CKA sample questions

Question 1

You are performing a cluster upgrade from v1.32.5 to v1.33.1 using `kubeadm`. After successfully upgrading the first control plane node with `kubeadm upgrade apply v1.33.1`, you proceed to upgrade the worker nodes. The worker's apt source already points to the `pkgs.k8s.io` v1.33 repository (package index updated), and the Kubernetes packages are not on hold. What is the correct sequence of commands to safely upgrade a worker node named `worker-01`?

Accepted Answer

1. `kubectl drain worker-01 --ignore-daemonsets`
2. `apt-get install -y kubeadm=1.33.1-1.1`
3. `kubeadm upgrade node`
4. `apt-get install -y kubelet=1.33.1-1.1 kubectl=1.33.1-1.1`
5. `systemctl restart kubelet`
6. `kubectl uncordon worker-01`

Answer

1. `kubectl drain worker-01 --ignore-daemonsets`
2. `apt-get install -y kubelet=1.33.1-1.1`
3. `systemctl restart kubelet`
4. `kubectl uncordon worker-01`

Answer

1. `apt-get install -y kubeadm=1.33.1-1.1`
2. `kubeadm upgrade node`
3. `apt-get install -y kubelet=1.33.1-1.1 kubectl=1.33.1-1.1`
4. `systemctl restart kubelet`

Answer

1. `kubeadm upgrade node` on the control plane node, targeting `worker-01`
2. `systemctl restart kubelet` on `worker-01`

Question 2

A pod is in a `CrashLoopBackOff` state. Running `kubectl logs --previous` shows that the application terminated due to a failure to connect to a database. You need to gain interactive access to the pod's environment to test network connectivity using tools like `ping` and `wget`, but these tools are not included in the original container image. What is the most effective `kubectl` command to debug this issue?

Accepted Answer

`kubectl debug -it --image=busybox:1.28 --share-processes --copy-to=debug-pod`

Answer

`kubectl port-forward 8080:80`

Answer

`kubectl attach -c `

Answer

`kubectl exec -it -- /bin/bash`

Question 3

You need to create a Kubernetes secret named `db-credentials` in the `backend` namespace to store a database username and password. The username is `admin` and the password is `S3cur3P@ssw0rd!`. Which imperative command correctly creates this secret directly from the command line, without first writing the credentials to a file?

Accepted Answer

`kubectl create secret generic db-credentials -n backend --from-literal=username=admin --from-literal=password='S3cur3P@ssw0rd!'`

Answer

`kubectl create secret generic db-credentials -n backend --from-env-file=creds.txt`

Answer

`kubectl create secret -n backend db-credentials --username=admin --password='S3cur3P@ssw0rd!'`

Answer

`echo "password: S3cur3P@ssw0rd!" | kubectl create secret generic db-credentials -n backend --from-file=username=<(echo -n admin) --from-file=password=/dev/stdin`

Question 4

An administrator needs to deploy a monitoring agent as a DaemonSet to all nodes in the cluster, but the control plane nodes must be excluded. The control plane nodes are labeled `node-role.kubernetes.io/control-plane` and tainted with `node-role.kubernetes.io/control-plane:NoSchedule`. Which TWO of the following statements about excluding the control plane nodes are correct? (Select TWO)

Accepted Answer

No toleration is needed: DaemonSet pods do not tolerate the `node-role.kubernetes.io/control-plane:NoSchedule` taint by default, so the taint alone already keeps them off the control plane nodes.

Accepted Answer

A nodeAffinity rule with a `requiredDuringSchedulingIgnoredDuringExecution` `nodeSelectorTerm` that matches only nodes without the control-plane role label (operator `DoesNotExist`) explicitly excludes the control plane nodes.

Answer

A podAntiAffinity rule against the `kube-apiserver` pods is required, because DaemonSet pods ignore node taints.

Answer

A toleration for the `node-role.kubernetes.io/control-plane:NoSchedule` taint must be added to the DaemonSet's Pod template.

Answer

Setting the `replicas` field in the DaemonSet spec to `0` for the control plane nodes excludes them.

Question 5

You are auditing RBAC permissions and need to quickly verify if a specific service account, `app-reader` in the `staging` namespace, has permission to `get` pods in the `production` namespace. Which command provides a clear 'yes' or 'no' answer to this question?

Accepted Answer

`kubectl auth can-i get pods -n production --as=system:serviceaccount:staging:app-reader`

Answer

`kubectl logs -n kube-system kube-apiserver-* | grep 'app-reader'`

Answer

`kubectl get clusterrolebinding -o wide`

Answer

`kubectl describe rolebinding -n production`

Question 6

A new cluster administrator is trying to understand the flow of traffic for a service exposed via NodePort. They observe that a request sent to `node-ip:node-port` on any node in the cluster correctly routes to a pod, even if that pod is not running on the node that received the request.

Which component is responsible for this routing behavior across the cluster?

```mermaid
graph TD
Client -->|"Request to Node2_IP:NodePort"| Rules2
subgraph Node2
Rules2["Service forwarding rules on Node2"]
end
subgraph Node1
TargetPod[Target Pod]
end
Rules2 -->|"DNAT to the Pod IP, delivered over the Pod network"| TargetPod
```

Accepted Answer

kube-proxy

Answer

The Ingress Controller

Answer

CoreDNS

Answer

The CNI Plugin

Question 7

A critical application is experiencing performance degradation. You suspect a 'noisy neighbor' pod is consuming excessive CPU resources on a worker node. Which `kubectl` command would you use to identify the pods consuming the most CPU on all nodes in the cluster?

Accepted Answer

`kubectl top pods -A --sort-by=cpu`

Answer

`kubectl describe nodes`

Answer

`kubectl get events --sort-by=.lastTimestamp`

Answer

`kubectl get pods -o wide --sort-by=.spec.nodeName`

Question 8

True or False: When using `kubeadm` with the default kubelet configuration, swap should be disabled on all nodes (both control plane and worker) before running `kubeadm init` or `kubeadm join`.

Accepted Answer

True

Answer

False

Question 9

You need to provision a PersistentVolume that sources its storage directly from a directory, `/data/mysql-pv`, on a specific worker node, `node-03`. This volume should be 5Gi in size and have a `ReadWriteOnce` access mode. Which of the following YAML snippets correctly defines this PersistentVolume?

Accepted Answer

```yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: mysql-local-pv
spec:
capacity:
storage: 5Gi
volumeMode: Filesystem
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
storageClassName: local-storage
local:
path: /data/mysql-pv
nodeAffinity:
required:
nodeSelectorTerms:
- matchExpressions:
- key: kubernetes.io/hostname
operator: In
values:
- node-03
```

Answer

```yaml
apiVersion: v1
kind: StorageClass
metadata:
name: local-storage
provisioner: kubernetes.io/no-provisioner
volumeBindingMode: WaitForFirstConsumer
parameters:
node: node-03
```

Answer

```yaml
apiVersion: v1
kind: PersistentVolume
metadata:
name: mysql-local-pv
spec:
capacity:
storage: 5Gi
accessModes:
- ReadWriteOnce
hostPath:
path: "/data/mysql-pv"
```

Answer

```yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: mysql-local-pvc
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 5Gi
nodeName: node-03
```

Question 10

You have been given a backup file of an etcd database located at `/tmp/etcd-backup.db`. The cluster's etcd is running as a static pod. You need to restore the cluster state from this backup file. Which command should you run to perform the restore?

Accepted Answer

`etcdutl --data-dir /var/lib/etcd-restore snapshot restore /tmp/etcd-backup.db`

Answer

`mv /tmp/etcd-backup.db /var/lib/etcd/member/snap/db`

Answer

`kubeadm init phase etcd --restore-from /tmp/etcd-backup.db`

Answer

`kubectl exec -n kube-system etcd-master-node -- etcdctl snapshot restore /tmp/etcd-backup.db`

Free CKA sample questions

You are auditing RBAC permissions and need to quickly verify if a specific service account, `app-reader` in the `staging` namespace, has permission to `get` pods in the `production` namespace. Which command provides a clear 'yes' or 'no' answer to this question?

A critical application is experiencing performance degradation. You suspect a 'noisy neighbor' pod is consuming excessive CPU resources on a worker node. Which `kubectl` command would you use to identify the pods consuming the most CPU on all nodes in the cluster?

True or False: When using `kubeadm` with the default kubelet configuration, swap should be disabled on all nodes (both control plane and worker) before running `kubeadm init` or `kubeadm join`.

You need to provision a PersistentVolume that sources its storage directly from a directory, `/data/mysql-pv`, on a specific worker node, `node-03`. This volume should be 5Gi in size and have a `ReadWriteOnce` access mode. Which of the following YAML snippets correctly defines this PersistentVolume?

You have been given a backup file of an etcd database located at `/tmp/etcd-backup.db`. The cluster's etcd is running as a static pod. You need to restore the cluster state from this backup file. Which command should you run to perform the restore?

10 more free samples are waiting