CKA Multiple Select — 30 Questions

Question 1

Which TWO components are part of the Kubernetes control plane? (Select 2)

Accepted Answer

etcd. etcd is a distributed key-value store that holds the cluster's state and configuration data. It is a core component of the Kubernetes control plane because the kube-apiserver reads from and writes to etcd to maintain cluster consistency, and without it the control plane cannot function.

Answer

kubelet

Answer

kube-proxy

Answer

container runtime

Question 2

Which TWO of the following are valid ways to isolate a set of pods from all ingress traffic except from monitoring pods?

Accepted Answer

Apply a NetworkPolicy with podSelector: matchLabels: { app: myapp }, ingress: [ { from: [ { podSelector: { matchLabels: { role: monitoring } } } ] } ]. It uses a NetworkPolicy with a `podSelector` targeting the protected pods and an `ingress` rule that explicitly allows traffic only from pods with the label `role: monitoring`. This isolates the target pods from all other ingress traffic, as Kubernetes NetworkPolicy defaults to denying ingress when any ingress rule is defined, and only the specified source pods are permitted.

Answer

Apply a NetworkPolicy with ingress rule allowing from a specific pod only

Answer

Apply a NetworkPolicy with empty podSelector and ingress rule allowing all

Answer

Apply a NetworkPolicy with podSelector: matchLabels: { app: myapp } and ingress rule with namespaceSelector: { matchLabels: { name: monitoring } }

Question 3

Which TWO of the following are valid methods to provide a token to a Pod for authenticating to the Kubernetes API server?

Accepted Answer

Using a projected volume with a ServiceAccountToken projection. A projected volume with a ServiceAccountToken projection allows you to explicitly control the token's audience, expiration, and path, and it requests a time-bound, audience-scoped token from the TokenRequest API. This is the recommended method for pods that need to authenticate to the Kubernetes API server with custom token properties.

Answer

Using a ConfigMap to store the token and mounting it

Answer

Storing a token in a Secret and mounting it as a volume

Answer

Setting the token as an environment variable using the downward API

Question 4

Which THREE of the following are CNI plugins?

Accepted Answer

Flannel. Flannel is a CNI plugin that provides a simple overlay network for Kubernetes clusters, typically using VXLAN or host-gw to encapsulate and route pod traffic across nodes. It implements the Container Network Interface (CNI) specification by installing a binary and configuration file on each node, enabling pod-to-pod communication without requiring a separate network daemon.

Answer

kube-proxy

Answer

CoreDNS

Question 5

A pod is stuck in 'Pending' state. Which TWO of the following are common causes?

Accepted Answer

A taint on the node that the pod does not tolerate. A pod enters 'Pending' state when it cannot be scheduled onto a node. Taints on a node with `NoSchedule` or `NoExecute` effects prevent pods that do not have matching tolerations from being scheduled there. This is a common cause because the scheduler skips tainted nodes unless the pod explicitly tolerates the taint, leaving the pod unscheduled and stuck in Pending.

Answer

The service account does not exist

Answer

The pod's liveness probe is failing

Answer

The pod's container image does not exist

Question 6

You are applying the following RBAC manifest:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Which TWO statements are true about this Role? (Choose TWO.)

Accepted Answer

It allows reading pod details in the 'development' namespace. The Role explicitly defines rules for the 'pods' resource with verbs 'get', 'watch', and 'list' in the 'development' namespace. These verbs allow reading pod details such as their specifications, status, and metadata. The Role is scoped to the 'development' namespace, so it only grants these read permissions within that namespace.

Answer

It also grants access to secrets in the 'development' namespace

Answer

It grants permissions across all namespaces

Answer

It allows creating pods in the 'development' namespace

Question 7

Which THREE of the following are valid methods to authenticate to the Kubernetes API server? (Select 3)

Accepted Answer

Service account bearer tokens. Service account bearer tokens are a valid authentication method to the Kubernetes API server. When a pod is associated with a service account, Kubernetes automatically mounts a token into the pod at /var/run/secrets/kubernetes.io/serviceaccount/token. This token is a signed JWT that the API server validates against the TokenReview API, allowing the pod to authenticate as that service account.

Answer

Anonymous requests

Answer

Password file with usernames and passwords

Question 8

Which TWO of the following are valid methods to diagnose why a node is in 'NotReady' state?

Accepted Answer

Check the kubelet service logs using 'journalctl -u kubelet'. Checking kubelet logs (journalctl) and verifying the network plugin are both standard troubleshooting steps. Option C (checking API server) is not node-level. Option D (checking kube-proxy) is for service connectivity, not node readiness. Option A (restarting all containers) is not relevant.

Answer

Restart all containers on the node

Answer

Check the kube-apiserver logs on the control plane

Answer

Check kube-proxy configuration

Question 9

You are troubleshooting a node that is 'NotReady'. Which THREE of the following are possible causes? (Choose three.)

Accepted Answer

The kubelet cannot contact the API server. The kubelet is the primary node agent that communicates with the API server to report node status, heartbeats, and pod lifecycle events. If the kubelet cannot reach the API server (e.g., due to network partition, TLS certificate issues, or API server downtime), it cannot send the periodic NodeStatus updates, and the control plane marks the node as 'NotReady' after the `node-monitor-grace-period` (default 40 seconds) expires.

Answer

The node has disk pressure

Answer

A pod on the node is consuming excessive memory

Question 10

You have a pod that is in CrashLoopBackOff. Which two troubleshooting steps should you take first? (Choose two.)

Accepted Answer

kubectl describe pod pod-name. `kubectl describe pod pod-name` provides detailed information about the pod's current state, including recent events, container restart counts, and the reason for the CrashLoopBackOff (e.g., exit code 137 from OOMKill or 1 from application error). This is the first step to understand the root cause of the crash loop.

Answer

kubectl delete pod pod-name

Answer

kubectl exec -it pod-name -- sh

Answer

kubectl rollout restart deployment

Question 11

A node is in 'NotReady' state. Which TWO of the following are common causes? (Select 2)

Accepted Answer

The kubelet service has stopped on the node. Options C and E are correct. A node becomes 'NotReady' when the kubelet stops reporting its status (C) or when the network plugin (e.g., Calico, Flannel) fails, preventing pod networking (E). Option A (ImagePullBackOff) is a pod-level issue and does not affect node status. Option B (insufficient memory) leads to pod eviction but the node remains Ready if kubelet is healthy. Option D (API server down) affects the entire cluster, but nodes may still show Ready if kubelet is functioning.

Answer

A pod on the node is in ImagePullBackOff

Answer

The node has insufficient memory

Answer

The Kubernetes API server is down

Question 12

A pod is in 'Pending' state. 'kubectl describe pod' shows: '0/3 nodes are available: 1 Insufficient memory, 2 node(s) had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate.' Which THREE actions would resolve the issue? (Choose three)

Accepted Answer

Remove the taint from the control-plane nodes.. The pod cannot be scheduled because one node lacks memory and two nodes have a control-plane taint. Any single action that resolves either the memory issue (decreasing memory request) or the taint issue (removing taint or adding toleration) will make a node available. Since the question asks for three actions, A, B, and D are the correct choices as each independently resolves the scheduling block. Options C and E do not address the reported problems.

Answer

Increase the CPU request of the pod.

Answer

Add a node selector to the pod that matches the control-plane nodes.

Question 13

Which TWO of the following are valid commands to view cluster events sorted by timestamp?

Accepted Answer

kubectl get events. Options A and B are correct. 'kubectl get events' shows events sorted by last timestamp by default, which satisfies the requirement. 'kubectl get events --sort-by=.metadata.creationTimestamp' explicitly sorts by creation timestamp, also valid. Option C uses -w to watch, not sort. Option D sorts by name, not timestamp. Option E shows events from all namespaces but does not sort by timestamp.

Answer

kubectl get events -w

Answer

kubectl get events --sort-by=.metadata.name

Answer

kubectl get events --all-namespaces

Question 14

You run 'kubectl logs pod-name' and get no output. Which TWO steps should you take to troubleshoot further?

Accepted Answer

Run 'kubectl describe pod pod-name' to check container state and events. Run 'kubectl describe pod pod-name' (option C) to check container state and events, and 'kubectl logs --previous pod-name' (option D) to retrieve logs from the previous container instance if the pod restarted. These are the two most direct steps to troubleshoot missing logs.

Answer

Run 'kubectl get events --all-namespaces'

Answer

Run 'kubectl top pod pod-name' to check resource usage

Answer

Run 'kubectl exec pod-name -- cat /var/log/container.log'

Question 15

You are troubleshooting a node that shows 'NotReady' status. Which TWO commands can help you investigate the kubelet state?

Accepted Answer

journalctl -u kubelet. journalctl -u kubelet (C) retrieves kubelet logs from the systemd journal, showing errors and warnings. systemctl status kubelet (D) displays the current status of the kubelet service, including whether it is running, enabled, and recent log entries. The other options: 'kubectl get nodes' (A) shows node status but not kubelet details; 'journalctl -u docker' (B) shows container runtime logs, not kubelet; 'kubectl describe pod' (E) is for pod details, not node-level kubelet troubleshooting.

Answer

kubectl get nodes

Answer

journalctl -u docker

Answer

kubectl describe pod

Question 16

You want to check resource usage of pods and nodes. Which TWO commands should you use?

Accepted Answer

kubectl top pods. To check resource usage, use `kubectl top pods` (B) for pods and `kubectl top nodes` (C) for nodes. The incorrect options use invalid flags: `kubectl top pod --nodes` and `kubectl top node --containers` are not supported, making them syntactically invalid.

Answer

kubectl top pod --nodes

Answer

kubectl resource usage

Answer

kubectl top node --containers

Question 17

A pod is stuck in 'Pending' state. Which THREE are common causes for this?

Accepted Answer

Insufficient CPU or memory resources on any node. A pod stuck in 'Pending' state means it has not been scheduled to a node yet, or it cannot start due to missing dependencies. The three most common causes are: insufficient CPU/memory resources on any node (C) because the scheduler cannot find a node that satisfies the pod's resource requests; node taints that the pod does not tolerate (D) which prevent scheduling; and an unbound PersistentVolumeClaim (E) that the pod requires before it can start. Option A is incorrect because a node not registered would not normally lead to a pod being pending—it would simply not be considered for scheduling. Option B is incorrect because an incorrect container image name results in an ImagePullBackOff error, not a pending state.

Answer

Node not registered with the cluster

Answer

Container image name is incorrect

Question 18

A ClusterIP Service is not reachable from within the cluster. You verify that the Service has endpoints. Which of the following could be the cause? (Select two.)

Accepted Answer

kube-proxy is not running on the node.. Kube-proxy is responsible for implementing ClusterIP Service networking rules (iptables/IPVS) on each node; if it is not running, traffic to the Service's ClusterIP will not be forwarded to endpoints. Option B is correct because if the container is listening on a different port than the Service's targetPort, the connection will fail at the pod level. Option C is incorrect because a failing readiness probe would cause the pod to be removed from the Service's endpoints, contradicting the premise that the Service has endpoints. Option D is incorrect because service name length is not a factor for reachability (max is 63 characters).

Answer

The pod's readiness probe is failing.

Answer

The Service name is too long.

Question 19

Which two commands can be used to view the logs of a container that has crashed? (Choose two.)

Accepted Answer

kubectl logs pod-name --previous. To view the logs of a container that has crashed, you can use `kubectl logs pod-name` (Option E) to view the logs of the current container instance (even if it is currently in a terminated or waiting state), or `kubectl logs pod-name --previous` (Option B) to view the logs of the previous instance if the container has restarted.

`journalctl -u kubelet` (Option A) and `systemctl status kubelet` (Option D) show the logs and status of the kubelet system service itself, not the stdout/stderr of individual containers. `kubectl describe pod` (Option C) shows pod events and metadata but does not display the container's stdout/stderr logs.

Answer

journalctl -u kubelet

Answer

kubectl describe pod pod-name

Answer

systemctl status kubelet

Question 20

You are troubleshooting a scenario where a pod cannot communicate with another pod in the same namespace via service name. Which THREE steps would you take to diagnose the issue? (Select 3)

Accepted Answer

Run 'kubectl get endpoints' to verify the service has healthy endpoints. Options B, C, and E are correct. Checking endpoints (B) verifies the service has healthy pods. Exec into the pod and using curl (C) tests connectivity to the service's cluster IP. Exec into the pod and running nslookup (E) checks DNS resolution of the service name. Option A checks node status, which is not directly related to pod-to-pod communication via service name. Option D checks logs of the target pod, which may not reveal network issues.

Answer

Run 'kubectl get nodes' to check node status

Answer

Run 'kubectl logs' on the target pod to check application logs