CKA Cluster Architecture, Installation and Configuration Practice Test 2 — 15 Questions

Question 1

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

Accepted Answer

Upgrade the first control plane node, then upgrade the remaining control plane nodes, then upgrade worker nodes.. Option B is correct because the recommended upgrade order for a kubeadm-managed cluster is to upgrade the first control plane node (using `kubeadm upgrade apply`), then the remaining control plane nodes (using `kubeadm upgrade node`), and finally the worker nodes. This ensures the cluster's control plane components (etcd, kube-apiserver, kube-controller-manager, kube-scheduler) are updated first, maintaining cluster stability and API server availability during the process.

Answer

Upgrade all worker nodes first, then upgrade the control plane nodes.

Answer

Upgrade all nodes simultaneously by running kubeadm upgrade apply on all nodes at once.

Answer

Upgrade worker nodes, then upgrade the control plane nodes, then drain the worker nodes.

Question 2

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

Accepted Answer

kubelet on the worker node. The kubelet is the primary node agent that runs on every worker node and is responsible for registering the node with the cluster and periodically reporting its status via NodeStatus updates. When a node is in 'NotReady' state, it means the kubelet has failed to send heartbeats or report readiness to the control plane, typically due to a crash, misconfiguration, or resource exhaustion. Checking the kubelet's logs and service status (e.g., 'systemctl status kubelet' or 'journalctl -u kubelet') is the first diagnostic step because it directly controls node health reporting.

Answer

kube-apiserver on the control plane

Answer

kube-controller-manager

Answer

etcd cluster health

Question 3

Which command is used to take a snapshot of etcd using etcdctl?

Accepted Answer

etcdctl snapshot save. Option C is correct because `etcdctl snapshot save` is the official command to create a point-in-time snapshot of an etcd datastore, which is essential for backup and disaster recovery in Kubernetes clusters. This command writes the snapshot to a specified file path, preserving all keys and metadata for later restoration via `etcdctl snapshot restore`.

Answer

etcdctl dump

Answer

etcdctl snapshot create

Answer

etcdctl backup

Question 4

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

Accepted Answer

ServiceAccount. A ServiceAccount is the correct resource because Kubernetes automatically mounts a projected volume containing a JWT token into pods that use the default or a specified ServiceAccount. This token is used by the pod to authenticate against the Kubernetes API server, enabling secure in-cluster communication without manual credential management.

Answer

Secret

Answer

ConfigMap

Answer

ClusterRoleBinding

Question 5

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

Accepted Answer

kubectl cordon <node-name>. The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

Answer

kubectl uncordon <node-name>

Answer

kubectl drain <node-name>

Answer

kubectl taint nodes <node-name> key=value:NoSchedule

Question 6

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are the correct combination because the CI/CD pipeline needs to create and delete pods only within the 'ci' namespace. A Role defines permissions scoped to a specific namespace, and a RoleBinding grants those permissions to a user or service account within that same namespace. This ensures the pipeline cannot affect resources in other namespaces.

Answer

ClusterRole and RoleBinding

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Question 7

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time batch task that runs to completion and then exits. It ensures a specified number of Pods terminate successfully, making it ideal for processing data and exiting without requiring continuous availability.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 8

Which of the following is NOT a control plane component in Kubernetes?

Accepted Answer

kube-proxy. kube-proxy is not a control plane component; it is a node-level (worker) component responsible for implementing network rules and handling service-to-pod traffic via iptables or IPVS. The control plane consists of kube-apiserver, etcd, kube-scheduler, and kube-controller-manager.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver

Question 9

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

Accepted Answer

The pod cannot be scheduled due to insufficient resources. A pod in 'Pending' state indicates that the pod has been accepted by the Kubernetes API server but is not yet running. The most common cause is that the scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other scheduling constraints (taints, node selector, affinity rules). This results in the pod remaining unscheduled, hence 'Pending'.

Answer

The pod has been deleted

Answer

The pod is waiting for a container to start

Answer

The container image is invalid

Question 10

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Option C is correct because etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 11

Which component is responsible for managing the network rules and forwarding on each node?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for managing network rules and forwarding traffic on each node. It implements the Kubernetes Service concept by maintaining iptables or IPVS rules that route packets to the correct backend pods, handling load balancing and service discovery at the network layer.

Answer

container runtime

Answer

kubelet

Answer

kube-scheduler

Question 12

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

Accepted Answer

kubeadm certs check-expiration. The `kubeadm certs check-expiration` command is the correct tool to inspect the expiration dates of all certificates generated by kubeadm for cluster components, such as the API server, controller-manager, scheduler, and etcd. It reads the certificate files from the default kubeadm certificate directory (`/etc/kubernetes/pki`) and displays their remaining validity period in a human-readable table. This command is part of the kubeadm certificate management suite and is specifically designed for this purpose.

Answer

kubeadm upgrade plan

Answer

kubeadm certs renew

Answer

kubectl get certificates

Question 13

Which TWO components are part of the Kubernetes control plane? (Select two.)

Accepted Answer

etcd. etcd is a distributed key-value store that serves as the primary datastore for the Kubernetes cluster, storing all cluster state and configuration data. The kube-controller-manager runs controller processes that regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. Both are core control plane components that run on the master node(s).

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 14

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

Accepted Answer

Client certificates. Client certificates are a valid authentication method for the Kubernetes API server. The API server can be configured with the `--client-ca-file` flag to trust a Certificate Authority (CA), and then clients present a TLS certificate signed by that CA to authenticate. This is a common and secure method for user and component authentication.

Answer

Username and password

Answer

SSH keys

Question 15

Which TWO commands are valid for managing nodes in Kubernetes? (Select two.)

Accepted Answer

kubectl drain . `kubectl drain ` is valid because it safely evicts all pods from a node, marking it unschedulable and preparing it for maintenance. `kubectl cordon ` is valid because it marks a node as unschedulable, preventing new pods from being scheduled onto it while existing pods continue running.

Answer

kubectl delete node <node>

Answer

kubectl taint <node>

Answer

kubectl scale node <node>