CKA Cluster Architecture, Installation and Configuration Practice Test 2 — 15 Questions

Question 1

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key. It uses the etcdctl v3 API with the `snapshot save` command, which is the proper method for creating a consistent point-in-time backup of an etcd cluster. The command includes mandatory TLS authentication flags (`--cacert`, `--cert`, `--key`) and the `--endpoints` flag to target a specific etcd member, ensuring a secure and successful snapshot operation.

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl snapshot save /backup/snapshot.db

Question 2

A developer wants to create a ServiceAccount named 'app-sa' and mount its token into a pod. Which YAML snippet correctly configures the pod to use this ServiceAccount?

Accepted Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: true. It uses the `serviceAccountName` field to assign the 'app-sa' ServiceAccount to the pod and sets `automountServiceAccountToken: true` to explicitly mount the token. By default, Kubernetes mounts the token if `automountServiceAccountToken` is not set, but setting it to `true` ensures the token is mounted even if the ServiceAccount itself has `automountServiceAccountToken: false`.

Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: false

Answer

spec:
  serviceAccountName: app-sa
  automountServiceAccountToken: "true"

Answer

spec:
  serviceAccount: app-sa

Question 3

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Accepted Answer

kubectl cordon node1. The `kubectl cordon node1` command marks the node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the correct approach when you need to isolate a node for maintenance without disrupting current workloads.

Answer

kubectl drain node1

Answer

kubectl taint nodes node1 key=value:NoSchedule

Answer

kubectl delete node node1

Question 4

An administrator runs 'kubeadm certs check-expiration' and sees that the kubelet client certificate expires in 7 days. What is the correct way to renew it?

Accepted Answer

Run 'kubeadm certs renew kubelet-client'. The `kubeadm certs renew kubelet-client` command is the correct way to renew only the kubelet client certificate without affecting other certificates. This targeted renewal is appropriate when only the kubelet client certificate is expiring, as it avoids unnecessary disruption to other components. The command regenerates the certificate using the existing CA, and the kubelet will automatically reload it.

Answer

Run 'kubeadm init phase certs kubelet-client'

Answer

Renew all certificates using 'kubeadm certs renew all'

Answer

Delete the old certificate and restart kubelet

Question 5

Which control plane component stores the entire cluster state?

Accepted Answer

etcd. Etcd because it is the distributed key-value store that serves as the single source of truth for the entire cluster state, including all objects, configurations, and secrets. The kube-apiserver is the only component that directly interacts with etcd, but it does not store the state itself—it reads from and writes to etcd on behalf of other components.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kube-apiserver

Question 6

You want to grant a user read-only access to all pods in the 'development' namespace. Which RBAC resource should you create?

Accepted Answer

Role in the development namespace with get, list, watch on pods. A Role in the 'development' namespace with get, list, watch on pods is correct because RBAC Roles are namespace-scoped and grant permissions only within that namespace. Since the requirement is read-only access to pods in a specific namespace, a Role is the appropriate resource to define these permissions.

Answer

ClusterRoleBinding with get, list, watch on pods

Answer

ClusterRole with get, list, watch on pods

Answer

RoleBinding referencing a ClusterRole that has get, list, watch on pods

Question 7

After upgrading the control plane using kubeadm, you need to update the kubelet configuration on the node. Which command should you run on the node?

Accepted Answer

kubeadm upgrade node. `kubeadm upgrade node` is the command used on worker nodes (or secondary control-plane nodes) after the primary control plane has been upgraded. It upgrades the kubelet configuration and other node-specific components to match the new cluster version, ensuring the node can rejoin the upgraded cluster.

Answer

kubeadm upgrade apply

Answer

kubectl upgrade node

Answer

kubeadm upgrade plan

Question 8

You need to back up the etcd database for a kubeadm-created cluster. Which directory contains the etcd data?

Accepted Answer

/var/lib/etcd. For a kubeadm-created cluster, etcd runs as a static Pod, and its data directory is mounted from the host path `/var/lib/etcd`. This is the default data directory used by etcd when started via kubeadm, and it stores all cluster state and configuration data. The CKA exam expects you to know this path for backup and restore operations.

Answer

/etc/kubernetes/pki/etcd

Answer

/var/lib/kubelet

Answer

/etc/etcd

Question 9

Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that maintains network rules (e.g., iptables, IPVS) and enables service abstraction by proxying traffic to the correct Pods. It watches the Kubernetes API server for Service and EndpointSlice changes, then updates the node's packet filtering rules to route cluster IP traffic to healthy backend Pods.

Answer

kube-scheduler

Answer

container runtime

Answer

kubelet

Question 10

Which TWO commands can be used to interact with etcd snapshot operations? (Select TWO.)

Accepted Answer

etcdctl snapshot restore. The `etcdctl snapshot save` command creates a point-in-time snapshot of the etcd datastore, which is essential for backing up the Kubernetes cluster state. The `etcdctl snapshot restore` command restores a cluster from a previously saved snapshot, typically used for disaster recovery or migrating etcd to a new node. Both commands are part of the official etcdctl snapshot subcommand group.

Answer

etcdctl import

Answer

etcdctl migrate

Answer

etcdctl backup

Question 11

Which THREE of the following are valid methods to configure a pod to use a specific ServiceAccount? (Select THREE.)

Accepted Answer

Set spec.serviceAccountName in the pod spec. The only valid method to configure a pod to use a specific ServiceAccount is to set the `serviceAccountName` field in the pod spec (or in the pod template of controllers like Deployments). The deprecated `serviceAccount` field is still recognized for backward compatibility but is not the recommended or exam-accepted method. Option D is incorrect because disabling automatic token mount and manually mounting a token does not assign a ServiceAccount to the pod; the ServiceAccount is still determined by the pod spec's `serviceAccountName` field.

Answer

Create a ClusterRoleBinding that binds the ServiceAccount to a ClusterRole

Answer

Set automountServiceAccountToken: false and manually mount the token as a volume

Answer

Use the serviceAccount field in the pod spec

Question 12

Which TWO commands are used to manage node schedulability? (Select TWO.)

Accepted Answer

kubectl uncordon. (kubectl uncordon) is correct because it marks a node as schedulable, allowing new pods to be placed on it. Option E (kubectl cordon) is correct because it marks a node as unschedulable, preventing new pods from being scheduled while leaving existing pods running. Both commands directly manage the node's schedulability status by toggling the `spec.unschedulable` field.

Answer

kubectl label

Answer

kubectl drain

Answer

kubectl taint

Question 13

Which command initializes a new Kubernetes control plane node using kubeadm?

Accepted Answer

kubeadm init. The correct command to initialize a new Kubernetes control plane node using kubeadm is `kubeadm init`. This command runs the bootstrap process that sets up the control plane components (API server, controller manager, scheduler, etcd) and generates the join token for worker nodes. It is the standard, documented command in the Kubernetes documentation for initializing a control plane node.

Answer

kubeadm bootstrap

Answer

kubeadm create cluster

Answer

kubeadm start

Question 14

An administrator runs 'kubectl get nodes' and sees that a worker node is in the 'Ready,SchedulingDisabled' state. Which command was most likely executed on that node?

Accepted Answer

kubectl cordon node01. The 'Ready,SchedulingDisabled' state indicates the node has been marked as unschedulable using the 'kubectl cordon' command. Cordon marks the node as unschedulable, preventing new pods from being scheduled onto it while existing pods continue running. This matches the observed state exactly.

Answer

kubectl drain node01

Answer

kubectl taint nodes node01 key=value:NoSchedule

Answer

kubectl uncordon node01

Question 15

During a cluster upgrade from v1.28 to v1.29, which component should be upgraded first on the control plane node?

Accepted Answer

etcd. During a Kubernetes cluster upgrade, the control plane components must be upgraded in a specific order to maintain cluster stability and API availability. etcd, as the cluster's backing store, should be upgraded first because all other control plane components (kube-apiserver, kube-scheduler, kube-controller-manager) depend on it for reading and writing cluster state. Upgrading etcd first ensures that the data store is compatible with the new version before the API server and other controllers are updated.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager