CKA Cluster Architecture, Installation and Configuration Practice Test 7 — 15 Questions

Question 1

Which TWO commands can be used to interact with etcd snapshot operations? (Select TWO.)

Accepted Answer

etcdctl snapshot restore. Option B, `etcdctl snapshot restore`, is correct because it is the etcdctl subcommand used to rebuild an etcd member's data directory from a previously taken snapshot file, typically with flags such as --data-dir and --initial-cluster. Option D, `etcdctl snapshot save`, is correct because it is the etcdctl subcommand that creates a point-in-time snapshot of the etcd key-value store and writes it to a file for backup purposes. Both commands belong to the `snapshot` subcommand group in etcdctl and are the standard tools for backup and recovery of etcd data. Option A, `etcdctl import`, is not a valid etcdctl snapshot operation, and option E, `etcdctl backup`, was a legacy command that has been replaced by `etcdctl snapshot save`. Option C, `etcdctl migrate`, is used to migrate etcd data formats or versions, not to perform snapshot save or restore operations.

Answer

etcdctl import

Answer

etcdctl migrate

Answer

etcdctl backup

Question 2

Which command initializes a new Kubernetes control plane node using kubeadm?

Accepted Answer

kubeadm init. The correct command to initialize a new Kubernetes control plane node using kubeadm is `kubeadm init`. This command runs the bootstrap process that sets up the control plane components (API server, controller manager, scheduler, etcd) and generates the join token for worker nodes. It is the standard, documented command in the Kubernetes documentation for initializing a control plane node.

Answer

kubeadm bootstrap

Answer

kubeadm create cluster

Answer

kubeadm start

Question 3

An administrator runs 'kubectl get nodes' and sees that a worker node is in the 'Ready,SchedulingDisabled' state. Which command was most likely executed on that node?

Accepted Answer

kubectl cordon node01. The 'Ready,SchedulingDisabled' state indicates the node has been marked as unschedulable using the 'kubectl cordon' command. Cordon marks the node as unschedulable, preventing new pods from being scheduled onto it while existing pods continue running. This matches the observed state exactly.

Answer

kubectl drain node01

Answer

kubectl taint nodes node01 key=value:NoSchedule

Answer

kubectl uncordon node01

Question 4

Which command is used to backup etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save. `etcdctl snapshot save` is the official command in etcdctl v3 to create a point-in-time backup of the etcd data store. This command captures the entire key-value store and metadata into a snapshot file, which can later be restored using `etcdctl snapshot restore` to recover the cluster state.

Answer

etcdctl backup

Answer

etcdctl export

Answer

etcdctl dump

Question 5

A developer needs to create a Role that allows listing pods in the 'dev' namespace. Which YAML snippet correctly defines this Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-lister
  namespace: dev
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It defines a Role (not ClusterRole) scoped to the 'dev' namespace with the 'list' verb on 'pods', which matches the requirement exactly. In Kubernetes RBAC, a Role grants permissions within a specific namespace, and the empty apiGroups string [""] refers to the core API group where pods reside.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-lister
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-lister-binding
  namespace: dev
subjects:
- kind: User
  name: dev-user
roleRef:
  kind: Role
  name: pod-lister
  apiGroup: rbac.authorization.k8s.io

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-lister
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get"]

Question 6

Which component is responsible for running containers on a node?

Accepted Answer

container runtime. The container runtime is the software responsible for actually running containers on a node. It pulls container images, creates container namespaces, and manages the container lifecycle (start, stop, delete). In Kubernetes, the kubelet delegates container execution to the container runtime via the CRI (Container Runtime Interface), but the runtime itself performs the low-level operations using technologies like runc or containerd.

Answer

kubelet

Answer

kube-scheduler

Answer

kube-proxy

Question 7

An admin wants to view the current context in their kubeconfig. Which command should they use?

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the exact command to display the currently active context from the kubeconfig file. The context includes the cluster, namespace, and user that `kubectl` will use by default. This is a direct query of the `current-context` field in the kubeconfig YAML/JSON structure.

Answer

kubectl config get-contexts

Answer

kubectl cluster-info

Answer

kubectl config view

Question 8

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely cause?

Accepted Answer

The pod does not tolerate the node's taint.. The pod is stuck in 'Pending' because the scheduler cannot find a node that satisfies its scheduling constraints. The 'kubectl describe pod' output explicitly states that 1 node has a taint (node-role.kubernetes.io/master) that the pod does not tolerate. By default, pods do not tolerate the master taint, so they are not scheduled onto master nodes unless a toleration is added. This is the direct cause of the pending state.

Answer

The pod is missing resource requests.

Answer

The node is cordoned.

Answer

The kubelet is not running on the node.

Question 9

Which kubectl command is used to drain a node before performing maintenance?

Accepted Answer

kubectl drain node01. The `kubectl drain` command is the correct tool for safely evicting all pods from a node before maintenance. It marks the node as unschedulable (similar to `cordon`) and then gracefully terminates pods, respecting PodDisruptionBudgets, ensuring workloads are rescheduled to other nodes without disruption.

Answer

kubectl cordon node01

Answer

kubectl taint node node01 key=value:NoExecute

Answer

kubectl delete node node01

Question 10

A ClusterRoleBinding grants cluster-admin access to a user. Which field in the ClusterRoleBinding specifies the user?

Accepted Answer

subjects. In Kubernetes RBAC, the `subjects` field in a ClusterRoleBinding (or RoleBinding) specifies the users, groups, or service accounts that the binding applies to. The `subjects` array contains objects with `kind`, `name`, and optionally `apiGroup` or `namespace`, allowing you to reference a specific user by name. Option B is correct because `subjects` is the only field that defines the identity of the principal receiving the permissions.

Answer

users

Answer

roleRef

Answer

bindings

Question 11

Which TWO of the following are control plane components? (Select 2)

Accepted Answer

etcd. etcd (D) is a control plane component because it is the consistent, highly-available key-value store that persists all cluster state and configuration data for Kubernetes. kube-apiserver (E) is also a control plane component: it exposes the Kubernetes API, validates and processes REST requests, and is the central communication hub through which all other components interact. By contrast, kubelet (A) runs on each worker node to manage pods and containers, kube-proxy (B) runs on nodes to implement Service networking rules via iptables/IPVS, and the container runtime (C) runs on nodes to actually pull images and run containers, so none of these three are control plane components.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 12

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates that the container was terminated because it exceeded its memory limit. Since the pod ran successfully for days before crashing, the most likely cause is a memory leak or increased workload demand. Increasing the memory limit in the container's resource specification allows the pod to use more memory without being killed, directly addressing the root cause.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 13

Which of the following is a core control plane component of Kubernetes?

Accepted Answer

kube-apiserver. The kube-apiserver is the front-end of the Kubernetes control plane and the only component that directly interacts with the etcd datastore. It validates and processes all REST API requests, making it the core control plane component responsible for exposing the Kubernetes API and managing the cluster state.

Answer

kubelet

Answer

CoreDNS

Answer

CRI-O

Question 14

You have a cluster with multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0 using kubeadm. What is the correct sequence of steps?

Accepted Answer

Upgrade kubeadm on the control plane node, upgrade control plane components, then drain and upgrade each worker node by upgrading kubelet and kubectl.. The official kubeadm upgrade workflow requires upgrading kubeadm first on the control plane node, then using `kubeadm upgrade apply` to upgrade control plane components, and finally draining and upgrading each worker node by updating kubelet and kubectl. This sequence ensures the cluster's management plane is updated before worker nodes, maintaining control plane stability and API compatibility during the rolling upgrade.

Answer

Upgrade kubeadm on the control plane node, then upgrade kubelet and kubectl on worker nodes, then upgrade kubelet and kubectl on control plane node.

Answer

Drain all nodes, upgrade kubelet and kubectl on all nodes, then upgrade kubeadm on the control plane node.

Answer

Upgrade kubelet and kubectl on all nodes first, then upgrade kubeadm on the control plane node.

Question 15

Which command is used to create a backup of etcd data using etcdctl?

Accepted Answer

etcdctl snapshot save /backup/snapshot.db. `etcdctl snapshot save` is the command used to create a point-in-time backup of etcd data. This command captures the entire key-value store and writes it to a specified file path, which is essential for disaster recovery in Kubernetes clusters that use etcd as their backing store.

Answer

etcdctl endpoint status

Answer

etcdctl snapshot restore /backup/snapshot.db

Answer

etcdctl member list