Cluster Architecture, Installation and Configuration

What is the purpose of the kube-proxy component?

A node named 'worker-1' is unhealthy. You want to mark it as unschedulable and move workloads to other nodes. Which command sequence is correct?

During a cluster upgrade, what is the correct order of operations for upgrading a node?

A new Kubernetes administrator runs 'kubeadm join --token <token> <control-plane-ip>:6443 --discovery-token-ca-cert-hash sha256:<hash>' on a worker node. The join fails with 'error execution phase preflight: couldn't validate the identity of the API Server'. What is the most likely cause?

Which command correctly backs up etcd data using etcdctl with API version 3?

Which component runs on every node in a Kubernetes cluster and ensures containers are running in a pod?

You are setting up a new Kubernetes cluster using kubeadm. You run 'kubeadm init --pod-network-cidr=10.244.0.0/16' on the control plane node. The command fails with: '[preflight] Some fatal errors occurred: [ERROR CRI]: container runtime is not running: output: time="..." level=fatal msg="validate service connection: CRI v1 runtime API is not implemented for endpoint 'unix:///var/run/containerd/containerd.sock': rpc error: code = Unimplemented desc = unknown service runtime.v1.RuntimeService'"'. What is the most likely cause?

Which of the following YAML snippets correctly defines a Kubernetes Deployment with 3 replicas and a rolling update strategy?

A ClusterRole named 'pod-reader' exists that grants get, list, and watch permissions on pods. You want to bind this ClusterRole to a user 'john' in the 'development' namespace only. Which resource should you create?

A ClusterRoleBinding grants cluster-admin access to a user. Which field in the ClusterRoleBinding specifies the user?

Which of the following is NOT a control plane component in Kubernetes?

You want to upgrade the control plane from v1.28.0 to v1.29.0 using kubeadm. After upgrading kubeadm on the control plane node, which command should you run first?

Your kubeadm cluster was initialized with default certificates. You need to check the expiration of the API server certificate and renew it if necessary. Which TWO commands are appropriate? (Choose TWO.)

To make a node unschedulable without evicting existing pods, which command should be used?

An admin runs 'kubectl get pods' and sees a pod in the 'Pending' state. Which is the most likely cause?

You have a cluster with multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0 using kubeadm. What is the correct sequence of steps?

Which TWO of the following are valid ways to create a Role in the 'default' namespace that grants get and list on pods?

An administrator needs to allow a service account 'monitor-sa' in namespace 'monitoring' to read pods across all namespaces. Which RBAC resources should be created?

You are the administrator of a cluster that uses an external etcd cluster. The kube-apiserver manifest on the control-plane node contains the flag `--etcd-servers=https://10.0.0.5:2379`. You need to add a second etcd endpoint at `https://10.0.0.6:2379` to increase availability. Where should you make this change?

You are preparing to upgrade a Kubernetes cluster from v1.27 to v1.28 using kubeadm. What is the correct order of operations for upgrading the control plane nodes?

What is the default port for the Kubernetes API server?

Which command initializes a Kubernetes control plane node using kubeadm?

Which THREE are valid methods to provide authentication to the Kubernetes API server? (Select three.)

You need to prepare a worker node for maintenance. Which TWO actions should you perform? (Choose TWO.)

Which THREE components run on every worker node in a Kubernetes cluster? (Choose THREE.)

You have a ClusterRole named 'deployer' that allows creating Deployments and Services. You want to grant a ServiceAccount 'ci-cd' in namespace 'app' the permissions defined in this ClusterRole. Which TWO resources are needed? (Choose TWO.)

You have a service account named 'my-sa' in the 'default' namespace. You want to mount its token into a pod automatically. Which field in the pod spec achieves this?

An administrator needs to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. Which of the following steps is performed FIRST?

An admin attempts to restore an etcd snapshot using 'etcdctl snapshot restore' but encounters an error. Which environment variable must be set for etcdctl to work with v3 API?

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Which TWO components are part of the Kubernetes control plane? (Choose TWO.)

A Kubernetes cluster was upgraded from v1.28 to v1.29. After the upgrade, nodes report NotReady. You check kubelet logs and see: 'error: failed to run Kubelet: misconfiguration: kubelet cgroup driver: "systemd" is different from docker cgroup driver: "cgroupfs"'. What is the most likely cause?

Which TWO of the following are responsibilities of the kube-controller-manager?

Which command initializes a new Kubernetes control plane node using kubeadm?

A developer is creating a Pod with a single container that should restart only if the process exits with non-zero. Which restartPolicy should be used?

You are troubleshooting a pod that is in 'Pending' state. Running 'kubectl describe pod' shows the event: '0/3 nodes are available: 3 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate.' What is the most likely cause?

You are upgrading a cluster from v1.28 to v1.29. You have already drained and upgraded all worker nodes. The control plane nodes have not been upgraded yet. 'kubectl get nodes' shows the control plane nodes are still v1.28. What is the correct next step?

You run `kubectl get pods` and get an error: 'error: You must be logged in to the server (Unauthorized)'. What is the most likely cause?

A user reports that they cannot access a Service of type ClusterIP from within the cluster. The Service selects pods that are running and responding. Which of the following is the MOST likely cause?

You run 'kubectl get nodes' and see that one node is marked as 'NotReady'. Which component is likely failing on that node?

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node.kubernetes.io/unreachable: }, that the pod didn't tolerate'. What does this indicate?

An administrator is setting up RBAC to allow a CI/CD pipeline to create and delete pods only in the 'ci' namespace. Which combination of resources should be created?

A cluster has multiple kubeconfig files. You want to set the current context to 'admin@production' for all future kubectl commands. Which command should you run?

What is the purpose of the kube-proxy component in a Kubernetes cluster?

A developer created a ServiceAccount named 'app-sa' in the 'dev' namespace. They want a pod to use this ServiceAccount. Which field in the pod spec should be set?

A CKA candidate runs 'kubectl get nodes' and sees that a worker node is in the 'NotReady' state. Which command should be used to diagnose the node's kubelet health?

A pod's YAML specifies 'restartPolicy: Never' and the container exits with code 0. What state will the pod be in?

Which command is used to take a snapshot of etcd using etcdctl?

Which component is responsible for maintaining network rules on each node?

Which TWO commands can be used to interact with etcd snapshot operations? (Select TWO.)

A user needs to deploy a pod that requires access to the Kubernetes API server from within the pod. Which resource should be used to provide authentication credentials automatically?

A node in the cluster has been cordoned. Which of the following is true about the node?

Which TWO of the following are control plane components?

What is the function of the 'kube-scheduler' in Kubernetes?

You are upgrading a Kubernetes cluster from version 1.28 to 1.29. What is the correct order of steps?

An administrator backs up etcd data using 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. Which command correctly restores this snapshot on a new etcd instance?

Which TWO of the following are control plane components? (Select 2)

An administrator runs 'kubectl get nodes' and sees that one node is in the 'NotReady' state. Which component should be checked FIRST to diagnose the issue?

Which component is responsible for managing the lifecycle of pods on a node?

Which THREE are valid steps when upgrading a Kubernetes cluster using kubeadm? (Select 3)

A node named 'node1' is having issues. You want to prevent any new pods from being scheduled onto it without affecting running pods. Which command should you use?

Which subcommand of 'kubectl config' is used to switch between different contexts?

A developer needs to access the Kubernetes API from a pod using a ServiceAccount. Which of the following is the recommended way to mount the ServiceAccount token into a pod?

You have a multi-node Kubernetes cluster. After upgrading the kubelet on a worker node, the node remains in 'NotReady' state. Which TWO actions should you take to troubleshoot? (Choose TWO.)

You have a Kubernetes cluster with a single control-plane node and multiple worker nodes. You need to upgrade the cluster from v1.28.0 to v1.29.0. Which sequence of steps is correct?

What is the purpose of the 'kubeadm reset' command?

Which kubectl command is used to drain a node before performing maintenance?

Which command initializes a new Kubernetes cluster using kubeadm?

Which control plane component is responsible for storing the cluster state and configuration?

To back up etcd, which command should be used with etcdctl?

A node has been cordoned. Which statement about the node is true?

What is the purpose of 'kubeadm reset'?

Which TWO commands can be used to view the configuration of a kubeconfig file?

Which component is responsible for managing the network rules and forwarding on each node?

Which command is used to create a backup of etcd data using etcdctl?

You have configured a ServiceAccount with an associated image pull secret. The Pod referencing this ServiceAccount still fails with ImagePullBackOff due to authentication errors. What is the most likely misconfiguration?

An admin wants to view the current context in their kubeconfig. Which command should they use?

Which TWO of the following are valid methods to authenticate to the Kubernetes API server?

You are using kubeadm to initialize a cluster. After running 'kubeadm init', you follow the instructions to set up the kubeconfig for the regular user. Which of the following commands should you run to allow kubectl to communicate with the cluster?

You need to renew all certificates on a kubeadm-managed cluster. Which command accomplishes this?

You have taken an etcd snapshot using 'ETCDCTL_API=3 etcdctl snapshot save snapshot.db'. Which TWO commands are needed to restore this snapshot to a new etcd member? (Choose TWO.)

Which command allows you to view the current context in a kubeconfig file?

Which command is used to backup etcd data using etcdctl?

Which component is responsible for maintaining the desired state of the cluster, such as ensuring the correct number of replicas for a Deployment?

Which command is used to check the expiration of certificates managed by kubeadm?

You have an etcd cluster with three members. You need to take a snapshot for disaster recovery. Which command correctly creates a snapshot?

Which component on a worker node is responsible for maintaining network rules and forwarding traffic to the correct pod?

An admin wants to check the expiration date of all certificates used by kubeadm components. Which command should be used?

An administrator runs 'kubectl get pods' and sees a pod stuck in 'Pending' state. Which of the following is NOT a typical cause?

Which TWO components are part of the Kubernetes control plane? (Select two.)

Which TWO components run on worker nodes? (Select 2)

You need to create a RoleBinding that grants a user access to read Pods in the 'dev' namespace. Which YAML manifest is correct?

Which command can you use to check the expiration date of certificates managed by kubeadm?

Which kubectl command is used to view the current context in the kubeconfig file?

You need to check the expiration date of certificates used by the kube-apiserver. Which command should you use?

Which command is used to initialize a Kubernetes cluster using kubeadm?

An admin runs 'kubectl get pods' and sees a pod in 'Pending' state for a long time. 'kubectl describe pod' shows '0/1 nodes are available: 1 node has memory pressure'. Which is the most likely cause?

Which kubectl command is used to mark a node as unschedulable for new pods without affecting existing running pods?

You run 'kubectl cordon node1'. Which TWO statements describe the effect of this command? (Choose TWO.)

Which THREE of the following are components of the Kubernetes control plane? (Choose THREE.)

You need to drain a node 'node1' and ensure that pods are evicted gracefully. Which command should you use?

You are performing a backup of etcd using the command: 'ETCDCTL_API=3 etcdctl snapshot save /backup/etcd-snapshot.db'. You get an error: 'Error: context deadline exceeded'. What is the most likely cause?

An administrator runs 'kubectl cordon node1' and then 'kubectl drain node1 --ignore-daemonsets'. What is the effect on node1?

You need to back up etcd data for a cluster with etcd running as a static Pod. Which command should you use?

You have a kubeconfig file with multiple contexts. You want to temporarily switch to a different context for a single kubectl command. Which flag should you use?

Which command displays the expiration date of all certificates managed by kubeadm?

You need to back up etcd on a single control plane node. Which command correctly creates a snapshot?

Which component is responsible for maintaining network rules on each worker node to enable service discovery and load balancing?

You need to grant a ServiceAccount named 'monitor-sa' in namespace 'monitoring' the ability to read Pods and Services across all namespaces. Which TWO resources are needed? (Choose TWO.)

You have multiple kubeconfig files. Which command merges them into a single config file?

An administrator runs 'kubectl get nodes' and sees that a worker node is in the 'Ready,SchedulingDisabled' state. Which command was most likely executed on that node?

A developer needs to create a Role that allows listing pods in the 'dev' namespace. Which YAML snippet correctly defines this Role?

Which THREE components must be present in a high-availability control plane setup?

Which TWO of the following are valid methods to configure kubectl to use a specific context?

An administrator runs 'kubectl run test-pod --image=nginx' and the pod is created but stays in 'Pending' state. Which command would BEST help diagnose why the pod is not running?

Which kubectl command is used to mark a node as unschedulable so that no new pods are scheduled onto it?

A cluster was installed using kubeadm. You need to upgrade the cluster from v1.28 to v1.29. Which of the following is the correct order of operations?

Which command is used to take a snapshot of etcd data for backup?

Which component is responsible for maintaining network rules on worker nodes?

Which command is used to mark a node as unschedulable and evict its pods?

You are setting up a new Kubernetes cluster using kubeadm. After running 'kubeadm init', you want to start using the cluster with kubectl. Which of the following commands should you run to configure kubectl for the admin user?

Which component is responsible for assigning pods to nodes?

Which TWO are true about taints and tolerations? (Select 2)

A developer wants to run a one-time batch job that processes data and then exits. Which Kubernetes resource should be used?

Which component is responsible for running containers on a node and reporting their status to the control plane?

An administrator creates a ServiceAccount named 'monitor' in the 'default' namespace. They want any pod using this ServiceAccount to be able to list pods cluster-wide. Which RBAC resource should be created and bound to this ServiceAccount?

You need to create a ServiceAccount named 'deployer' and grant it permission to create Deployments in namespace 'app'. Which YAML snippet correctly creates the necessary RBAC resources?

Which component on a worker node is responsible for maintaining network rules and enabling service abstraction?

You are applying the following RBAC manifest: --- apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: development name: pod-reader rules: - apiGroups: [""] resources: ["pods"] verbs: ["get", "watch", "list"] Which TWO statements are true about this Role? (Choose TWO.)

A pod is stuck in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/master: }, that the pod didn't tolerate'. What is the most likely cause?

Which component is responsible for running containers on a Kubernetes node?

You initialize a cluster with 'kubeadm init' and want to join a worker node. What is the correct command to generate the join command?

Which kubeconfig context is currently active?

You need to back up etcd data for a cluster running Kubernetes v1.29. Which command correctly creates a snapshot?

To check the expiration date of all certificates managed by kubeadm, which command should you run?

Which of the following is NOT a control plane component?

A user reports that they can't authenticate to the cluster using a kubeconfig file. Running 'kubectl config view' shows the current context points to a user with client certificate and key. Which command checks the expiration date of the client certificate?

Your cluster has three control plane nodes. You suspect the etcd cluster has a leader election issue. Which TWO commands can help diagnose the etcd cluster health and membership? (Choose TWO.)

You are asked to backup the etcd database on a control plane node. The etcd is running as a static pod. Which command sequence will create a consistent snapshot?

You have a kubeconfig file with multiple contexts. How do you switch to the context named 'prod-cluster'?

A ServiceAccount 'monitor-sa' needs to be able to list Pods in namespace 'monitoring'. Which RBAC configuration is appropriate?

A developer created a ClusterRole named 'pod-reader' with rules to get and list pods. They created a ClusterRoleBinding 'read-pods-global' binding this ClusterRole to a service account 'sa-pod-reader' in the 'default' namespace. Which of the following is true about the permissions of this service account?

Which control plane component stores the entire cluster state?

After upgrading the control plane using kubeadm, you need to update the kubelet configuration on the node. Which command should you run on the node?

An administrator runs 'kubectl get pods' and sees a pod in 'Pending' state. The output of 'kubectl describe pod pod-name' shows '0/1 nodes are available: 1 node(s) had taint that the pod didn't tolerate'. What is the most likely cause?

You run 'kubeadm certs check-expiration' and see that the 'apiserver' certificate expires in 30 days. What is the correct way to renew just that certificate using kubeadm?

You need to allow a specific user to create and manage deployments in the 'development' namespace only. Which RBAC resources should you create?

Which kubeconfig context field defines the set of users, clusters, and namespaces for kubectl operations?

You need to back up the etcd database for a kubeadm-created cluster. Which directory contains the etcd data?

Which of the following is a core control plane component of Kubernetes?

Which TWO components are part of the Kubernetes control plane? (Select 2)

Which command creates a kubeconfig file that can be used to authenticate as a specific user?

Which component is responsible for running containers on a node?

Which of the following is a core control plane component responsible for persisting cluster state?

A Pod is stuck in Pending state. Running 'kubectl describe pod' shows '0/3 nodes are available: 1 node(s) had taint {node-role.kubernetes.io/control-plane: }, 2 node(s) had taint {node-role.kubernetes.io/master: }'. The Pod does not have tolerations. What is the most likely cause?

You need to upgrade a Kubernetes cluster from v1.28 to v1.29 using kubeadm. After upgrading the control plane, what should you do on each worker node?

You need to create a Kubernetes ServiceAccount named 'build-bot' and ensure that pods using this ServiceAccount can authenticate to the Kubernetes API using a long-lived token. Which TWO steps are necessary? (Choose TWO.)

Which TWO commands can be used to check the expiration of certificates managed by kubeadm?