CKA Troubleshooting Practice Question
Which TWO of the following are valid commands to view cluster events sorted by timestamp?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl get events
Options A and B are correct. 'kubectl get events' shows events sorted by last timestamp by default, which satisfies the requirement. 'kubectl get events --sort-by=.metadata.creationTimestamp' explicitly sorts by creation timestamp, also valid. Option C uses -w to watch, not sort. Option D sorts by name, not timestamp. Option E shows events from all namespaces but does not sort by timestamp.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kubectl get events
Why this is correct
kubectl get events is correct because the default output of the events command is already sorted by lastTimestamp, the moment each event was last observed, from most to least recent. This gives an effective chronological view without needing extra flags, satisfying the requirement to view events sorted by a time field.
- ✓
kubectl get events --sort-by=.metadata.creationTimestamp
Why this is correct
kubectl get events --sort-by=.metadata.creationTimestamp explicitly sorts events by the event object's creationTimestamp, which records when the event was initially created rather than when it was last seen. This is a valid alternative ordering that highlights original event emission, and the JSONPath expression is a legitimate argument to --sort-by, providing a deterministic order distinct from the default lastTimestamp.
- ✗
kubectl get events -w
Why it's wrong here
The -w flag enables watch mode, which streams subsequent event changes in real time. While the initial snapshot may appear sorted, no sorting operation is performed by the watch itself; it is designed for continuous monitoring, not for producing a sorted view at a point in time, so it does not fulfill the timestamp-sorting requirement.
- ✗
kubectl get events --sort-by=.metadata.name
Why it's wrong here
Sorting by .metadata.name arranges events alphabetically by their generated resource name, such as a pod name suffixed with a random hash, which has no correlation with when the event occurred. This yields a lexicographic order that is neither chronological nor useful for understanding event sequence, making it incorrect for the intended timestamp-based sort.
- ✗
kubectl get events --all-namespaces
Why it's wrong here
The --all-namespaces flag expands the query to events across every namespace in the cluster, which aids cluster-wide visibility but does not alter the sort order. The output still uses the default lastTimestamp ordering and ignores creationTimestamp entirely, so this command only broadens scope without providing the required sorting mechanism.
Go deeper
Related to this question
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.