CKA Cluster Architecture, Installation and Configuration Practice Test 6 — 15 Questions

Question 1

A CKA candidate runs 'kubectl get nodes' and sees that a worker node is in the 'NotReady' state. Which command should be used to diagnose the node's kubelet health?

Accepted Answer

journalctl -u kubelet. The kubelet is the primary node agent that registers the node with the cluster and reports its status via periodic heartbeats. When a node is NotReady, the most direct way to diagnose kubelet health is to inspect its systemd unit logs using 'journalctl -u kubelet', which shows startup errors, certificate issues, or resource exhaustion that prevent the kubelet from functioning correctly.

Answer

systemctl status docker

Answer

kubectl get events --all-namespaces

Answer

kubectl logs -n kube-system kubelet-<node>

Question 2

An administrator needs to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which of the following steps is performed FIRST?

Accepted Answer

Run 'kubeadm upgrade plan' on the first control plane node. Before any upgrade operations, kubeadm requires an assessment of the cluster's upgrade path and potential issues. 'kubeadm upgrade plan' on the first control plane node checks the current and target versions, validates the upgrade feasibility, and displays the upgrade steps and any manual interventions needed. This must be done first to ensure the upgrade is safe and to identify any version skew or configuration problems before proceeding.

Answer

Drain all worker nodes

Answer

Run 'kubectl cordon' on all nodes

Answer

Upgrade kubelet on the first control plane node

Question 3

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

Accepted Answer

etcdctl snapshot restore /backup/etcd-snapshot.db --data-dir=/var/lib/etcd-restored. Option B is correct because `etcdctl snapshot restore` is the proper command to restore an etcd snapshot to a new data directory. The `--data-dir` flag specifies where the restored data should be placed, allowing the new etcd instance to use that directory. This command recreates the etcd member's data from the snapshot file, which is essential for disaster recovery.

Answer

kubectl apply -f /backup/etcd-snapshot.db

Answer

etcdctl snapshot load /backup/etcd-snapshot.db

Answer

ETCDCTL_API=3 etcdctl restore /backup/etcd-snapshot.db

Question 4

A developer is creating a Deployment with a single container that should restart only if the process exits with non-zero. Which restartPolicy should be used?

Accepted Answer

Always. In Kubernetes, the `restartPolicy` for a Pod controls whether the kubelet restarts the container when it exits. The `Always` policy (the default for Deployments) restarts the container regardless of the exit code, which is required for a Deployment to maintain the desired number of replicas. Since the developer wants the container to restart only on non-zero exit, `Always` is the correct choice because it restarts on any exit, including non-zero.

Answer

Never

Answer

UnlessStopped

Answer

OnFailure

Question 5

A kubeadm cluster was initialized with a custom certificate validity. You need to check the expiration date of the kube-apiserver certificate. Which command should you use?

Accepted Answer

kubeadm certs check-expiration. Option D is correct because `kubeadm certs check-expiration` is the dedicated kubeadm command introduced in v1.20+ to display the expiration dates of all certificates managed by kubeadm, including the kube-apiserver certificate. This command reads the certificate files from `/etc/kubernetes/pki/` and outputs the remaining validity period in a human-readable format, making it the standard and recommended way to check certificate expiration in a kubeadm cluster.

Answer

kubeadm alpha certs check-expiration

Answer

kubectl get secret -n kube-system

Answer

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -dates

Question 6

A ServiceAccount 'monitor-sa' needs to be able to list Pods in namespace 'monitoring'. Which RBAC configuration is appropriate?

Accepted Answer

Create a Role in namespace 'monitoring' with 'get' and 'list' verbs on pods, then a RoleBinding in 'monitoring' to monitor-sa. Option D is correct because a Role in the 'monitoring' namespace with 'get' and 'list' verbs on pods, combined with a RoleBinding in the same namespace to the 'monitor-sa' ServiceAccount, grants the exact permissions required within the scope of that namespace. This follows the principle of least privilege by scoping permissions to the specific namespace where the pods reside.

Answer

Create a ClusterRole with 'get' and 'list' verbs on pods, then a ClusterRoleBinding to monitor-sa

Answer

Add the ServiceAccount to the cluster-admin group

Answer

Create a Role in default namespace with 'get' and 'list' verbs on pods, then a RoleBinding in 'monitoring' to monitor-sa

Question 7

Which component is responsible for running containers on a Kubernetes node?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on each Kubernetes node. It is responsible for ensuring that containers are running in a Pod as expected by interacting with the container runtime (e.g., Docker, containerd, CRI-O) via the Container Runtime Interface (CRI). It receives Pod specifications from the API server and manages the lifecycle of the containers accordingly.

Answer

kube-proxy

Answer

kube-scheduler

Answer

kube-controller-manager

Question 8

You need to drain a node 'node1' and ensure that pods are evicted gracefully. Which command should you use?

Accepted Answer

kubectl drain node1. Option D is correct because `kubectl drain node1` safely evicts all pods from the node while respecting PodDisruptionBudgets (PDBs) and graceful termination periods. It cordons the node first (marking it unschedulable) and then evicts pods, ensuring that workloads are rescheduled on other nodes without disruption.

Answer

kubectl delete node node1

Answer

kubectl cordon node1

Answer

kubectl taint node node1 key=value:NoSchedule

Question 9

An administrator runs 'kubectl get pods' and sees a pod stuck in 'Pending' state. Which of the following is NOT a typical cause?

Accepted Answer

A required ConfigMap does not exist. A missing ConfigMap does not prevent a pod from being scheduled; it only causes the pod to fail at runtime when it tries to mount or use the ConfigMap. The 'Pending' state specifically indicates that the pod has not been scheduled to a node, which is a scheduling issue, not a runtime configuration issue. Therefore, a missing ConfigMap is not a typical cause of a pod stuck in 'Pending'.

Answer

Insufficient CPU or memory resources on any node

Answer

PersistentVolumeClaim is pending and not bound

Answer

Node selector labels do not match any node

Question 10

You have multiple kubeconfig files. Which command merges them into a single config file?

Accepted Answer

KUBECONFIG=config1:config2 kubectl config view --flatten > merged-config. Option B is correct because the `KUBECONFIG` environment variable can accept a colon-separated list of kubeconfig files, and `kubectl config view --flatten` merges them into a single configuration, outputting the combined result to stdout, which can be redirected to a new file. This is the standard method for merging multiple kubeconfig files in Kubernetes.

Answer

kubectl config merge config1 config2 > merged-config

Answer

cat config1 config2 > merged-config && kubectl config use-context merged-config

Answer

kubectl merge-config config1 config2

Question 11

A pod is failing with 'CrashLoopBackOff'. You run 'kubectl logs mypod' and see no output. What is the first troubleshooting step?

Accepted Answer

kubectl logs mypod --previous. The correct first step is to use `kubectl logs mypod --previous` because the pod is in `CrashLoopBackOff`, meaning the current container has crashed and restarted. Since `kubectl logs mypod` shows no output, the current container may have exited before writing logs, or logs were written to stderr. The `--previous` flag retrieves logs from the last terminated container instance, which often contains the crash error message.

Answer

kubectl exec -it mypod -- sh

Answer

kubectl delete pod mypod && kubectl create -f mypod.yaml

Answer

kubectl describe pod mypod

Question 12

An administrator wants to use a ServiceAccount token that is mounted into a pod automatically. Which field enables token projection?

Accepted Answer

automountServiceAccountToken: true. Option D is correct because the `automountServiceAccountToken` field, when set to `true` (the default), causes Kubernetes to automatically project the ServiceAccount token into the pod as a volume mount at `/var/run/secrets/kubernetes.io/serviceaccount/token`. This field can be set at the pod spec level or overridden at the ServiceAccount level, enabling token projection for authentication to the Kubernetes API server.

Answer

serviceAccountToken: true

Answer

enableToken: true

Answer

mountServiceAccountToken: true

Question 13

Which TWO of the following are valid methods to configure kubectl to use a specific context?

Accepted Answer

kubectl config use-context my-context. Option C is correct because `kubectl config use-context my-context` is the explicit command to switch the current context in kubectl's configuration file (typically ~/.kube/config). This updates the `current-context` field in the config, so all subsequent kubectl commands target the cluster, namespace, and user defined in that context.

Answer

kubectl config set-context my-context

Answer

kubectl config current-context

Answer

kubectl --config /path/to/config get pods

Question 14

Which THREE components must be present in a high-availability control plane setup?

Accepted Answer

kube-controller-manager. The kube-controller-manager is a core control plane component that runs controller processes to regulate the state of the cluster, such as the node controller, replication controller, and endpoints controller. In a high-availability setup, multiple instances of the kube-controller-manager run concurrently, but only one active leader performs work at a time, using leader election via endpoints or leases to ensure no duplicate actions occur.

Answer

kubelet

Answer

kube-proxy

Question 15

Which TWO commands are used to manage nodes in a cluster?

Accepted Answer

kubectl cordon. B is correct because `kubectl cordon` marks a node as unschedulable, preventing new pods from being assigned to it while existing pods continue running. D is correct because `kubectl drain` safely evicts all pods from a node, optionally respecting PodDisruptionBudgets, and then marks the node as unschedulable. Both commands are essential for node maintenance and are directly used to manage node scheduling state in a cluster.

Answer

kubectl taint

Answer

kubectl delete node

Answer

kubectl get nodes