CKA Cluster Architecture, Installation and Configuration Practice Test 3 — 15 Questions

Question 1

A ServiceAccount named 'my-sa' exists in the 'default' namespace. Which command creates a token for this ServiceAccount and stores it in a secret?

Accepted Answer

kubectl apply -f token.yaml. Applying a YAML file that defines a Secret of type `kubernetes.io/service-account-token` with the annotation `kubernetes.io/service-account.name: my-sa` will create a token for the ServiceAccount 'my-sa' and store it in that Secret. This is the proper method in Kubernetes 1.24+ to generate a token and persist it in a Secret object.

Answer

kubectl get secret my-sa-token-xxxxx -o jsonpath='{.data.token}' | base64 -d

Answer

kubectl create serviceaccount my-sa --token

Answer

kubectl create token my-sa

Question 2

Which TWO of the following are valid methods to restore an etcd cluster from a snapshot? (Select 2)

Accepted Answer

Using etcd operator with a backup CR. The etcd operator, commonly used in Kubernetes environments managed by operators, provides a custom resource (CR) for backup and restore. When a backup CR is applied, the operator automates the process of restoring an etcd cluster from a previously taken snapshot, handling the necessary steps like stopping etcd, restoring data, and restarting the cluster. Option C is correct because `etcdctl snapshot restore` is the native etcd command-line tool that directly restores an etcd cluster from a a snapshot file, which is the standard method for manual restoration.

Answer

Restarting etcd pod

Answer

kubeadm reset

Answer

kubectl apply -f etcd-backup.yaml

Question 3

Which THREE of the following are valid steps in a typical cluster upgrade procedure using kubeadm? (Select 3)

Accepted Answer

Upgrade kubelet and kubectl on worker nodes after upgrading the control plane. In a kubeadm cluster upgrade, the control plane components (including kube-apiserver, controller-manager, and scheduler) must be upgraded first to ensure API compatibility. After the control plane is successfully upgraded, the kubelet and kubectl on worker nodes are upgraded to match the new version, as the kubelet must communicate with the upgraded API server. This sequence prevents version skew issues and maintains cluster stability.

Answer

Upgrade the container runtime on worker nodes before the control plane

Answer

Delete all pods before upgrading

Question 4

Which TWO of the following are control plane components? (Select 2)

Accepted Answer

etcd. etcd is a distributed key-value store that serves as the primary datastore for all cluster state and configuration data in Kubernetes. It is a core control plane component because the API server relies on it to persist and retrieve cluster state, and without it the cluster cannot function.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 5

Which of the following is a core control plane component of Kubernetes?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that directly interacts with the etcd datastore. It validates and processes all REST API requests, making it the core control plane component responsible for exposing the Kubernetes API and managing the cluster state.

Answer

kubelet

Answer

CoreDNS

Answer

CRI-O

Question 6

Which command is used to create a backup of etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save /backup/snapshot.db. `etcdctl snapshot save` is the command used to create a point-in-time backup of etcd data. This command captures the entire key-value store and writes it to a specified file path, which is essential for disaster recovery in Kubernetes clusters that use etcd as their backing store.

Answer

etcdctl endpoint status

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

etcdctl member list

Question 7

Which kubectl command is used to mark a node as unschedulable so that no new pods are scheduled onto it?

Accepted Answer

kubectl cordon . The `kubectl cordon ` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing any new pods onto that node, while existing pods continue to run unaffected. This is the correct command for the described task.

Answer

kubectl taint <node>

Answer

kubectl uncordon <node>

Answer

kubectl drain <node>

Question 8

Which component is responsible for running containers on a node?

Accepted Answer

container runtime (e.g., containerd). The container runtime (e.g., containerd, CRI-O) is the component that actually pulls container images, creates container namespaces, and runs the container processes on a node. It implements the Container Runtime Interface (CRI) to manage the full lifecycle of containers, including starting, stopping, and monitoring them. Without a container runtime, no containers can be executed on the node.

Answer

kube-scheduler

Answer

kubelet

Answer

kube-proxy

Question 9

Which TWO of the following are valid ways to expose a set of pods as a network service in Kubernetes?

Accepted Answer

Ingress. Ingress is correct because it provides HTTP/HTTPS routing to services based on hostnames or paths, exposing a set of pods externally via a single entry point. It relies on an Ingress controller (e.g., NGINX, Traefik) to implement the rules defined in the Ingress resource, making it a valid way to expose pods as a network service.

Answer

ConfigMap

Answer

Deployment

Answer

NetworkPolicy

Question 10

Which THREE of the following are true about etcd backup and restore?

Accepted Answer

Restoring from a snapshot requires using 'etcdctl snapshot restore'. 'etcdctl snapshot restore' is the command used to restore an etcd cluster from a previously taken snapshot. This command restores the snapshot data to a new data directory, which can then be used to start etcd members. It is a required step in the restore process to recover the cluster state.

Answer

After restoring a snapshot, you must restart all etcd members manually

Answer

Etcd snapshots exclude cluster member information

Question 11

Which TWO of the following are valid methods to authenticate to the Kubernetes API server?

Accepted Answer

Client certificate. Client certificate authentication (option A) is valid because the Kubernetes API server can be configured with TLS to require clients to present a valid X.509 certificate signed by the cluster's Certificate Authority (CA). The API server verifies the certificate's Common Name (CN) or Subject Alternative Name (SAN) against the user identity, and the 'organizational unit' (O) field can map to Kubernetes groups. This is a core authentication method used by tools like kubectl and kubelet.

Answer

Secrets

Answer

RBAC

Answer

Node authorization

Question 12

A CKA candidate runs 'kubectl get nodes' and sees that a worker node is in the 'NotReady' state. Which command should be used to diagnose the node's kubelet health?

Accepted Answer

journalctl -u kubelet. The kubelet is the primary node agent that registers the node with the cluster and reports its status via periodic heartbeats. When a node is NotReady, the most direct way to diagnose kubelet health is to inspect its systemd unit logs using 'journalctl -u kubelet', which shows startup errors, certificate issues, or resource exhaustion that prevent the kubelet from functioning correctly.

Answer

systemctl status docker

Answer

kubectl get events --all-namespaces

Answer

kubectl logs -n kube-system kubelet-<node>

Question 13

An administrator needs to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which of the following steps is performed FIRST?

Accepted Answer

Run 'kubeadm upgrade plan' on the first control plane node. Before any upgrade operations, kubeadm requires an assessment of the cluster's upgrade path and potential issues. 'kubeadm upgrade plan' on the first control plane node checks the current and target versions, validates the upgrade feasibility, and displays the upgrade steps and any manual interventions needed. This must be done first to ensure the upgrade is safe and to identify any version skew or configuration problems before proceeding.

Answer

Drain all worker nodes

Answer

Run 'kubectl cordon' on all nodes

Answer

Upgrade kubelet on the first control plane node

Question 14

A developer is creating a Deployment with a single container that should restart only if the process exits with non-zero. Which restartPolicy should be used?

Accepted Answer

OnFailure. In Kubernetes, the `restartPolicy` for a Pod controls container restart behavior. The requirement is to restart only when the process exits with a non-zero code, which is exactly what `OnFailure` does. `Always` restarts on any exit (zero or non-zero), `Never` does not restart at all, and `UnlessStopped` is not a valid Kubernetes restart policy (it is a Docker restart policy). Note that while Pods and Jobs support `OnFailure`, workloads like Deployments, StatefulSets, and DaemonSets only support `Always`.

Answer

Never

Answer

Always

Answer

UnlessStopped

Question 15

A kubeadm cluster was initialized with a custom certificate validity. You need to check the expiration date of the kube-apiserver certificate. Which command should you use?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command introduced in v1.20+ to display the expiration dates of all certificates managed by kubeadm, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period in a human-readable format, making it the standard and recommended way to check certificate expiration in a kubeadm cluster.

Answer

kubeadm alpha certs check-expiration

Answer

kubectl get secret -n kube-system

Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -dates