CKA Cluster Architecture, Installation and Configuration Practice Test 4 — 15 Questions

Question 1

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd, CRI-O) via the Container Runtime Interface (CRI). It receives Pod specifications from the API server and manages the lifecycle of the containers accordingly.

Answer

kube-proxy

Answer

kube-scheduler

Answer

kube-controller-manager

Question 2

You need to drain a node 'node1' and ensure that pods are evicted gracefully. Which command should you use?

Accepted Answer

kubectl drain node1. `kubectl drain node1` safely evicts all pods from the node while respecting PodDisruptionBudgets (PDBs) and graceful termination periods. It cordons the node first (marking it unschedulable) and then evicts pods, ensuring that workloads are rescheduled on other nodes without disruption.

Answer

kubectl delete node node1

Answer

kubectl cordon node1

Answer

kubectl taint node node1 key=value:NoSchedule

Question 3

An administrator runs 'kubectl get pods' and sees a pod stuck in 'Pending' state. Which of the following is NOT a typical cause?

Accepted Answer

A required ConfigMap does not exist. A missing ConfigMap does not prevent a pod from being scheduled; it only causes the pod to fail at runtime when it tries to mount or use the ConfigMap. The 'Pending' state specifically indicates that the pod has not been scheduled to a node, which is a scheduling issue, not a runtime configuration issue. Therefore, a missing ConfigMap is not a typical cause of a pod stuck in 'Pending'.

Answer

Insufficient CPU or memory resources on any node

Answer

PersistentVolumeClaim is pending and not bound

Answer

Node selector labels do not match any node

Question 4

You have multiple kubeconfig files. Which command merges them into a single config file?

Accepted Answer

KUBECONFIG=config1:config2 kubectl config view --flatten > merged-config. The `KUBECONFIG` environment variable can accept a colon-separated list of kubeconfig files, and `kubectl config view --flatten` merges them into a single configuration, outputting the combined result to stdout, which can be redirected to a new file. This is the standard method for merging multiple kubeconfig files in Kubernetes.

Answer

kubectl config merge config1 config2 > merged-config

Answer

cat config1 config2 > merged-config && kubectl config use-context merged-config

Answer

kubectl merge-config config1 config2

Question 5

An administrator wants to use a ServiceAccount token that is mounted into a pod automatically. Which field enables token projection?

Accepted Answer

automountServiceAccountToken: true. The `automountServiceAccountToken` field, when set to `true` (the default), causes Kubernetes to automatically project the ServiceAccount token into the pod as a volume mount at `/var/run/secrets/kubernetes.io/serviceaccount/token`. This field can be set at the pod spec level or overridden at the ServiceAccount level, enabling token projection for authentication to the Kubernetes API server.

Answer

serviceAccountToken: true

Answer

enableToken: true

Answer

mountServiceAccountToken: true

Question 6

Which TWO of the following are valid methods to configure kubectl to use a specific context?

Accepted Answer

kubectl config use-context my-context. `kubectl config use-context my-context` is the explicit command to switch the current context in kubectl's configuration file (typically ~/.kube/config). This updates the `current-context` field in the config, so all subsequent kubectl commands target the cluster, namespace, and user defined in that context.

Answer

kubectl config set-context my-context

Answer

kubectl config current-context

Answer

kubectl --config /path/to/config get pods

Question 7

Which THREE components must be present in a high-availability control plane setup?

Accepted Answer

kube-controller-manager. The kube-controller-manager is a core control plane component that runs controller processes to regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. In a high-availability setup, multiple instances of the kube-controller-manager run concurrently, but only one active leader performs work at a time, using leader election via endpoints or leases to ensure no duplicate actions occur.

Answer

kubelet

Answer

kube-proxy

Question 8

Which TWO commands are used to manage nodes in a cluster?

Accepted Answer

kubectl cordon. B is correct because `kubectl cordon` marks a node as unschedulable, preventing new pods from being assigned to it while existing pods continue running. D is correct because `kubectl drain` safely evicts all pods from a node, optionally respecting PodDisruptionBudgets, and then marks the node as unschedulable. Both commands are essential for node maintenance and are directly used to manage node scheduling state in a cluster.

Answer

kubectl taint

Answer

kubectl delete node

Answer

kubectl get nodes

Question 9

You are setting up a new Kubernetes cluster using kubeadm. You run 'kubeadm init --pod-network-cidr=10.244.0.0/16' on the control plane node. The command fails with: '[preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running: output: time="..." level=fatal msg="validate service connection: CRI v1 runtime API is not implemented for endpoint 'unix:///var/run/containerd/containerd.sock': rpc error: code = Unimplemented desc = unknown service runtime.v1.RuntimeService'"'. What is the most likely cause?

Accepted Answer

The containerd runtime does not support the CRI v1 API; it may be an older version that only supports v1alpha2. The error message indicates that the containerd socket is reachable but the CRI v1 API (runtime.v1.RuntimeService) is not implemented. This typically occurs when containerd is an older version that only supports the CRI v1alpha2 API. Kubernetes 1.24+ defaults to the CRI v1 API, so an older containerd without v1 support will fail during kubeadm init.

Answer

The --pod-network-cidr flag is incorrect

Answer

The kubelet version is incompatible with containerd

Answer

The containerd service is not running

Question 10

Which kubectl command is used to view the current context in the kubeconfig file?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. This command directly queries the `current-context` field in the kubeconfig and outputs its value, allowing you to verify which cluster, user, and namespace combination is active without modifying any configuration.

Answer

kubectl config view

Answer

kubectl config use-context

Answer

kubectl config get-contexts

Question 11

An administrator needs to allow a service account 'monitor-sa' in namespace 'monitoring' to read pods across all namespaces. Which RBAC resources should be created?

Accepted Answer

Create a ClusterRole with pod read permissions and a ClusterRoleBinding to monitor-sa. A ClusterRole is required because the service account needs to read pods across all namespaces, which is a cluster-scoped permission. A ClusterRoleBinding binds that ClusterRole to the service account 'monitor-sa', granting the permissions cluster-wide. This is the correct approach for cross-namespace access.

Answer

Create a ClusterRole with pod read permissions and a RoleBinding in each namespace

Answer

Create a Role in the monitoring namespace and a RoleBinding to monitor-sa

Answer

Create a Role with pod read permissions and a ClusterRoleBinding to monitor-sa

Question 12

A node has been cordoned. Which statement about the node is true?

Accepted Answer

The node is marked as unschedulable, but existing pods continue to run. When a node is cordoned using `kubectl cordon <node>`, it is marked as unschedulable by setting the `spec.unschedulable` field to `true`. This prevents new pods from being scheduled onto the node, but existing pods continue to run normally. The kubelet remains active, and the node stays in the cluster.

Answer

All pods on the node are immediately terminated

Answer

The kubelet on the node is stopped

Answer

The node is removed from the cluster

Question 13

Which of the following is NOT a control plane component?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each worker node, not on the control plane. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., containerd or CRI-O). Control plane components are those that manage the cluster's state and scheduling decisions, which run on the control plane nodes.

Answer

kube-apiserver

Answer

kube-controller-manager

Answer

kube-scheduler

Question 14

You need to check the expiration date of certificates used by the kube-apiserver. Which command should you use?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display the expiration dates of all certificates managed by kubeadm in the cluster, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period for each, making it the most direct and accurate method for checking certificate expiration in a kubeadm-deployed cluster.

Answer

kubeadm certs renew

Answer

kubectl get secrets -n kube-system

Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -text -noout

Question 15

What is the purpose of the 'kubeadm reset' command?

Accepted Answer

To undo the effects of kubeadm init or kubeadm join on a node. The 'kubeadm reset' command is designed to revert a node back to its pre-'kubeadm init' or pre-'kubeadm join' state. It cleans up all cluster-related configuration, certificates, and etcd data (if running on the control plane), effectively removing the node from the cluster and allowing it to be re-initialized or re-joined cleanly.

Answer

To restart the kubelet service

Answer

To upgrade the cluster to a newer version

Answer

To add a new node to the cluster