CKA Cluster Architecture, Installation and Configuration Practice Test 6 — 15 Questions

Question 1

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

Accepted Answer

The pod cannot be scheduled due to insufficient resources. A pod in 'Pending' state indicates that the pod has been accepted by the Kubernetes API server but is not yet running. The most common cause is that the scheduler cannot find a node that satisfies the pod's resource requests (CPU, memory) or other scheduling constraints (taints, node selector, affinity rules). This results in the pod remaining unscheduled, hence 'Pending'.

Answer

The pod has been deleted

Answer

The pod is waiting for a container to start

Answer

The container image is invalid

Question 2

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

Accepted Answer

ETCDCTL_API=3. Etcdctl uses the etcd v2 API by default, and to interact with the v3 API (which is the standard for etcd v3.x clusters), the environment variable `ETCDCTL_API=3` must be set. Without this variable, `etcdctl snapshot restore` will fail as it relies on v3-specific commands and data model.

Answer

ETCD_API=3

Answer

ETCDCTL_API=v3

Answer

ETCDCTL_VERSION=3

Question 3

Which component is responsible for managing the network rules and forwarding on each node?

Accepted Answer

kube-proxy. kube-proxy is the component responsible for managing network rules and forwarding traffic on each node. It implements the Kubernetes Service concept by maintaining iptables or IPVS rules that route packets to the correct backend pods, handling load balancing and service discovery at the network layer.

Answer

container runtime

Answer

kubelet

Answer

kube-scheduler

Question 4

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

Accepted Answer

kubeadm certs check-expiration. The `kubeadm certs check-expiration` command is the correct tool to inspect the expiration dates of all certificates generated by kubeadm for cluster components, such as the API server, controller-manager, scheduler, and etcd. It reads the certificate files from the default kubeadm certificate directory (`/etc/kubernetes/pki`) and displays their remaining validity period in a human-readable table. This command is part of the kubeadm certificate management suite and is specifically designed for this purpose.

Answer

kubeadm upgrade plan

Answer

kubeadm certs renew

Answer

kubectl get certificates

Question 5

Which TWO components are part of the Kubernetes control plane? (Select two.)

Accepted Answer

etcd. etcd is a distributed key-value store that serves as the primary datastore for the Kubernetes cluster, storing all cluster state and configuration data. The kube-controller-manager runs controller processes that regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. Both are core control plane components that run on the master node(s).

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 6

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

Accepted Answer

Client certificates. Option B (Client certificates) is correct because the Kubernetes API server supports X.509 client certificate authentication via the --client-ca-file flag, where the certificate's CN becomes the username and O becomes the group. Option C (ServiceAccount bearer tokens) is correct because pods authenticate to the API server using ServiceAccount tokens mounted at /var/run/secrets/kubernetes.io/serviceaccount/token, which are validated by the API server's service account token authenticator. Option D (Static token file) is correct because the API server can be configured with --token-auth-file to authenticate requests bearing a bearer token listed in a CSV token file. Option A (Username and password) is not a valid API server authentication method — basic auth was removed in Kubernetes 1.19, so it no longer applies. Option E (SSH keys) is not valid because SSH keys are used for secure shell access to nodes, not for authenticating to the Kubernetes API server.

Answer

Username and password

Answer

SSH keys

Question 7

Which component is responsible for managing the lifecycle of pods on a node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a pod as expected, managing the pod lifecycle by communicating with the container runtime (e.g., containerd or CRI-O) and reporting the node and pod status back to the API server.

Answer

kube-scheduler

Answer

kube-controller-manager

Answer

kube-proxy

Question 8

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

Accepted Answer

Drain control plane node, upgrade kubeadm and kubelet on control plane, uncordon, then repeat for worker nodes. The kubeadm upgrade process requires the control plane node to be upgraded first, as it hosts the core cluster components (API server, scheduler, controller-manager). Draining the node ensures workloads are evicted, then kubeadm and kubelet are upgraded on the control plane, followed by uncordoning. Worker nodes are upgraded afterward to maintain cluster stability and compatibility.

Answer

Drain each node, upgrade control plane, then upgrade worker nodes

Answer

Upgrade worker nodes first, then control plane nodes

Answer

Upgrade all nodes simultaneously

Question 9

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key. It uses the etcdctl v3 API with the `snapshot save` command, which is the proper method for creating a consistent point-in-time backup of an etcd cluster. The command includes mandatory TLS authentication flags (`--cacert`, `--cert`, `--key`) and the `--endpoints` flag to target a specific etcd member, ensuring a secure and successful snapshot operation.

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl backup --data-dir /var/lib/etcd

Answer

etcdctl snapshot save /backup/snapshot.db

Question 10

Which command allows you to view the current context in a kubeconfig file?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated kubectl command that displays the currently active context from the kubeconfig file. It reads the `current-context` field from the kubeconfig (typically `~/.kube/config`) and outputs its name, making it the most direct way to view the current context.

Answer

kubectl config get-contexts

Answer

kubectl cluster-info

Answer

kubectl config view

Question 11

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Accepted Answer

kubectl cordon node1. The `kubectl cordon node1` command marks the node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the correct approach when you need to isolate a node for maintenance without disrupting current workloads.

Answer

kubectl drain node1

Answer

kubectl taint nodes node1 key=value:NoSchedule

Answer

kubectl delete node node1

Question 12

Which control plane component stores the entire cluster state?

Accepted Answer

etcd. Etcd because it is the distributed key-value store that serves as the single source of truth for the entire cluster state, including all objects, configurations, and secrets. The kube-apiserver is the only component that directly interacts with etcd, but it does not store the state itself—it reads from and writes to etcd on behalf of other components.

Answer

kube-controller-manager

Answer

kube-scheduler

Answer

kube-apiserver

Question 13

After upgrading the control plane using kubeadm, you need to update the kubelet configuration on the node. Which command should you run on the node?

Accepted Answer

kubeadm upgrade node. `kubeadm upgrade node` is the command used on worker nodes (or secondary control-plane nodes) after the primary control plane has been upgraded. It upgrades the kubelet configuration and other node-specific components to match the new cluster version, ensuring the node can rejoin the upgraded cluster.

Answer

kubeadm upgrade apply

Answer

kubectl upgrade node

Answer

kubeadm upgrade plan

Question 14

You need to back up the etcd database for a kubeadm-created cluster. Which directory contains the etcd data?

Accepted Answer

/var/lib/etcd. For a kubeadm-created cluster, etcd runs as a static Pod, and its data directory is mounted from the host path `/var/lib/etcd`. This is the default data directory used by etcd when started via kubeadm, and it stores all cluster state and configuration data. The CKA exam expects you to know this path for backup and restore operations.

Answer

/etc/kubernetes/pki/etcd

Answer

/var/lib/kubelet

Answer

/etc/etcd

Question 15

Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?

Accepted Answer

kube-proxy. kube-proxy is the component on each worker node that maintains network rules (e.g., iptables, IPVS) and enables service abstraction by proxying traffic to the correct Pods. It watches the Kubernetes API server for Service and EndpointSlice changes, then updates the node's packet filtering rules to route cluster IP traffic to healthy backend Pods.

Answer

kube-scheduler

Answer

container runtime

Answer

kubelet