CKA Cluster Architecture, Installation and Configuration Practice Test 8 — 15 Questions

Question 1

You need to allow a specific pod running in namespace 'app' to communicate with a database pod in namespace 'db' only. Which NetworkPolicy configuration achieves this?

Accepted Answer

NetworkPolicy in namespace 'db' with podSelector: {} and ingress from namespace 'app'. To restrict ingress traffic to the 'db' namespace so that it only accepts connections from the 'app' namespace, you must apply a NetworkPolicy in the 'db' namespace. Using `podSelector: {}` in the policy spec selects all pods in the 'db' namespace, and an ingress rule with a `namespaceSelector` matching the 'app' namespace (Option B) allows traffic from all pods in that namespace. Option A is incorrect because adding an empty `podSelector: {}` inside the ingress rule is either redundant (if evaluated as an AND condition) or opens up unintended access from all pods in the local 'db' namespace (if evaluated as an OR condition in separate block elements).

Answer

NetworkPolicy in namespace 'db' with podSelector: {} and ingress from namespace 'app' and podSelector: {}

Answer

NetworkPolicy in namespace 'app' with egress to namespace 'db' and podSelector: {}

Answer

NetworkPolicy in namespace 'app' allowing ingress from namespace 'db'

Question 2

A cluster has multiple kubeconfig files. You want to set the current context to 'admin@production' for all future kubectl commands. Which command should you run?

Accepted Answer

kubectl config use-context admin@production. The `kubectl config use-context` command is used to set the current context in a kubeconfig file, which determines the cluster, user, and namespace that kubectl will use by default for all subsequent commands. Option B correctly specifies `admin@production` as the context to switch to, making it the active context for future kubectl operations.

Answer

kubectl config set-context admin@production

Answer

kubectl config set-cluster admin@production

Answer

kubectl config get-contexts admin@production

Question 3

During a cluster upgrade, what is the correct order of operations for upgrading a node?

Accepted Answer

Drain the node, upgrade kubelet and kube-proxy, then uncordon. During a node upgrade, the node must first be drained to safely evict all pods and ensure workloads are rescheduled. Then, the kubelet and kube-proxy (which run as system services) are upgraded to match the control plane version. Finally, the node is uncordoned to make it schedulable again, allowing new pods to be placed on it.

Answer

Upgrade kubelet, drain the node, then uncordon

Answer

Drain the node, uncordon, then upgrade kubelet

Answer

Uncordon the node, drain, then upgrade

Question 4

Which TWO of the following are control plane components? (Select 2)

Accepted Answer

kube-controller-manager. The Kubernetes control plane components are kube-apiserver, etcd, kube-scheduler, kube-controller-manager, and cloud-controller-manager. kube-proxy and kubelet run on nodes, not as control plane components. Therefore, options B, C, and E are all control plane components, making the question's 'Select 2' requirement ambiguous.

Answer

kube-proxy

Answer

kubelet

Question 5

Which TWO of the following are correct commands to view the current context in kubeconfig? (Select 2)

Accepted Answer

kubectl config current-context. `kubectl config current-context` is the dedicated command to display the currently active context from the kubeconfig file. It directly outputs the context name without any additional formatting or filtering, making it the simplest and most straightforward way to view the current context.

Answer

kubectl config get-contexts -o name

Answer

kubectl config view --context current

Answer

kubectl config get-contexts

Question 6

Which component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of replicas for a Deployment?

Accepted Answer

kube-controller-manager. The kube-controller-manager is responsible for running controller processes that regulate the state of the cluster. It includes the Deployment controller, which watches the API server for changes to Deployment objects and ensures the actual number of replicas matches the desired state by creating or deleting Pods via the ReplicaSet controller.

Answer

kube-apiserver

Answer

kubelet

Answer

kube-scheduler

Question 7

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db. Etcd v3 is the default and supported version in Kubernetes v1.29, and the `ETCDCTL_API=3` environment variable ensures the etcdctl client uses the v3 API, which provides the `snapshot save` command for creating consistent backups. The command `ETCDCTL_API=3 etcdctl snapshot save /backup/snapshot.db` correctly captures a point-in-time snapshot of the etcd data store, which is essential for disaster recovery.

Answer

kubectl etcd snapshot save /backup/snapshot.db

Answer

etcdctl backup /backup/snapshot.db

Answer

ETCDCTL_API=2 etcdctl snapshot save /backup/snapshot.db

Question 8

A kubeadm cluster is being upgraded from v1.28 to v1.29. You have upgraded the control plane components on the first master node. What is the NEXT step according to the recommended upgrade procedure?

Accepted Answer

Upgrade the remaining control plane nodes. After upgrading the control plane components on the first master node in a kubeadm cluster, the next step is to upgrade the remaining control plane nodes. The kubeadm upgrade procedure requires upgrading all control plane nodes before any worker nodes, because the control plane must be fully upgraded to v1.29 to ensure API server compatibility and etcd cluster consistency. Skipping to worker nodes or draining the first node prematurely would violate the upgrade order specified in the official Kubernetes upgrade documentation.

Answer

Drain the first node

Answer

Upgrade the worker nodes

Answer

Run kubeadm upgrade plan

Question 9

Which command is used to prevent a node from being scheduled with new pods?

Accepted Answer

kubectl cordon . The `kubectl cordon ` command marks a node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the standard Kubernetes command for this purpose, directly setting the `spec.unschedulable` field to `true` on the node object.

Answer

kubectl taint <node> key=value:NoSchedule

Answer

kubectl patch node <node> -p '{"spec":{"unschedulable":true}}'

Answer

kubectl drain <node>

Question 10

A developer created a ServiceAccount named 'app-sa' in the 'dev' namespace. They want a pod to use this ServiceAccount. Which field in the pod spec should be set?

Accepted Answer

spec.serviceAccountName. The `spec.serviceAccountName` field in a Pod spec is the standard way to assign a specific ServiceAccount to a Pod. When this field is set, the Pod's containers will use the token of that ServiceAccount for API authentication. If omitted, the Pod defaults to the `default` ServiceAccount in its namespace.

Answer

spec.serviceAccount

Answer

spec.authentication.serviceAccount

Answer

spec.accountName

Question 11

A ClusterRole named 'pod-reader' grants get, list, watch on pods. You want to bind it to a user 'john' cluster-wide. Which resource should you create?

Accepted Answer

ClusterRoleBinding. A ClusterRoleBinding is the correct resource because it grants cluster-wide permissions to a user. While a ClusterRole defines the permissions (get, list, watch on pods), a ClusterRoleBinding binds that ClusterRole to a subject (user 'john') across all namespaces. This is the only way to achieve cluster-scoped authorization in Kubernetes RBAC.

Answer

Role

Answer

RoleBinding in default namespace

Answer

ClusterRole

Question 12

During a cluster upgrade using kubeadm, after upgrading kubeadm on the node, which command upgrades the kubelet configuration?

Accepted Answer

kubeadm upgrade node config --kubelet-version v1.29.0. After upgrading kubeadm on the node, the correct command to upgrade the kubelet configuration is `kubeadm upgrade node config --kubelet-version v1.29.0`. This command updates the kubelet configuration file (typically `/var/lib/kubelet/config.yaml`) to match the target Kubernetes version, ensuring the kubelet can join the upgraded control plane. It is a specific subcommand of `kubeadm upgrade node` that handles only the kubelet configuration, not the kubelet binary itself.

Answer

kubectl upgrade node kubelet

Answer

kubeadm upgrade apply --kubelet-version v1.29.0

Answer

systemctl restart kubelet

Question 13

Which command initializes a new Kubernetes cluster using kubeadm?

Accepted Answer

kubeadm init. `kubeadm init` is the official Kubernetes command to bootstrap a control-plane node and initialize a new cluster. It performs preflight checks, generates certificates, creates the static Pod manifests for core components (etcd, API server, controller manager, scheduler), and configures the admin kubeconfig file.

Answer

kubeadm create cluster

Answer

kubeadm setup

Answer

kubeadm start

Question 14

Which TWO components run on worker nodes? (Select 2)

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every worker node, responsible for managing pods and their containers as directed by the control plane. kube-proxy runs on each node (including workers) to maintain network rules and handle service-to-pod traffic routing via iptables or IPVS.

Answer

etcd

Answer

kube-apiserver

Answer

kube-scheduler

Question 15

Which THREE are valid methods to restore an etcd cluster from a snapshot? (Select 3)

Accepted Answer

Restore snapshot on a new node and add it as a member, then remove old. It describes the standard procedure for replacing a failed etcd member using a snapshot: you restore the snapshot on a new node (using `etcdctl snapshot restore`), start the new etcd instance, add it as a member to the existing cluster, and then remove the old, failed member. This ensures the new node joins with the correct data and the cluster quorum is maintained.

Answer

kubeadm reset and re-init

Answer

kubectl apply -f snapshot.yaml