CKA Cluster Architecture, Installation and Configuration Practice Test 9 — 15 Questions

Question 1

Which TWO are true about taints and tolerations? (Select 2)

Accepted Answer

A node can have multiple taints. A node can indeed have multiple taints applied to it, each with different effects (NoSchedule, PreferNoSchedule, or NoExecute). This allows fine-grained control over pod placement, such as dedicating nodes for specific workloads or isolating sensitive pods. Option E is correct because tolerations are applied to pods and allow them to be scheduled on nodes that have matching taints, effectively overriding the taint's restriction.

Answer

Taints prevent all pods from scheduling on a node

Answer

Taints are applied to pods

Answer

Tolerations are set on nodes

Question 2

Which TWO components are part of the Kubernetes control plane? (Choose TWO.)

Accepted Answer

kube-apiserver. The Kubernetes control plane manages the cluster's overall state and scheduling decisions. The kube-apiserver (B) is the front-end for the control plane, exposing the Kubernetes API, while the kube-scheduler (C) is responsible for assigning newly created pods to nodes based on resource availability and constraints. Both are essential control plane components that run on the master node(s).

Answer

container runtime

Answer

kubelet

Answer

kube-proxy

Question 3

You need to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which TWO steps are REQUIRED as part of the upgrade process? (Choose TWO.)

Accepted Answer

Upgrade the control plane nodes first. The Kubernetes control plane must be upgraded first to prevent version skew issues, as newer node components might rely on API features not yet available on an older control plane. Additionally, each node must be drained before upgrading to safely evict Pods and allow the kubelet to restart without conflicts, which is a required step in the kubeadm upgrade process.

Answer

Run 'kubeadm upgrade plan' before upgrading

Answer

Upgrade kubelet and kubeadm on the node at the same time

Answer

Upgrade all nodes simultaneously to minimize downtime

Question 4

You have taken an etcd snapshot using 'ETCDCTL_API=3 etcdctl snapshot save snapshot.db'. Which TWO commands are needed to restore this snapshot to a new etcd member? (Choose TWO.)

Accepted Answer

Update the etcd configuration (e.g., --data-dir) and restart the etcd service. After restoring an etcd snapshot, the etcd service must be configured to use the restored data directory (e.g., via `--data-dir` or the `ETCD_DATA_DIR` environment variable) and then restarted. This ensures the new etcd member loads the snapshot data instead of starting with an empty or default state.

Answer

etcdctl endpoint health

Answer

etcdctl snapshot save backup.db

Answer

etcdctl snapshot status snapshot.db

Question 5

Which THREE components run on every worker node in a Kubernetes cluster? (Choose THREE.)

Accepted Answer

kube-proxy. B (kube-proxy) is correct because it runs on every worker node to maintain network rules and handle service-to-pod traffic routing via iptables or IPVS. It is a core component for Kubernetes networking, ensuring that service endpoints are reachable from within the cluster.

Answer

etcd

Answer

kube-apiserver

Question 6

You need to grant a ServiceAccount named 'monitor-sa' in namespace 'monitoring' the ability to read Pods and Services across all namespaces. Which TWO resources are needed? (Choose TWO.)

Accepted Answer

ClusterRoleBinding binding the ClusterRole to the ServiceAccount. A is correct because a ClusterRoleBinding grants cluster-scoped permissions to a subject (like a ServiceAccount) across all namespaces. Since the ServiceAccount 'monitor-sa' needs to read Pods and Services in every namespace, a ClusterRoleBinding is the appropriate resource to bind a ClusterRole to the ServiceAccount, avoiding the need for per-namespace RoleBindings.

Answer

ServiceAccount token secret

Answer

RoleBinding in each namespace

Answer

Role in the 'monitoring' namespace

Question 7

You run 'kubectl cordon node1'. Which TWO statements describe the effect of this command? (Choose TWO.)

Accepted Answer

New pods will not be scheduled onto node1. `kubectl cordon` marks a node as unschedulable, preventing the Kubernetes scheduler from placing any new pods onto that node. This is achieved by setting the `node.kubernetes.io/unschedulable` taint or the `spec.unschedulable` field to true, which the scheduler checks during pod assignment. Existing pods on the node continue to run normally and are not affected by the cordon operation.

Answer

The node is removed from the cluster

Answer

All pods on node1 are deleted

Answer

Existing pods on node1 are immediately evicted

Question 8

Which TWO commands are used to set the current context in kubeconfig? (Choose TWO.)

Accepted Answer

kubectl config use-context . `kubectl config use-context ` is the explicit command to switch the current context in your kubeconfig file. Option C is correct because the kubeconfig file is a YAML file that contains a `current-context` field; manually editing this field to the desired context name achieves the same result as the command.

Answer

kubectl config current-context

Answer

kubectl set-context <context-name>

Answer

kubectl config get-contexts

Question 9

You have a ClusterRole named 'deployer' that allows creating Deployments and Services. You want to grant a ServiceAccount 'ci-cd' in namespace 'app' the permissions defined in this ClusterRole. Which TWO resources are needed? (Choose TWO.)

Accepted Answer

The existing ClusterRole 'deployer'. The ClusterRole 'deployer' already contains the necessary rules to allow creating Deployments and Services. You do not need to create a new ClusterRole; you can reuse the existing one. Option C is correct because a RoleBinding in namespace 'app' can reference a ClusterRole and bind it to a ServiceAccount within that namespace, granting the permissions only in that namespace. This is the standard method to grant cluster-scoped permissions to a namespaced subject.

Answer

Create a new ClusterRole with the same rules

Answer

ClusterRoleBinding with subject ServiceAccount 'ci-cd' in namespace 'app'

Answer

A Secret for the ServiceAccount

Question 10

Your kubeadm cluster was initialized with default certificates. You need to check the expiration of the API server certificate and renew it if necessary. Which TWO commands are appropriate? (Choose TWO.)

Accepted Answer

kubeadm certs renew all. `kubeadm certs renew all` renews all PKI certificates in the cluster, including the API server certificate, without requiring a full cluster reinitialization. Option B is correct because `kubeadm certs check-expiration` displays the expiration dates of all certificates managed by kubeadm, allowing you to verify the API server certificate's expiry before deciding to renew.

Answer

kubectl config view

Answer

kubeadm upgrade plan

Answer

kubectl cluster-info

Question 11

A CKA candidate is troubleshooting a control plane node that was upgraded using kubeadm from v1.28 to v1.29. After the upgrade, the kube-apiserver pod fails to start. Which TWO actions should the candidate take to diagnose and resolve the issue? (Select TWO.)

Accepted Answer

Run 'kubeadm upgrade apply v1.29.0' again after resetting the node with 'kubeadm reset'. If the kube-apiserver pod fails to start after a kubeadm upgrade, a clean re-application of the upgrade using 'kubeadm upgrade apply v1.29.0' after resetting the node with 'kubeadm reset' can resolve corrupted or mismatched configuration files, certificates, or static pod manifests. This process reinitializes the control plane components from scratch while preserving the target version, ensuring all manifests and certificates are regenerated correctly.

Answer

Downgrade etcd to a version compatible with Kubernetes 1.28

Answer

Immediately upgrade the worker nodes to match the control plane version

Answer

Run 'kubeadm upgrade plan' to verify the target version

Question 12

Which control plane component is responsible for storing the cluster state and configuration?

Accepted Answer

etcd. etcd is the distributed key-value store that serves as the single source of truth for the entire cluster, storing all cluster state data such as configurations, secrets, service endpoints, and resource specifications. The kube-apiserver reads from and writes to etcd exclusively, making it the only component that directly persists the cluster's desired and current state.

Answer

kube-controller-manager

Answer

kube-apiserver

Answer

kube-scheduler

Question 13

A cluster was upgraded from v1.28 to v1.29 using kubeadm. After upgrading the control plane, nodes remain at v1.28. What is the correct next step to upgrade a worker node?

Accepted Answer

SSH into the worker node and run 'kubeadm upgrade node', then upgrade kubelet and kubectl, then restart kubelet.. After upgrading the control plane with kubeadm, worker nodes must be upgraded individually. The correct sequence is to SSH into the worker node, run 'kubeadm upgrade node' to upgrade the kubelet configuration and static pod manifests, then upgrade the kubelet and kubectl binaries (typically via the package manager), and finally restart the kubelet to pick up the new version. This ensures the node runs the same Kubernetes version as the control plane.

Answer

Drain the node, then run 'kubeadm upgrade node' on the worker node.

Answer

Upgrade kubelet on the worker node using the package manager and restart kubelet.

Answer

Run 'kubeadm upgrade apply' on the worker node.

Question 14

Which component runs on every node in a Kubernetes cluster and ensures containers are running in a pod?

Accepted Answer

kubelet. The kubelet is the primary node agent that runs on every node in a Kubernetes cluster. It is responsible for ensuring that containers described in PodSpecs are running and healthy by communicating with the container runtime via the CRI (Container Runtime Interface). Without the kubelet, no pod or container lifecycle management can occur on that node.

Answer

kube-scheduler

Answer

container runtime

Answer

kube-proxy

Question 15

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Accepted Answer

kubeadm certs check-expiration. `kubeadm certs check-expiration` is the dedicated kubeadm command to display expiration dates for all PKI certificates in the cluster, including the client certificate used by the user's kubeconfig. This command parses the certificates directly from the `/etc/kubernetes/pki` directory and shows remaining validity, making it the precise tool for this scenario.

Answer

kubeadm upgrade plan --certificate-expiration

Answer

kubectl config view --raw | grep client-certificate

Answer

openssl x509 -in /etc/kubernetes/admin.conf -text -noout