CKA Cluster Architecture, Installation and Configuration Practice Test 14 — 15 Questions

Question 1

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

Accepted Answer

kubeadm certs renew apiserver. `kubeadm certs renew apiserver` is the standard command in modern kubeadm (v1.15+) to renew a specific certificate without affecting others. It regenerates the apiserver certificate using the existing CA key, updating the expiration date while keeping the same Subject and SANs.

Answer

kubeadm alpha certs renew apiserver

Answer

kubeadm init phase certs apiserver --renew

Answer

kubectl create certificate apiserver

Question 2

Which kubeconfig context is currently active?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the name of the currently active context from the kubeconfig file. The active context determines which cluster, user, and namespace are used by default for kubectl commands, making this the precise way to identify the active context.

Answer

kubectl config view

Answer

kubectl cluster-info

Answer

kubectl config get-contexts

Question 3

What is the purpose of the kube-proxy component?

Accepted Answer

It manages network rules for Services and endpoints. B is correct because kube-proxy is the component responsible for implementing the network rules that enable Kubernetes Services to function. It runs on each node and maintains iptables or IPVS rules to route traffic to the correct backend Pods based on the Service's endpoints, handling load balancing and service discovery at the network layer.

Answer

It proxies API requests to the kube-apiserver

Answer

It stores cluster state

Answer

It schedules pods to nodes

Question 4

Which command initializes a new Kubernetes cluster using kubeadm?

Accepted Answer

kubeadm init. `kubeadm init` is the official Kubernetes command to bootstrap a control-plane node and initialize a new cluster. It performs preflight checks, generates certificates, creates the static Pod manifests for core components (etcd, API server, controller manager, scheduler), and configures the admin kubeconfig file.

Answer

kubeadm create cluster

Answer

kubeadm setup

Answer

kubeadm start

Question 5

Which TWO components run on worker nodes? (Select 2)

Accepted Answer

kubelet. kubelet (B) is correct because it is the primary node agent that runs on every worker node, registering the node with the API server and managing pod lifecycles via the container runtime. kube-proxy (E) is also correct because it runs on each worker node to maintain network rules (iptables/IPVS) that implement Kubernetes Service load balancing and pod networking. etcd (A) is incorrect because it is the cluster's distributed key-value datastore, typically running on control plane nodes. kube-apiserver (C) is incorrect because it is the control plane's front-end REST API server, not a worker node component. kube-scheduler (D) is incorrect because it is a control plane component that assigns pods to nodes rather than running on the worker nodes themselves.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 6

Which TWO are true about taints and tolerations? (Select 2)

Accepted Answer

A node can have multiple taints. Option B is correct because a Kubernetes node can carry multiple taints simultaneously, each expressed as key=value:effect, and a pod must tolerate every NoSchedule/NoExecute taint on that node to be scheduled there. Option E is correct because tolerations are declared in a pod's spec (spec.tolerations) and let the scheduler place that pod on a node whose taints it matches, effectively overriding the taint's scheduling restriction. Option A is wrong because taints only repel pods that lack matching tolerations, not all pods; pods with appropriate tolerations can still schedule. Option C is wrong because taints are applied to nodes (via kubectl taint nodes), not to pods. Option D is wrong because tolerations are set on pods, not on nodes.

Answer

Taints prevent all pods from scheduling on a node

Answer

Taints are applied to pods

Answer

Tolerations are set on nodes

Question 7

You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?

Accepted Answer

mkdir -p $HOME/.kube && sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config && sudo chown $(id -u):$(id -g) $HOME/.kube/config. After running 'kubeadm init', the admin kubeconfig file is generated at /etc/kubernetes/admin.conf. To use kubectl as a regular (non-root) user, you must copy this file to the user's $HOME/.kube/config directory and then change its ownership to the current user. This ensures kubectl can authenticate to the cluster using the admin certificate and key embedded in the config file.

Answer

sudo kubeadm reset --force

Answer

sudo cp /etc/kubernetes/admin.conf /root/.kube/config

Answer

sudo cp /etc/kubernetes/pki/admin.conf $HOME/.kube/config

Question 8

Which TWO components are part of the Kubernetes control plane? (Choose TWO.)

Accepted Answer

kube-apiserver. The Kubernetes control plane is the set of components that make global cluster decisions and expose the cluster API, and it includes the kube-apiserver (B) and kube-scheduler (C). The kube-apiserver (B) is the front end of the control plane: it validates and processes REST requests, persists cluster state in etcd, and is the only component that talks directly to etcd. The kube-scheduler (C) is also a control-plane component: it watches for newly created Pods with no assigned node and selects a suitable node based on resource requirements, affinity/anti-affinity, taints and tolerations, and other scheduling policies. The other options are node-level components, not control-plane components: the container runtime (A) executes containers on a node, the kubelet (D) is the node agent that ensures containers described in PodSpecs are running and healthy, and kube-proxy (E) maintains network rules on nodes to implement Service networking.

Answer

container runtime

Answer

kubelet

Answer

kube-proxy

Question 9

You have taken an etcd snapshot using 'ETCDCTL_API=3 etcdctl snapshot save snapshot.db'. Which TWO commands are needed to restore this snapshot to a new etcd member? (Choose TWO.)

Accepted Answer

Update the etcd configuration (e.g., --data-dir) and restart the etcd service. Option D is correct because 'etcdctl snapshot restore snapshot.db --data-dir=/var/lib/etcd-restore' is the actual command that rebuilds the etcd data directory from the saved snapshot, writing a fresh member's data into the specified --data-dir. Option C is correct because after restoring the snapshot to a new data directory, the etcd member's configuration (for example the --data-dir flag in the etcd unit file or manifest) must be pointed at that restored directory and the etcd service restarted so the new member starts from the restored state. Option A ('etcdctl endpoint health') only checks cluster endpoint health and does not perform any restore action. Option B ('etcdctl snapshot save backup.db') creates a new snapshot rather than restoring one. Option E ('etcdctl snapshot status snapshot.db') only reports metadata such as hash, revision, and total keys in the snapshot file and does not restore it.

Answer

etcdctl endpoint health

Answer

etcdctl snapshot save backup.db

Answer

etcdctl snapshot status snapshot.db

Question 10

You are applying the following RBAC manifest:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Which TWO statements are true about this Role? (Choose TWO.)

Accepted Answer

It allows reading pod details in the 'development' namespace. The Role explicitly defines rules for the 'pods' resource with verbs 'get', 'watch', and 'list' in the 'development' namespace. These verbs allow reading pod details such as their specifications, status, and metadata. The Role is scoped to the 'development' namespace, so it only grants these read permissions within that namespace.

Answer

It also grants access to secrets in the 'development' namespace

Answer

It grants permissions across all namespaces

Answer

It allows creating pods in the 'development' namespace

Question 11

Your cluster has three control plane nodes. You suspect the etcd cluster has a leader election issue. Which TWO commands can help diagnose the etcd cluster health and membership? (Choose TWO.)

Accepted Answer

etcdctl endpoint health --cluster. `etcdctl endpoint health --cluster` queries the health status of all etcd endpoints in the cluster, which directly reveals if any node is unreachable or unhealthy—a common symptom of leader election issues. Option E is correct because `etcdctl member list` displays the current cluster membership, including each member's ID, name, peer URLs, and client URLs, allowing you to verify that all expected control plane nodes are properly joined and that no split-brain or quorum loss has occurred.

Answer

etcdctl cluster-status

Answer

etcdctl version

Answer

etcdctl snapshot save snapshot.db

Question 12

Which THREE components run on every worker node in a Kubernetes cluster? (Choose THREE.)

Accepted Answer

kube-proxy. kube-proxy (B) is correct because it runs on every worker node and maintains the node's network rules (via iptables/IPVS) to implement Kubernetes Service load balancing and ClusterIP routing. kubelet (C) is correct because it is the node agent that runs on every worker node, registers the node with the API server, and manages Pod lifecycle by instructing the container runtime via the CRI. The container runtime (E) is correct because every worker node must have a CRI-compliant runtime (e.g., containerd or CRI-O) to actually pull images and run containers for Pods. In contrast, etcd (A) is the cluster's distributed key-value datastore and runs on control plane nodes, not worker nodes, and kube-apiserver (D) is the control plane's API front end, also not part of the worker node's required components.

Answer

etcd

Answer

kube-apiserver

Question 13

You need to grant a ServiceAccount named 'monitor-sa' in namespace 'monitoring' the ability to read Pods and Services across all namespaces. Which TWO resources are needed? (Choose TWO.)

Accepted Answer

ClusterRoleBinding binding the ClusterRole to the ServiceAccount. Option C is correct because reading Pods and Services across all namespaces requires a ClusterRole, which is a cluster-scoped resource whose rules (e.g., apiGroups: [""], resources: ["pods", "services"], verbs: ["get", "list", "watch"]) apply across the entire cluster. Option A is correct because a ClusterRole alone grants nothing; a ClusterRoleBinding must bind that ClusterRole to the ServiceAccount subject (kind: ServiceAccount, name: monitor-sa, namespace: monitoring) to actually confer the permissions cluster-wide. Option B is not needed because token secrets are only for obtaining a long-lived bearer token and are unrelated to RBAC authorization. Option D is wrong because a RoleBinding is namespace-scoped and would have to be created in every namespace individually, which does not satisfy the 'across all namespaces' requirement. Option E is wrong because a Role in the 'monitoring' namespace only grants permissions within that single namespace, not cluster-wide.

Answer

ServiceAccount token secret

Answer

RoleBinding in each namespace

Answer

Role in the 'monitoring' namespace

Question 14

You run 'kubectl cordon node1'. Which TWO statements describe the effect of this command? (Choose TWO.)

Accepted Answer

New pods will not be scheduled onto node1. Option D is correct because 'kubectl cordon node1' sets the node's spec.unschedulable field to true, which causes the Kubernetes scheduler to skip node1 when placing new pods, so no new pods will be scheduled onto it. Option E is correct because cordoning is precisely the operation that marks a node as unschedulable, which is reflected in the node's status and taints the scheduler's view of that node. The unmarked options do not belong: option A is wrong because cordoning does not remove the node from the cluster (that would require 'kubectl delete node'), option B is wrong because cordoning does not delete any pods, and option C is wrong because existing pods are not evicted by cordon—eviction requires 'kubectl drain' (with appropriate flags such as --ignore-daemonsets and --delete-emptydir-data).

Answer

The node is removed from the cluster

Answer

All pods on node1 are deleted

Answer

Existing pods on node1 are immediately evicted

Question 15

You need to create a Kubernetes ServiceAccount named 'build-bot' and ensure that pods using this ServiceAccount can authenticate to the Kubernetes API using a long-lived token. Which TWO steps are necessary? (Choose TWO.)

Accepted Answer

Create a ServiceAccount object named 'build-bot'. Creating a ServiceAccount named 'build-bot' is the foundational step; without the ServiceAccount object, no pods can be assigned a service account identity. Option E is correct because a Secret of type 'kubernetes.io/service-account-token' with an annotation referencing the ServiceAccount causes the Kubernetes controller manager to automatically generate and populate a long-lived token, which pods can mount and use to authenticate to the API server.

Answer

Create a Secret of type 'Opaque' with the token data

Answer

Run 'kubectl create token build-bot'

Answer

Use the TokenRequest API to generate a token