CKA Workloads and Scheduling — 50 Questions

Question 1

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates the container was terminated because it exceeded its memory limit. Since the pod ran successfully for days, the issue is likely a memory leak or increased workload demand. Increasing the memory limit in the container's resource specification allows the pod to handle the higher memory usage without being killed.

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Question 2

You need to update a Deployment's image from nginx:1.20 to nginx:1.21 using a rolling update strategy, but you want to ensure that during the update, at most 2 pods above the desired replicas (10) are running, and at least 8 pods are available at all times. Which strategy configuration should you apply?

Accepted Answer

maxSurge: 2, maxUnavailable: 2. Option C is correct because it sets maxSurge=2 and maxUnavailable=2, which ensures that during the rolling update, at most 2 extra pods can be created above the desired 10 (so maximum 12 pods running), and at least 8 pods (desired 10 minus maxUnavailable 2) are always available. This satisfies the requirement of at most 2 pods above desired replicas and at least 8 available at all times.

Answer

maxSurge: 3, maxUnavailable: 2

Answer

maxSurge: 3, maxUnavailable: 3

Answer

maxSurge: '20%', maxUnavailable: '20%'

Question 3

Which kubectl command will show the rollout history of a Deployment named 'web-app'?

Accepted Answer

kubectl rollout history deployment web-app. Option C is correct because `kubectl rollout history deployment web-app` is the dedicated command to display the rollout history of a Deployment, including revision numbers and change-cause annotations. This command retrieves the stored ReplicaSet revisions associated with the Deployment, allowing you to see past rollout states.

Answer

kubectl describe deployment web-app

Answer

kubectl rollout status deployment web-app

Answer

kubectl get deployment web-app -o yaml

Question 4

You have a DaemonSet that is supposed to run on all nodes, but you notice it is not running on a node with a taint 'dedicated=monitoring:NoSchedule'. What must be added to the DaemonSet's pod template to make it run on that node?

Accepted Answer

A toleration with key 'dedicated', value 'monitoring', effect 'NoSchedule'. Option D is correct because a DaemonSet's pods must tolerate a node's taints to be scheduled on that node. The taint 'dedicated=monitoring:NoSchedule' means pods without a matching toleration will not be scheduled. Adding a toleration with key 'dedicated', value 'monitoring', and effect 'NoSchedule' explicitly allows the DaemonSet pod to bypass this taint and run on the node.

Answer

Add the annotation 'scheduler.alpha.kubernetes.io/tolerations'

Answer

A nodeSelector with key 'dedicated' and value 'monitoring'

Answer

Set the priorityClassName to 'system-node-critical'

Question 5

You have a Deployment 'db' with 3 replicas. Each pod writes to a PersistentVolumeClaim (PVC). A StatefulSet is required for stable network identities and ordered pod management. Which of the following is a key characteristic that differentiates a StatefulSet from a Deployment?

Accepted Answer

StatefulSets maintain a sticky identity for each pod, including stable hostnames and persistent storage. Option D is correct because StatefulSets assign each pod a unique, stable network identity (e.g., a hostname derived from the StatefulSet name and ordinal index) and guarantee that each pod's PersistentVolumeClaim is bound to the same PersistentVolume across rescheduling. This ensures that each pod retains its identity and data, which is critical for stateful applications like databases. Deployments, in contrast, treat pods as interchangeable and do not guarantee stable hostnames or persistent storage binding.

Answer

StatefulSets support rolling updates but not canary deployments

Answer

StatefulSets automatically create a Service for each pod

Answer

StatefulSets cannot use PersistentVolumeClaims

Question 6

You have a CronJob that runs a batch job every 5 minutes. The job takes about 2 minutes to complete. However, if a job takes longer than 5 minutes, you want to prevent a new job from starting until the previous one finishes. Which CronJob field should you configure?

Accepted Answer

concurrencyPolicy: Forbid. The `concurrencyPolicy` field in a CronJob spec controls how the controller handles overlapping job executions. Setting it to `Forbid` ensures that if a previous job is still running when the next scheduled time arrives, the new job is skipped, preventing concurrent runs. This directly addresses the requirement to block a new job from starting until the previous one finishes.

Answer

successfulJobsHistoryLimit

Answer

suspend: true

Answer

startingDeadlineSeconds

Question 7

Which of the following describes the role of init containers in a pod?

Accepted Answer

They run to completion before any main containers start, and each init container must complete successfully before the next one starts. Init containers are specialized containers that run before the main application containers in a Pod. They are defined in the Pod spec under `initContainers` and execute sequentially: each init container must complete successfully (exit code 0) before the next one starts. Only after all init containers have finished does Kubernetes start the main containers defined in the `containers` array. This ensures prerequisite setup tasks (e.g., waiting for a database, running migrations) are completed before the application starts.

Answer

They run in parallel with the main containers to provide additional services

Answer

They are used for liveness and readiness probes of the main container

Answer

They run after the main containers have started to clean up resources

Question 8

You need to schedule a pod to a specific node named 'worker-2' for testing purposes. Which field should you set in the pod spec?

Accepted Answer

nodeName. The `nodeName` field in the PodSpec directly assigns the pod to a specific node by name, bypassing the scheduler entirely. Setting `nodeName: worker-2` forces the kubelet on that node to run the pod, making it the correct choice for pinning a pod to a specific node for testing.

Answer

schedulerName

Answer

affinity

Answer

nodeSelector

Question 9

A pod with a resource request of 500m CPU and a limit of 1 CPU is scheduled. The node has a CPU capacity of 2 cores. What does the '500m' represent?

Accepted Answer

500 millicores (0.5 CPU core). In Kubernetes, CPU resources are measured in millicores, where 1000m equals 1 full CPU core (vCPU or hyperthread). The '500m' in a resource request means the pod is guaranteed at least 500 millicores, or 0.5 CPU core, from the node's 2-core capacity. This is a standard unit used by the kubelet for CPU scheduling and the Completely Fair Scheduler (CFS) quota enforcement.

Answer

500 megabytes of memory

Answer

50% of the node's CPU capacity

Answer

A limit of 500,000 CPU seconds per day

Question 10

You have a PriorityClass 'high-priority' with value 1000 and 'low-priority' with value 100. A pod A with 'high-priority' is pending because the node has no resources. A pod B with 'low-priority' is running on that node. What will happen if preemption is enabled?

Accepted Answer

Pod B will be preempted (evicted) to allow pod A to be scheduled on the node. When preemption is enabled, the Kubernetes scheduler can evict lower-priority pods to free resources for pending higher-priority pods. In this scenario, Pod A (priority 1000) is pending due to insufficient resources, while Pod B (priority 100) is running on the node. The scheduler will preempt (evict) Pod B to allow Pod A to be scheduled, as the priority difference is significant and preemption is enabled by default in Kubernetes (via the 'PrioritySort' and 'Preemption' plugins).

Answer

Pod A will be scheduled only after pod B completes its work

Answer

Pod A will remain pending because preemption is not enabled by default

Answer

The cluster administrator must manually delete pod B to allow pod A to schedule

Question 11

Which command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. Option B is correct because `kubectl create configmap app-config --from-file=config.properties` directly reads the file `config.properties` and creates a ConfigMap named `app-config` with a key equal to the filename (i.e., `config.properties`) and the value set to the file's content. The `--from-file` flag without a key specification uses the filename as the key, which is the standard behavior for creating a ConfigMap from a single file.

Answer

kubectl create configmap app-config --from-file=key=config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create secret generic app-config --from-file=config.properties

Question 12

You want to mount a Secret named 'db-secret' as a volume in a pod. Which volume type should you use in the pod spec?

Accepted Answer

secret. Option D is correct because Kubernetes provides a dedicated 'secret' volume type specifically designed to mount Secret objects (like 'db-secret') as files into a pod. This volume type automatically handles decryption and projection of the secret data into the container's filesystem, ensuring sensitive information is securely exposed without being stored in the pod definition or environment variables.

Answer

hostPath

Answer

configMap

Answer

emptyDir

Question 13

Which TWO of the following are valid ways to expose environment variables from a ConfigMap to a pod? (Select TWO.)

Accepted Answer

Using envFrom with configMapRef. Option C is correct because `envFrom` with `configMapRef` allows you to inject all key-value pairs from a ConfigMap as environment variables into a pod, which is a concise way to expose ConfigMap data without specifying each key individually. This is a native Kubernetes feature that automatically creates environment variables for each entry in the ConfigMap.

Answer

Using envFrom with secretRef

Answer

Using env field with configMapKeyRef directly

Answer

Mounting the ConfigMap as a volume, which automatically sets environment variables

Question 14

Which THREE of the following are valid ways to restrict or influence pod scheduling using taints and tolerations? (Select THREE.)

Accepted Answer

Adding a taint with effect NoSchedule to a node. Adding a taint with effect NoSchedule to a node tells the Kubernetes scheduler not to schedule any pods onto that node unless they have a matching toleration. This is a core use of taints and tolerations to restrict pod placement, making option A correct.

Answer

Adding a toleration to a pod to prevent it from being scheduled on certain nodes

Answer

Applying a nodeSelector to a pod to match node labels

Question 15

Which TWO of the following are valid strategies for a Deployment's rolling update? (Select TWO.)

Accepted Answer

maxUnavailable: 0. Option A is correct because setting `maxUnavailable: 0` ensures that during a rolling update, no Pods are taken down below the desired replica count, guaranteeing zero downtime. This is a valid strategy when you want to maintain full availability at the cost of potentially slower updates, as new Pods must be created before any old ones are terminated.

Answer

podManagementPolicy: OrderedReady

Answer

scaleUp: 2

Answer

type: Recreate

Question 16

A Deployment named 'web-app' is configured with rolling update strategy. You run 'kubectl describe deployment web-app' and see 'RollingUpdateStrategy: 25% max unavailable, 25% max surge'. You have 4 replicas. You update the image. How many pods will be unavailable during the rollout at most?

Accepted Answer

1. With a rolling update strategy of 25% max unavailable and 25% max surge on a Deployment with 4 replicas, the maximum number of pods that can be unavailable during the rollout is 1. This is because 25% of 4 replicas equals 1, and Kubernetes rounds down for max unavailable, ensuring at least 3 pods remain available throughout the update.

Answer

0

Answer

4

Answer

2

Question 17

You have a DaemonSet that runs a logging agent. You want to ensure it only runs on nodes with GPU. Which field should you set in the DaemonSet's pod template spec?

Accepted Answer

spec.template.spec.nodeSelector. Option B is correct because `spec.template.spec.nodeSelector` is a simple, direct field in the Pod template spec that constrains which nodes the DaemonSet's pods can be scheduled on. By setting a key-value pair like `gpu: true`, you ensure the logging agent only runs on nodes that have that label, which is the standard Kubernetes mechanism for node-level selection without complex expressions.

Answer

spec.selector

Answer

spec.template.spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution

Answer

spec.template.spec.nodeName

Question 18

Which kubectl command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. Option D is correct because `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' using the contents of the file 'config.properties'. The `--from-file` flag reads the file as-is and stores its content under a key that defaults to the filename (config.properties). This is the standard method for creating a ConfigMap from a single file.

Answer

kubectl apply configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 19

A StatefulSet named 'db' has 3 replicas. You need to update the pod template to change the resource limits. After applying the change, you run 'kubectl rollout status sts db' and it hangs. What is the most likely reason?

Accepted Answer

The StatefulSet's pod management policy is OrderedReady, and the first pod to update (db-2) is not becoming Ready.. Option B is correct because StatefulSets with the default OrderedReady pod management policy update pods sequentially in reverse order (from highest ordinal to lowest). When `kubectl rollout status sts db` hangs, it indicates that the update is stuck waiting for the first pod in the update sequence (db-2) to become Ready. If db-2 fails to become Ready due to the new resource limits (e.g., insufficient cluster resources or misconfigured limits), the rollout cannot proceed to update db-1 and db-0, causing the command to hang indefinitely.

Answer

The update strategy is set to OnDelete, and you need to delete pods manually.

Answer

The maxSurge setting is preventing the update from starting.

Answer

The StatefulSet's service name is incorrect, causing DNS resolution failures.

Question 20

You have a CronJob that runs a backup job every 5 minutes. The job takes about 2 minutes to complete. You notice that sometimes two job pods are running simultaneously. What is the most likely cause?

Accepted Answer

The concurrencyPolicy is set to 'Allow' (default) which permits overlapping executions.. Option B is correct because the default `concurrencyPolicy` for a CronJob is `Allow`, which permits new Job pods to start even if a previous Job is still running. Since the backup takes 2 minutes and the CronJob runs every 5 minutes, overlapping executions should not normally occur unless the Job duration exceeds the interval. However, if the `concurrencyPolicy` is set to `Allow`, the CronJob controller will create a new Job pod regardless of whether the previous one is still running, leading to simultaneous pods. The most likely cause is that the `concurrencyPolicy` is explicitly or implicitly set to `Allow`, allowing overlapping executions.

Answer

The backup takes longer than expected due to data volume.

Answer

The job's parallelism is set to 2.

Answer

The CronJob's startingDeadlineSeconds is set too low.