CKA Practice Question: Cluster Architecture, Installation and Configuration
You need to back up etcd on a single control plane node. Which command correctly creates a snapshot?
⚠ Common exam trap
The trap here is that candidates often forget the TLS certificates or the `ETCDCTL_API=3` variable, assuming a simple `etcdctl snapshot save` will work, but the CKA exam environment enforces secure connections requiring full authentication flags.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/etcd-snapshot.db
It uses the required `ETCDCTL_API=3` environment variable and specifies the necessary TLS client certificates (`--cacert`, `--cert`, `--key`) to authenticate to the etcd server, which by default listens on `https://127.0.0.1:2379` with mutual TLS enabled. The `snapshot save` command creates a point-in-time backup of the etcd data store, essential for disaster recovery in a Kubernetes control plane.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 snapshot save /backup/etcd-snapshot.db
Why it's wrong here
This command correctly sets the v3 API and targets the local etcd endpoint, but omits the required TLS client certificates. Kubernetes etcd is configured with mutual TLS, so without --cacert, --cert, and --key, etcdctl cannot authenticate to the server and the snapshot save fails with an authentication error.
- ✗
ETCDCTL_API=3 etcdctl snapshot restore /backup/etcd-snapshot.db
Why it's wrong here
The restore subcommand does not create a backup; it initializes a new etcd data directory from an existing snapshot file. Running restore here would fail because the snapshot file does not exist (no save has been performed) or would attempt to overwrite cluster state, and it also lacks the TLS flags required for any secure connection.
- ✗
etcdctl snapshot save /backup/etcd-snapshot.db
Why it's wrong here
Without ETCDCTL_API=3, etcdctl defaults to the deprecated v2 API, which has no snapshot save command. Even if the API version were correct, the absence of both an endpoints flag and TLS certificate options means etcdctl cannot reach or authenticate to the etcd server, so this command cannot succeed.
- ✓
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/etcd-snapshot.db
Why this is correct
This is the correct backup command: it forces the v3 API, explicitly connects to the local etcd endpoint via HTTPS, and supplies the CA certificate and client certificate/key from the standard kubeadm PKI paths. Those credentials satisfy etcd's mutual TLS requirement and allow a verified snapshot to be written to /backup/etcd-snapshot.db.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Kubernetes Node Roles
Kubernetes Node Roles are labels assigned to machines in a cluster that define whether a node runs application containers (worker) or manages the cluster (control plane).
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.