing pods on the node are immediately evicted.

Question 5

A developer needs to access the Kubernetes API from a pod using a ServiceAccount. Which of the following is the recommended way to mount the ServiceAccount token into a pod?

Accepted Answer

Use a projected service account token with a mount path.. The recommended way to mount a ServiceAccount token into a pod is by using a projected service account token volume. This approach, introduced in Kubernetes 1.20, provides a time-bound, audience-scoped, and automatically rotated token that is mounted as a file at a specified mount path, enhancing security over static secrets.

Answer

Use the downward API to inject the token as an environment variable.

Answer

Set the token in the pod spec using the 'serviceAccountToken' field.

Answer

Mount the secret directly using a volume.

Question 6

Which subcommand of 'kubectl config' is used to switch between different contexts?

Accepted Answer

kubectl config use-context. 'kubectl config use-context' is the exact subcommand used to switch the current context in a kubeconfig file. This command updates the 'current-context' field in the kubeconfig, directing all subsequent kubectl commands to the specified cluster, namespace, and user combination.

Answer

kubectl config switch-context

Answer

kubectl config set-context

Answer

kubectl config current-context

Question 7

Which component is responsible for assigning pods to nodes?

Accepted Answer

kube-scheduler. The kube-scheduler is responsible for assigning pods to nodes based on resource requirements, constraints, and policies. It watches for newly created pods that have no node assignment and selects an optimal node for each pod to run on.

Answer

kubelet

Answer

kube-apiserver

Answer

kube-controller-manager

Question 8

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

Accepted Answer

Upgrade the control plane first, then drain each worker node, upgrade the kubelet and kube-proxy, then uncordon. Kubernetes requires the control plane to be upgraded first, as it is the source of truth for the cluster state and API version compatibility. After the control plane is upgraded, each worker node must be drained (to evict pods gracefully), upgraded (kubelet and kube-proxy), and then uncordoned to resume scheduling. This sequential process ensures that the cluster remains functional and that kubelet versions never exceed the kube-apiserver version, which is a strict compatibility requirement.

Answer

Upgrade all worker nodes first, then upgrade the control plane

Answer

Drain all nodes simultaneously, upgrade the control plane, then upgrade worker nodes

Answer

Upgrade the control plane and worker nodes at the same time

Question 9

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

Accepted Answer

The service account can read pods in all namespaces. ClusterRoleBindings are cluster-scoped, meaning they grant permissions across all namespaces. Since the ClusterRoleBinding 'read-pods-global' binds the 'pod-reader' ClusterRole to the service account 'sa-pod-reader', the service account can get and list pods in every namespace, not just the 'default' namespace.

Answer

The service account can only read pods in the 'default' namespace

Answer

The service account can only list pods, not get them

Answer

The service account cannot read pods in any namespace

Question 10

You are using kubeadm to initialize a cluster. After running 'kubeadm init', you follow the instructions to set up the kubeconfig for the regular user. Which of the following commands should you run to allow kubectl to communicate with the cluster?

Accepted Answer

sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config. After running 'kubeadm init', the admin.conf file is generated in /etc/kubernetes/ and contains the cluster CA certificate, client certificate, and API server endpoint. This is the only kubeconfig file that grants full administrative access to the cluster, making it the correct file to copy to the user's $HOME/.kube/config for kubectl to communicate with the cluster.

Answer

sudo cp /etc/kubernetes/controller-manager.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/scheduler.conf $HOME/.kube/config

Answer

sudo cp /etc/kubernetes/kubelet.conf $HOME/.kube/config

Question 11

Which command can you use to check the expiration date of certificates managed by kubeadm?

Accepted Answer

kubeadm certs check-expiration. The correct command is `kubeadm certs check-expiration`, which is a dedicated kubeadm subcommand that inspects all certificates managed by kubeadm and displays their expiration dates, remaining validity, and renewal status. This command reads the certificate files from `/etc/kubernetes/pki/` and parses their X.509 metadata, providing a concise summary without requiring external tools like OpenSSL.

Answer

kubectl get certificates

Answer

kubeadm certs list

Answer

kubeadm certs renew --check

Question 12

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

Accepted Answer

Role and RoleBinding. A Role grants permissions within a specific namespace, and a RoleBinding binds that Role to a user or service account within the same namespace. To restrict a user to creating and managing deployments only in the 'development' namespace, you need a Role (scoped to that namespace) and a RoleBinding (also scoped to that namespace). ClusterRole and ClusterRoleBinding are cluster-scoped and would grant permissions across all namespaces, which is not desired here.

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Answer

ClusterRole and RoleBinding

Question 13

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

Accepted Answer

spec.serviceAccountName. Setting `spec.serviceAccountName` to 'my-sa' in the pod spec automatically mounts the service account token as a volume at `/var/run/secrets/kubernetes.io/serviceaccount/`. This is the standard way to associate a service account with a pod, and Kubernetes automatically handles token projection and mounting for that service account.

Answer

spec.serviceAccount

Answer

spec.containers[].env[].valueFrom.secretKeyRef

Answer

spec.automountServiceAccountToken

Question 14

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

Accepted Answer

The endpoint flag is missing or incorrect, causing the client to timeout trying to connect. The error 'context deadline exceeded' indicates that the etcdctl client attempted to connect to the etcd endpoint but the request timed out before a connection could be established. This is most commonly caused by the --endpoints flag being omitted or pointing to an incorrect address (e.g., localhost:2379 instead of the actual etcd listener), so the client cannot reach the etcd server within the default timeout period.

Answer

The etcdctl version is incompatible with etcd

Answer

The etcd cluster is not running

Answer

The snapshot file already exists and is locked

Question 15

What is the function of the 'kube-scheduler' in Kubernetes?

Accepted Answer

It assigns pods to nodes. The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Answer

It runs the container runtime

Answer

It manages network rules for services

Answer

It stores cluster state