Cluster Setup practice questions

A team needs to set up a highly available Kubernetes control plane across three availability zones. What is the minimum number of etcd members required to achieve fault tolerance against one zone failure?

Trap 1: 5

5 members tolerate up to 2 failures, but minimum required is 3.

Trap 2: 1

1 member cannot tolerate any failure.

Trap 3: 7

7 members tolerate up to 3 failures, but minimum required is 3.

A
5
Why wrong: 5 members tolerate up to 2 failures, but minimum required is 3.
B
1
Why wrong: 1 member cannot tolerate any failure.
C
3
3 members tolerate one member failure, maintaining majority.
D
7
Why wrong: 7 members tolerate up to 3 failures, but minimum required is 3.

Question 2mediummultiple choice

A security audit reveals that the kube-apiserver is using the default insecure port 8080 on a production cluster. Which is the most secure and recommended remediation?

Trap 1: Change the --insecure-port flag to 0

Setting to 0 disables the insecure port; however the question asks for the most secure remediation. This is correct but the option is misleading as it only changes port number.

Trap 2: Set --insecure-port=6443

This would run the insecure API on 6443, which is not recommended.

Trap 3: Set --secure-port=8080

This sets the secure port to 8080, but the insecure port may still be enabled.

A
Change the --insecure-port flag to 0
Why wrong: Setting to 0 disables the insecure port; however the question asks for the most secure remediation. This is correct but the option is misleading as it only changes port number.
B
Set --insecure-port=0 and ensure --secure-port=6443 is configured
Setting insecure-port to 0 disables it, and secure-port=6443 uses TLS.
C
Set --insecure-port=6443
Why wrong: This would run the insecure API on 6443, which is not recommended.
D
Set --secure-port=8080
Why wrong: This sets the secure port to 8080, but the insecure port may still be enabled.

Question 3hardmultiple choice

During a cluster upgrade, the kubelet on a worker node fails to start after updating the kubelet binary. The kubelet logs show: 'failed to load bootstrap client certificate: open /var/lib/kubelet/pki/kubelet-client-current.pem: no such file or directory'. What is the most likely cause?

Trap 1: The kubelet's node IP has changed

This would cause certificate mismatch, not missing file.

Trap 2: The kubelet's certificate has expired

Expired cert would show 'certificate has expired' error, not missing file.

Trap 3: The kubelet is using an outdated kubeconfig

An outdated kubeconfig would cause authentication failure, not missing file.

A
The kubelet's node IP has changed
Why wrong: This would cause certificate mismatch, not missing file.
B
The kubelet's certificate has expired
Why wrong: Expired cert would show 'certificate has expired' error, not missing file.
C
The kubelet is using an outdated kubeconfig
Why wrong: An outdated kubeconfig would cause authentication failure, not missing file.
D
The bootstrap kubeconfig file is missing or misconfigured
The bootstrap kubeconfig is used to initially request a client certificate; missing file leads to this error.

Question 4mediummulti select

Which TWO of the following are valid methods to secure the etcd cluster in a Kubernetes setup?

Trap 1: Enable encryption at rest for etcd data

Encryption at rest is for etcd data, but the question asks for securing the cluster, not data at rest.

Trap 2: Configure RBAC on etcd

etcd does not have RBAC; it uses TLS authentication.

Trap 3: Apply NetworkPolicies to etcd pods

NetworkPolicies are for Kubernetes pods, but etcd may run outside Kubernetes.

A
Enable encryption at rest for etcd data
Why wrong: Encryption at rest is for etcd data, but the question asks for securing the cluster, not data at rest.
B
Configure RBAC on etcd
Why wrong: etcd does not have RBAC; it uses TLS authentication.
C
Enable TLS with peer certificates for etcd member communication
Peer certificates secure inter-etcd communication.
D
Enable TLS with client certificates for etcd client communication
Client certificates secure communication between API server and etcd.
E
Apply NetworkPolicies to etcd pods
Why wrong: NetworkPolicies are for Kubernetes pods, but etcd may run outside Kubernetes.

Question 5hardmulti select

Which THREE of the following are required when setting up a Kubernetes control plane with kubeadm for a production environment?

Trap 1: Specify --apiserver-advertise-address

Optional; kubeadm auto-detects.

Trap 2: Generate a bootstrap token with kubeadm token create

Token is for joining nodes, not for control plane init.

A
Ensure the Kubernetes version is not downgraded
kubeadm prevents downgrading.
B
Specify --pod-network-cidr to define the pod network range
Required for pod networking.
C
Specify --control-plane-endpoint for high availability
Required for HA control plane setup.
D
Specify --apiserver-advertise-address
Why wrong: Optional; kubeadm auto-detects.
E
Generate a bootstrap token with kubeadm token create
Why wrong: Token is for joining nodes, not for control plane init.

Question 6easymultiple choice

A cluster is using kubeadm and the control plane components are running as static pods. Where are the static pod manifests for the API server located by default?

Trap 1: /var/lib/kubelet/

This is the kubelet working directory.

Trap 2: /etc/kubernetes/admin.conf

This is a kubeconfig file.

Trap 3: /etc/kubernetes/

This directory contains config files, not static pod manifests.

A
/var/lib/kubelet/
Why wrong: This is the kubelet working directory.
B
/etc/kubernetes/manifests/
Default static pod manifest directory.
C
/etc/kubernetes/admin.conf
Why wrong: This is a kubeconfig file.
D
/etc/kubernetes/
Why wrong: This directory contains config files, not static pod manifests.

Question 7hardmultiple choice

You are responsible for securing a multi-tenant Kubernetes cluster that uses kubeadm for bootstrapping. The cluster has three control plane nodes and five worker nodes, all running Ubuntu 22.04. A recent security scan discovered that the etcd data directory is not encrypted at rest. The cluster stores sensitive customer data in secrets. You plan to enable encryption at rest for etcd. You have already created an encryption configuration file and placed it at /etc/kubernetes/encryption-config.yaml. The cluster is currently running Kubernetes v1.28.0 with etcd v3.5.9. You need to ensure that all existing and new secrets are encrypted. You also want to minimize downtime. Which of the following steps should you take?

Trap 1: Edit the etcd configuration to use the encryption config file…

Encryption is handled by the API server, not etcd directly.

Trap 2: Add --experimental-encryption-provider-config=/etc/kubernetes/encryp…

The flag is deprecated; use --encryption-provider-config.

Trap 3: Move the etcd data directory to an encrypted filesystem using LUKS

This encrypts at the filesystem level, but the question asks for etcd encryption at rest via Kubernetes mechanism.

A
Edit the etcd configuration to use the encryption config file directly
Why wrong: Encryption is handled by the API server, not etcd directly.
B
Add --experimental-encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest and restart the kubelet
Why wrong: The flag is deprecated; use --encryption-provider-config.
C
Move the etcd data directory to an encrypted filesystem using LUKS
Why wrong: This encrypts at the filesystem level, but the question asks for etcd encryption at rest via Kubernetes mechanism.
D
Add --encryption-provider-config=/etc/kubernetes/encryption-config.yaml to the kube-apiserver manifest, then kubelet will automatically restart the static pod
Correct flag and automatic restart by kubelet.

Question 8mediummultiple choice

A security team wants to ensure that all communication between the kubelet and the API server is encrypted. Which flag must be set on the kubelet to enforce this?

Trap 1: --tls-cert-file

This is for serving certificates, not for client connections.

Trap 2: --node-status-update-frequency

This controls update frequency, not encryption.

Trap 3: --require-kubeconfig

This flag is deprecated.

A
--tls-cert-file
Why wrong: This is for serving certificates, not for client connections.
B
--node-status-update-frequency
Why wrong: This controls update frequency, not encryption.
C
--kubeconfig
The kubeconfig file contains the API server address with HTTPS.
D
--require-kubeconfig
Why wrong: This flag is deprecated.

Question 9mediumdrag order

Order the steps to rotate a Kubernetes API server certificate.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 10mediummatching