CKA Workloads and Scheduling — 40 Questions

Question 1

You need to update a Deployment's image from nginx:1.20 to nginx:1.21 using a rolling update strategy, but you want to ensure that during the update, at most 2 pods above the desired replicas (10) are running, and at least 8 pods are available at all times. Which strategy configuration should you apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

maxSurge: 2, maxUnavailable: 2. To ensure that at most 2 pods above the desired replicas (10) are running, maxSurge must be set to 2. To ensure that at least 8 pods are available at all times, the maximum number of unavailable pods is 10 - 8 = 2, so maxUnavailable must be set to 2. Therefore, the correct configuration is maxSurge: 2, maxUnavailable: 2. Option D has been changed to an incorrect option to ensure there is only one correct answer.

Answer

maxSurge: 3, maxUnavailable: 2

Answer

maxSurge: 3, maxUnavailable: 3

Answer

maxSurge: '20%', maxUnavailable: '20%'

Question 2

You have a DaemonSet that is supposed to run on all nodes, but you notice it is not running on a node with a taint 'dedicated=monitoring:NoSchedule'. What must be added to the DaemonSet's pod template to make it run on that node?

Accepted Answer

A toleration with key 'dedicated', value 'monitoring', effect 'NoSchedule'. A DaemonSet's pods must tolerate a node's taints to be scheduled on that node. The taint 'dedicated=monitoring:NoSchedule' means pods without a matching toleration will not be scheduled. Adding a toleration with key 'dedicated', value 'monitoring', and effect 'NoSchedule' explicitly allows the DaemonSet pod to bypass this taint and run on the node.

Answer

Add the annotation 'scheduler.alpha.kubernetes.io/tolerations'

Answer

A nodeSelector with key 'dedicated' and value 'monitoring'

Answer

Set the priorityClassName to 'system-node-critical'

Question 3

You have a CronJob that runs a batch job every 5 minutes. The job takes about 2 minutes to complete. However, if a job takes longer than 5 minutes, you want to prevent a new job from starting until the previous one finishes. Which CronJob field should you configure?

Accepted Answer

concurrencyPolicy: Forbid. The `concurrencyPolicy` field in a CronJob spec controls how the controller handles overlapping job executions. Setting it to `Forbid` ensures that if a previous job is still running when the next scheduled time arrives, the new job is skipped, preventing concurrent runs. This directly addresses the requirement to block a new job from starting until the previous one finishes.

Answer

successfulJobsHistoryLimit

Answer

suspend: true

Answer

startingDeadlineSeconds

Question 4

Which of the following describes the role of init containers in a pod?

Accepted Answer

They run to completion before any main containers start, and each init container must complete successfully before the next one starts. Init containers are specialized containers that run before the main application containers in a Pod. They are defined in the Pod spec under `initContainers` and execute sequentially: each init container must complete successfully (exit code 0) before the next one starts. Only after all init containers have finished does Kubernetes start the main containers defined in the `containers` array. This ensures prerequisite setup tasks (e.g., waiting for a database, running migrations) are completed before the application starts.

Answer

They run in parallel with the main containers to provide additional services

Answer

They are used for liveness and readiness probes of the main container

Answer

They run after the main containers have started to clean up resources

Question 5

You need to schedule a pod to a specific node named 'worker-2' for testing purposes. Which field should you set in the pod spec?

Accepted Answer

nodeName. The `nodeName` field in the PodSpec directly assigns the pod to a specific node by name, bypassing the scheduler entirely. Setting `nodeName: worker-2` forces the kubelet on that node to run the pod, making it the correct choice for pinning a pod to a specific node for testing.

Answer

schedulerName

Answer

affinity

Answer

nodeSelector

Question 6

Which command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` directly reads the file `config.properties` and creates a ConfigMap named `app-config` with a key equal to the filename (i.e., `config.properties`) and the value set to the file's content. The `--from-file` flag without a key specification uses the filename as the key. Option A is incorrect because the syntax `--from-file=key=config.properties` creates a ConfigMap with the key "key", not the filename. Option C is incorrect because `--from-literal` is for literal key-value pairs, not files. Option D is incorrect because `kubectl create secret generic` creates a Secret, not a ConfigMap.

Answer

kubectl create configmap app-config --from-file=key=config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create secret generic app-config --from-file=config.properties

Question 7

You want to mount a Secret named 'db-secret' as a volume in a pod. Which volume type should you use in the pod spec?

Accepted Answer

secret. Kubernetes provides a dedicated 'secret' volume type specifically designed to mount Secret objects (like 'db-secret') as files into a pod. This volume type automatically handles decryption and projection of the secret data into the container's filesystem, ensuring sensitive information is securely exposed without being stored in the pod definition or environment variables.

Answer

hostPath

Answer

configMap

Answer

emptyDir

Question 8

Which TWO of the following are valid strategies for a Deployment's rolling update? (Select TWO.)

Accepted Answer

maxUnavailable: 0. Setting `maxUnavailable: 0` ensures that during a rolling update, no Pods are taken down below the desired replica count, guaranteeing zero downtime. This is a valid strategy when you want to maintain full availability at the cost of potentially slower updates, as new Pods must be created before any old ones are terminated.

Answer

podManagementPolicy: OrderedReady

Answer

scaleUp: 2

Answer

type: Recreate

Question 9

A Deployment named 'web-app' is configured with rolling update strategy. You run 'kubectl describe deployment web-app' and see 'RollingUpdateStrategy: 25% max unavailable, 25% max surge'. You have 4 replicas. You update the image. How many pods will be unavailable during the rollout at most?

Accepted Answer

1. With a rolling update strategy of 25% max unavailable and 25% max surge on a Deployment with 4 replicas, the maximum number of pods that can be unavailable during the rollout is 1. This is because 25% of 4 replicas equals 1, and Kubernetes rounds down for max unavailable, ensuring at least 3 pods remain available throughout the update.

Answer

0

Answer

4

Answer

2

Question 10

Which kubectl command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' using the contents of the file 'config.properties'. The `--from-file` flag reads the file as-is and stores its content under a key that defaults to the filename (config.properties). This is the standard method for creating a ConfigMap from a single file.

Answer

kubectl apply configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 11

You have a CronJob that runs a backup job every 5 minutes. The job takes about 2 minutes to complete. You notice that sometimes two job pods are running simultaneously. What is the most likely cause?

Accepted Answer

The backup takes longer than expected due to data volume.. A CronJob scheduled every 5 minutes with a normal runtime of 2 minutes will not overlap under normal circumstances. If you observe two pods running simultaneously, it means a previous execution took longer than 5 minutes (for example, due to increased data volume). Because the default `concurrencyPolicy` is `Allow`, the CronJob controller starts the new job without terminating or blocking it, leading to concurrent pods.

Answer

The concurrencyPolicy is set to 'Allow' (default) which permits overlapping executions.

Answer

The job's parallelism is set to 2.

Answer

The CronJob's startingDeadlineSeconds is set too low.

Question 12

You have a Pod that needs to run a database migration before the main application container starts. Which Kubernetes concept should you use?

Accepted Answer

Init container. Init containers are designed to run to completion before the main application containers start, making them the ideal Kubernetes primitive for tasks like database migrations that must complete before the primary service begins. Unlike sidecars, init containers do not run concurrently with the main container, ensuring the migration finishes before the application container starts.

Answer

Sidecar container

Answer

PostStart hook

Answer

Job

Question 13

You need to implement a PriorityClass named 'high-priority' with value 1000 and mark it as non-preempting. Which YAML field should you set to true?

Accepted Answer

spec.preemptionPolicy: Never. Setting `spec.preemptionPolicy: Never` in a PriorityClass definition marks it as non-preempting, meaning pods with this priority will not preempt lower-priority pods even if they have a higher priority value. This field is the only one that controls preemption behavior for a PriorityClass.

Answer

spec.description: "non-preempting"

Answer

spec.globalDefault: true

Answer

spec.value: 1000

Question 14

A HorizontalPodAutoscaler (HPA) is configured for a Deployment with 5 replicas. The HPA is using average CPU utilization, target 50%. You observe that the actual CPU usage is 40% and the HPA does not scale down. What is the most likely reason?

Accepted Answer

The HPA's downscale stabilization window is preventing immediate scale down.. If the HPA's minReplicas is set to 5, the HPA is prohibited from scaling down below 5 replicas, making Option C a correct explanation. To make Option D the single correct answer, Option C should be changed to 'The HPA's maxReplicas is set to 5', which only limits scaling up and would not prevent a scale-down.

Answer

The HPA is using the wrong metric.

Answer

The Deployment's rolling update is in progress.

Answer

The HPA's minReplicas is set to 5.

Question 15

Which of the following is a valid way to mount a Secret as a volume in a Pod?

Accepted Answer

volumes:
- name: secret-volume
  secret:
    secretName: my-secret. It uses the `secret` volume type with the `secretName` field to reference a Kubernetes Secret object. This is the standard syntax for mounting a Secret as a volume in a Pod, allowing the Secret's data to be exposed as files in the container's filesystem.

Answer

volumes:
- name: secret-volume
  secretName: my-secret

Answer

volumes:
- name: secret-volume
  configMap:
    name: my-secret

Answer

volumes:
- name: secret-volume
  hostPath:
    path: /etc/secret

Question 16

You have a Deployment with 3 replicas. You run 'kubectl rollout history deployment web-app' and see revision 2 is current. You want to roll back to revision 1. Which command should you use?

Accepted Answer

kubectl rollout undo deployment/web-app --to-revision=1. `kubectl rollout undo deployment/web-app --to-revision=1` explicitly rolls back the Deployment to revision 1, which is the desired state. The `--to-revision` flag targets a specific revision from the rollout history, ensuring the Deployment's Pod template is reverted to the exact configuration of revision 1.

Answer

kubectl set image deployment/web-app web-app=image:v1

Answer

kubectl rollout history deployment/web-app --revision=1

Answer

kubectl rollout undo deployment/web-app

Question 17

Which TWO statements about Kubernetes resource requests and limits are correct? (Select 2)

Accepted Answer

Limits can be set independently for CPU and memory.. Kubernetes allows CPU and memory limits to be set independently via the `resources.limits` field in a container spec. CPU limits are defined in millicores (e.g., 500m) and memory limits in bytes (e.g., 256Mi), and they are not coupled — you can set a CPU limit without a memory limit and vice versa. This independence gives administrators fine-grained control over resource allocation per container.

Answer

Memory requests and limits are both compressible.

Answer

If a container exceeds its memory limit, it is throttled.

Answer

If no limits are specified, the pod can use unlimited resources.

Question 18

Which THREE of the following are valid taint effects that can be applied to a node? (Select 3)

Accepted Answer

NoSchedule. Taint effects in Kubernetes control pod scheduling onto nodes. `NoSchedule` (C) prevents pods that do not tolerate the taint from being scheduled on the node, making it a valid taint effect.

Answer

NeverSchedule

Answer

PreferSchedule

Question 19

Which TWO statements about DaemonSets are correct? (Select 2)

Accepted Answer

DaemonSets are often used for cluster daemons like log collectors or monitoring agents.. DaemonSets are specifically designed to run cluster-wide services such as log collectors (e.g., Fluentd) or monitoring agents (e.g., Prometheus Node Exporter). They automatically deploy a pod on every node (or a subset of nodes based on node selectors), ensuring that each node has a copy of the daemon pod for tasks like log aggregation or metrics collection.

Answer

DaemonSets are typically managed by a parent Deployment.

Answer

DaemonSets do not support rolling updates.

Answer

DaemonSets have a desired number of replicas that the scheduler tries to maintain.

Question 20

A StatefulSet named 'web' with spec.replicas=3 uses the default pod management policy (OrderedReady). The StatefulSet has persistent volume claims. You run 'kubectl scale statefulset web --replicas=5'. Which statement is TRUE about the new pods?

Accepted Answer

Pods web-3 and web-4 are created sequentially, each with its own PVC. A StatefulSet with the default OrderedReady pod management policy creates pods sequentially, strictly in order from the lowest ordinal index to the highest. When scaling from 3 to 5 replicas, pods web-3 and web-4 are created one after another, each with its own dedicated PersistentVolumeClaim (PVC) as defined in the StatefulSet's volumeClaimTemplates.

Answer

Pods web-3 and web-4 are created in parallel, both sharing the same PVC

Answer

The existing pods are recreated with new PVCs

Answer

Only web-3 is created because the StatefulSet cannot exceed 4 replicas