Courseiva

Certified Kubernetes Administrator CKA (CKA) — Questions 226–300

726 questions total · 10pages · All types, answers revealed

Page 3

Page 4 of 10

Page 5
226
MCQmedium

A Job named 'data-processor' completes successfully. You want to run it again with the same configuration. What is the correct way to rerun the Job?

A.Edit the Job with 'kubectl edit job data-processor' and change the template.
B.Delete the Job with 'kubectl delete job data-processor' and then recreate it.
C.Run 'kubectl rollout restart job data-processor'
D.Run 'kubectl rerun job data-processor'
AnswerB

A Job is immutable with respect to its pod template, so issuing `kubectl delete job data-processor` removes both the Job object and any completed Pods, and then `kubectl create job` (or `kubectl apply -f job.yaml`) creates a new Job resource that will schedule fresh Pods and run the template again. Without deletion, the old Job object's status and spec prevent an in-place rerun; a completed Job will never recreate its finished Pods.

Why this answer

A completed Job in Kubernetes is immutable and cannot be rerun by editing or restarting it. The only way to execute the same Job again is to delete the existing Job and recreate it with the same configuration, as Jobs are designed to run to completion and are not intended to be restarted like Deployments.

Exam trap

The trap here is that candidates confuse Jobs with Deployments or other controllers that support rolling updates and restarts, leading them to incorrectly apply commands like 'kubectl rollout restart' or assume editing the template will trigger a new run.

How to eliminate wrong answers

Option A is wrong because editing a completed Job's template does not trigger a new run; the Job's pod template is immutable after creation, and changes require deletion and recreation. Option C is wrong because 'kubectl rollout restart' is a command for Deployments, DaemonSets, and StatefulSets, not for Jobs, which do not support rolling updates or restarts. Option D is wrong because 'kubectl rerun' is not a valid kubectl command; Kubernetes does not provide a built-in command to rerun a Job.

227
Multi-Selectmedium

Which TWO of the following are valid access modes for a PersistentVolume in Kubernetes? (Select two.)

Select 2 answers
A.WriteMany
B.ReadOnlySingle
C.ReadWriteOnce
D.ReadWriteMany
E.ReadWriteOncePerNode
AnswersC, D

ReadWriteOnce (RWO) is a valid access mode that allows a volume to be mounted with read-write access on a single node. Multiple Pods running on that same node can concurrently use the volume, but while it is attached to that node, no other node can mount it. This mode is typical for block storage like AWS EBS or Google Persistent Disks, which are designed for single-node attachment and do not support multi-node reads or writes.

Why this answer

ReadWriteOnce (C) is a valid PersistentVolume access mode, meaning the volume can be mounted as read-write by a single node at a time. ReadWriteMany (D) is also valid, allowing the volume to be mounted as read-write by many nodes simultaneously. These are two of the four standard Kubernetes access modes, alongside ReadOnlyMany and ReadWriteOncePod.

WriteMany (A) is not a valid mode because the read/write distinction is missing. ReadOnlySingle (B) is invalid since the correct read-only mode is ReadOnlyMany. ReadWriteOncePerNode (E) is not a real access mode; the per-node semantics are already covered by ReadWriteOnce.

Exam trap

The trap here is that candidates confuse the valid access modes with similar-sounding but non-existent modes like 'WriteMany' or 'ReadWriteOncePerNode', which are not part of the Kubernetes API specification.

228
MCQhard

You have a pod that is CrashLoopBackOff. The logs show 'error: dial tcp: lookup service.default.svc.cluster.local: no such host'. What is the most likely cause?

A.The CoreDNS pod is down
B.The service 'service' does not exist in the 'default' namespace
C.The pod's DNS policy is set to 'None'
D.A network policy is blocking UDP port 53
AnswerB

The application's connection string or manifest refers to a Kubernetes Service by the DNS name "service", but no Service object with that name exists in the "default" namespace. When the pod attempts to resolve it, CoreDNS returns NXDOMAIN because no A/AAAA record has been created for a non-existent Service, so the application fails to connect to its required dependency and exits, causing Kubernetes to restart the pod in a CrashLoopBackOff state. This is a configuration error in the workload definition, not an infrastructure or DNS-server failure.

Why this answer

The error message 'no such host' indicates that the DNS lookup for 'service.default.svc.cluster.local' failed because the hostname does not exist. In Kubernetes, this FQDN resolves only if a Service named 'service' exists in the 'default' namespace. Since the lookup fails with 'no such host', the most likely cause is that the Service does not exist, not a DNS infrastructure issue.

Exam trap

The trap here is that candidates often assume any DNS error means CoreDNS is down, but the specific 'no such host' message points to a missing DNS record, not a DNS service failure.

Why the other options are wrong

A

While CoreDNS being down could cause this, the error is about a specific service name not found, not a generic DNS failure. More likely the service doesn't exist.

C

If DNS policy was None, the pod would not even attempt cluster DNS; the error shows it tried but failed.

D

Network policies block traffic; but DNS would likely timeout or connection refused, not 'no such host'.

229
MCQhard

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

A.Completed
B.Failed
C.Succeeded
D.Running
AnswerC

"Succeeded" is the correct phase for a Pod whose containers all exit with status 0 and whose restartPolicy is Never or OnFailure. The kubelet detects the clean exit and updates status.phase to Succeeded, indicating the container ran to completion without errors. This matches the given pod definition exactly, making it the correct answer.

Why this answer

When a pod's restartPolicy is set to 'Never' and its container exits with code 0 (indicating a successful termination), the pod transitions to the 'Succeeded' phase. This is because Kubernetes treats a zero exit code as a successful completion, and with restartPolicy: Never, no restart is attempted, leaving the pod in a terminal Succeeded state.

Exam trap

The trap here is that candidates confuse the 'Completed' status from kubectl get pods output (which is a human-readable shorthand) with the actual pod phase 'Succeeded', or they assume any exit means 'Failed' regardless of the exit code.

How to eliminate wrong answers

Option A is wrong because 'Completed' is not a valid Kubernetes pod phase; the correct phase for a successful termination is 'Succeeded'. Option B is wrong because 'Failed' applies only when the container exits with a non-zero exit code, not code 0. Option D is wrong because 'Running' indicates the container is still executing, but here the container has already exited.

230
MCQhard

You are troubleshooting a pod that cannot start. Running 'kubectl describe pod' shows the event: 'Failed to pull image "myregistry.io/myapp:1.0": rpc error: code = Unknown desc = Error response from daemon: manifest for myregistry.io/myapp:1.0 not found'. What is the MOST likely cause?

A.The registry is unreachable due to network issues
B.The image tag '1.0' does not exist in the registry
C.The image registry requires authentication and the imagePullSecret is missing
D.The image has been deleted from the registry
AnswerB

The 'manifest not found' error explicitly indicates that the container runtime successfully contacted the image registry but could not locate the specific image manifest associated with the requested tag '1.0'. This means the registry confirmed its existence but reported that no image with that precise tag is available. This is the most direct and accurate interpretation of the given error message, signifying the tag itself is absent.

Why this answer

The error message 'manifest for myregistry.io/myapp:1.0 not found' indicates that the registry successfully received the pull request but could not locate the specific image tag '1.0'. This is a manifest lookup failure, not a connectivity or authentication issue. The most likely cause is that the tag '1.0' does not exist in the repository, either because it was never pushed or was removed.

Exam trap

The trap here is that candidates confuse 'manifest not found' with network or authentication errors, but the specific wording of the error message directly points to a missing tag in the registry, not connectivity or credentials.

How to eliminate wrong answers

Option A is wrong because network issues would produce a different error, such as 'dial tcp: lookup myregistry.io: no such host' or 'connection refused', not a manifest-not-found error. Option C is wrong because missing authentication would result in a 'denied: requested access to the resource is denied' or 'unauthorized: authentication required' error, not a manifest-not-found error. Option D is wrong because if the image had been deleted from the registry, the registry would typically still have the manifest metadata and would return a 'not found' for the blob, but the error specifically says 'manifest not found', which means the tag itself is missing—this is functionally the same as the tag never existing, but the phrasing 'deleted' implies the tag existed before, which is less likely given the exact error message; however, the most precise cause is that the tag does not exist in the registry's index.

231
MCQeasy

What is the default kube-proxy mode in Kubernetes v1.29?

A.nftables
B.userspace
C.iptables
D.ipvs
AnswerC

iptables is the default kube-proxy mode in Kubernetes v1.29, using legacy netfilter rules to implement Service load balancing. kube-proxy programs iptables chains with rules that use the statistic matching module to select backend Pods with random probability. This approach provides efficient in-kernel NAT and load balancing without requiring a separate proxy process for each connection, which is why it remains the standard.

Why this answer

In Kubernetes v1.29, the default kube-proxy mode is `iptables`. This mode uses Linux iptables rules to handle service traffic, providing better performance and reliability than the older userspace mode. It is the default because it balances simplicity and efficiency for most cluster configurations.

Exam trap

The trap here is that candidates may confuse the default mode with the most advanced or performant option (like ipvs), or mistakenly think nftables is the default because it is the modern replacement for iptables in Linux, but Kubernetes v1.29 still defaults to iptables.

How to eliminate wrong answers

Option A is wrong because `nftables` is not a supported kube-proxy mode in Kubernetes v1.29; it is a newer Linux packet filtering framework that may be used in future versions but is not the default. Option B is wrong because `userspace` was the default mode in early Kubernetes versions (pre-v1.2) but was deprecated due to high overhead and is no longer the default. Option D is wrong because `ipvs` is an optional mode that provides better performance for large-scale clusters but is not the default; it must be explicitly configured via the `--proxy-mode=ipvs` flag or kube-proxy configuration.

232
MCQeasy

Which Service type exposes a Service externally via a cloud provider's load balancer?

A.ExternalName
B.LoadBalancer
C.ClusterIP
D.NodePort
AnswerB

This service type integrates directly with cloud providers to automatically provision a native external load balancer, such as an AWS NLB/ALB or GCP Cloud Load Balancer. It assigns a public IP address or DNS name to the service, routing external internet traffic directly to the underlying NodePort and ClusterIP configurations.

Why this answer

(LoadBalancer) is correct because the LoadBalancer Service type automatically provisions an external load balancer from the underlying cloud provider (e.g., AWS ELB, GCP TCP/UDP Load Balancer, Azure Load Balancer) and assigns a public IP or DNS name to expose the Service externally. This is achieved by the cloud-controller-manager component, which watches for Services of type LoadBalancer and creates the corresponding cloud resource.

Exam trap

The CKA exam often tests the distinction between NodePort and LoadBalancer, trapping candidates who think NodePort alone provides external cloud load balancing, when in fact NodePort only opens a port on each node and requires an external load balancer or manual routing to be truly accessible from outside.

How to eliminate wrong answers

Option A (ExternalName) is wrong because it maps a Service to a DNS name (via CNAME) and does not expose any ports or provide load balancing; it is used for internal DNS aliasing, not external exposure. Option C (ClusterIP) is wrong because it assigns a virtual IP reachable only within the cluster (via kube-proxy iptables/IPVS rules) and is not accessible from outside the cluster without additional components. Option D (NodePort) is wrong because it exposes the Service on a static port on each Node's IP address, but it does not integrate with a cloud provider's load balancer; it is a lower-level mechanism that requires manual configuration or an external load balancer to route traffic to the NodePort.

233
MCQmedium

Which of the following volume types provides ephemeral storage that shares the pod's lifecycle and is initially empty?

A.secret
B.emptyDir
C.configMap
D.hostPath
AnswerB

An `emptyDir` volume is created when the pod is scheduled and deleted permanently when the pod is removed, satisfying the shared-lifecycle constraint. Its contents start empty and persist across container restarts within that pod, unlike `hostPath`, which survives pod deletion by binding to the node's filesystem.

Why this answer

B is correct because an `emptyDir` volume is created empty when a Pod is assigned to a node and exists as long as that Pod is running. It provides ephemeral storage that shares the Pod's lifecycle, meaning it is deleted when the Pod is removed, and it is initially empty, making it ideal for scratch space, caching, or temporary data.

Exam trap

The trap here is that candidates often confuse `emptyDir` with `hostPath` or `configMap`, mistakenly thinking that any volume that is initially empty must be a `configMap` or that `hostPath` provides ephemeral storage, when in fact `emptyDir` is the only volume type that is both ephemeral and initially empty by design.

How to eliminate wrong answers

Option A is wrong because a `secret` volume is used to inject sensitive data (e.g., passwords, tokens) into a Pod, not for ephemeral storage; it is populated from the Kubernetes API and is not initially empty. Option C is wrong because a `configMap` volume provides configuration data from ConfigMap objects, not ephemeral storage; it is also pre-populated with key-value pairs and shares the Pod's lifecycle but is not initially empty. Option D is wrong because a `hostPath` volume mounts a file or directory from the host node's filesystem into the Pod, persisting beyond the Pod's lifecycle and not being initially empty; it is not ephemeral and does not share the Pod's lifecycle.

234
Multi-Selectmedium

A node is 'NotReady'. Which THREE steps should you take to troubleshoot?

Select 3 answers
A.Check the kube-apiserver logs on the control plane
B.Reboot the node immediately
C.Check kubelet logs with 'journalctl -u kubelet'
D.SSH to the node and run 'systemctl status kubelet'
E.Run 'kubectl describe node <node-name>' to see conditions
AnswersC, D, E

The kubelet is the node agent that registers the node, runs pods, and continuously posts its status and heartbeat to the control plane, so its logs are the definitive source for why it stopped functioning. Running 'journalctl -u kubelet' reveals systemd unit output including fatal errors like failure to connect to the container runtime via the CRI socket, expired certificates, or resource exhaustion. You can also use '--since' or '-f' to focus on the time the node became NotReady and to watch for live errors, making this a primary diagnostic step.

Why this answer

Option C is correct because when a node reports NotReady, the kubelet is the primary agent responsible for reporting node status, so inspecting its logs with 'journalctl -u kubelet' reveals errors such as failed certificate rotation, container runtime connectivity issues, or PLEG problems. Option D is correct because 'systemctl status kubelet' on the node quickly shows whether the kubelet service is active, failed, or crash-looping, which is a fundamental first check for a NotReady node. Option E is correct because 'kubectl describe node <node-name>' displays the node's Conditions (Ready, MemoryPressure, DiskPressure, PIDPressure) and events, giving the exact reason and timestamp for the NotReady state.

Option A is not appropriate because kube-apiserver logs on the control plane do not diagnose why a specific node's kubelet stopped posting status; the API server merely reflects the missing heartbeats. Option B is not appropriate because rebooting the node immediately is a disruptive action that destroys diagnostic state and should only be done after evidence is gathered, not as a troubleshooting step.

235
MCQmedium

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

A.Service of type ClusterIP
B.NetworkPolicy
C.Service of type NodePort
D.Ingress
AnswerD

Ingress is the standard Kubernetes API object for L7 HTTP routing, allowing you to define host- and path-based rules that direct traffic to multiple backend Services. A single Ingress controller receives external traffic on one IP (often via a load balancer) and routes each request to the appropriate Service based on the URL path. This exactly fulfills the requirement of exposing multiple HTTP services on a single IP address.

Why this answer

Ingress is the correct resource because it provides HTTP/HTTPS layer-7 routing to multiple services based on hostnames or paths, all exposed on a single IP address. Services of type ClusterIP, NodePort, or LoadBalancer operate at layer 4 and cannot perform path-based routing. An Ingress controller (e.g., NGINX, HAProxy) implements the rules defined in the Ingress resource to direct traffic to the appropriate backend services.

Exam trap

The trap here is that candidates confuse Ingress with Service types like NodePort or LoadBalancer, thinking those can handle HTTP routing, but they only provide layer-4 load balancing without any awareness of HTTP paths or hostnames.

How to eliminate wrong answers

Option A is wrong because a Service of type ClusterIP is only reachable within the cluster and does not provide external access or path-based routing. Option B is wrong because NetworkPolicy controls traffic flow between pods at the network layer (layer 3/4) and cannot expose services or perform HTTP path routing. Option C is wrong because a Service of type NodePort exposes a static port on each node's IP at layer 4 (TCP/UDP) and cannot route based on HTTP paths or hostnames.

236
MCQmedium

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

A.The egress rule has a typo in the IP block
B.The pods are not running
C.NetworkPolicy egress rules deny all traffic by default unless explicitly allowed
D.The CNI plugin does not support egress rules
AnswerC

When a `NetworkPolicy` is applied to pods and includes an `egress` section, the default behavior for those pods' outbound traffic immediately switches from "allow all" to "deny all." Any egress traffic not explicitly matched by one of the `egress` rules within that policy will be dropped. Therefore, if the newly added egress rule does not explicitly permit the necessary external IPs, all external traffic will be blocked by default.

Why this answer

NetworkPolicy in Kubernetes follows a default-deny model for traffic. When any egress rule is added to a NetworkPolicy, it implicitly denies all egress traffic that is not explicitly allowed by that rule. Therefore, if the egress rule does not include a rule allowing traffic to external IPs (e.g., via an IPBlock or a namespace selector), those destinations become unreachable.

This is by design, as NetworkPolicies are additive whitelists.

Exam trap

The trap here is that candidates often assume egress rules are additive (i.e., they only allow traffic without affecting existing connectivity), but Kubernetes NetworkPolicy egress rules are whitelist-only, meaning any egress rule implicitly denies all other egress traffic.

How to eliminate wrong answers

Option A is wrong because a typo in the IP block would cause a mismatch, but the question states the pods can no longer reach external IPs at all, which is a broader symptom consistent with default-deny behavior, not a typo. Option B is wrong because if the pods were not running, they would not be able to reach any IPs at all, and the question implies they were previously able to reach external IPs before the update. Option D is wrong because most CNI plugins (e.g., Calico, Cilium, Weave) support egress rules; the CKA exam assumes a standard CNI that supports NetworkPolicy, and lack of support would typically cause no enforcement, not a sudden block.

237
MCQmedium

A team is designing a storage solution for a Cassandra cluster on Kubernetes. Each pod must have its own dedicated storage, and the cluster must be able to scale up and down dynamically. Which Kubernetes resource should be used to manage the storage?

A.ReplicaSet with emptyDir volumes
B.DaemonSet with hostPath volumes
C.StatefulSet with a volumeClaimTemplate
D.Deployment with a single PersistentVolume shared by all pods
AnswerC

StatefulSets are specifically designed for stateful applications like Cassandra that require stable network identifiers and persistent, dedicated storage. By utilizing a volumeClaimTemplate, Kubernetes automatically provisions a unique PersistentVolumeClaim (PVC) for each Pod replica, ensuring that even if a Pod is rescheduled, it reconnects to its exact corresponding volume.

Why this answer

StatefulSet is the correct choice because it provides stable, unique network identities and dedicated storage for each pod via a volumeClaimTemplate. This ensures each Cassandra pod gets its own PersistentVolume, which is essential for stateful applications that require data persistence and ordered scaling. The volumeClaimTemplate automatically provisions a unique PersistentVolumeClaim for each replica, enabling dynamic scaling up and down while preserving data integrity.

Exam trap

The trap here is that candidates often choose Deployment with a shared PersistentVolume, mistakenly thinking it simplifies management, but they overlook the need for dedicated, persistent storage per pod and the ordered scaling guarantees that only StatefulSet provides.

How to eliminate wrong answers

Option A is wrong because emptyDir volumes are ephemeral and tied to the pod's lifecycle; data is lost when the pod is deleted, making it unsuitable for a Cassandra cluster that requires persistent storage. Option B is wrong because hostPath volumes bind to a specific node's filesystem, which prevents dynamic scaling and can cause data inconsistency if pods are rescheduled to different nodes; DaemonSets also run one pod per node, not suitable for a scalable Cassandra cluster. Option D is wrong because a single PersistentVolume shared by all pods would create a single point of failure and contention, violating the requirement for each pod to have its own dedicated storage; Deployments also do not guarantee stable pod identities or ordered scaling needed for stateful applications.

238
MCQeasy

You are a cluster administrator managing a production Kubernetes cluster that hosts a stateful application using StatefulSets with PersistentVolumeClaims (PVCs) backed by a cloud provider's persistent disk. A developer reports that a new pod in the StatefulSet is stuck in 'Pending' state. You describe the StatefulSet and see that it has 3 replicas. Two pods are Running, but the third pod (pod-2) is Pending. You check the PVC for pod-2 and see it is 'Pending'. The StorageClass uses 'WaitForFirstConsumer' volume binding mode. The node where pod-2 should run has sufficient resources. Other PVCs in the same namespace bound successfully. What is the most likely cause of the pending PVC and pod?

A.The PV that should bind to the PVC has a nodeAffinity that does not match any available node.
B.The CSI driver is not installed on the node where pod-2 is scheduled.
C.The PVC's requested storage size exceeds the available capacity in the cloud provider's quota.
D.The PVC's access mode is ReadWriteOnce, but the pod requires ReadWriteMany.
AnswerA

When a PersistentVolumeClaim (PVC) uses the WaitForFirstConsumer binding mode, the selection or provisioning of a PersistentVolume (PV) is delayed until a pod requiring that PVC is scheduled. If the selected PV has nodeAffinity rules that do not match the node where pod-2 was scheduled, the volume attachment will fail. This mismatch prevents the volume from being mounted, causing pod-2 to remain in a Pending state, unable to start its containers.

Why this answer

With 'WaitForFirstConsumer' volume binding mode, the PVC binding is deferred until a pod using it is scheduled. The PV that should bind to the PVC has a nodeAffinity that does not match any available node, preventing the scheduler from binding the PVC and scheduling the pod. This results in both the PVC and pod remaining in 'Pending' state, even though the node has sufficient resources.

Exam trap

The trap here is that candidates often assume a Pending PVC is always due to insufficient storage capacity or quota, ignoring the impact of volume binding modes and nodeAffinity constraints on scheduling.

How to eliminate wrong answers

Option B is wrong because the CSI driver must be installed on all nodes that can run pods using the CSI driver; if it were missing on the scheduled node, the pod would fail with a different error (e.g., 'FailedMount'), not remain Pending due to an unbounded PVC. Option C is wrong because if the requested storage size exceeded the cloud provider's quota, the PVC would likely fail with a specific error (e.g., 'ProvisioningFailed') rather than remain Pending, and other PVCs in the same namespace bound successfully, indicating quota is not the issue. Option D is wrong because ReadWriteOnce is the default access mode for most cloud persistent disks and is compatible with StatefulSet pods; ReadWriteMany would be required only if multiple pods need to write simultaneously to the same volume, which is not the case here.

239
MCQhard

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

A.Has no effect because NetworkPolicy requires at least one rule
B.Denies all ingress and egress traffic to all pods in the namespace
C.Denies only ingress traffic to pods labeled 'app: denied'
D.Allows all traffic because no rules are specified
AnswerB

This is correct because an empty podSelector matches every pod within the target namespace. By defining both Ingress and Egress in the policyTypes list without providing any corresponding allow rules, the policy enforces a strict default-deny posture for all incoming and outgoing network traffic.

Why this answer

A NetworkPolicy with an empty `podSelector` selects all pods in the namespace. When no rules are specified, the policy defaults to denying all ingress and egress traffic because NetworkPolicy rules are whitelist-based: if no rule allows traffic, all traffic is denied. This effectively isolates the namespace by blocking all network traffic to and from every pod.

Exam trap

The trap here is that candidates assume an empty rule set means 'allow all' or that a podSelector must match specific labels, but in Kubernetes NetworkPolicy, an empty podSelector selects all pods and no rules means deny all traffic.

How to eliminate wrong answers

Option A is wrong because a NetworkPolicy with an empty podSelector and no rules is valid and has the effect of denying all traffic; it does not require at least one rule to take effect. Option C is wrong because an empty podSelector selects all pods, not just those with a specific label like 'app: denied', and the policy denies all traffic, not just ingress. Option D is wrong because the absence of rules means no traffic is allowed, not that all traffic is allowed; NetworkPolicy uses a default-deny model when no rules match.

240
MCQeasy

Which command creates a Job that runs a single pod to execute the command 'echo Hello'?

A.kubectl create job hello --image=busybox -- echo Hello
B.kubectl create cronjob hello --image=busybox -- echo Hello
C.kubectl create deployment hello --image=busybox -- echo Hello
D.kubectl run job hello --image=busybox -- echo Hello
AnswerA

The `kubectl create job` command is the correct imperative way to create a Kubernetes Job object named `hello`. It uses the busybox image and passes `echo Hello` as the container's command, and since a Job's default completion count is 1, the Job controller schedules one Pod that runs to successful exit. This Job-managed Pod is automatically restarted or recreated if it fails, fulfilling the requirement of a single Pod execution to completion.

Why this answer

`kubectl create job` is the dedicated command to create a Kubernetes Job object, which runs a pod to completion. The `--image=busybox` specifies the container image, and the `-- echo Hello` passes the command and its arguments to the container's entrypoint. This creates a non-repeating Job that executes the command once.

Exam trap

The trap here is that candidates confuse `kubectl create job` with `kubectl run` or `kubectl create cronjob`, mistakenly thinking a one-time task can be created with a deployment or cronjob syntax, or that `kubectl run` supports a 'job' subcommand.

How to eliminate wrong answers

Option B is wrong because `kubectl create cronjob` creates a CronJob, which schedules Jobs on a recurring basis, not a one-time Job. Option C is wrong because `kubectl create deployment` creates a Deployment, which manages a ReplicaSet to ensure a specified number of pods run continuously, not a single-run Job. Option D is wrong because `kubectl run job` is not a valid command; `kubectl run` can create a pod or deployment, but not a Job directly, and the syntax `kubectl run job` is incorrect.

241
MCQmedium

A pod is in ImagePullBackOff state. Which command is MOST useful to diagnose the issue?

A.kubectl logs <pod-name>
B.kubectl exec <pod-name> -- ls
C.kubectl get events --field-selector type=Warning
D.kubectl describe pod <pod-name>
AnswerD

kubectl describe pod is the correct and most useful command because it displays the pod's complete status, conditions, container states, and recent events in one place, including the exact kubelet-generated error from the failed image pull. This output reveals crucial details such as the image name/tag, whether the registry returned a 'manifest unknown' error, an authentication failure, or a network issue, and shows the exponential backoff timing, enabling a precise root-cause diagnosis.

Why this answer

`kubectl describe pod <pod-name>` provides detailed pod status, including the exact reason for ImagePullBackOff (e.g., invalid image name, registry authentication failure, or network issues). It surfaces the underlying error message from the kubelet, such as 'Failed to pull image' or 'manifest not found', which directly points to the root cause.

Exam trap

The trap here is that candidates often assume `kubectl logs` is the universal diagnostic tool, but it fails for pre-start states like ImagePullBackOff, where the container never runs to produce logs.

How to eliminate wrong answers

Option A is wrong because `kubectl logs` retrieves container logs, but ImagePullBackOff occurs before the container starts, so there are no logs to fetch. Option B is wrong because `kubectl exec` requires a running container to execute commands, but a pod in ImagePullBackOff never reaches the running state. Option C is wrong because `kubectl get events --field-selector type=Warning` may show related warnings, but it is less specific to the pod and may miss the exact error message; `kubectl describe pod` directly includes the relevant event in its output.

242
MCQhard

You run 'kubectl get pods' and see a pod with status 'ImagePullBackOff'. Which of the following is a possible cause?

A.The node has a disk pressure condition
B.The pod's resource limits are too low
C.The container image name is misspelled
D.The pod's liveness probe is failing
AnswerC

The ImagePullBackOff status indicates that the kubelet tried to pull the image from the repository but the attempt failed and it is backing off with exponential retry delay. A misspelled image name means the registry cannot find a matching repository or tag, often returning a 404 or 'manifest unknown' error, which leaves the kubelet in this backoff loop. For example, specifying 'ngin:x' instead of 'nginx:latest' will surface as ImagePullBackOff; fixing the typo and re-pulling resolves it.

Why this answer

The correct answer is C: the container image name is misspelled. ImagePullBackOff means the kubelet failed to pull the container image and is backing off before retrying, which commonly happens when the image reference is invalid, such as a typo in the image name or tag, or when the image does not exist in the registry. Option A is incorrect because disk pressure on a node typically causes Evicted pods or a DiskPressure node condition, not ImagePullBackOff.

Option B is incorrect because insufficient resource limits usually lead to Pending scheduling or OOMKilled states, not image pull failures. Option D is incorrect because a failing liveness probe causes container restarts and a CrashLoopBackOff-like state, not an image pull error.

243
MCQmedium

You try to run 'kubectl logs mypod' and get the error: 'Error from server (BadRequest): container "myapp" in pod "mypod" is waiting to start: PodInitializing'. What does this mean?

A.The pod has crashed and is restarting.
B.The kubelet is not running on the node.
C.The container has a different name than specified.
D.The pod is still being initialized and the container has not started yet.
AnswerD

This is correct because during the PodInitializing phase, the pod's init containers are still executing, meaning the primary application containers have not yet been created or started by the container runtime. Because the target application container does not exist in a running or terminated state yet, the kubelet cannot stream any log output, resulting in a waiting to start error.

Why this answer

The error message 'container "myapp" in pod "mypod" is waiting to start: PodInitializing' indicates that the pod's init containers (if any) are still running or the container runtime is pulling the image and setting up the container. The container has not yet entered the 'Running' state, so logs cannot be retrieved until it starts. This is a standard Kubernetes lifecycle phase where the pod is in 'PodInitializing' status, meaning the main container is not ready to serve logs.

Exam trap

The trap here is that candidates confuse 'PodInitializing' with a crash or restart loop, but the key distinction is that 'PodInitializing' is a transient startup phase, not a failure state, and logs are unavailable until the container actually starts.

How to eliminate wrong answers

Option A is wrong because 'PodInitializing' does not indicate a crash loop; a crashed container would show 'CrashLoopBackOff' or 'Error' status, not 'PodInitializing'. Option B is wrong because if the kubelet were not running, the pod would not be scheduled or would show 'NodeLost' or 'Unknown' status, not a specific container-level initialization error. Option C is wrong because the error explicitly names the container 'myapp', confirming the container name matches the one in the pod spec; a name mismatch would produce a different error like 'container "myapp" is not valid' or 'not found'.

244
MCQmedium

A pod in the 'production' namespace is in CrashLoopBackOff state. Running 'kubectl describe pod web-app -n production' shows the event 'OOMKilled'. What is the most appropriate action to resolve this issue?

A.Increase the CPU request for the container
B.Delete the namespace and redeploy
C.Increase the memory limit in the container spec
D.Delete and recreate the pod
AnswerC

The container was OOMKilled because its memory footprint hit the hard memory limit set in the container spec, and the Linux OOM killer terminated it to protect the node. Increasing the memory limit (and, if applicable, the memory request) gives the container more headroom under its cgroup, so it can allocate the additional memory it needs without being killed. This is the direct fix: update the Deployment or Pod template with a higher memory limit, which triggers a rolling update to apply the new limit.

Why this answer

OOMKilled means the container exceeded its memory limit. Increasing the memory limit is the correct fix.

245
MCQmedium

You need to check the memory usage of all pods in the 'production' namespace. Which command fulfills this requirement?

A.kubectl get pod --namespace=production -o wide
B.kubectl describe pod --namespace=production
C.kubectl top node
D.kubectl top pod --namespace=production
AnswerD

kubectl top pod --namespace=production is the correct kubectl command because it directly queries the metrics-server, which receives its data from kubelet cAdvisor, and returns the current CPU and memory usage for every pod in the production namespace. This is the only option among the four that actually measures live runtime memory consumption per pod, exactly satisfying the requirement. It produces a table with columns for NAME, CPU(cores), and MEMORY(bytes); note that without an explicit --namespace flag, kubectl top pod would default to the current namespace, so specifying production is essential.

Why this answer

`kubectl top pod --namespace=production` directly queries the metrics-server to retrieve real-time CPU and memory usage for each pod in the specified namespace. This command leverages the Kubernetes Metrics API to display resource consumption, making it the precise tool for checking memory usage of pods.

Exam trap

The trap here is that candidates confuse `kubectl describe` (which shows resource requests/limits but not actual usage) with `kubectl top` (which shows live consumption), or they mistakenly think `kubectl get pod -o wide` includes resource metrics.

How to eliminate wrong answers

Option A is wrong because `kubectl get pod -o wide` only shows pod metadata and node assignment, not memory usage metrics. Option B is wrong because `kubectl describe pod` provides detailed pod configuration and status, but does not include real-time memory usage data from the metrics-server. Option C is wrong because `kubectl top node` displays resource usage at the node level, not per-pod, and does not filter by namespace.

246
MCQhard

A pod cannot resolve a service DNS name. The cluster uses CoreDNS. Which of the following is the most likely cause if the pod's /etc/resolv.conf contains 'nameserver 10.96.0.10' and the CoreDNS pod is running?

A.The CoreDNS ConfigMap does not have the correct cluster domain.
B.The pod's DNS policy is set to 'Default'.
C.The CoreDNS pod is in CrashLoopBackOff.
D.The service's DNS name is misspelled.
AnswerA

CoreDNS's kubernetes plugin reads a ConfigMap (typically named 'coredns' in the kube-system namespace) to determine the cluster domain, usually 'cluster.local.' If the 'kubernetes' block in that ConfigMap specifies a mismatched or missing domain, CoreDNS will not append the correct search domain, so fully qualified service names like 'my-svc.my-ns.svc.cluster.local' will fail to resolve. Since the pod is running, a static misconfiguration in the ConfigMap is a primary suspect and directly explains the symptom.

Why this answer

If the CoreDNS ConfigMap does not specify the correct cluster domain (e.g., `cluster.local`), CoreDNS will not respond to queries for service DNS names within that domain. The pod's `resolv.conf` shows the correct ClusterIP of the CoreDNS service (10.96.0.10), and the CoreDNS pod is running, so the issue is likely a misconfiguration in the CoreDNS plugin settings, specifically the `kubernetes` plugin's `clusterDomain` parameter.

Exam trap

The trap here is that candidates assume a running CoreDNS pod and correct `nameserver` IP guarantee DNS resolution, overlooking that CoreDNS must be configured with the correct cluster domain to handle service DNS names.

How to eliminate wrong answers

Option B is wrong because setting the pod's DNS policy to 'Default' means the pod inherits the node's `/etc/resolv.conf`, which typically points to the cluster's DNS service (10.96.0.10) anyway, so it would not prevent DNS resolution. Option C is wrong because the question explicitly states the CoreDNS pod is running, so CrashLoopBackOff is not the cause. Option D is wrong because while a misspelled DNS name would cause resolution failure, the question asks for the most likely cause given the pod's resolv.conf is correct and CoreDNS is running; a configuration error in CoreDNS is a more systematic issue than a simple typo.

247
MCQeasy

Which command is used to take a snapshot of etcd using etcdctl?

A.etcdctl dump
B.etcdctl snapshot create
C.etcdctl snapshot save
D.etcdctl backup
AnswerC

This is the correct and official command used by etcdctl, specifically in API version 3, to write a point-in-time snapshot of the etcd database to a specified file. Administrators must typically provide additional flags such as endpoints, cacert, cert, and key to authenticate against the secure etcd cluster before executing this command.

Why this answer

`etcdctl snapshot save` is the official command to create a point-in-time snapshot of an etcd datastore, which is essential for backup and disaster recovery in Kubernetes clusters. This command writes the snapshot to a specified file path, preserving all keys and metadata for later restoration via `etcdctl snapshot restore`.

Exam trap

The trap here is that candidates may confuse the `snapshot save` command with the non-existent `snapshot create` or the deprecated `backup` command from etcd v2, leading them to pick a plausible-sounding but incorrect option.

How to eliminate wrong answers

Option A is wrong because `etcdctl dump` is not a valid etcdctl subcommand; it may be confused with `etcdctl get` or `etcdctl watch` but does not exist for snapshotting. Option B is wrong because `etcdctl snapshot create` is not a valid command; the correct subcommand is `snapshot save`, not `create`. Option D is wrong because `etcdctl backup` is not a valid etcdctl command; the `backup` subcommand was used in older etcd v2 but has been replaced by `snapshot save` in etcd v3, which is the version used in modern CKA environments.

248
Multi-Selecteasy

Which TWO of the following kubectl commands can be used to view the logs of a container in a pod? (Choose two.)

Select 2 answers
A.kubectl describe pod pod-name
B.kubectl logs pod-name
C.kubectl exec pod-name -- logs
D.kubectl get pod pod-name -o yaml
E.kubectl logs pod-name --previous
AnswersB, E

This is the standard command used to retrieve the stdout and stderr streams from the primary container running inside a pod. If the pod contains multiple containers, you must specify the target container using the `-c` or `--container` flag, otherwise it defaults to the first container defined in the spec.

Why this answer

Option B, `kubectl logs pod-name`, is correct because the `kubectl logs` command is the dedicated subcommand for retrieving the stdout/stderr output of a container in a pod, and with a single container it defaults to that container. Option E, `kubectl logs pod-name --previous`, is also correct because the `--previous` (or `-p`) flag retrieves the logs from the previous, terminated instance of the container in the pod, which is still a valid way to view container logs. Option A, `kubectl describe pod pod-name`, is not correct because describe shows pod metadata, events, and status, not the container's log stream.

Option C, `kubectl exec pod-name -- logs`, is not correct because it attempts to run a `logs` binary inside the container rather than using the Kubernetes logs API. Option D, `kubectl get pod pod-name -o yaml`, is not correct because it only outputs the pod's YAML manifest/status, not its container logs.

Exam trap

The trap here is that candidates may confuse `kubectl exec` with `kubectl logs`, thinking they can run a 'logs' command inside the container, or they may mistakenly believe `kubectl describe` includes log output, when in fact it only shows events and container state.

249
MCQhard

A Pod is in 'CrashLoopBackOff' state. You run 'kubectl logs <pod> --previous' and see an error about a missing environment variable. The Pod spec defines the environment variable in a ConfigMap. What is the best next step to diagnose the issue?

A.Use 'kubectl exec -it <pod> -- env' to list environment variables
B.Run 'kubectl get configmap <configmap-name>' to verify the ConfigMap exists and contains the expected key
C.Increase the pod's memory limit to prevent OOM
D.Check the node's kubelet logs for errors
AnswerB

If a container crashes due to a missing environment variable sourced from a ConfigMap, verifying the existence of the target ConfigMap and its keys using kubectl get configmap is the correct troubleshooting step. This confirms whether the reference in the Pod specification is valid and populated.

Why this answer

The first step in diagnosing a missing environment variable that should come from a ConfigMap is to verify that the ConfigMap itself exists and contains the expected key. If the ConfigMap is missing or the key is absent, the Pod will fail to start or crash, leading to CrashLoopBackOff. Running 'kubectl get configmap' directly confirms whether the resource is present and correctly populated, which is the most efficient next step before deeper investigation.

Exam trap

The trap here is that candidates may jump to 'kubectl exec' to inspect environment variables, forgetting that a crashed Pod cannot be exec'd into, and instead should first verify the ConfigMap resource that the Pod depends on.

How to eliminate wrong answers

Option A is wrong because 'kubectl exec -it <pod> -- env' requires the Pod to be running, but a Pod in CrashLoopBackOff is not in a running state, so exec will fail. Option C is wrong because increasing memory limits addresses OOMKilled scenarios, not missing environment variables; the error message explicitly points to a missing variable, not resource exhaustion. Option D is wrong because checking node kubelet logs is a low-level diagnostic step for node-level issues (e.g., CNI, kubelet failures), not for Pod-level configuration errors like a missing ConfigMap key.

250
MCQmedium

Which component is responsible for maintaining network rules on each node?

A.kube-controller-manager
B.etcd
C.kube-proxy
D.kubelet
AnswerC

kube-proxy is a network daemon that runs on each node to implement the Kubernetes Service abstraction. It monitors the API server for changes to Service and EndpointSlice objects, translating those definitions into active network rules using backend technologies like iptables or IPVS. This mechanism ensures that traffic directed to a Service's virtual IP is correctly load-balanced and routed to the appropriate backend pods.

Why this answer

C is correct because kube-proxy is the component responsible for maintaining network rules on each node. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates iptables, IPVS, or other rules to route traffic to the appropriate Pods. This ensures that network policies and service load balancing are enforced at the node level.

Exam trap

The trap here is confusing kubelet with kube-proxy, as both run on each node, but kubelet manages Pod lifecycle while kube-proxy manages network rules and service routing.

How to eliminate wrong answers

Option A is wrong because kube-controller-manager runs controller loops (e.g., ReplicaSet, Deployment, Node) but does not manage per-node network rules. Option B is wrong because etcd is a distributed key-value store used for cluster state, not for maintaining network rules on nodes. Option D is wrong because kubelet is the primary node agent that manages Pods and containers, but it does not handle network rule enforcement (that is kube-proxy's role).

251
Multi-Selectmedium

Which TWO commands can be used to interact with etcd snapshot operations? (Select TWO.)

Select 2 answers
A.etcdctl import
B.etcdctl snapshot restore
C.etcdctl migrate
D.etcdctl snapshot save
E.etcdctl backup
AnswersB, D

etcdctl snapshot restore is the correct command to recover etcd data from a previously saved snapshot. It creates a new etcd data directory from the snapshot file, and can be used with flags such as --name, --initial-cluster, and --initial-advertise-peer-urls to configure a restored member for a new cluster. This is the standard approach for disaster recovery or migrating an etcd cluster to a new set of nodes.

Why this answer

Option B, `etcdctl snapshot restore`, is correct because it is the etcdctl subcommand used to rebuild an etcd member's data directory from a previously taken snapshot file, typically with flags such as --data-dir and --initial-cluster. Option D, `etcdctl snapshot save`, is correct because it is the etcdctl subcommand that creates a point-in-time snapshot of the etcd key-value store and writes it to a file for backup purposes. Both commands belong to the `snapshot` subcommand group in etcdctl and are the standard tools for backup and recovery of etcd data.

Option A, `etcdctl import`, is not a valid etcdctl snapshot operation, and option E, `etcdctl backup`, was a legacy command that has been replaced by `etcdctl snapshot save`. Option C, `etcdctl migrate`, is used to migrate etcd data formats or versions, not to perform snapshot save or restore operations.

Exam trap

The trap here is that candidates may confuse `etcdctl snapshot save` with the non-existent `etcdctl backup` command, or think `etcdctl migrate` is related to snapshot operations when it is actually for version migration.

252
MCQmedium

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

A.ServiceAccount
B.Secret
C.ConfigMap
D.ClusterRoleBinding
AnswerA

A ServiceAccount supplies pods with an automatically mounted token and CA certificate, giving in-cluster workloads an identity for authenticating to the Kubernetes API server. It satisfies the requirement for automatic credential provisioning without embedding secrets manually.

Why this answer

A ServiceAccount is the correct resource because Kubernetes automatically mounts a projected volume containing a JWT token into pods that use the default or a specified ServiceAccount. This token is used by the pod to authenticate against the Kubernetes API server, enabling secure in-cluster communication without manual credential management.

Exam trap

The trap here is that candidates often confuse authorization resources like ClusterRoleBinding with authentication mechanisms, or think that a generic Secret or ConfigMap can serve as an automatic credential provider, when in fact only a ServiceAccount provides the automated token injection and rotation required for in-cluster API access.

How to eliminate wrong answers

Option B is wrong because a Secret is a generic resource for storing sensitive data like passwords or tokens, but it does not automatically provide authentication credentials to a pod; you must explicitly mount or reference it, and it lacks the automatic token rotation and API server integration of a ServiceAccount. Option C is wrong because a ConfigMap is designed for non-sensitive configuration data (e.g., environment variables or config files) and cannot store or provide authentication credentials. Option D is wrong because a ClusterRoleBinding grants RBAC permissions to a subject (like a ServiceAccount or user) but does not itself provide authentication credentials; it is an authorization resource, not an authentication mechanism.

253
MCQeasy

A node in your cluster is reporting 'NotReady' status. You log into the node and run 'systemctl status kubelet'. The kubelet service is not running. Which command should you use to start the kubelet and enable it to start on boot?

A.systemctl start --enable kubelet
B.systemctl enable kubelet
C.systemctl enable --now kubelet
D.systemctl start kubelet
AnswerC

This is the correct command to resolve the `NotReady` status and ensure future stability. The `systemctl enable --now kubelet` command not only configures the `kubelet` service to start automatically during subsequent system boots but also immediately starts the service in the current session. This dual action ensures the `kubelet` is running right away, allowing the node to quickly transition to a `Ready` state without requiring a manual reboot.

Why this answer

`systemctl enable --now kubelet` both starts the kubelet service immediately and creates the necessary symlinks to enable it to start automatically on boot. This is the most efficient way to handle a stopped service that needs to be persistent across reboots, which is critical for a Kubernetes node to rejoin the cluster after a reboot.

Exam trap

The trap here is that candidates often confuse `systemctl start` with `systemctl enable`, or assume that `systemctl start` alone is sufficient, overlooking the requirement to persist the service across reboots, which is a common cause of nodes failing to rejoin after a reboot in production.

How to eliminate wrong answers

Option A is wrong because `systemctl start --enable` is not a valid systemctl syntax; the correct flag for simultaneous start and enable is `--now`. Option B is wrong because `systemctl enable kubelet` only creates the boot-time symlinks but does not start the service immediately, leaving the node in a NotReady state until a manual start or reboot. Option D is wrong because `systemctl start kubelet` starts the service only for the current session; after a reboot, the kubelet will not start automatically, and the node will again report NotReady.

254
MCQmedium

A node in the cluster has been cordoned. Which of the following is true about the node?

A.The node is removed from the cluster.
B.kubectl drain is automatically performed on the node.
C.The node is marked as unschedulable, but existing pods continue to run.
D.Existing pods on the node are immediately evicted.
AnswerC

Cordoning sets the node's spec.unschedulable field to true, so the scheduler places no new pods there. Existing pods remain running and are not evicted, which distinguishes cordon from drain, where workloads are actively moved off the node.

Why this answer

When a node is cordoned using `kubectl cordon`, it is marked as unschedulable by setting the `node.Spec.Unschedulable` field to true. This prevents new pods from being scheduled onto the node, but existing pods continue to run normally. The node remains part of the cluster and is not removed or drained automatically.

Exam trap

The trap here is that candidates confuse cordoning with draining, assuming cordoning also evicts existing pods or removes the node, when in fact it only prevents new scheduling and leaves running pods untouched.

How to eliminate wrong answers

Option A is wrong because cordoning does not remove the node from the cluster; the node remains a member and can be uncordoned later. Option B is wrong because `kubectl drain` is not automatically performed; draining is a separate, explicit operation that evicts pods, whereas cordon only prevents new scheduling. Option D is wrong because existing pods are not immediately evicted; they continue running until they are terminated or the node is drained manually.

255
Multi-Selecthard

Which THREE of the following are valid commands to troubleshoot network connectivity between pods? (Select 3)

Select 3 answers
A.kubectl exec pod-a -- nslookup service-name
B.kubectl describe node | grep Network
C.kubectl logs pod-a | grep network
D.kubectl exec pod-a -- curl http://pod-b
E.kubectl exec pod-a -- ping pod-b-ip
AnswersA, D, E

This command launches nslookup inside pod-a's network namespace, querying the cluster's CoreDNS/kube-dns service to resolve the name "service-name". Successful resolution proves that DNS pod(s), kube-dns service, and the pod's resolv.conf are functioning, and it returns the ClusterIP or headless endpoints needed for service discovery. It is a valid connectivity test because without DNS, application-level communication via service names fails regardless of reachable pods.

Why this answer

kubectl exec can run networking tools inside a pod. curl is a common tool. nslookup tests DNS. ping tests basic connectivity.

256
MCQhard

A cluster administrator notices that nodes are not joining the cluster after a kubeadm init. The kubelet logs show: 'failed to run Kubelet: could not init service: open /var/lib/kubelet/config.yaml: permission denied'. What is the most likely cause?

A.The kubelet is running out of disk space.
B.The kubelet is not able to reach the API server.
C.The kubelet binary is missing.
D.The kubelet configuration file has incorrect ownership or permissions.
AnswerD

The kubelet service requires read access to its configuration file, typically located at `/var/lib/kubelet/config.yaml`. If this file has incorrect ownership or highly restrictive permissions (such as `0000`), the systemd service will fail to start, explicitly logging a 'permission denied' error when attempting to parse its startup parameters.

Why this answer

The error message 'open /var/lib/kubelet/config.yaml: permission denied' indicates that the kubelet process does not have the necessary read permissions to access its configuration file. This is typically caused by incorrect file ownership (e.g., owned by root instead of the kubelet user) or restrictive file permissions (e.g., 600 instead of 644). Since kubelet runs as a systemd service, it requires appropriate access to this file to initialize properly.

Exam trap

The trap here is that candidates often confuse 'permission denied' with network connectivity issues or resource exhaustion, but the specific file path in the error message directly points to a filesystem permission problem.

How to eliminate wrong answers

Option A is wrong because disk space issues would produce errors like 'no space left on device' or 'disk quota exceeded', not a permission denied error on a specific file. Option B is wrong because inability to reach the API server would manifest as connection timeout or refused errors in the kubelet logs, not a file permission error during initialization. Option C is wrong because a missing kubelet binary would result in a 'command not found' or 'executable file not found' error when systemd tries to start the service, not a permission denied error on a configuration file.

257
MCQmedium

After deploying a new Deployment, you run 'kubectl get events' and see 'FailedScheduling' events. What is a possible cause?

A.The container port is already in use on the node
B.The pod has a node selector that matches no nodes
C.The node has a taint that tolerates the pod
D.The pod's image pull secret is missing
AnswerB

When a pod defines a nodeSelector that does not match the labels of any active node in the cluster, the default-scheduler cannot find a valid placement. Consequently, the pod remains in a Pending state, and the scheduler emits a FailedScheduling warning event indicating that zero nodes match the selector.

Why this answer

A FailedScheduling event indicates that the Kubernetes scheduler could not find a suitable node to place the pod. Option B is correct because if a pod has a node selector that does not match any node's labels, the scheduler will fail to schedule it, resulting in a FailedScheduling event. The scheduler evaluates node selectors against node labels, and if no node satisfies the selector, the pod remains unscheduled.

Exam trap

The trap here is confusing scheduling failures with runtime failures, as candidates often associate port conflicts or image pull issues with scheduling, when in fact those errors occur after the pod is placed on a node.

How to eliminate wrong answers

Option A is wrong because a container port already in use on a node would cause a port conflict at runtime, not a scheduling failure; the scheduler does not check port availability on nodes. Option C is wrong because a node with a taint that tolerates the pod would actually allow scheduling, not prevent it; the issue is when a taint is not tolerated by the pod. Option D is wrong because a missing image pull secret would cause an ImagePullBackOff or ErrImagePull event after scheduling, not a FailedScheduling event.

258
Multi-Selecteasy

Which TWO of the following are control plane components?

Select 2 answers
A.cloud-controller-manager
B.kubelet
C.etcd
D.container runtime
E.kube-proxy
AnswersA, C

The cloud-controller-manager is a control plane component that runs cloud-specific controllers, such as those for node lifecycle, load balancers, and routing, by interacting with the cloud provider's API. It is scheduled only on control plane nodes and is built as a separate binary to isolate cloud dependencies from the core Kubernetes controllers. Because its entire function is to bridge the cluster to a cloud provider's infrastructure, it belongs exclusively to the control plane.

Why this answer

The cloud-controller-manager (A) is a control plane component because it runs cloud-specific controller loops (node, route, and service controllers) that interact with the underlying cloud provider's API, and it runs on the control plane alongside the API server and scheduler. etcd (C) is the control plane's consistent, highly-available key-value store that persists all cluster state and objects, making it a core control plane component. By contrast, kubelet (B) is a node agent that runs on each worker node and manages pod lifecycles via the CRI, so it is a node component, not control plane. The container runtime (D) is node-level software (e.g., containerd or CRI-O) that actually runs containers, and kube-proxy (E) is a node-level network proxy implementing Service rules via iptables/IPVS, so neither belongs to the control plane.

Exam trap

CNCF often tests the distinction between control plane and node components, and the trap here is that candidates mistakenly classify kube-proxy or kubelet as control plane components because they are essential for cluster operation, but they are not part of the control plane's core management layer.

259
Multi-Selectmedium

Which TWO statements about DaemonSets are correct? (Select 2)

Select 2 answers
A.DaemonSets are typically managed by a parent Deployment.
B.DaemonSets do not support rolling updates.
C.DaemonSets are often used for cluster daemons like log collectors or monitoring agents.
D.DaemonSets have a desired number of replicas that the scheduler tries to maintain.
E.DaemonSets ensure that all (or some) nodes run a copy of a pod.
AnswersC, E

DaemonSets are the standard mechanism for running system-level services that need to be present on every node, such as log collectors (e.g., Fluentd), monitoring agents (e.g., Prometheus Node Exporter), and network components (e.g., kube-proxy, CNI plugins). Because these daemons provide cluster-wide functionality, they must be automatically scheduled on each node and removed when the node leaves, which is exactly what a DaemonSet guarantees.

Why this answer

Option C is correct because DaemonSets are designed for node-level cluster services such as log collectors (e.g., Fluentd/Fluent Bit), monitoring agents (e.g., node-exporter), and CNI/storage daemons, where one pod per node is needed. Option E is correct because a DaemonSet's core behavior is to ensure that all nodes, or a subset selected via nodeSelector/affinity/tolerations, run a copy of a specified pod, with new nodes automatically getting the pod. Option A is incorrect because DaemonSets are standalone controllers managed directly by the DaemonSet controller, not by a parent Deployment.

Option B is incorrect because DaemonSets do support rolling updates via updateStrategy: RollingUpdate (with maxUnavailable), as well as OnDelete. Option D is incorrect because DaemonSets do not use a desired replica count like Deployments or ReplicaSets; their pod count is determined by the number of matching nodes.

Exam trap

The trap here is that candidates often confuse DaemonSets with Deployments, mistakenly thinking DaemonSets have a replica count or are managed by a Deployment, or that they lack update strategies, when in fact DaemonSets are independent and fully support rolling updates.

260
MCQhard

An administrator runs 'kubeadm init' on a machine that previously had a Kubernetes cluster. The command fails with the above errors. What is the best course of action?

A.Run 'kubeadm reset' to clean up the previous installation and then re-run kubeadm init.
B.Manually delete the /etc/kubernetes/manifests/kube-apiserver.yaml file and kill the process using port 6443.
C.Use a different port for the API server by specifying --apiserver-bind-port.
D.Run kubeadm init with --force flag to override the errors.
AnswerA

Running 'kubeadm reset' is the best practice and official method to revert any changes made to the host by a previous 'kubeadm init' or 'kubeadm join' execution. It automatically stops and removes running containers, cleans up local directories like '/var/lib/etcd' and '/etc/kubernetes', and resets iptables rules. This ensures a clean slate, allowing a subsequent 'kubeadm init' command to succeed without encountering conflicting state or port conflicts.

Why this answer

When `kubeadm init` fails on a machine that previously hosted a Kubernetes cluster, it is typically because residual configuration files, certificates, and control plane static pod manifests from the prior installation conflict with the new initialization. Running `kubeadm reset` is the official cleanup command that removes these artifacts (e.g., `/etc/kubernetes/`, CNI configurations, and iptables rules), restoring the node to a pre-init state so that `kubeadm init` can succeed cleanly.

Exam trap

The trap here is that candidates may think a simple file deletion or port change is sufficient, but the CKA exam expects you to know that `kubeadm reset` is the only safe, comprehensive cleanup method for re-initializing a cluster on the same node.

How to eliminate wrong answers

Option B is wrong because manually deleting only the kube-apiserver.yaml manifest and killing its process does not remove other critical residual files (e.g., etcd data, kubelet config, CA certificates, or other static pod manifests), leaving the node in an inconsistent state that will still cause `kubeadm init` to fail. Option C is wrong because changing the API server port with `--apiserver-bind-port` does not address the root cause of leftover cluster state; it merely avoids the port conflict temporarily while other conflicts (e.g., existing etcd data, stale certificates) remain. Option D is wrong because `kubeadm init` does not support a `--force` flag; attempting to override errors without proper cleanup can lead to a corrupted or non-functional cluster.

261
MCQeasy

What is the function of the 'kube-scheduler' in Kubernetes?

A.It runs the container runtime
B.It manages network rules for services
C.It stores cluster state
D.It assigns pods to nodes
AnswerD

The kube-scheduler assigns Pods to Nodes by continuously watching the API server for unscheduled Pods (those with an empty spec.nodeName), then filtering Nodes based on constraints like resource requests, taints and tolerations, node selectors, affinity rules, and data locality, and finally scoring the remaining candidates to pick the best fit. Once a Node is chosen, it creates a Binding object that commits the Pod to that Node, after which the kubelet on the selected Node takes over to actually start its containers.

Why this answer

The kube-scheduler is a core control plane component that watches for newly created Pods with no assigned node and selects an optimal node for them to run on. It makes scheduling decisions based on resource requirements, constraints like affinity/anti-affinity rules, data locality, and other policies. Option D is correct because the scheduler's primary function is to assign pods to nodes.

Exam trap

The trap here is that candidates often confuse the kube-scheduler with kubelet or kube-proxy, but the scheduler's sole role is node selection for pods, not running containers or managing network rules.

How to eliminate wrong answers

Option A is wrong because the container runtime (e.g., containerd, CRI-O) runs containers, not the kube-scheduler. Option B is wrong because managing network rules for services is the job of the kube-proxy component, which implements Service networking via iptables/IPVS. Option C is wrong because storing cluster state is the responsibility of etcd, a distributed key-value store; the kube-scheduler does not persist any state.

262
MCQmedium

You need to schedule a pod to a specific node named 'worker-2' for testing purposes. Which field should you set in the pod spec?

A.schedulerName
B.affinity
C.nodeSelector
D.nodeName
AnswerD

nodeName is the only field that directly assigns a pod to a specific node by its exact Node resource name. When nodeName is set, the kubelet on that node sees the pod in the API server and attempts to run it, completely bypassing the scheduling process. This is a hard assignment: the pod will never be scheduled elsewhere, and if the node does not exist or is not ready, the pod stays Pending or fails.

Why this answer

The `nodeName` field in the PodSpec directly assigns the pod to a specific node by name, bypassing the scheduler entirely. Setting `nodeName: worker-2` forces the kubelet on that node to run the pod, making it the correct choice for pinning a pod to a specific node for testing.

Exam trap

CNCF often tests the distinction between `nodeSelector` (label-based scheduling) and `nodeName` (direct assignment), leading candidates to choose `nodeSelector` when the question explicitly requires a specific node name.

How to eliminate wrong answers

Option A is wrong because `schedulerName` specifies a custom scheduler to use for scheduling decisions, not a direct node assignment; it still relies on scheduling logic. Option B is wrong because `affinity` (node affinity or pod affinity) provides soft or hard constraints for scheduling preferences but does not guarantee placement on a specific node like `nodeName` does. Option C is wrong because `nodeSelector` matches labels on nodes to schedule the pod to any node with those labels, not a single named node.

263
MCQhard

You are upgrading a Kubernetes cluster from version 1.28 to 1.29. What is the correct order of steps?

A.Upgrade all worker nodes first, then upgrade control plane nodes.
B.Upgrade control plane nodes first, then upgrade worker nodes without draining them.
C.Upgrade control plane nodes first, then drain each worker node before upgrading it.
D.Upgrade all nodes simultaneously.
AnswerC

This sequence aligns perfectly with the official Kubernetes upgrade lifecycle. Upgrading the control plane components first ensures that the API server can handle requests from newer kubelet versions. Subsequently draining each worker node before its upgrade guarantees that workloads are safely rescheduled onto other healthy nodes, minimizing service disruption during the node's maintenance window.

Why this answer

The Kubernetes upgrade process requires upgrading the control plane nodes first to ensure the cluster's management layer is running the new version before worker nodes are upgraded. Draining each worker node before upgrading it is essential to safely evict pods and maintain application availability, as the kubelet on the node must be stopped during the upgrade and the node must be cordoned to prevent new pods from being scheduled.

Exam trap

The trap here is that candidates may think upgrading worker nodes without draining is acceptable if they use a rolling update strategy, but the CKA exam specifically tests the requirement to drain nodes before upgrading to avoid pod disruption.

How to eliminate wrong answers

Option A is wrong because upgrading worker nodes before control plane nodes violates the Kubernetes upgrade order; the control plane must be upgraded first to avoid version skew incompatibilities. Option B is wrong because upgrading worker nodes without draining them first can cause pod disruptions and data loss, as the kubelet is stopped during the upgrade and pods are not gracefully terminated. Option D is wrong because upgrading all nodes simultaneously is not supported; Kubernetes requires a sequential upgrade to maintain cluster stability and prevent version mismatch between components.

264
MCQeasy

Which reclaim policy will cause the underlying storage to be deleted when the associated PersistentVolume is released from a PersistentVolumeClaim?

A.Delete
B.Recycle
C.Retain
D.Archive
AnswerA

The "Delete" reclaim policy is the correct choice because it ensures that when a PersistentVolumeClaim (PVC) is deleted, Kubernetes automatically de-provisions both the PersistentVolume (PV) object and the actual underlying storage resource. This automation removes the storage asset, such as an AWS EBS volume or a GCP Persistent Disk, from the external infrastructure, preventing orphaned resources and incurring unnecessary costs.

Why this answer

The Delete reclaim policy instructs the system to remove the underlying storage asset (e.g., an AWS EBS volume, GCE Persistent Disk, or NFS export) when the PersistentVolume is released from a PersistentVolumeClaim. This is the only policy that automatically cleans up the physical storage, ensuring no orphaned resources remain.

Exam trap

The trap here is that candidates may confuse 'Recycle' with 'Delete' because both involve automatic cleanup, but Recycle only scrubs data without removing the storage asset, and it is no longer supported in modern Kubernetes versions.

How to eliminate wrong answers

Option B (Recycle) is wrong because Recycle was a legacy policy that performed a basic scrub (e.g., 'rm -rf /thevolume') and made the volume available again, but it did not delete the underlying storage; it was deprecated in Kubernetes 1.15 and removed in 1.20. Option C (Retain) is wrong because Retain leaves the PersistentVolume and its underlying storage intact after the PVC is released, requiring manual administrator intervention to reclaim or delete the storage. Option D (Archive) is wrong because Archive is not a valid Kubernetes PersistentVolume reclaim policy; the only three defined policies are Retain, Recycle (deprecated), and Delete.

265
MCQhard

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

A.ipvs
B.iptables
C.kernelnet
D.userspace
AnswerA

IPVS (IP Virtual Server) is a kernel-level transport-layer load balancer that kube-proxy uses to implement Kubernetes Services with a virtual server table. Unlike iptables' random chaining, IPVS supports multiple scheduling algorithms, including least connection (lc), which routes new connections to the backend with the fewest active connections. It also offers better scalability and O(1) lookups by using hash tables, making it the correct choice for advanced load-balancing needs.

Why this answer

(ipvs) is correct because kube-proxy in IPVS mode uses the Linux kernel's IP Virtual Server (IPVS) to implement Layer 4 load balancing, which supports sophisticated scheduling algorithms such as 'least connection' (lc), round-robin, and others. IPVS operates in kernel space with a hash table structure, providing better performance and scalability compared to iptables, especially in clusters with thousands of services.

Exam trap

The trap here is that candidates often assume iptables is the default and most performant mode, but the CKA exam expects you to know that IPVS is the only mode that supports advanced scheduling algorithms like 'least connection' and offers better performance at scale.

How to eliminate wrong answers

Option B is wrong because iptables mode uses a linear chain of iptables rules for each service, which becomes slow and inefficient as the number of services grows, and it only supports random or round-robin selection via DNAT rules, not sophisticated algorithms like 'least connection'. Option C is wrong because 'kernelnet' is not a valid kube-proxy mode; the recognized modes are userspace, iptables, IPVS, and (in newer versions) nftables. Option D is wrong because userspace mode runs in user space and proxies traffic via a userspace proxy, which introduces higher latency and lower performance due to context switching, and it does not support advanced load balancing algorithms like 'least connection'.

266
MCQhard

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

A.kubectl apply -f /backup/etcd-snapshot.db
B.etcdctl snapshot restore /backup/etcd-snapshot.db --data-dir=/var/lib/etcd-restored
C.etcdctl snapshot load /backup/etcd-snapshot.db
D.ETCDCTL_API=3 etcdctl restore /backup/etcd-snapshot.db
AnswerB

etcdctl snapshot restore is the correct command because it takes a previously captured snapshot file and reconstructs a new etcd data directory. The --data-dir flag points to the location where the restored database files should be written, and the etcd server must later be configured to use that directory; this is the canonical procedure for restoring etcd in Kubernetes control-plane recovery.

Why this answer

`etcdctl snapshot restore` is the proper command to restore an etcd snapshot to a new data directory. The `--data-dir` flag specifies where the restored data should be placed, allowing the new etcd instance to use that directory. This command recreates the etcd member's data from the snapshot file, which is essential for disaster recovery.

Exam trap

CNCF often tests the exact subcommand syntax, so candidates mistakenly choose `etcdctl restore` or `etcdctl snapshot load` instead of the correct `etcdctl snapshot restore`.

How to eliminate wrong answers

Option A is wrong because `kubectl apply` is used to apply Kubernetes resources from YAML/JSON manifests, not to restore etcd snapshots; it cannot interpret a binary snapshot file. Option C is wrong because `etcdctl snapshot load` is not a valid subcommand; the correct subcommand is `snapshot restore`. Option D is wrong because `etcdctl restore` is not a valid subcommand; the correct syntax requires `snapshot restore`, and the `ETCDCTL_API=3` environment variable is not needed when using the v3 API by default.

267
MCQhard

A Pod is stuck in Pending state. 'kubectl describe pod' shows the event: '0/4 nodes are available: 1 node had taint {node-role.kubernetes.io/control-plane: }, that the pod didn't tolerate, 3 Insufficient cpu.' Which of the following is the most likely combination of issues?

A.Three nodes have insufficient CPU for the pod's request, and one node has a taint not tolerated by the pod
B.The pod has a resource request that exceeds available CPU on all nodes
C.The pod does not tolerate any taints, and all nodes have taints
D.The cluster has only one node with sufficient CPU, but it is cordoned
AnswerA

The kubectl describe pod output lists Events from the scheduler. In this case, the events directly report two distinct issues: three nodes have insufficient CPU to satisfy the pod's resource request, and one node has a taint for which the pod has no matching toleration. Since these are the exact messages shown, this option correctly captures the full diagnosis.

Why this answer

The event message explicitly states that 1 node has a taint (node-role.kubernetes.io/control-plane) that the pod does not tolerate, and 3 nodes have insufficient CPU. This means the pod's CPU request cannot be satisfied on three nodes, and the remaining node is tainted, leaving no schedulable node. Option A correctly identifies this combination of issues.

Exam trap

The trap here is that candidates may misinterpret '0/4 nodes are available' as all nodes having the same issue, but the event message lists distinct reasons per node, requiring careful reading to identify the combination of taint and resource insufficiency.

How to eliminate wrong answers

Option B is wrong because the event shows only 3 nodes have insufficient CPU, not all 4; one node has a taint issue, not a CPU shortage. Option C is wrong because the event indicates only 1 node has a taint, not all nodes; the other 3 nodes have insufficient CPU, not taints. Option D is wrong because the event does not mention any node being cordoned; it specifically cites taint and insufficient CPU as the reasons.

268
MCQmedium

A DaemonSet is expected to run on all nodes, but a particular node does not have the pod. The node is Ready and has no taints. You run 'kubectl describe daemonset <name>' and see 'MISSING' for that node. What is a likely cause?

A.The DaemonSet is configured to run only on control plane nodes
B.The DaemonSet has a nodeSelector that the node does not match
C.The node has insufficient resources for the DaemonSet pod
D.The node has a taint that is not tolerated
AnswerB

The DaemonSet controller uses the nodeSelector field to match node labels before scheduling pods. If a specific node lacks the required label or has a mismatched value, the controller will intentionally skip scheduling the DaemonSet pod on that node, leaving it as the sole exception.

Why this answer

When a DaemonSet shows 'MISSING' for a specific node that is Ready and has no taints, the most common cause is that the node does not match the DaemonSet's nodeSelector. The nodeSelector field in the DaemonSet spec defines a set of key-value pairs that must match the node's labels. If the node lacks the required labels, the DaemonSet controller will not schedule the pod on that node, resulting in the 'MISSING' status.

Exam trap

The trap here is that candidates often assume 'MISSING' implies a resource or taint issue, but the CKA exam tests the understanding that nodeSelector mismatches cause the DaemonSet controller to skip the node entirely, not just fail to schedule.

How to eliminate wrong answers

Option A is wrong because a DaemonSet configured to run only on control plane nodes would use a nodeSelector or node affinity targeting control plane labels (e.g., node-role.kubernetes.io/control-plane), and the question states the node is Ready with no taints, but does not indicate it is a control plane node; however, the 'MISSING' status would occur for worker nodes, not for a specific node that is Ready—this option does not explain why only one node is missing. Option C is wrong because insufficient resources (CPU/memory) would cause the pod to be in a 'Pending' state, not 'MISSING'; the DaemonSet controller would still attempt to schedule and show the pod as pending, not missing. Option D is wrong because the question explicitly states the node has no taints, so a taint that is not tolerated cannot be the cause.

269
MCQeasy

Which of the following Service types does NOT assign a ClusterIP to the Service?

A.LoadBalancer
B.Headless
C.ClusterIP
D.NodePort
AnswerB

A Headless Service is explicitly configured by setting the spec.clusterIP field to None. This configuration instructs the control plane not to allocate a virtual IP address or perform load balancing via kube-proxy. Instead, DNS queries for the service return the direct A/AAAA records of the underlying backend pods, making it ideal for stateful applications.

Why this answer

A Headless Service is created by setting the `clusterIP` field to `None` in the Service specification. This tells Kubernetes not to allocate a ClusterIP, making the Service headless. Instead of a virtual IP, DNS queries for the Service name return the IP addresses of all matching Pods directly, enabling stateful workloads like databases to discover individual Pod endpoints.

Exam trap

The trap here is that candidates often assume all Services must have a ClusterIP, forgetting that the `clusterIP: None` field explicitly disables it, and they may confuse Headless Services with NodePort or LoadBalancer types that still allocate a ClusterIP under the hood.

How to eliminate wrong answers

Option A is wrong because a LoadBalancer Service type does assign a ClusterIP; it creates a ClusterIP first, then provisions an external load balancer that routes traffic to that ClusterIP. Option C is wrong because ClusterIP is the default Service type that explicitly assigns a stable virtual IP from the cluster's service CIDR range. Option D is wrong because a NodePort Service type also assigns a ClusterIP; it builds on top of ClusterIP by additionally opening a high-port on every Node to forward traffic to that ClusterIP.

270
MCQeasy

A pod named 'app' is not starting. You run 'kubectl describe pod app' and see the event: 'MountVolume.SetUp failed for volume "pvc-volume" : rpc error: code = NotFound desc = volume not found'. What is the most likely issue?

A.The container image is not found in the registry
B.The node running the pod is out of disk space
C.The pod has insufficient CPU resources
D.The PersistentVolumeClaim (PVC) referenced by the pod does not exist or is not bound
AnswerD

When a pod definition references a PersistentVolumeClaim that is either missing from the namespace or stuck in a 'Pending' state (unbound), the kubelet cannot mount the volume. Consequently, the pod remains blocked in the 'ContainerCreating' or 'Pending' phase, and 'kubectl describe' will display a warning event such as 'FailedMount' or 'FailedScheduling' due to the missing volume.

Why this answer

The error 'volume not found' indicates that the PersistentVolumeClaim (PVC) named 'pvc-volume' does not exist or is not bound to a PersistentVolume (PV). Kubernetes requires a PVC to be in 'Bound' state before a pod can mount it; if the PVC is missing or unbound, the volume mount fails at pod startup.

Exam trap

The trap here is that candidates may confuse volume mount errors with image or resource issues, but the specific 'volume not found' RPC error directly points to a missing or unbound PVC, not to node-level or image-related problems.

How to eliminate wrong answers

Option A is wrong because a missing container image would produce an 'ErrImagePull' or 'ImagePullBackOff' event, not a volume mount error. Option B is wrong because node disk space issues typically cause 'Evicted' pods or 'NodeHasDiskPressure' conditions, not a 'volume not found' RPC error from the CSI driver. Option C is wrong because insufficient CPU resources would result in a 'FailedScheduling' event or 'OOMKill' if the pod runs, not a volume mount failure.

271
MCQeasy

Which of the following commands will list all PersistentVolumeClaims in a cluster?

A.kubectl get pv
B.kubectl get pvc
C.kubectl get claims
D.kubectl get persistent-volume-claims
AnswerB

Correct. `kubectl get pvc` is the standard shorthand command to list all PersistentVolumeClaims.

Why this answer

`kubectl get pvc` is the correct command to list PersistentVolumeClaims using the official short name. Option A lists PersistentVolumes (`pv`). Option C (`claims`) and Option D (`persistent-volume-claims` with hyphens) are invalid resource names and will result in an error.

Exam trap

Candidates often confuse the shorthand `pv` for PersistentVolume with `pvc` for PersistentVolumeClaim, or mistakenly believe that `kubectl get claims` is valid.

How to eliminate wrong answers

Option A is wrong because `kubectl get pv` lists PersistentVolumes, not PersistentVolumeClaims; these are distinct resources where PVs represent actual storage volumes and PVCs represent requests for storage. Option C is wrong because `kubectl get claims` is not a valid kubectl command; Kubernetes does not recognize 'claims' as a resource abbreviation, and this will result in an error.

272
Multi-Selecteasy

Which TWO of the following are control plane components? (Select 2)

Select 2 answers
A.kubelet
B.kube-proxy
C.container runtime
D.etcd
E.kube-apiserver
AnswersD, E

etcd is the distributed key-value store that holds the entire cluster's desired state—all API objects, configuration, secrets, and metadata—and it is the single source of truth for Kubernetes. It is fundamentally a control plane component because every control plane operation reads from or writes to etcd, and it requires quorum-based consensus (Raft) to maintain consistent state across replicas. Without etcd, the API server cannot operate, and the cluster has no real state to reconcile.

Why this answer

etcd (D) is a control plane component because it is the consistent, highly-available key-value store that persists all cluster state and configuration data for Kubernetes. kube-apiserver (E) is also a control plane component: it exposes the Kubernetes API, validates and processes REST requests, and is the central communication hub through which all other components interact. By contrast, kubelet (A) runs on each worker node to manage pods and containers, kube-proxy (B) runs on nodes to implement Service networking rules via iptables/IPVS, and the container runtime (C) runs on nodes to actually pull images and run containers, so none of these three are control plane components.

Exam trap

CNCF often tests the distinction between control plane and node components, and the trap here is that candidates confuse kubelet or kube-proxy as control plane components because they are critical to cluster operation, but they actually run on every node and are not part of the control plane.

273
MCQmedium

You run 'kubectl get pods' and see a pod named 'db' in CrashLoopBackOff. 'kubectl logs db' shows nothing. 'kubectl logs db --previous' shows 'Error: database connection failed'. What is the most likely cause?

A.The node is out of memory
B.The environment variable for database host is incorrect
C.The pod's liveness probe is misconfigured
D.The container image is missing
AnswerB

The application inside the container is crashing because it cannot establish a network connection to its dependency, which is a classic symptom of a misconfigured database host environment variable. When the application attempts to resolve or connect to an invalid hostname or IP address specified in its configuration, it throws an unhandled connection exception and terminates, causing Kubernetes to place the pod in a CrashLoopBackOff state.

Why this answer

The 'kubectl logs db --previous' output shows 'Error: database connection failed', which indicates the application inside the container is failing to connect to a database. Since the current logs are empty (the container restarted), the previous logs reveal the root cause: a configuration issue, most likely an incorrect database host environment variable. This is a classic application-level startup failure, not a resource or probe issue.

Exam trap

A common trap is that candidates may assume CrashLoopBackOff always indicates a probe or resource problem, ignoring the diagnostic value of 'kubectl logs --previous' which reveals application-level errors.

How to eliminate wrong answers

Option A is wrong because a node out-of-memory condition would cause the pod to be evicted or show OOMKilled status, not CrashLoopBackOff with a specific database connection error. Option C is wrong because a misconfigured liveness probe would cause the pod to be restarted by kubelet, but the logs would not show a database connection error; the probe failure would be logged by kubelet, not the application. Option D is wrong because a missing container image would result in ErrImagePull or ImagePullBackOff, not CrashLoopBackOff with application logs.

274
MCQhard

A Service of type ClusterIP is not reachable from within the cluster. Pods backing the Service are running and healthy. What is the most likely cause?

A.DNS resolution failure
B.kube-proxy not running or misconfigured
C.Ingress controller not set up
D.Service type should be NodePort
AnswerB

kube-proxy is the component responsible for implementing the Service abstraction by installing iptables, IPVS, or eBPF rules on every node. If it is not running, misconfigured, or its rules are out of sync, packets destined for the ClusterIP have no forwarding rules and are silently dropped or rejected. This directly matches the symptom of an unreachable ClusterIP while the backing pods and their endpoints may still be healthy.

Why this answer

When Pods are healthy but a ClusterIP Service is unreachable from within the cluster, the most common cause is that kube-proxy is not running or is misconfigured. kube-proxy is responsible for implementing the ClusterIP virtual IP by programming iptables (or IPVS) rules on each node to forward traffic to the selected Pods. Without these rules, packets destined for the ClusterIP are dropped or rejected, even though the Service and Endpoints objects exist.

Exam trap

The trap here is that candidates often assume a healthy Pod and Service object guarantee connectivity, overlooking that kube-proxy must actively program the underlying network rules to make the ClusterIP routable.

Why the other options are wrong

A

DNS resolves Service name to ClusterIP; connectivity fails after.

C

Ingress is for external; ClusterIP is internal.

D

ClusterIP works internally.

275
Multi-Selecthard

Which THREE of the following are true about expanding a PersistentVolumeClaim?

Select 3 answers
A.After expanding the PVC, the pod must be recreated for the new size to take effect.
B.You can reduce the size of a PVC after creation.
C.The StorageClass must have allowVolumeExpansion: true.
D.The volume plugin must support expansion.
E.You can expand a PVC by editing its spec.resources.requests.storage field.
AnswersC, D, E

The StorageClass referenced by a PersistentVolumeClaim must have the allowVolumeExpansion field set to true for PVC expansion to be permitted. This field tells the PersistentVolumeController that claims using this class are eligible for resizing, and it enables the controller to process updates to the requested storage size. If the field is false or omitted, the API server—or the external controller—will not allow the PVC's storage request to be increased, and any such edit will either be rejected or have no effect on the actual volume.

Why this answer

Option C is correct because a PersistentVolumeClaim can only be expanded if its StorageClass explicitly sets allowVolumeExpansion: true; without this field, the API server rejects the resize request. Option D is correct because even with allowVolumeExpansion enabled, the underlying CSI or in-tree volume plugin must actually support online or offline expansion for the operation to succeed. Option E is correct because the standard way to request more capacity is to edit the PVC's spec.resources.requests.storage field to a larger value, which triggers the resize workflow.

Option A is not universally true: many CSI drivers support online expansion so the pod does not need to be recreated, and only certain filesystem-resize cases require a pod restart. Option B is incorrect because Kubernetes does not support shrinking a PVC; the requested storage can only be increased, never decreased.

Exam trap

The trap here is that candidates often think a pod must be recreated for the new size to take effect, but Kubernetes handles filesystem resizing automatically for supported plugins, making option A a common distractor.

276
MCQeasy

Which of the following is a valid CNI plugin for Kubernetes networking?

A.Calico
B.etcd
C.Docker
D.Kubelet
AnswerA

Calico is a valid Container Network Interface (CNI) plugin that provides networking and network policy for Kubernetes clusters. It implements the CNI specification by configuring routes, assigning IP addresses (via IPAM), and enforcing policy using iptables or eBPF dataplanes, making it one of the most widely adopted CNI plugins in production.

Why this answer

Calico is a valid CNI plugin that implements the Container Network Interface specification to provide networking and network policy for Kubernetes clusters. It uses BGP (Border Gateway Protocol) to route packets between nodes and supports overlay or non-overlay networking modes, making it a widely adopted choice for production environments.

Exam trap

The trap here is that candidates confuse cluster infrastructure components (etcd, kubelet) or container runtimes (Docker) with CNI plugins, because they are all part of the Kubernetes ecosystem but serve fundamentally different roles.

How to eliminate wrong answers

Option B (etcd) is wrong because etcd is a distributed key-value store used to store Kubernetes cluster state and configuration, not a CNI plugin for networking. Option C (Docker) is wrong because Docker is a container runtime that can be used with Kubernetes but is not a CNI plugin; CNI plugins handle network interface setup, not container execution. Option D (Kubelet) is wrong because Kubelet is the primary node agent that manages pods and containers on a node, and while it invokes CNI plugins, it is not itself a CNI plugin.

277
MCQeasy

An administrator is tasked with setting up a new Kubernetes cluster using kubeadm. They have two nodes: one control plane and one worker. After initializing the control plane with 'kubeadm init', the worker node fails to join with the error 'error execution phase preflight: [preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running'. What should the administrator check first?

A.Ensure that containerd is installed and running on the worker node.
B.Verify that the control plane node is healthy.
C.Check if the join token has expired.
D.Install a network plugin like Calico on the control plane.
AnswerA

The kubelet on the worker node communicates with the container runtime through the Container Runtime Interface (CRI), typically over a Unix socket such as /run/containerd/containerd.sock. If containerd is not installed, the service is stopped, or the socket is missing, kubelet will fail with a CRI connection error and never start pods. Run `systemctl status containerd` and check the socket path configured in kubelet (--container-runtime-endpoint) to confirm the runtime is active.

Why this answer

The error 'container runtime is not running' on the worker node indicates that the CRI (Container Runtime Interface) implementation, typically containerd, is not active. Since kubelet relies on a running container runtime to manage pods, the administrator must first check that containerd is installed and running on the worker node using commands like 'systemctl status containerd' or 'systemctl start containerd'.

Exam trap

The trap here is that candidates often assume the error is related to the control plane or networking, but the CRI error specifically points to a missing or stopped container runtime on the node attempting to join.

How to eliminate wrong answers

Option B is wrong because the control plane node's health is irrelevant to a preflight error on the worker node; the worker node's kubelet cannot even start without a runtime. Option C is wrong because a token expiration would produce an authentication error (e.g., 'error: failed to request certificate'), not a CRI runtime error. Option D is wrong because a network plugin like Calico is installed after nodes have joined and is not required for the join process; the preflight check fails before any network plugin is considered.

278
MCQhard

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

A.kubelet on the worker node
B.kube-apiserver on the control plane
C.kube-controller-manager
D.etcd cluster health
AnswerA

The kubelet is the essential agent running on each worker node, responsible for registering the node with the control plane and continuously reporting its health and status to the API server via heartbeats. If the kubelet process fails, crashes, or loses network connectivity on a specific worker node, it stops sending these crucial heartbeats. Consequently, the Node Controller on the control plane will eventually mark that particular node as 'NotReady' because it is no longer receiving status updates from its designated agent.

Why this answer

The kubelet is the primary node agent that runs on every worker node and is responsible for registering the node with the cluster and periodically reporting its status via NodeStatus updates. When a node is in 'NotReady' state, it means the kubelet has failed to send heartbeats or report readiness to the control plane, typically due to a crash, misconfiguration, or resource exhaustion. Checking the kubelet's logs and service status (e.g., 'systemctl status kubelet' or 'journalctl -u kubelet') is the first diagnostic step because it directly controls node health reporting.

Exam trap

CNCF often tests the misconception that the kube-controller-manager or kube-apiserver is the root cause of node unreadiness, but the trap here is that the kubelet is the sole component responsible for reporting node health, and its failure is the most direct cause of a 'NotReady' state.

How to eliminate wrong answers

Option B is wrong because the kube-apiserver is the front-end for the Kubernetes API and handles all REST requests, but it does not directly report node health; a failing kube-apiserver would affect all API calls, not just a single node's status. Option C is wrong because the kube-controller-manager runs controllers like the Node Controller that reacts to node status changes, but it does not generate the initial health data; it only acts on the status reported by the kubelet. Option D is wrong because etcd stores cluster state, including node status, but a healthy etcd cluster is required for the control plane to function; however, if only one node is NotReady, the issue is almost certainly local to that node, not the distributed key-value store.

279
MCQmedium

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

A.Creates a new Service with port mapping 8080:80
B.Forwards port 8080 from the Service to port 80 on the local machine
C.Forwards port 80 from the local machine to port 8080 on the Service
D.Forwards local port 8080 to port 80 on the Service
AnswerD

The command `kubectl port-forward service/<name> 8080:80` correctly creates a local listener on port 8080 and forwards traffic through the Kubernetes API server to a pod that backs the specified Service, reaching that pod on its port 80. The format is always <local>:<remote>, so the left side of the colon is the port that appears on your workstation (localhost:8080) and the right side is the intended destination port inside the cluster (the Service's port 80). This lets you reach a cluster-internal Service endpoint without exposing it publicly, which is useful for debugging, accessing a private web UI, or testing a preview of an application running inside the cluster.

Why this answer

`kubectl port-forward` creates a tunnel from a local port to a pod (or service) in the cluster. When targeting a Service, it selects one of the Service's endpoints (a pod) and forwards traffic from localhost:8080 to port 80 on that pod. This allows direct access to the Service without exposing it externally.

Exam trap

The trap here is confusing the direction of the port mapping: candidates often think the first port is the remote port and the second is the local port, but `kubectl port-forward` always uses the format `local_port:remote_port`.

How to eliminate wrong answers

Option A is wrong because `kubectl port-forward` does not create or modify any Kubernetes resources; it only establishes a temporary network tunnel from the local machine. Option B is wrong because it reverses the direction: the command forwards the local port 8080 to the Service's port 80, not the Service's port 8080 to the local machine. Option C is wrong because it incorrectly states that the local machine's port 80 is forwarded to the Service's port 8080, which is the opposite of the actual mapping (local 8080 → Service 80).

280
MCQeasy

Which access mode allows multiple pods running on different nodes to read from and write to a PersistentVolume at the same time?

A.ReadOnlyMany
B.ReadWriteMany
C.ReadWriteOnce
D.ReadWriteOncePod
AnswerB

ReadWriteMany (RWX) is the correct access mode because it allows a persistent volume to be mounted concurrently by multiple nodes with both read and write capabilities. This enables multiple pods distributed across different nodes in the cluster to share, read, and write to the same underlying storage system simultaneously.

Why this answer

ReadWriteMany (RWM) is the access mode that allows multiple pods running on different nodes to simultaneously read from and write to a PersistentVolume. This is defined in the Kubernetes PersistentVolume specification and is supported by storage backends like NFS, GlusterFS, or CephFS, which provide shared filesystem semantics across network-attached storage.

Exam trap

The trap here is that candidates often confuse ReadWriteOnce (which allows multiple pods on the same node) with ReadWriteMany, forgetting that ReadWriteOnce restricts access to a single node, not just a single pod, and thus cannot support pods on different nodes.

How to eliminate wrong answers

Option A is wrong because ReadOnlyMany allows multiple pods to read from the PV simultaneously but prohibits any write operations, so it cannot support concurrent writes. Option C is wrong because ReadWriteOnce allows only a single node to mount the PV with read-write access, meaning pods on different nodes cannot write concurrently. Option D is wrong because ReadWriteOncePod restricts the PV to a single pod (even on the same node), preventing any multi-pod or multi-node concurrent access.

281
MCQeasy

A Pod is in Pending state for a long time. 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) had taints that the pod didn't tolerate'. What is the most likely issue?

A.The nodes do not have enough CPU or memory to run the Pod.
B.The Pod does not have tolerations for the taints on the nodes.
C.The nodes are not tainted, but the Pod has tolerations.
D.The scheduler is not running.
AnswerB

When a node is tainted with a NoSchedule or NoExecute effect, the kube-scheduler will reject any pod that lacks matching tolerations. The kubectl describe pod output confirms this scenario by displaying a scheduling event indicating that the pod had 0/N nodes available due to untolerated taints. Adding the appropriate tolerations to the pod specification is required to allow scheduling on these nodes.

Why this answer

The event '0/3 nodes are available: 3 node(s) had taints that the pod didn't tolerate' directly indicates that all nodes in the cluster have taints applied, and the Pod's spec does not include corresponding tolerations. Taints and tolerations work together to ensure that Pods are only scheduled onto nodes whose taints they tolerate; without matching tolerations, the scheduler will skip those nodes entirely, leaving the Pod in a Pending state.

Exam trap

CNCF often tests the distinction between taints/tolerations and resource constraints, so candidates may incorrectly assume the error is about resource exhaustion when the event message explicitly mentions taints.

How to eliminate wrong answers

Option A is wrong because insufficient CPU or memory would produce a different event, such as 'Insufficient cpu' or 'Insufficient memory', not a taint-related message. Option C is wrong because if nodes are not tainted, the Pod would be scheduled normally regardless of tolerations; the event explicitly states nodes had taints, so this scenario contradicts the observed error. Option D is wrong because if the scheduler were not running, the Pod would remain in Pending state without any scheduling events at all, and 'kubectl describe pod' would not show taint-related messages.

282
MCQhard

A Pod is stuck in 'Pending' state. You run 'kubectl describe pod my-pod' and see the event: '0/3 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate, 2 Insufficient cpu.' The pod has resource requests: cpu: 2, memory: 1Gi. The cluster has 3 nodes: one control-plane with taint node-role.kubernetes.io/master:NoSchedule, and two worker nodes each with 1 CPU. What is the most likely cause?

A.The pod requests more memory than any available node can provide.
B.The pod has a higher priority than other pods and is preempting them.
C.The pod requests more CPU than any available node can provide.
D.The control-plane node has insufficient resources.
AnswerC

The pod requests 2 CPUs, which exceeds the capacity of any individual worker node, as each worker node only provides 1 CPU. Furthermore, the control-plane node, which might have sufficient CPU, is typically tainted with `node-role.kubernetes.io/control-plane:NoSchedule` or similar, preventing the scheduler from placing this pod on it unless the pod explicitly tolerates this taint. Consequently, no suitable node exists in the cluster to satisfy the pod's CPU request, leading to its Pending status.

Why this answer

The pod requests 2 CPU, but each worker node has only 1 CPU, making them insufficient. The control-plane node has the taint `node-role.kubernetes.io/master:NoSchedule` which the pod does not tolerate, so it is also unavailable. The event explicitly states '2 Insufficient cpu', confirming that the CPU request cannot be satisfied by any node.

Exam trap

The trap here is that candidates may focus on the taint message and assume the control-plane node's resources are the issue (Option D), or misinterpret the 'Insufficient cpu' as a memory problem (Option A), rather than recognizing that the CPU request exceeds the capacity of the only schedulable nodes (the workers).

How to eliminate wrong answers

Option A is wrong because the pod requests 1Gi memory, which is well within the capacity of any node (worker nodes typically have more than 1Gi memory), and the event does not mention memory insufficiency. Option B is wrong because priority and preemption are unrelated to the 'Pending' state caused by resource shortages; the event shows no preemption activity, and preemption would involve evicting lower-priority pods, not failing to schedule. Option D is wrong because the control-plane node is tainted with NoSchedule, making it unschedulable for this pod regardless of its resources; the issue is the taint, not insufficient resources on that node.

283
MCQeasy

Which kube-proxy mode uses iptables rules to handle service traffic?

A.ipvs
B.nftables
C.userspace
D.iptables
AnswerD

iptables is the correct mode because kube-proxy in this mode programs the kernel's iptables NAT table with rules that translate a service's ClusterIP or NodePort to a selected pod IP. These rules use statistics to randomly choose among healthy endpoints, so packet forwarding and load balancing are entirely implemented with iptables rules. As a result, the service handling is performed by iptables in the kernel, not by a userspace process.

Why this answer

Kube-proxy's iptables mode uses Linux iptables rules to handle service traffic. In this mode, kube-proxy watches the Kubernetes API server for Service and Endpoint changes and programs iptables rules in the NAT table (specifically the PREROUTING and OUTPUT chains) to redirect traffic destined for a Service's ClusterIP to the backend Pod IPs via DNAT. This is the default mode in most Kubernetes distributions due to its reliability and moderate performance.

Exam trap

The trap here is that candidates often confuse the iptables mode with the ipvs mode, assuming ipvs also uses iptables rules, but ipvs operates at a different layer (kernel-level load balancing) and does not rely on iptables for service traffic handling.

How to eliminate wrong answers

Option A is wrong because ipvs mode uses the IPVS (IP Virtual Server) kernel module to handle service traffic, not iptables; it offers better scalability and performance for large clusters by using a hash table instead of a linear rule chain. Option B is wrong because nftables is a modern replacement for iptables, but kube-proxy does not have a native nftables mode; the iptables mode uses legacy iptables, not nftables. Option C is wrong because userspace mode is an older, deprecated mode where kube-proxy runs in userspace and proxies traffic through a userspace process, not using iptables rules for packet forwarding.

284
MCQhard

A StatefulSet named 'mysql' manages 3 replicas. You need to scale it down to 1 replica. What happens to the PersistentVolumeClaims (PVCs) of the removed pods?

A.The PVCs are retained to preserve data.
B.The PVCs are automatically backed up before deletion.
C.The PVCs are retained only if the pod with the highest ordinal is removed first.
D.The PVCs are automatically deleted along with the pods.
AnswerA

When a StatefulSet is scaled down or deleted, Kubernetes intentionally preserves the associated PersistentVolumeClaims (PVCs) to prevent accidental data loss. This ensures that if the StatefulSet is scaled back up or recreated, the new pods can seamlessly reattach to their existing storage volumes and resume operations with their historical data intact.

Why this answer

When a StatefulSet is scaled down, the PersistentVolumeClaims (PVCs) associated with the removed pods are retained by default. This is because StatefulSets are designed for stateful workloads where data persistence is critical; the PVCs remain to preserve data in case the pod is recreated or the StatefulSet is scaled up again. Kubernetes does not automatically delete PVCs when a StatefulSet pod is removed, as PVC lifecycle is independent of pod lifecycle.

Exam trap

The trap here is that candidates often confuse StatefulSet PVC behavior with that of Deployments or Jobs, where pods and their volumes are ephemeral, leading them to incorrectly assume PVCs are automatically deleted on scale-down.

How to eliminate wrong answers

Option B is wrong because Kubernetes does not have an automatic backup mechanism for PVCs when scaling down a StatefulSet; PVCs are simply retained, not backed up. Option C is wrong because PVCs are retained regardless of which pod (highest ordinal or not) is removed first; the ordinal-based removal order only affects pod naming, not PVC retention. Option D is wrong because PVCs are not automatically deleted when pods are removed; they persist until explicitly deleted by the user or through a configured StorageClass with reclaimPolicy: Delete, which is not the default behavior for StatefulSet PVCs.

285
MCQmedium

A pod is in 'Pending' state. 'kubectl describe pod' shows '0/4 nodes are available: 1 node(s) had taint that the pod didn't tolerate, 2 node(s) didn't match pod's node affinity/selector, 1 node(s) had insufficient memory'. What does this indicate?

A.The pod's image pull failed on all nodes
B.The pod will eventually be scheduled when resources free up
C.The pod is unschedulable due to multiple constraints
D.The pod has a resource limit that prevents it from running
AnswerC

Correct. The '0/N' node count in kubectl describe means the scheduler evaluated all nodes and none satisfied the pod's combined requirements, such as nodeSelector, node affinity, required tolerations, or disk/resource requests. The pod's PodScheduled condition is False with a reason of Unschedulable, and events show failedScheduling. Multiple simultaneous constraints each eliminate different nodes, leaving no feasible candidate.

Why this answer

The 'Pending' state combined with the scheduler's message '0/4 nodes are available' and the listed reasons (taints, node affinity/selector mismatches, insufficient memory) indicates that the pod cannot be placed on any node due to multiple constraints. The scheduler evaluates all nodes and finds none that satisfy the pod's requirements, making the pod unschedulable. This is not a transient resource issue but a combination of scheduling constraints that must be resolved manually.

Exam trap

CNCF often tests the distinction between resource requests and limits, and candidates mistakenly think limits affect scheduling, when in fact only requests are considered by the scheduler's PodFitsResources predicate.

How to eliminate wrong answers

Option A is wrong because image pull failures produce 'ImagePullBackOff' or 'ErrImagePull' events, not a 'Pending' state with node availability messages. Option B is wrong because the message includes taints and affinity/selector mismatches, which are not resolved by freeing resources; only the 'insufficient memory' issue might clear up, but the other constraints are permanent until the pod or nodes are reconfigured. Option D is wrong because resource limits (spec.containers[].resources.limits) affect runtime behavior (e.g., OOMKill) but do not prevent scheduling; scheduling is blocked by resource requests (spec.containers[].resources.requests) or node capacity, not limits.

286
MCQeasy

Which component is responsible for managing the lifecycle of pods on a node?

A.kube-scheduler
B.kube-controller-manager
C.kubelet
D.kube-proxy
AnswerC

The kubelet is the primary node agent that interacts with the container runtime via the Container Runtime Interface (CRI) to manage the lifecycle of pods assigned to its node. It ensures that the containers described in the PodSpecs are running and healthy, executing liveness and readiness probes, and reporting status back to the API server.

Why this answer

The kubelet is the primary node agent that runs on each node in a Kubernetes cluster. It is responsible for ensuring that containers are running in a pod as expected, managing the pod lifecycle by communicating with the container runtime (e.g., containerd or CRI-O) and reporting the node and pod status back to the API server.

Exam trap

The trap here is that candidates often confuse the kube-scheduler (which places pods on nodes) with the kubelet (which actually runs and manages them), or think the kube-controller-manager handles node-level pod operations.

How to eliminate wrong answers

Option A is wrong because the kube-scheduler is responsible for assigning pods to nodes based on resource availability and constraints, not for managing pods on a node. Option B is wrong because the kube-controller-manager runs controllers (e.g., ReplicaSet, Node controller) that regulate the desired state of the cluster, but it does not directly manage pod lifecycles on individual nodes. Option D is wrong because kube-proxy handles network proxying and load balancing for services on each node, not pod lifecycle management.

287
MCQmedium

You need to check the resource usage of nodes in your cluster. Which command should you run?

A.kubectl top nodes
B.kubectl get nodes -o wide
C.kubectl logs --all-containers
D.kubectl describe nodes
AnswerA

The "kubectl top nodes" command queries the Metrics Server API to retrieve and display the current, real-time CPU and memory utilization of all nodes in the cluster. This is the standard, built-in command used by administrators to quickly identify resource-constrained nodes. It requires the Metrics Server to be properly installed and running in the cluster to function.

Why this answer

`kubectl top nodes` retrieves and displays real-time CPU and memory usage metrics for all nodes in the cluster. This command relies on the metrics server being deployed and functioning, which aggregates resource usage data from kubelet’s cAdvisor endpoint. It is the standard Kubernetes command for checking node-level resource consumption.

Exam trap

The trap here is that candidates often confuse `kubectl describe nodes` (which shows static capacity and allocatable resources) with `kubectl top nodes` (which shows dynamic, real-time usage), leading them to choose option D when they need actual consumption data.

How to eliminate wrong answers

Option B is wrong because `kubectl get nodes -o wide` shows additional node information such as internal IP, external IP, and OS image, but does not display resource usage metrics. Option C is wrong because `kubectl logs --all-containers` retrieves container logs from a pod, not node-level resource usage. Option D is wrong because `kubectl describe nodes` provides detailed node status, conditions, and capacity/allocatable resources, but does not show current real-time resource consumption like `kubectl top nodes` does.

288
Multi-Selectmedium

Which TWO taint effects can be used to prevent a pod from being scheduled on a node unless it has a matching toleration?

Select 2 answers
A.PreferNoSchedule
B.NoExecute
C.NoSchedule
D.FailSchedule
E.NoAdmit
AnswersB, C

NoExecute is one of the two valid taint effects that actively prevent pods from being scheduled on a tainted node. In addition to preventing new pods without the toleration from landing there, it also evicts any existing pods on the node that do not tolerate the taint. This makes NoExecute the most aggressive effect, as it immediately removes running workloads, unlike NoSchedule which only blocks future scheduling.

Why this answer

NoSchedule (C) is correct because it is a taint effect that prevents new pods from being scheduled onto a tainted node unless the pod has a matching toleration; existing pods already running on the node are not evicted. NoExecute (B) is also correct because it not only prevents scheduling of pods without a matching toleration but also evicts already-running pods that do not tolerate the taint, making it a valid taint effect for blocking scheduling. PreferNoSchedule (A) is a soft preference, so the scheduler will try to avoid the node but may still place a pod there without a toleration, so it does not strictly prevent scheduling.

FailSchedule (D) and NoAdmit (E) are not valid Kubernetes taint effects; the only supported effects are NoSchedule, PreferNoSchedule, and NoExecute.

Exam trap

The trap here is that candidates often confuse `PreferNoSchedule` with a hard scheduling constraint, but it only provides a soft preference and does not prevent scheduling, unlike `NoSchedule` and `NoExecute` which are hard constraints.

289
Multi-Selectmedium

Which of the following are valid methods to debug a failing CoreDNS pod? (Select TWO)

Select 2 answers
A.kubectl logs -n kube-system -l k8s-app=kube-dns
B.kubectl delete pod -n kube-system -l k8s-app=kube-dns
C.kubectl get endpoints -n kube-system kube-dns
D.kubectl scale deployment coredns --replicas=2
E.kubectl run -it --rm test --image=busybox -- nslookup kubernetes.default
AnswersA, C

This command retrieves the current logs from every CoreDNS pod by targeting the standard label selector `k8s-app=kube-dns` in the `kube-system` namespace. Since CoreDNS is normally deployed as a Deployment with multiple replicas, the `-l` flag aggregates output from all pods, allowing you to spot query processing errors, panics, or plugin misconfigurations (e.g., kubernetes plugin failures, upstream resolution timeouts) that would not be visible if you inspected only a single pod. Logs directly reveal whether DNS requests are reaching CoreDNS and how it handles them, making this the first-line diagnostic method.

Why this answer

`kubectl logs -n kube-system -l k8s-app=kube-dns` retrieves the logs from all CoreDNS pods (which are labeled `k8s-app=kube-dns` in the `kube-system` namespace). This is a direct method to inspect errors, crashes, or misconfigurations in the DNS service. Option C is correct because `kubectl get endpoints -n kube-system kube-dns` shows the IP addresses of the pods backing the `kube-dns` service; if the endpoint list is empty, it indicates that no CoreDNS pods are ready to serve DNS requests, which is a common failure point.

Exam trap

The trap here is that candidates confuse debugging actions (like checking logs or endpoints) with recovery actions (like deleting or scaling pods), and they may also mistake client-side DNS tests (like `nslookup`) for pod-level debugging, which only confirms the symptom, not the cause.

Why the other options are wrong

B

Deleting a pod is a fix, not a debug method.

D

Scaling is a fix, not debugging.

E

This tests DNS resolution, not debugging CoreDNS pod itself.

290
Multi-Selectmedium

Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)

Select 3 answers
A.Upgrade kubelet and kubectl on the node.
B.Upgrade kubeadm on the node to the target version.
C.Upgrade the container runtime to a compatible version.
D.Drain the node before upgrading it.
E.Run 'kubeadm upgrade apply' on the worker node.
AnswersA, B, D

kubelet and kubectl are not automatically upgraded by kubeadm; you must manually update these binaries on each node using your package manager (e.g., apt-get upgrade kubelet kubectl) or by replacing them in /usr/bin. This manual step is required because kubeadm upgrade node only handles the static pod manifests and kubeadm configuration, not the kubelet or kubectl client versions.

Why this answer

After upgrading kubeadm on the control plane, you must upgrade kubelet and kubectl on each node to match the target Kubernetes version. The kubelet is the primary node agent that communicates with the control plane, and kubectl is the CLI tool used to interact with the cluster. Without upgrading these components, the node may fail to register or report an incompatible version, causing the node to be in a NotReady state.

Exam trap

The trap here is that candidates often confuse the 'kubeadm upgrade apply' command, thinking it can be run on any node, when in fact it must be executed on the control plane node, while worker nodes require 'kubeadm upgrade node'.

291
MCQmedium

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

A.kubectl drain node1
B.kubectl cordon node1
C.kubectl taint nodes node1 key=value:NoSchedule
D.kubectl delete node node1
AnswerB

The `kubectl cordon node1` command is the standard and safest way to mark a node as unschedulable. It updates the node's spec to set `unschedulable: true`, which prevents the Kubernetes scheduler from placing any new pods onto it, while leaving all currently running pods completely unaffected.

Why this answer

The `kubectl cordon node1` command marks the node as unschedulable, preventing new pods from being scheduled onto it while leaving existing pods running. This is the correct approach when you need to isolate a node for maintenance without disrupting current workloads.

Exam trap

The trap here is that candidates often confuse `cordon` with `drain` or `taint`, thinking that draining is required to prevent scheduling, or that tainting is the only way to achieve this, but `cordon` is the simplest and most direct command for marking a node unschedulable without affecting running pods.

How to eliminate wrong answers

Option A is wrong because `kubectl drain node1` evicts all pods from the node (with graceful termination), which would affect running pods, contrary to the requirement. Option C is wrong because `kubectl taint nodes node1 key=value:NoSchedule` adds a taint that prevents new pods from being scheduled unless they tolerate the taint, but it does not affect existing pods; however, the question asks for a command that prevents new pods without affecting running pods, and while tainting can achieve this, it is not the standard or simplest command for this purpose—cordon is the direct and intended tool. Option D is wrong because `kubectl delete node node1` removes the node object from the cluster, which would cause the kubelet to lose registration and potentially affect running pods (they would be terminated or orphaned), and it is a destructive action not suitable for simple scheduling prevention.

292
Multi-Selecthard

You have a Pod that is in CrashLoopBackOff. Which TWO of the following commands would be most helpful in diagnosing the issue?

Select 2 answers
A.kubectl get events --all-namespaces
B.kubectl logs <pod-name> --previous
C.kubectl describe pod <pod-name>
D.kubectl logs <pod-name>
E.kubectl top pod <pod-name>
AnswersB, C

When a container crashes and restarts, standard log commands only show the output of the currently running instance. Appending the `--previous` flag retrieves the stdout and stderr logs from the prior, terminated instance of the container, which typically contains the stack trace or error that caused the crash.

Why this answer

Option B, `kubectl logs <pod-name> --previous`, is correct because CrashLoopBackOff means the container has already restarted, so the `--previous` flag retrieves the logs from the last terminated container instance, which typically contains the actual crash/error output that caused the failure. Option C, `kubectl describe pod <pod-name>`, is correct because it shows the Pod's status conditions, container states (Waiting/Terminated with reason and exit code), restart count, and recent events such as image pull errors, OOMKilled, or failed probes, which are essential for pinpointing why the container keeps crashing. Option A, `kubectl get events --all-namespaces`, is not the best choice because it returns a broad cluster-wide event stream that is noisy and not scoped to the specific Pod, making it less efficient than describing the Pod itself.

Option D, `kubectl logs <pod-name>`, is not the most helpful here because without `--previous` it targets the current container instance, which may not have produced logs yet or may not exist if the container is stuck restarting. Option E, `kubectl top pod <pod-name>`, is incorrect because it only reports CPU and memory usage metrics and provides no diagnostic information about the crash cause.

Exam trap

The trap here is that candidates often pick `kubectl logs <pod-name>` (option D) without `--previous`, not realizing that in a CrashLoopBackOff the current container may have no useful logs, while the previous terminated container holds the error details.

293
MCQhard

A pod is stuck in Pending with event '0/4 nodes are available: 1 node(s) had taint "node.kubernetes.io/disk-pressure", and 3 node(s) had taint "node.kubernetes.io/memory-pressure", that the pod didn't tolerate'. What is the best approach to schedule the pod?

A.Use 'kubectl taint nodes --all node.kubernetes.io/disk-pressure- node.kubernetes.io/memory-pressure-' to remove the taints
B.Add tolerations for both taints to the pod spec
C.Free up disk space and reduce memory usage on the affected nodes
D.Delete the pod and recreate it with higher resource requests
AnswerC

The correct action is to free disk space and reduce memory consumption on the affected nodes. When the underlying pressure conditions clear, the kubelet automatically removes the corresponding taints, allowing the pending pod to schedule normally. This directly addresses the root cause of the unschedulable state and aligns with Kubernetes' intended behavior of reflecting node health through taints and conditions.

Why this answer

The cluster has nodes with disk-pressure and memory-pressure taints. These are typically added by the node controller when resources are low. The pod does not tolerate these taints.

The best approach is to free resources on the nodes or add tolerations; however, tolerating pressure taints is not recommended as it can cause further instability. Usually, you should resolve the underlying resource issues.

294
MCQeasy

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

A.kubectl expose pod my-pod --port=8080
B.kubectl proxy --port=8080
C.kubectl port-forward service/my-service 8080:8080
D.kubectl port-forward pod/my-pod 8080:8080
AnswerD

This command successfully establishes a secure, temporary tunnel from your local machine's port 8080 directly to port 8080 of the specified pod. It is the standard, lightweight method for debugging and interacting with a pod's endpoint without exposing it to the wider network.

Why this answer

`kubectl port-forward` creates a direct tunnel from a local port to a specific pod, allowing you to access the pod's HTTP endpoint on port 8080 from your local machine on port 8080. This command targets the pod directly (`pod/my-pod`) and maps local port 8080 to the pod's port 8080, which is exactly what the question requires for temporary, ad-hoc access without creating a Service.

Exam trap

The trap here is that candidates often confuse `kubectl port-forward` with `kubectl expose` or `kubectl proxy`, thinking those commands provide direct pod access, when in fact `port-forward` is the only command that creates a direct, temporary tunnel from a local port to a specific pod's port without creating a Service or proxying through the API server.

How to eliminate wrong answers

Option A is wrong because `kubectl expose` creates a Kubernetes Service object (e.g., ClusterIP, NodePort) that persists in the cluster, not a temporary local port forward; it does not directly expose the pod to your local machine on port 8080. Option B is wrong because `kubectl proxy` creates a local HTTP proxy to the Kubernetes API server, not a direct tunnel to a specific pod's port; it requires additional URL path manipulation to reach a pod and does not map local port 8080 to the pod's port 8080. Option C is wrong because it targets a Service (`service/my-service`) rather than the pod itself; while `port-forward` works with Services, the question explicitly asks to access a pod's HTTP endpoint, and using a Service introduces an extra layer that may not be available or desired for temporary direct pod access.

295
MCQmedium

You run 'kubectl get pods' and see a pod with status 'Init:CrashLoopBackOff'. What does this indicate?

A.An init container in the pod is failing and restarting
B.The pod's init container ran successfully but the main container has not started yet
C.The pod is still initializing but will eventually run
D.The main container is crashing and the pod is restarting
AnswerA

When a pod's status displays Init:CrashLoopBackOff, it indicates that one of its defined init containers has exited with a non-zero status code and is repeatedly failing during startup. Kubernetes will continuously attempt to restart this failing init container before it can proceed to the main application containers, blocking the pod from reaching the Running state.

Why this answer

The status 'Init:CrashLoopBackOff' indicates that an init container within the pod is failing and being repeatedly restarted by Kubernetes. Init containers run sequentially before any main containers start, and if one exits with a non-zero exit code, Kubernetes retries it with an exponential backoff delay, leading to the CrashLoopBackOff state. This is distinct from a main container crash, which would show 'CrashLoopBackOff' without the 'Init:' prefix.

Exam trap

The CKA exam often tests the distinction between init container failures and main container failures by using the 'Init:' prefix in the status, so candidates who overlook this prefix may mistakenly choose the main container crash option.

How to eliminate wrong answers

Option B is wrong because if an init container ran successfully, the pod would proceed to start the main container, not remain in an 'Init:' status; the 'Init:' prefix specifically indicates an init container is still running or failing. Option C is wrong because 'Init:CrashLoopBackOff' is not a transient initialization state—it signals a persistent failure with restarts, not eventual success without intervention. Option D is wrong because a crashing main container would show 'CrashLoopBackOff' (without 'Init:'), not 'Init:CrashLoopBackOff', which explicitly points to an init container issue.

296
MCQmedium

Which subcommand of 'kubectl config' is used to switch between different contexts?

A.kubectl config switch-context
B.kubectl config set-context
C.kubectl config current-context
D.kubectl config use-context
AnswerD

`kubectl config use-context` writes the named context into the `current-context` field of kubeconfig, so subsequent kubectl commands target that cluster, user and namespace combination. It directly satisfies the requirement to switch between contexts, unlike `set-context`, which only modifies a context's properties without activating it.

Why this answer

'kubectl config use-context' is the exact subcommand used to switch the current context in a kubeconfig file. This command updates the 'current-context' field in the kubeconfig, directing all subsequent kubectl commands to the specified cluster, namespace, and user combination.

Exam trap

The trap here is that candidates confuse 'set-context' (which modifies context definitions) with 'use-context' (which switches the active context), leading them to choose option B instead of D.

How to eliminate wrong answers

Option A is wrong because 'kubectl config switch-context' is not a valid kubectl subcommand; kubectl does not have a 'switch-context' command. Option B is wrong because 'kubectl config set-context' is used to modify or create a context definition (e.g., setting cluster, user, or namespace), but it does not change the active/current context. Option C is wrong because 'kubectl config current-context' only displays the name of the currently active context, without switching to a different one.

297
MCQmedium

You run `kubectl port-forward service/my-svc 8080:80`. What does this command do?

A.It forwards local port 8080 to port 80 on a Pod selected by the Service, bypassing the Service's ClusterIP.
B.It forwards traffic from port 80 to port 8080 within the cluster.
C.It creates a LoadBalancer Service on port 8080 forwarding to port 80.
D.It exposes the Service on each node's port 8080.
AnswerA

Port-forward resolves the Service to a backing Pod and tunnels local 8080 directly to that Pod's port 80, bypassing the ClusterIP entirely. This satisfies the scenario's constraint of reaching a Service-selected Pod without routing through the virtual IP.

Why this answer

The `kubectl port-forward` command forwards connections from a local port to a port on a Pod. When you specify a Service (e.g., `service/my-svc`), kubectl automatically selects an active Pod matching the Service's selector and forwards the traffic directly to that Pod. It completely bypasses the Service's ClusterIP and kube-proxy routing.

Exam trap

Candidates often mistakenly believe that `kubectl port-forward` routes traffic through the Service's ClusterIP. In reality, it resolves the Service's selector, picks a backing Pod, and establishes a direct tunnel to that Pod via the API server and the node's kubelet.

How to eliminate wrong answers

Option B is wrong because it describes the direction of traffic backwards: port-forward forwards from a local port to a remote port, not from port 80 to port 8080 within the cluster. Option C is wrong because port-forward does not create or modify any Service object; it is a temporary client-side tunnel, not a LoadBalancer Service creation. Option D is wrong because port-forward does not expose the Service on each node's port; that would be achieved by a NodePort Service, not by kubectl port-forward.

298
MCQeasy

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

A.kubectl exec -it web-pod -- nc -l -p 8080
B.kubectl proxy --port=8080
C.kubectl expose pod web-pod --port=8080 --target-port=80
D.kubectl port-forward pod/web-pod 8080:80
AnswerD

kubectl port-forward pod/web-pod 8080:80 creates a direct TCP tunnel from your localhost:8080 to port 80 inside web-pod via the Kubernetes API server. The pod/<name> resource identifier and the local:remote port pair are the correct port-forward syntax, and this is the intended command for one-off debugging access. It keeps running until interrupted.

Why this answer

`kubectl port-forward` creates a direct tunnel from a local port to a specified port on a pod, allowing access to the pod's service without exposing it externally. The syntax `pod/web-pod 8080:80` forwards localhost:8080 to port 80 of the pod named 'web-pod'.

Exam trap

The trap here is that candidates confuse `kubectl port-forward` with `kubectl expose` or `kubectl proxy`, mistakenly thinking that creating a Service or a proxy is the correct way to forward a local port to a specific pod, when in fact `port-forward` is the only command that creates a direct local-to-pod tunnel.

How to eliminate wrong answers

Option A is wrong because `kubectl exec -it web-pod -- nc -l -p 8080` starts a netcat listener inside the pod on port 8080, which does not forward a local port to the pod's port 80; it listens on a different port inside the container. Option B is wrong because `kubectl proxy --port=8080` creates a proxy server that forwards traffic to the Kubernetes API server, not to a specific pod's port 80. Option C is wrong because `kubectl expose pod web-pod --port=8080 --target-port=80` creates a Service object that exposes the pod within the cluster, but it does not forward a local port to the pod; it requires additional steps like `kubectl get svc` and accessing via the service IP or node port.

299
MCQmedium

You run kubectl get nodes and see one node is NotReady. The kubelet is running on the node. What is the most likely cause?

A.The kubelet is not installed
B.Network connectivity issue between kubelet and API server
C.The node has been cordoned
D.The API server is down
AnswerB

This is the correct answer. The kubelet is responsible for reporting the node's status to the API server through periodic heartbeat updates. When there is a network connectivity issue between the kubelet and the API server, the API server's node controller does not receive these updates for longer than the node-monitor-grace-period (default 40 seconds). As a result, the node is marked as NotReady, even though the kubelet process itself continues to run locally and can still manage containers on the node.

Why this answer

When a node is NotReady but the kubelet is running, the most common cause is a network connectivity issue between the kubelet and the API server. The kubelet reports node status via periodic heartbeats (node-status-update-frequency, default 10s) and if the API server cannot receive these updates due to network problems (e.g., firewall rules, DNS resolution failure, or dropped packets), the node controller marks the node as NotReady after the node-monitor-grace-period (default 40s). The kubelet being running eliminates installation issues, and the API server being down would affect all nodes, not just one.

Exam trap

The trap here is that candidates confuse 'cordon' (which affects scheduling but not readiness) with 'NotReady' (which indicates a health or connectivity failure), leading them to pick Option C when the node is actually unreachable.

Why the other options are wrong

A

Question states kubelet is running.

C

Cordoning makes node Unschedulable, not NotReady.

D

If API server is down, kubectl get nodes would fail, not show NotReady.

300
MCQmedium

A developer reports that a Pod named 'web-pod' in namespace 'frontend' is crashing repeatedly. You run 'kubectl logs web-pod -n frontend' but see no output. Which command should you run next to see the logs from the previous, crashed container instance?

A.kubectl get events -n frontend --sort-by=.metadata.creationTimestamp
B.kubectl logs web-pod -n frontend --previous
C.kubectl logs web-pod -n frontend -c web-pod
D.kubectl exec -it web-pod -n frontend -- sh
AnswerB

This command is the correct approach because the --previous (or -p) flag instructs the kubelet to retrieve the stdout and stderr logs from the most recently terminated instance of the container. This is essential for diagnosing CrashLoopBackOff states where the current container has restarted and its active log buffer is empty or irrelevant.

Why this answer

The `kubectl logs --previous` flag retrieves logs from the previous instance of a container in a Pod, which is exactly what you need when the current container has crashed and restarted, leaving no logs from the current instance. Since `kubectl logs web-pod -n frontend` returned no output, the current container likely started fresh after a crash, and the logs from the crashed container are stored in the terminated container's log file. This flag accesses those logs without needing to specify a container name explicitly when there is only one container in the Pod.

Exam trap

The trap here is that candidates may think `kubectl logs` without flags is sufficient, or they may confuse `--previous` with `-c` (container name), not realizing that `--previous` is specifically designed to access logs from a terminated container instance, while `-c` only selects a container within a multi-container Pod.

How to eliminate wrong answers

Option A is wrong because `kubectl get events` shows cluster events (e.g., scheduling, pulling images) but does not provide container logs, which are needed to debug the crash. Option C is wrong because `-c web-pod` specifies a container name, but if the Pod has only one container (named 'web-pod'), this command is redundant and still fetches logs from the current (possibly empty) container, not the previous crashed instance. Option D is wrong because `kubectl exec` opens an interactive shell into the running container, but if the container is crashing repeatedly, it may not be running, and even if it were, this would not retrieve logs from the previous terminated instance.

Page 3

Page 4 of 10

Page 5

All pages