CKA Cluster Architecture, Installation and Configuration Practice Test 5 — 15 Questions

Question 1

Which THREE of the following are valid steps in a Kubernetes cluster upgrade procedure using kubeadm?

Accepted Answer

Drain the control plane node before upgrading it. Draining the control plane node before upgrading it ensures that all workloads are evicted and rescheduled to other nodes, preventing service disruption. This is a standard Kubernetes procedure where 'kubectl drain' marks the node as unschedulable and evicts pods, respecting PodDisruptionBudgets.

Answer

Downgrade the kubelet on worker nodes to match the control plane version

Answer

Uncordon the node before draining it

Question 2

Which TWO commands can be used to view the configuration of a kubeconfig file?

Accepted Answer

kubectl config get-contexts. `kubectl config get-contexts` lists all contexts defined in the kubeconfig file, showing their names, clusters, and users. Option E is correct because `kubectl config view` displays the entire merged kubeconfig file content, including clusters, users, and contexts, in YAML or JSON format.

Answer

kubectl describe configmap kubeconfig

Answer

kubectl config set-context

Answer

kubectl config current-context

Question 3

Which of the following is a core control plane component responsible for persisting cluster state?

Accepted Answer

etcd. etcd is the core control plane component responsible for persisting cluster state. It is a distributed, consistent key-value store that stores all cluster data, including configuration, state, and metadata. The kube-apiserver is the only component that interacts directly with etcd, ensuring that all state changes are recorded durably.

Answer

kube-apiserver

Answer

kube-scheduler

Answer

kube-controller-manager

Question 4

You are upgrading a Kubernetes cluster from v1.29.0 to v1.30.0 using kubeadm. What is the correct sequence of operations?

Accepted Answer

Drain control plane node, upgrade kubeadm, kubelet, kubectl, uncordon, then repeat for worker nodes. Upgrading a Kubernetes cluster with kubeadm requires a sequential, node-by-node approach starting with the control plane. The control plane node must be drained to evict workloads, then kubeadm, kubelet, and kubectl are upgraded, and the node is uncordoned before moving to worker nodes. This ensures the cluster control plane remains available and worker nodes are upgraded only after the control plane is stable, preventing cluster downtime.

Answer

Upgrade kubeadm on all nodes, then upgrade kubelet on each node without draining

Answer

Upgrade all nodes simultaneously

Answer

Upgrade worker nodes first, then control plane nodes

Question 5

An administrator runs 'kubectl get pods' and sees a pod in 'Pending' state. The output of 'kubectl describe pod pod-name' shows '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate'. What is the most likely cause?

Accepted Answer

The node has a taint that repels the pod, and the pod lacks the corresponding toleration. The pod is in 'Pending' state because the scheduler cannot find a node that satisfies the pod's scheduling constraints. The 'kubectl describe pod' output explicitly states '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate', which means the node has a taint (e.g., a key-value pair with an effect like NoSchedule) and the pod does not have a matching toleration in its spec. This prevents the pod from being scheduled onto that node, leaving it stuck in Pending.

Answer

The pod's container image is not found

Answer

The pod has a resource request that exceeds available resources

Answer

The pod's namespace does not exist

Question 6

Which command is used to mark a node as unschedulable and evict its pods?

Accepted Answer

kubectl drain node-name --ignore-daemonsets. `kubectl drain` marks a node as unschedulable (similar to `cordon`) and then evicts all pods from the node, respecting PodDisruptionBudgets. The `--ignore-daemonsets` flag is required because DaemonSet pods cannot be evicted via drain (they are managed by the DaemonSet controller and would be immediately rescheduled on the same node), so the command would fail without this flag.

Answer

kubectl delete node node-name

Answer

kubectl cordon node-name

Answer

kubectl taint node node-name key=value:NoSchedule

Question 7

You have a kubeconfig file with multiple contexts. You want to temporarily switch to a different context for a single kubectl command. Which flag should you use?

Accepted Answer

--context. The `--context` flag allows you to override the current context from the kubeconfig file for a single kubectl command. This is the correct way to temporarily switch contexts without modifying the kubeconfig file's current-context field. The flag accepts the context name as defined in the kubeconfig's contexts array.

Answer

--user

Answer

--cluster

Answer

--kubeconfig

Question 8

You need to create a ServiceAccount named 'my-sa' and a ClusterRoleBinding that binds the built-in 'view' ClusterRole to that ServiceAccount. Which set of commands achieves this?

Accepted Answer

kubectl create sa my-sa -n default && kubectl create clusterrolebinding my-binding --clusterrole=view --serviceaccount=default:my-sa. It creates the ServiceAccount 'my-sa' in the 'default' namespace (as required for a ServiceAccount) and then uses the correct `--serviceaccount=namespace:name` syntax to bind the built-in 'view' ClusterRole to that ServiceAccount via a ClusterRoleBinding. The `--serviceaccount` flag must include the namespace to uniquely identify the ServiceAccount in a cluster-scoped binding.

Answer

kubectl create sa my-sa && kubectl create clusterrolebinding my-binding --clusterrole=view --sa=my-sa

Answer

kubectl create sa my-sa && kubectl create rolebinding my-binding --clusterrole=view --serviceaccount=my-sa

Answer

kubectl create serviceaccount my-sa && kubectl create clusterrolebinding my-binding --clusterrole=view --user=my-sa

Question 9

Which component is responsible for running containers on a node and reporting their status to the control plane?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a Pod as expected, by interacting with the container runtime (e.g., containerd) to start, stop, and monitor containers. The kubelet then reports the status of the node and its Pods back to the control plane via the Kubernetes API server, using heartbeats (NodeStatus updates) and Pod status updates.

Answer

container runtime (e.g., containerd)

Answer

kube-proxy

Answer

kube-scheduler

Question 10

You run 'kubectl logs pod-name' and get an error: 'Error from server (Forbidden): pods "pod-name" is forbidden: User "dev-user" cannot list resource "pods/log" in API group "" in the namespace "default"'. What RBAC configuration is missing?

Accepted Answer

A Role with 'get' on 'pods/log' in the 'default' namespace. The error indicates that the user 'dev-user' is forbidden from listing 'pods/log' in the 'default' namespace. To access pod logs, you need a Role (or ClusterRole) that grants the 'get' verb on the 'pods/log' subresource, scoped to the specific namespace. Option B correctly specifies a Role with 'get' on 'pods/log' in the 'default' namespace, which is the minimal RBAC configuration required to resolve the Forbidden error.

Answer

A ClusterRole with 'get' on 'pods'

Answer

A ClusterRoleBinding for the user to the 'view' ClusterRole

Answer

A RoleBinding with 'list' on 'pods'

Question 11

You initialize a cluster with 'kubeadm init' and want to join a worker node. What is the correct command to generate the join command?

Accepted Answer

kubeadm token create --print-join-command. `kubeadm token create --print-join-command` generates a new bootstrap token and immediately outputs the full `kubeadm join` command, including the token, control-plane endpoint, and discovery token CA cert hash. This is the recommended way to obtain a ready-to-use join command after initializing the cluster with `kubeadm init`.

Answer

kubeadm join --token

:6443

Answer

kubeadm init phase upload-config kubelet

Answer

kubeadm token list

Question 12

You need to renew all certificates on a kubeadm-managed cluster. Which command accomplishes this?

Accepted Answer

kubeadm certs renew all. `kubeadm certs renew all` is the dedicated command to renew all PKI certificates in a kubeadm-managed cluster. It regenerates each certificate using the existing CA key, updating the certificate files in `/etc/kubernetes/pki/` without restarting control plane components; a manual restart or kubelet reload is required afterward.

Answer

kubeadm certs renew apiserver

Answer

kubeadm certs check-expiration

Answer

kubeadm upgrade apply

Question 13

Which TWO of the following are valid ways to create a Role in the 'default' namespace that grants get and list on pods?

Accepted Answer

kubectl create role pod-reader --verb=get,list --resource=pods -n default. `kubectl create role pod-reader --verb=get,list --resource=pods -n default` directly creates a Role in the default namespace with the specified verbs and resource. This command is a standard Kubernetes RBAC command that generates a Role with the correct apiGroups ("" for core resources) and the requested permissions.

Answer

kubectl create role pod-reader --verb=discover --resource=pods -n default

Answer

kubectl create role pod-reader --verb=delete --resource=pods -n default

Answer

kubectl create clusterrole pod-reader --verb=get,list --resource=pods

Question 14

Which THREE of the following are steps required when restoring an etcd cluster from a snapshot?

Accepted Answer

Run 'etcdctl snapshot restore' specifying a new data directory. 'etcdctl snapshot restore' is the command used to restore an etcd cluster from a snapshot. You must specify a new data directory (e.g., --data-dir=/var/lib/etcd-restored) to avoid overwriting existing data and to allow the restored snapshot to be used as a fresh data source for the etcd member.

Answer

Restore the snapshot on every etcd member in the cluster

Answer

Run 'kubeadm init' to reinitialize the control plane

Question 15

Which TWO commands can be used to check the expiration of certificates managed by kubeadm?

Accepted Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A2 Validity. `openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text | grep -A2 Validity` directly reads the X.509 certificate file on disk and displays its validity period (Not Before and Not After dates). This is a manual, low-level method to check certificate expiration without relying on kubeadm utilities. Option E is correct because `kubeadm certs check-expiration` is the dedicated kubeadm command that lists all certificates managed by kubeadm along with their remaining validity, providing a comprehensive and automated check.

Answer

kubeadm upgrade plan

Answer

kubectl get certificates

Answer

kubeadm certs renew --all