CKA Practice Question: Cluster Architecture, Installation and Configuration
A node named 'worker-1' is unhealthy. You want to mark it as unschedulable and move workloads to other nodes. Which command sequence is correct?
⚠ Common exam trap
Candidates often confuse the order of `cordon` and `drain`, mistakenly thinking draining first is safe, but the CKA exam tests the understanding that cordoning must precede draining to prevent new pods from being scheduled onto the node during the eviction process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl cordon worker-1; kubectl drain worker-1
`kubectl cordon worker-1` marks the node as unschedulable, preventing new pods from being scheduled onto it, and `kubectl drain worker-1` safely evicts all existing pods from the node, respecting PodDisruptionBudgets and terminating pods gracefully. This sequence ensures workloads are moved to other nodes without disrupting running services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl uncordon worker-1; kubectl drain worker-1
Why it's wrong here
Running `kubectl uncordon` marks the node as schedulable by removing the unschedulable taint, which is the exact opposite of what is needed for an unhealthy node. This allows the control plane to schedule new workloads onto the failing node right before the drain operation begins. Consequently, this sequence defeats the purpose of isolating the node and can lead to scheduling churn or application downtime.
- ✓
kubectl cordon worker-1; kubectl drain worker-1
Why this is correct
This is the correct sequence because `kubectl cordon` immediately taints the node as unschedulable, ensuring no new workloads are assigned to it. Following this with `kubectl drain` safely evicts existing pods, forcing controllers to recreate them on healthy nodes. This orderly transition prevents race conditions where evicted pods are immediately rescheduled back onto the same failing node.
- ✗
kubectl delete node worker-1; kubectl cordon worker-1
Why it's wrong here
Deleting the node object directly from the API server is a destructive action that bypasses the graceful eviction process of running workloads. Furthermore, attempting to run `kubectl cordon` after deleting the node will fail entirely because the node resource no longer exists in the cluster state. This approach risks abrupt application outages and leaves orphaned pods in an undefined state.
- ✗
kubectl drain worker-1; kubectl cordon worker-1
Why it's wrong here
Initiating a drain before cordoning creates a critical race condition where the scheduler may immediately place the evicted pods back onto the same unhealthy node. Although `kubectl drain` implicitly cordons the node as its very first step, executing them as separate commands in this reversed order is logically flawed. If the drain command fails or is interrupted halfway through, the node remains uncordoned and open to new scheduling requests.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.