CKA Practice Question: Cluster Architecture, Installation and Configuration
Which command displays the expiration date of all certificates managed by kubeadm?
⚠ Common exam trap
Many exam-takers confuse `kubeadm` certificate management commands with `kubectl` CSR resources, or assume an outdated `alpha` subcommand is still valid, leading them to pick B or D instead of the correct A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubeadm certs check-expiration
`kubeadm certs check-expiration` is the dedicated command in kubeadm v1.15+ that inspects the expiration dates of all certificates managed by kubeadm, including those for the API server, kubelet, and etcd. It reads certificate files from `/etc/kubernetes/pki/` and displays their remaining validity period in a human-readable table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kubeadm certs check-expiration
Why this is correct
kubeadm certs check-expiration is the official command that reads the X.509 certificates under /etc/kubernetes/pki and prints a table containing each certificate's common name, expiry date, and residual time. It also highlights certificates that are already expired or about to expire, allowing administrators to plan a kubeadm certificate renew or upgrade. This is the only command that directly answers the question of certificate expiration for kubeadm-managed clusters.
- ✗
kubeadm alpha certs check-expiration
Why it's wrong here
The 'alpha' prefix was historically used for experimental kubeadm subcommands and is not part of the stable 'certs' command group in current releases. Running 'kubeadm alpha certs check-expiration' will fail because kubeadm alpha does not expose a 'certs' subcommand; the correct invocation is 'kubeadm certs check-expiration' without any intermediate 'alpha'. Even in older versions where an alpha variant existed, it was deprecated and later removed, so this is not a reliable or valid command.
- ✗
kubeadm certs list
Why it's wrong here
kubeadm certs does not accept a 'list' subcommand; the valid operational subcommands are 'check-expiration', 'renew', and 'generate'. Because 'list' is not implemented, kubeadm would return an error indicating an unknown command. To obtain expiration data, you must use 'check-expiration', which also provides information on whether each certificate is externally managed or part of a kubeadm CA.
- ✗
kubectl get certificates
Why it's wrong here
kubectl get certificates attempts to retrieve a Kubernetes API resource named 'certificates', which does not exist as a built-in resource; the correct API resource for certificate signing requests is 'certificatesigningrequests' (abbreviation 'csr'), and 'kubectl get csr' is the valid command. Even if it worked, it would only show CSR objects submitted by users or nodes, not the static certificate files stored on the control-plane hosts. These static files are not visible to kubectl because they are local filesystem artifacts outside the Kubernetes API.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.