CKA Troubleshooting Practice Test 16 — 15 Questions

Question 1

You want to check the current resource usage (CPU and memory) of pods in the 'default' namespace. Which kubectl command should you use?

Accepted Answer

kubectl top pods. `kubectl top pods` retrieves real-time CPU and memory metrics for pods from the metrics server, which is the standard way to check current resource usage in a Kubernetes cluster. This command relies on the Metrics API and requires the metrics server to be deployed.

Answer

kubectl get pods -o wide

Answer

kubectl logs pods

Answer

kubectl describe pods

Question 2

You are debugging a DNS issue from within a pod. The pod is running 'busybox'. Which command would you use to test DNS resolution for 'kubernetes.default.svc.cluster.local'?

Accepted Answer

kubectl exec -it my-pod -- nslookup kubernetes.default.svc.cluster.local. `kubectl exec -it my-pod -- nslookup kubernetes.default.svc.cluster.local` runs the `nslookup` command directly inside the running pod, which uses the pod's configured DNS resolver (typically CoreDNS) to resolve the Kubernetes service FQDN. This is the standard method to test DNS resolution from within a pod, as it bypasses any external DNS and validates the cluster's internal DNS chain.

Answer

kubectl describe svc kubernetes -n default

Answer

kubectl exec -it my-pod -- curl kubernetes.default.svc.cluster.local

Answer

kubectl run test --image=busybox -- nslookup kubernetes.default.svc.cluster.local

Question 3

A pod is not able to communicate with another pod in the same namespace. Both pods are running and have IP addresses. Which command can you use to test connectivity from the first pod to the second pod's IP?

Accepted Answer

kubectl exec first-pod -- ping . `kubectl exec first-pod -- ping ` runs the `ping` command inside the first pod, which uses ICMP to test IP-level connectivity to the second pod's IP address. This directly verifies whether the network path between the two pods is functional, including any CNI plugin, overlay network, or network policy rules.

Answer

kubectl logs first-pod

Answer

kubectl top pod first-pod

Answer

kubectl exec second-pod -- ping <first-pod-ip>

Question 4

You run 'kubectl get nodes' and see that a node is 'NotReady'. You SSH into the node and run 'systemctl status kubelet'. The output shows 'Active: inactive (dead)'. What is the most likely cause?

Accepted Answer

The kubelet service is stopped. The kubelet is the primary node agent that runs on every node and is responsible for maintaining pod lifecycles. When 'systemctl status kubelet' shows 'Active: inactive (dead)', it means the kubelet systemd service is not running. Since the kubelet must be active for the node to report its status to the control plane, a stopped kubelet directly causes the node to be 'NotReady'.

Answer

The network plugin is misconfigured

Answer

The node has been cordoned

Answer

The container runtime is not installed

Question 5

A pod is stuck in 'Pending' state. Which TWO of the following are common causes?

Accepted Answer

A taint on the node that the pod does not tolerate. A pod enters 'Pending' state when it cannot be scheduled onto a node. Taints on a node with `NoSchedule` or `NoExecute` effects prevent pods that do not have matching tolerations from being scheduled there. This is a common cause because the scheduler skips tainted nodes unless the pod explicitly tolerates the taint, leaving the pod unscheduled and stuck in Pending.

Answer

The service account does not exist

Answer

The pod's liveness probe is failing

Answer

The pod's container image does not exist

Question 6

Which TWO of the following are valid commands to check the status of control plane components?

Accepted Answer

systemctl status kube-apiserver. `systemctl status kube-apiserver` directly queries the systemd service manager for the status of the kube-apiserver process, which is a core control plane component. Option C is correct because `kubectl get pods -n kube-system` lists all pods in the kube-system namespace, which includes control plane components like etcd, kube-scheduler, and kube-controller-manager when they run as static pods or Deployments. Both commands provide direct visibility into the health of control plane components.

Answer

kubectl get nodes

Answer

kubectl get events --all-namespaces

Answer

kubectl top nodes

Question 7

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The OOMKilled status indicates the container was terminated by the Linux Out-of-Memory (OOM) killer because it exceeded its memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being killed, directly addressing the root cause of the crash loop.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 8

Which kubectl command is used to view the logs of a container that has previously crashed in a pod?

Accepted Answer

kubectl logs pod-name --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has crashed and been restarted. This is essential for debugging crash loops, as the current container may have no logs or only startup logs, while the crashed container's logs contain the error.

Answer

kubectl logs pod-name -c container-name --tail=100

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name

Question 9

You are troubleshooting a pod that cannot start. Running 'kubectl describe pod' shows the event: 'Failed to pull image "myregistry.io/myapp:1.0": rpc error: code = Unknown desc = Error response from daemon: manifest for myregistry.io/myapp:1.0 not found'. What is the MOST likely cause?

Accepted Answer

The image tag '1.0' does not exist in the registry. The error message 'manifest for myregistry.io/myapp:1.0 not found' indicates that the registry successfully received the pull request but could not locate the specific image tag '1.0'. This is a manifest lookup failure, not a connectivity or authentication issue. The most likely cause is that the tag '1.0' does not exist in the repository, either because it was never pushed or was removed.

Answer

The registry is unreachable due to network issues

Answer

The image registry requires authentication and the imagePullSecret is missing

Answer

The image has been deleted from the registry

Question 10

You need to check the current resource usage of nodes in your cluster. Which command should you use?

Accepted Answer

kubectl top nodes. `kubectl top nodes` retrieves and displays real-time CPU and memory usage metrics for all nodes in the cluster, directly answering the question about current resource usage. This command relies on the metrics server being deployed in the cluster to collect resource utilization data from kubelets via the Summary API.

Answer

kubectl top pods

Answer

kubectl get events

Answer

kubectl get nodes -o wide

Question 11

You run 'kubectl get pods' and see a pod in 'CrashLoopBackOff'. You want to see the logs of the last crashed instance. Which command should you run?

Accepted Answer

kubectl logs pod-name --previous. The `--previous` flag (or its shorthand `-p`) tells `kubectl logs` to retrieve logs from the previous instance of a container that has crashed and restarted. Since the pod is in `CrashLoopBackOff`, the current container has already exited, and you need to inspect the logs of the last terminated container to diagnose the crash. To avoid having two correct answers, Option C has been changed to an invalid flag.

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name --last

Answer

kubectl logs pod-name

Question 12

Which command can you run to see the events related to a specific pod?

Accepted Answer

kubectl describe pod pod-name. `kubectl describe pod pod-name` includes a dedicated 'Events' section that lists all lifecycle events for that specific pod, such as scheduling, container pulls, and restarts. This command filters events to only those relevant to the pod, making it the most direct way to view pod-specific events without needing to parse all cluster events.

Answer

kubectl logs pod-name

Answer

kubectl get pod pod-name

Answer

kubectl get events

Question 13

A node in your cluster is reporting 'NotReady' status. You log into the node and run 'systemctl status kubelet'. The kubelet service is not running. Which command should you use to start the kubelet and enable it to start on boot?

Accepted Answer

systemctl enable --now kubelet. `systemctl enable --now kubelet` both starts the kubelet service immediately and creates the necessary symlinks to enable it to start automatically on boot. This is the most efficient way to handle a stopped service that needs to be persistent across reboots, which is critical for a Kubernetes node to rejoin the cluster after a reboot.

Answer

systemctl start --enable kubelet

Answer

systemctl enable kubelet

Answer

systemctl start kubelet

Question 14

You run 'kubectl get pods' and see a pod in 'ImagePullBackOff' state. Which command would help you determine the exact reason for the image pull failure?

Accepted Answer

kubectl describe pod . A is correct because 'kubectl describe pod ' provides detailed information about the pod, including the container status, events, and the exact error message from the image pull attempt. This output includes the reason for the ImagePullBackOff, such as a missing image, incorrect tag, authentication failure, or network issue, which is essential for troubleshooting.

Answer

kubectl top pod <pod-name>

Answer

kubectl logs <pod-name>

Answer

kubectl get events

Question 15

A Pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient cpu.' Which of the following is the most likely combination of issues?

Accepted Answer

Three nodes have insufficient CPU for the pod's request, and one node has a taint not tolerated by the pod. The event message explicitly states that 1 node has a taint (node-role.kubernetes.io/control-plane) that the pod does not tolerate, and 3 nodes have insufficient CPU. This means the pod's CPU request cannot be satisfied on three nodes, and the remaining node is tainted, leaving no schedulable node. Option A correctly identifies this combination of issues.

Answer

The pod has a resource request that exceeds available CPU on all nodes

Answer

The pod does not tolerate any taints, and all nodes have taints

Answer

The cluster has only one node with sufficient CPU, but it is cordoned