CKA Practice Question: Cluster Architecture, Installation and Configuration
Which command creates a kubeconfig file that can be used to authenticate as a specific user?
⚠ Common exam trap
Watch out — candidates often confuse `set-credentials` with `set-context`, thinking that creating a context automatically includes user credentials, when in fact the user must be defined separately before being referenced in a context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl config set-credentials
The `kubectl config set-credentials` command creates or updates a user entry in a kubeconfig file, allowing you to specify authentication credentials such as a client certificate, token, or username/password for a specific user. This is the correct way to define a user identity that can later be associated with a context via `kubectl config set-context`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl config set-context
Why it's wrong here
kubectl config set-context creates or modifies a context entry in the kubeconfig file, which is a named reference that bundles a cluster, a user, and a namespace together. However, it does not create or modify the actual user credentials—it only associates a pre-existing user with a cluster. Without having first defined the user via set-credentials, the resulting context is incomplete and cannot authenticate to the cluster.
- ✓
kubectl config set-credentials
Why this is correct
This is the correct command because it creates or updates the user entry in the kubeconfig with the necessary authentication credentials, such as --client-certificate, --client-key, --token, or --username/--password. Running this command ensures that a named user with valid credentials is available for contexts to reference. Without it, you only have cluster and context definitions but no authenticated identity to actually connect to the API server.
- ✗
kubectl config create-user
Why it's wrong here
kubectl config create-user is not a valid kubectl subcommand. The kubectl config command group only supports set-cluster, set-credentials, set-context, use-context, and view. Running this would produce an error, as the Kubernetes CLI does not have a create-user operation because credentials are managed via set-credentials.
- ✗
kubectl config set-cluster
Why it's wrong here
kubectl config set-cluster defines or modifies a cluster entry in the kubeconfig, specifying the API server's URL and optionally certificate-authority data. However, this command only configures the cluster endpoint; it contains no user authentication information. It is separate from and complementary to set-credentials, and on its own cannot produce a usable kubeconfig for authentication.
Go deeper
Related to this question
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.