CKA Troubleshooting Practice Test 9 — 15 Questions

Question 1

You run 'kubectl get pods -n default' and see a pod named 'backend' in ImagePullBackOff state. What is the most likely cause?

Accepted Answer

The image name or tag is incorrect. ImagePullBackOff indicates Kubernetes cannot pull the container image, often due to a tag typo or non-existent image.

Answer

The node is out of disk space

Answer

The container's memory limit is too low

Answer

The pod's service account lacks permissions

Question 2

Which command shows the logs of a pod that has crashed and restarted?

Accepted Answer

kubectl logs pod-name --previous. kubectl logs --previous shows logs from the previous container instance.

Answer

kubectl logs pod-name

Answer

kubectl logs pod-name -c container-name

Answer

kubectl describe pod pod-name

Question 3

A pod remains in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the solution?

Accepted Answer

Add a toleration to the pod spec. The pod cannot tolerate the master taint. Remove the taint or add tolerations.

Answer

Increase the pod's CPU request

Answer

Remove the pod and recreate it

Answer

Delete the taint from the node

Question 4

You run 'kubectl get nodes' and one node shows 'NotReady'. You SSH into the node and run 'systemctl status kubelet'. Kubelet is active but 'journalctl -u kubelet -n 50' shows 'network plugin is not ready: cni config uninitialized'. What is the most likely cause?

Accepted Answer

The CNI configuration file is missing or incorrect. The CNI plugin configuration is missing, causing the network plugin to be unready.

Answer

The container runtime is not installed

Answer

Kubelet is not running

Answer

The node's IP address has changed

Question 5

You run 'kubectl top nodes' but get 'error: metrics not available yet'. What is the most likely cause?

Accepted Answer

The Metrics Server is not deployed. Metrics server is not deployed or not ready, so resource metrics are unavailable.

Answer

kubectl top requires root access

Answer

Nodes have insufficient CPU

Answer

Kubelet is not running on nodes

Question 6

A newly created Service of type ClusterIP is not accessible from within the cluster. You exec into a pod and run 'curl http://service-name:80' but get 'Connection refused'. What is the most likely cause?

Accepted Answer

The application inside the pod is not listening on the targetPort. Connection refused indicates the application in the backend pods is not listening on the expected port, or the service's targetPort is wrong.

Answer

The service selector does not match pod labels

Answer

The backend pods are not ready

Answer

The service is not in the same namespace

Question 7

Which command shows events sorted by timestamp for troubleshooting recent issues?

Accepted Answer

kubectl get events --sort-by=.lastTimestamp. To view events sorted by the most recent timestamp for troubleshooting, use 'kubectl get events --sort-by=.lastTimestamp'. The .lastTimestamp field records when the event was last observed, making it ideal for identifying recent issues. While .metadata.creationTimestamp exists, .lastTimestamp is more appropriate for recent event ordering.

Answer

kubectl logs --events

Answer

kubectl describe events

Answer

kubectl get events

Question 8

You run 'kubectl get pods' and see a pod named 'db' in CrashLoopBackOff. 'kubectl logs db' shows nothing. 'kubectl logs db --previous' shows 'Error: database connection failed'. What is the most likely cause?

Accepted Answer

The environment variable for database host is incorrect. The 'kubectl logs db --previous' output shows 'Error: database connection failed', which indicates the application inside the container is failing to connect to a database. Since the current logs are empty (the container restarted), the previous logs reveal the root cause: a configuration issue, most likely an incorrect database host environment variable. This is a classic application-level startup failure, not a resource or probe issue.

Answer

The node is out of memory

Answer

The pod's liveness probe is misconfigured

Answer

The container image is missing

Question 9

A pod is in CrashLoopBackOff. You want to see the current container's logs. Which command do you use?

Accepted Answer

kubectl logs pod-name. `kubectl logs pod-name` retrieves the current container logs from the pod's standard output (stdout/stderr). For a pod in CrashLoopBackOff, the container is actively restarting, so the current logs (from the latest crash) are available without the `--previous` flag. This command directly shows the most recent container output, which is essential for diagnosing the crash reason.

Answer

kubectl exec pod-name -- cat /var/log/app.log

Answer

kubectl describe pod pod-name

Answer

kubectl logs pod-name --previous

Question 10

You have a Deployment with 3 replicas. One pod is in CrashLoopBackOff. The other two are Running. You run 'kubectl get events' and see 'Liveness probe failed: HTTP probe failed with statuscode: 503'. What should you do?

Accepted Answer

Check the application health endpoint and fix it to return 200. Liveness probe failure causes container restart. The fix could be adjusting the probe or fixing the app to respond correctly.

Answer

Increase the initialDelaySeconds of the liveness probe

Answer

Scale down the deployment

Answer

Remove the liveness probe

Question 11

A pod is stuck in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {key=value: NoSchedule}, 1 node(s) had taint {node.kubernetes.io/unreachable: }. What does this indicate?

Accepted Answer

The pod does not tolerate the taints on the available nodes. The pod cannot tolerate the taints. One node has a custom taint, another is unreachable.

Answer

The nodes are all in NotReady state

Answer

The pod requires at least 2 nodes

Answer

The pod has insufficient resources

Question 12

Which THREE are valid methods to debug DNS resolution inside a pod? (Select 3)

Accepted Answer

kubectl exec <pod> -- nslookup kubernetes.default.svc.cluster.local. To debug DNS resolution inside a pod, you can:
1. Use `nslookup` (Option B) to query the DNS server directly for a service name.
2. Use `dig` (Option D) to perform a detailed DNS lookup and trace the resolution path.
3. Inspect `/etc/resolv.conf` (Option E) inside the pod to verify that the DNS search paths and nameserver IP (which should point to the kube-dns/CoreDNS service IP) are configured correctly.

`ping` (Option A) is not a reliable DNS debugging tool as it may fail due to ICMP being blocked even if DNS resolution succeeds, and it does not provide detailed DNS query/response information. `kubectl logs` (Option C) only shows application logs, not DNS resolution details unless the application itself logs DNS errors.

Answer

kubectl exec <pod> -- ping kubernetes.default.svc.cluster.local

Answer

kubectl logs <pod>

Question 13

A pod is in Pending state. Which TWO are possible causes? (Select 2)

Accepted Answer

A PersistentVolumeClaim used by the pod is not bound. Pending means pod cannot be scheduled. Resource constraints and PVC not bound are common causes.

Answer

The pod's liveness probe is failing

Answer

The container image is invalid

Answer

The pod's readiness probe is failing

Question 14

Which THREE are valid steps to troubleshoot a node that is in 'NotReady' state? (Select 3)

Accepted Answer

Check kubelet logs with 'journalctl -u kubelet'. Check kubelet status, logs, and network plugin. Restarting kubelet may help; checking API server is not node-specific.

Answer

Run 'kubectl get events' from the control plane

Answer

Restart the kube-apiserver on the control plane

Question 15

A node in the cluster is showing status 'NotReady'. You run 'kubectl describe node worker1' and see that the kubelet has not posted node status for more than 1 minute. Which command should you run on the node to check the kubelet logs?

Accepted Answer

journalctl -u kubelet. On systemd-based systems, 'journalctl -u kubelet' is the standard command to view kubelet logs. 'journalctl -f -u kubelet' follows the log, but the question asks for checking logs, not following.

Answer

cat /var/log/kubelet/kubelet.log

Answer

kubectl logs kubelet -n kube-system

Answer

systemctl restart kubelet