CKA Cluster Architecture, Installation and Configuration Practice Test 5 — 15 Questions

Question 1

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.

Answer

kubeadm upgrade plan --certificate-expiration

Answer

kubectl config view --raw | grep client-certificate

Answer

openssl x509 -in /etc/kubernetes/admin.conf -text -noout

Question 2

An admin runs 'kubectl get pods' and sees a pod in 'Pending' state for a long time. 'kubectl describe pod' shows '0/1 nodes are available: 1 node has memory pressure'. Which is the most likely cause?

Accepted Answer

The node is under memory pressure and cannot admit the pod.. The '0/1 nodes are available: 1 node has memory pressure' message in `kubectl describe pod` indicates that the kubelet on the node has set a memory pressure condition, which triggers eviction thresholds. When a node is under memory pressure, the kubelet refuses to admit new pods (except those with QoS class Guaranteed) to prevent further resource exhaustion, leaving the pod stuck in Pending state. This matches option C exactly.

Answer

The node's disk is full.

Answer

The pod's image pull secret is missing.

Answer

The pod requires more CPU than any node can provide.

Question 3

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

Accepted Answer

kubectl config set-credentials. The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.

Answer

kubectl config set-context

Answer

kubectl config create-user

Answer

kubectl config set-cluster

Question 4

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

Accepted Answer

Succeeded. When a pod's restartPolicy is set to 'Never' and its container exits with code 0 (indicating a successful termination), the pod transitions to the 'Succeeded' phase. This is because Kubernetes treats a zero exit code as a successful completion, and with restartPolicy: Never, no restart is attempted, leaving the pod in a terminal Succeeded state.

Answer

Completed

Answer

Failed

Answer

Running

Question 5

To make a node unschedulable without evicting existing pods, which command should be used?

Accepted Answer

kubectl cordon node01. `kubectl cordon` marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the precise command for the task described, as it modifies the node's `spec.unschedulable` field to `true` without affecting running workloads.

Answer

kubectl taint node01 key=value:NoSchedule

Answer

kubectl drain node01

Answer

kubectl uncordon node01

Question 6

Which TWO components are part of the Kubernetes control plane? (Select 2)

Accepted Answer

etcd. Option A, etcd, is correct because it is the control plane's distributed key-value store that persistently holds all cluster state and configuration data, which the API server reads and writes. Option E, kube-apiserver, is correct because it is the central control plane component that exposes the Kubernetes API, validates and processes REST requests, and is the entry point through which all other components interact with the cluster. The unmarked options do not belong: kubelet (B) is a node agent that runs on each worker node to manage pods and containers, kube-proxy (C) is a node-level network proxy implementing Service networking rules, and the container runtime (D) is the node software (e.g., containerd or CRI-O) that actually runs containers — all three are node components, not control plane components.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 7

Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)

Accepted Answer

Upgrade kubelet and kubectl on the node.. After upgrading kubeadm on the control plane, you must upgrade kubelet and kubectl on each node to match the target Kubernetes version. The kubelet is the primary node agent that communicates with the control plane, and kubectl is the CLI tool used to interact with the cluster. Without upgrading these components, the node may fail to register or report an incompatible version, causing the node to be in a NotReady state.

Answer

Upgrade the container runtime to a compatible version.

Answer

Run 'kubeadm upgrade apply' on the worker node.

Question 8

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

Accepted Answer

Upgrade the first control plane node, then upgrade the remaining control plane nodes, then upgrade worker nodes.. The recommended upgrade order for a kubeadm-managed cluster is to upgrade the first control plane node (using `kubeadm upgrade apply`), then the remaining control plane nodes (using `kubeadm upgrade node`), and finally the worker nodes. This ensures the cluster's control plane components (etcd, kube-apiserver, kube-controller-manager, kube-scheduler) are updated first, maintaining cluster stability and API server availability during the process.

Answer

Upgrade all worker nodes first, then upgrade the control plane nodes.

Answer

Upgrade all nodes simultaneously by running kubeadm upgrade apply on all nodes at once.

Answer

Upgrade worker nodes, then upgrade the control plane nodes, then drain the worker nodes.

Question 9

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

Accepted Answer

kubelet on the worker node. The kubelet is the primary node agent that runs on every worker node and is responsible for registering the node with the cluster and periodically reporting its status via NodeStatus updates. When a node is in 'NotReady' state, it means the kubelet has failed to send heartbeats or report readiness to the control plane, typically due to a crash, misconfiguration, or resource exhaustion. Checking the kubelet's logs and service status (e.g., 'systemctl status kubelet' or 'journalctl -u kubelet') is the first diagnostic step because it directly controls node health reporting.

Answer

kube-apiserver on the control plane

Answer

kube-controller-manager

Answer

etcd cluster health

Question 10

Which command is used to take a snapshot of etcd using etcdctl?

Accepted Answer

etcdctl snapshot save. `etcdctl snapshot save` is the official command to create a point-in-time snapshot of an etcd datastore, which is essential for backup and disaster recovery in Kubernetes clusters. This command writes the snapshot to a specified file path, preserving all keys and metadata for later restoration via `etcdctl snapshot restore`.

Answer

etcdctl dump

Answer

etcdctl snapshot create

Answer

etcdctl backup

Question 11

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

Accepted Answer

ServiceAccount. A ServiceAccount is the correct resource because Kubernetes automatically mounts a projected volume containing a JWT token into pods that use the default or a specified ServiceAccount. This token is used by the pod to authenticate against the Kubernetes API server, enabling secure in-cluster communication without manual credential management.

Answer

Secret

Answer

ConfigMap

Answer

ClusterRoleBinding

Question 12

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

Accepted Answer

kubectl cordon <node-name>. The `kubectl cordon` command marks a node as unschedulable by setting the `node.Spec.Unschedulable` field to `true`. This prevents the Kubernetes scheduler from placing new pods onto the node, while existing pods continue to run unaffected. It is the correct tool for this specific maintenance task.

Answer

kubectl uncordon <node-name>

Answer

kubectl drain <node-name>

Answer

kubectl taint nodes <node-name> key=value:NoSchedule

Question 13

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are the correct combination because the CI/CD pipeline needs to create and delete pods only within the 'ci' namespace. A Role defines permissions scoped to a specific namespace, and a RoleBinding grants those permissions to a user or service account within that same namespace. This ensures the pipeline cannot affect resources in other namespaces.

Answer

ClusterRole and RoleBinding

Answer

ClusterRole and ClusterRoleBinding

Answer

Role and ClusterRoleBinding

Question 14

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Accepted Answer

Job. A Job is the correct Kubernetes resource for a one-time batch task that runs to completion and then exits. It ensures a specified number of Pods terminate successfully, making it ideal for processing data and exiting without requiring continuous availability.

Answer

DaemonSet

Answer

CronJob

Answer

Deployment

Question 15

Which of the following is NOT a control plane component in Kubernetes?

Accepted Answer

kube-proxy. kube-proxy is not a control plane component; it is a node-level (worker) component responsible for implementing network rules and handling service-to-pod traffic via iptables or IPVS. The control plane consists of kube-apiserver, etcd, kube-scheduler, and kube-controller-manager.

Answer

kube-scheduler

Answer

etcd

Answer

kube-apiserver