CKA Cluster Architecture, Installation and Configuration Practice Test 6 — 15 Questions

Question 1

You need to back up etcd data for a cluster with etcd running as a static Pod. Which command should you use?

Accepted Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/snapshot.db. It uses the `etcdctl` command with the required API version 3, specifies the etcd endpoint, and provides the necessary TLS certificates (CA, server cert, and key) to authenticate to the etcd server. When etcd runs as a static Pod, it uses TLS for client-server communication, so these flags are mandatory for a successful snapshot.

Answer

kubectl cp etcd-master:/var/lib/etcd /backup/

Answer

etcdctl snapshot save /backup/snapshot.db

Answer

kubectl exec -n kube-system etcd-master -- etcdctl snapshot save /backup/snapshot.db

Question 2

During a cluster upgrade using kubeadm, after upgrading the control plane, you attempt to upgrade a worker node. The command `kubeadm upgrade node` fails with the error 'node is not ready'. What is the most likely cause?

Accepted Answer

The worker node has a newer version of kubelet than the control plane.. According to the official Kubernetes documentation, the correct sequence to upgrade a worker node after upgrading the `kubeadm` binary is:
1. Drain the node (safely evicting running pods)
2. Run `kubeadm upgrade node` on the worker node (to upgrade local kubelet configuration)
3. Upgrade `kubelet` and `kubectl` binaries on the worker node
4. Restart the `kubelet` service
5. Uncordon the node (making it schedulable again)

Running `kubeadm upgrade node` must occur before the kubelet binary itself is upgraded and restarted.

Answer

The worker node's kube-proxy is outdated.

Answer

The kubelet on the worker node has not been restarted.

Answer

The worker node has not been cordoned.

Question 3

You need to create a RoleBinding that grants a user access to read Pods in the 'dev' namespace. Which YAML manifest is correct?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: Role
  name: pod-reader. It defines a RoleBinding in the 'dev' namespace that binds a User named 'dev-user' to a Role named 'pod-reader'. This grants the user read access to Pods within that specific namespace, which is exactly what the question requires. RoleBindings are namespace-scoped and must specify the target namespace in metadata.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  namespace: dev
...
subjects:
- kind: ServiceAccount
  name: dev-user
roleRef:
  kind: Role
  name: pod-reader

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: ClusterRole
  name: pod-reader

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
...
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: ClusterRole
  name: pod-reader

Question 4

You have configured a ServiceAccount with an associated image pull secret. The Pod referencing this ServiceAccount still fails with ImagePullBackOff due to authentication errors. What is the most likely misconfiguration?

Accepted Answer

The secret is not in the same namespace as the Pod.. Secrets in Kubernetes are namespace-scoped. When you configure `imagePullSecrets` on a ServiceAccount, the ServiceAccount admission controller automatically injects these secrets into any Pod referencing that ServiceAccount. However, because Secrets are namespace-scoped, the secret must exist in the same namespace as the ServiceAccount and the Pod. If the secret was created in a different namespace, the Pod will fail to pull the image with an authentication error (ImagePullBackOff).

Answer

The secret type is wrong; it should be kubernetes.io/dockercfg.

Answer

The ServiceAccount does not have the imagePullSecrets field configured.

Answer

The Pod spec must set the secret in imagePullSecrets directly.

Question 5

To check the expiration date of all certificates managed by kubeadm, which command should you run?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all certificates managed by kubeadm in the cluster. This command reads the certificate files from the default kubeadm certificate directory (typically `/etc/kubernetes/pki`) and parses their `NotAfter` field to show remaining validity.

Answer

kubectl get certificates

Answer

kubeadm certs renew

Answer

kubeadm alpha certs check-expiration

Question 6

A Pod is stuck in Pending state. Running 'kubectl describe pod' shows '0/3 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, 2 node(s) had taint {node-role.kubernetes.io/master: }'. The Pod does not have tolerations. What is the most likely cause?

Accepted Answer

The Pod does not have tolerations for the control-plane or master taints.. The Pod is stuck in Pending state because it does not have tolerations for the taints present on the nodes. The error message explicitly states that 1 node has the control-plane taint and 2 nodes have the master taint. By default, Pods without matching tolerations cannot be scheduled onto tainted nodes. Since all available nodes are tainted, the scheduler has no eligible node to place the Pod, leaving it in Pending.

Answer

The scheduler is not running.

Answer

The Pod requests more CPU than any node can provide.

Answer

The Pod has a node selector that doesn't match any node.

Question 7

Which TWO of the following are valid ways to set the namespace for a kubectl command?

Accepted Answer

kubectl config set-context $(kubectl config current-context) --namespace=myns. `kubectl config set-context` with the current context explicitly updates the namespace for that context, making it the default for all subsequent `kubectl` commands without needing the `--namespace` flag. Option D is correct because the `--namespace` flag can be passed directly to any `kubectl` command to override the current context's namespace for that single invocation.

Answer

kubectl config set-context --namespace=myns

Answer

kubectl namespace myns

Answer

export KUBE_NAMESPACE=myns

Question 8

Which THREE of the following are valid steps when restoring etcd from a snapshot using etcdctl?

Accepted Answer

Update the etcd configuration to point to the new data directory.. After restoring etcd from a snapshot, the restored data is placed into a new data directory. The etcd configuration must be updated to point to this new directory so that the etcd service uses the restored data when it starts.

Option B is incorrect because 'snapshot save' is used to create a backup, not to restore.

Option C is incorrect because you cannot simply copy the snapshot file into the active data directory; you must use the 'etcdctl snapshot restore' command to properly initialize the directory structure from the backup.

Option D is correct because you must stop the etcd service (or move its static Pod manifest) before restoring to ensure data integrity and prevent conflicts.

Option E is correct because 'etcdctl snapshot restore' is the command that creates the new data directory from the snapshot file.

Answer

Run etcdctl snapshot save to create a backup.

Answer

Use --data-dir flag with snapshot restore to specify the destination.

Question 9

Which TWO of the following are responsibilities of the kube-controller-manager?

Accepted Answer

Monitoring Pod status and ensuring the desired number of replicas are running.. The kube-controller-manager runs the ReplicaSet controller, which continuously monitors Pod status via the Kubernetes API server and ensures that the desired number of Pod replicas are running at all times. If a Pod fails or is deleted, the controller creates a replacement to maintain the specified replica count.

Answer

Maintaining network rules on nodes.

Answer

Assigning Pods to nodes based on resource availability.

Answer

Managing cloud provider-specific resources like load balancers.

Question 10

You are upgrading a Kubernetes cluster from version 1.28 to 1.29. What is the correct order of steps?

Accepted Answer

Upgrade control plane nodes first, then drain each worker node before upgrading it.. The Kubernetes upgrade process requires upgrading the control plane nodes first to ensure the cluster's management layer is running the new version before worker nodes are upgraded. Draining each worker node before upgrading it is essential to safely evict pods and maintain application availability, as the kubelet on the node must be stopped during the upgrade and the node must be cordoned to prevent new pods from being scheduled.

Answer

Upgrade all worker nodes first, then upgrade control plane nodes.

Answer

Upgrade control plane nodes first, then upgrade worker nodes without draining them.

Answer

Upgrade all nodes simultaneously.

Question 11

Which component is responsible for maintaining network rules on each node?

Accepted Answer

kube-proxy. C is correct because kube-proxy is the component responsible for maintaining network rules on each node. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or other rules to route traffic to the appropriate Pods. This ensures that network policies and service load balancing are enforced at the node level.

Answer

kube-controller-manager

Answer

etcd

Answer

kubelet

Question 12

What is the default port for the Kubernetes API server?

Accepted Answer

6443. The Kubernetes API server defaults to port 6443 for secure HTTPS traffic. This is the standard port used by kubectl and other clients to communicate with the control plane over TLS-encrypted connections, as defined in the Kubernetes documentation and default kube-apiserver configuration.

Answer

10250

Answer

8080

Answer

2379

Question 13

Which command is used to check the expiration of certificates managed by kubeadm?

Accepted Answer

kubeadm certs check-expiration. The correct command to check the expiration of certificates managed by kubeadm is `kubeadm certs check-expiration`. This command reads the certificate files located in `/etc/kubernetes/pki/` and displays their remaining validity period, allowing administrators to proactively renew certificates before they expire.

Answer

kubeadm certs status

Answer

kubeadm certs list

Answer

kubeadm certs renew

Question 14

To back up etcd, which command should be used with etcdctl?

Accepted Answer

etcdctl snapshot save. The correct command to back up etcd is `etcdctl snapshot save`, which creates a point-in-time snapshot of the etcd key-value store. This is the officially recommended method for backing up etcd data in Kubernetes clusters, as it captures the entire database state consistently.

Answer

etcdctl export

Answer

etcdctl backup

Answer

etcdctl dump

Question 15

A ClusterRoleBinding grants permissions to a user, but the user is unable to perform the action. What is a possible cause?

Accepted Answer

The subject in the ClusterRoleBinding is misspelled or missing the kind.. To make the question technically precise and ensure there is only one correct answer, we specify in the stem that the ClusterRole itself has been verified to have the correct rules. We also correct Option A to focus on the misspelled subject name (or namespace for ServiceAccounts), which is a silent failure because Kubernetes does not validate the existence of subjects when creating bindings.

Answer

The ClusterRole does not have the required rules.

Answer

The user's kubeconfig does not include the correct context.

Answer

A RoleBinding in the namespace overrides the ClusterRoleBinding.