CKA Practice Test.

1. A cluster administrator wants a new control plane node's kubelet and kube-proxy to trust the API server automatically after running kubeadm join. Which artifact makes this trust possible without manual certificate exchange?

• A. A shared bootstrap token combined with the cluster CA certificate hash presented to kubeadm join
• B. An SSH key pair copied from the first control plane node
• C. A Kubernetes Secret of type kubernetes.io/basic-auth created in the default namespace
• D. A wildcard DNS record pointing to the API server load balancer

2. During a cluster upgrade planned with kubeadm, which component version relationship must be respected to avoid an unsupported configuration?

• A. kubelet versions may be newer than the API server version by any number of minor versions
• B. kube-proxy must always be exactly two minor versions behind kubelet
• C. etcd must be upgraded only after every node's kubelet has been upgraded
• D. kubelet on each node must not be newer than the kube-apiserver version, and should be no more than a few minor versions older

3. An administrator needs to back up the state of a kubeadm-managed cluster so it can be restored after a catastrophic control plane failure. What must be captured to ensure all cluster objects can be recovered?

• A. A tar archive of /var/lib/kubelet on every worker node
• B. A consistent snapshot of the etcd data store
• C. The contents of the kube-apiserver container image
• D. A copy of the kubeconfig file used by kubectl

4. A candidate applies a new taint to a control plane node so that only specific pods can be scheduled there. Which pod-side field must match the taint for scheduling to be permitted on that node?

• A. nodeSelector referencing the node's hostname label
• B. An identical toleration in the pod spec matching the taint's key, value, and effect
• C. A resource limit equal to the node's allocatable capacity
• D. An ownerReference pointing to the node object

5. An admin wants to grant a CI/CD service account permission to create and delete Deployments only within the 'staging' namespace, and no other namespace. Which combination of objects accomplishes this correctly?

• A. A ClusterRole bound to the service account with a ClusterRoleBinding
• B. A Role scoped to the 'staging' namespace bound to the service account with a RoleBinding in that namespace
• C. A PodSecurityPolicy applied cluster-wide restricting the namespace field
• D. A NetworkPolicy limiting ingress to the staging namespace

6. A team wants every future Pod created in a namespace to automatically receive a specific toleration and an init container without modifying each manifest. Which mechanism is designed for this kind of automatic mutation at admission time?

• A. A LimitRange object in the namespace
• B. A MutatingAdmissionWebhook (or built-in mutating admission plugin) configured for that namespace
• C. A ResourceQuota object in the namespace
• D. A StorageClass marked as default

7. An administrator inspects /etc/kubernetes/manifests/kube-apiserver.yaml on a control plane node and needs to change how long client certificates issued by the API server remain valid. What is the most direct supported approach?

• A. Restart the kubelet service on every worker node
• B. Edit the --client-ca-file flag to point to a different CA
• C. Run kubectl edit deployment kube-apiserver -n kube-system
• D. Modify the relevant certificate-related flags in the static pod manifest and let the kubelet restart the apiserver pod automatically

8. A Deployment specifies 'replicas: 4' and a rolling update strategy with maxUnavailable=1 and maxSurge=1. During a rollout of a new image, what is the primary guarantee this strategy provides?

• A. All 4 old pods are terminated simultaneously before any new pod starts
• B. At most one pod can be unavailable and at most one extra pod can exist above the desired count at any point during the rollout
• C. The rollout pauses indefinitely until an administrator manually approves each pod replacement
• D. New pods only start after all old pods pass a readiness gate defined in a separate Job

9. A Pod's container regularly crashes shortly after startup because a downstream dependency isn't ready yet, and Kubernetes keeps restarting it with increasing delay between attempts. What is this restart behavior called?

• A. Liveness probe failure escalation
• B. CrashLoopBackOff, where the kubelet increases the delay between restart attempts exponentially
• C. Eviction due to node pressure
• D. Preemption by a higher-priority pod

10. A workload must run exactly one copy of a logging agent pod on every node in the cluster, including nodes added later. Which controller is purpose-built for this requirement?

• A. Deployment with replicas set to the current node count
• B. DaemonSet
• C. StatefulSet with a headless Service
• D. Job with parallelism set to the node count

11. A container needs a value that changes per environment (e.g., a database hostname) without rebuilding the image, and the value should be easy to update independently of the Pod spec. Which approach best fits this requirement?

• A. Hardcode the value as an environment variable directly in the container image
• B. Reference a ConfigMap key as an environment variable or mounted volume in the Pod spec
• C. Store the value in a Secret encoded only in base64 for readability
• D. Pass the value as a command-line flag to kubectl apply

12. A Pod defines a container with resources.requests.cpu: 250m and resources.limits.cpu: 500m. What does this configuration mean for scheduling and runtime behavior?

• A. The scheduler guarantees exactly 500m CPU is reserved and the container is killed if it ever uses less than 250m
• B. The scheduler uses the 250m request to find a node with enough allocatable CPU, and the kernel throttles the container if it tries to exceed the 500m limit
• C. The container will be OOMKilled if it exceeds 500m CPU usage
• D. Requests and limits apply only to memory, not CPU, so this field is ignored

13. A Job manifest sets 'completions: 5' and 'parallelism: 2' without specifying a completion mode. What behavior should the administrator expect?

• A. 5 pods run concurrently at all times until all succeed
• B. Up to 2 pods run concurrently at a time, and the Job continues creating new pods until 5 have completed successfully in total
• C. Exactly 2 pods run once each and the Job is marked complete regardless of the completions field
• D. The Job creates 5 pods immediately and ignores the parallelism field entirely

14. A cluster-internal application needs a stable virtual IP and DNS name that load-balances traffic across a dynamic set of backend Pods selected by label, without exposing it outside the cluster. Which Service type satisfies this exactly?

• A. ClusterIP
• B. NodePort
• C. LoadBalancer
• D. ExternalName

15. An application Pod tries to reach another Service by its short name 'backend' instead of the fully qualified 'backend.namespace.svc.cluster.local' and it resolves correctly. What makes this possible?

• A. kube-proxy injects a HOSTS file entry for every Service into each Pod
• B. CoreDNS is configured with a search domain list in the Pod's /etc/resolv.conf that includes the Pod's namespace and cluster domain
• C. NetworkPolicy objects perform name resolution as a side effect of allowing traffic
• D. The Pod's container image bundles a static DNS zone file for the cluster

16. By default, with no NetworkPolicy objects created in a namespace, what is the network traffic behavior between Pods in that namespace?

• A. Traffic is allowed only if both Pods share the same service account
• B. Only traffic within the same Deployment is allowed by default
• C. All ingress and egress traffic is allowed between Pods, since Kubernetes networking is unrestricted by default
• D. All traffic is denied until at least one NetworkPolicy explicitly allows it

17. A NetworkPolicy is created selecting Pods with label app=payments and specifies a single ingress rule allowing traffic from Pods labeled app=frontend on port 8080. What is the resulting effect on traffic to app=payments pods?

• A. Only ingress from app=frontend pods on port 8080 is allowed; all other ingress to those pods is now denied
• B. Egress from app=payments pods is also automatically restricted to app=frontend
• C. The policy has no effect unless a corresponding egress rule exists on the frontend pods
• D. All ingress remains allowed because NetworkPolicies only add exceptions, never restrictions

18. A Service of type NodePort is created for a Deployment. From outside the cluster, which of the following correctly describes how traffic reaches a backend Pod?

• A. External traffic must first pass through kube-scheduler before reaching kube-proxy
• B. A client connects to any cluster node's IP on the allocated NodePort, and kube-proxy forwards the connection to a healthy backend Pod, possibly on a different node
• C. External traffic can only reach Pods that are running on the specific node the client connects to
• D. NodePort Services require an Ingress controller to route any traffic at all

19. An Ingress resource defines host-based routing rules for 'shop.example.com', but external clients report the domain does not route any traffic. What is the most likely missing piece?

• A. The Ingress object must be recreated as a NodePort Service
• B. An Ingress controller is not deployed or not watching Ingress resources in the cluster
• C. Ingress objects are automatically ignored unless TLS is configured
• D. DNS records are managed automatically by the Ingress API and never require external configuration

20. A PersistentVolumeClaim requests 10Gi with accessMode ReadWriteOnce, and a matching PersistentVolume of 10Gi with the same accessMode already exists statically. What determines whether binding succeeds?

• A. Binding requires the PVC's storageClassName, accessModes, and capacity to be compatible with the PV, subject to any selector/label matching
• B. Binding is based solely on which PVC was created first in time, ignoring size or access mode
• C. PersistentVolumes can only bind to PersistentVolumeClaims in the same namespace as the PV
• D. Binding always requires a StorageClass with a provisioner, even for pre-provisioned PVs

21. A cluster uses a StorageClass with 'reclaimPolicy: Delete' for dynamically provisioned volumes. What happens to the underlying storage asset when the bound PersistentVolumeClaim is deleted?

• A. The PersistentVolume and its underlying storage are automatically deleted as well
• B. The PersistentVolume is retained indefinitely regardless of the reclaim policy
• C. The PersistentVolume is recycled by running a scrub Pod, a legacy option still active by default
• D. Deleting a PVC has no effect on the PersistentVolume under any reclaim policy

22. A Pod mounts a volume backed by a PersistentVolumeClaim with accessMode ReadWriteOnce (RWO). A second Pod on a different node also references the same PVC. What should the administrator expect?

• A. Both Pods mount the volume simultaneously without restriction, since RWO only limits write access, not read access
• B. The second Pod will typically fail to schedule or mount, because RWO volumes can only be mounted read-write by a single node at a time
• C. Kubernetes automatically converts the volume to ReadWriteMany to satisfy both Pods
• D. The second Pod mounts successfully but all writes from the first Pod are silently discarded

23. An application needs its container's filesystem changes to persist only for the Pod's lifetime and be shared between two containers in the same Pod, without needing any external storage backend. Which volume type is appropriate?

• A. A PersistentVolumeClaim backed by network storage
• B. An emptyDir volume
• C. A hostPath volume pointing to a directory unique to one node
• D. A ConfigMap volume

24. A user runs 'kubectl get pods' and sees a Pod stuck in Pending state for several minutes. Which command provides the most direct explanation of why the scheduler has not placed it?

• A. kubectl logs <pod-name>
• B. kubectl describe pod <pod-name>, checking the Events section for scheduling failure reasons
• C. kubectl get nodes -o wide
• D. kubectl top pod <pod-name>

25. A Deployment's Pods are repeatedly restarted, and 'kubectl describe pod' shows 'Liveness probe failed: HTTP probe failed with statuscode: 500'. What is the most direct interpretation of this signal?

• A. The container's readiness probe passed but its liveness probe endpoint is returning an application-level error, so the kubelet is restarting the container
• B. The node itself is unreachable and is about to be marked NotReady
• C. The container image failed to pull from the registry
• D. A NetworkPolicy is blocking all traffic to the Pod

26. kubectl get nodes shows a worker node in state NotReady. Which of the following is the most systematic first step to diagnose the root cause?

• A. Scale the affected Deployment to zero replicas
• B. Delete and recreate the node object immediately
• C. Modify the node's taints to NoExecute to force pod eviction before investigating
• D. SSH to the node and check the kubelet service status and logs (e.g., systemctl status kubelet, journalctl -u kubelet)

27. kubectl get pods shows a Pod in ImagePullBackOff. kubectl describe pod reveals 'Failed to pull image: unauthorized: authentication required'. What is the most likely fix?

• A. Add a toleration for the NoSchedule taint
• B. Increase the Pod's memory limit
• C. Change the Pod's restartPolicy to Never
• D. Create or correct an imagePullSecrets reference in the Pod spec (or service account) with valid registry credentials

28. An application Pod cannot reach a Service by its DNS name, but curling the Service's ClusterIP directly from the same Pod works. What area should be investigated first?

• A. The etcd cluster's disk I/O latency
• B. The kube-scheduler logs on the control plane
• C. The CoreDNS Pods' health/logs and the Pod's /etc/resolv.conf configuration
• D. The container's CPU limit settings

29. A Deployment update introduces a broken container image, and Pods enter CrashLoopBackOff cluster-wide for that Deployment. What is the fastest supported way to restore service while investigating the image issue?

• A. kubectl rollout undo deployment/<name> to revert to the previous working ReplicaSet revision
• B. kubectl delete deployment/<name> and manually recreate Pods with kubectl run
• C. Scale the Deployment to 0 replicas and leave it there until a new image is ready
• D. Edit the Service to point selector labels at a nonexistent ReplicaSet

30. A PersistentVolumeClaim remains stuck in Pending status indefinitely. Which combination of checks best narrows the root cause?

• A. Only checking whether the Pod referencing the PVC has a valid image tag
• B. Checking whether a matching PV exists (for static provisioning) or whether the StorageClass provisioner and CSI driver are functioning (for dynamic provisioning), plus events on the PVC
• C. Checking only the node's kubelet logs, since PVCs are node-scoped objects
• D. Checking the kube-scheduler's leader election status exclusively

31. A candidate needs to drain a node for maintenance while minimizing disruption to workloads managed by a Deployment with a PodDisruptionBudget (PDB) requiring minAvailable: 2 out of 3 replicas. What happens when 'kubectl drain' is run on a node holding one of those replicas?

• A. The drain proceeds unconditionally, ignoring the PDB, because PDBs only apply to manual kubectl delete commands
• B. The eviction respects the PDB, only proceeding if evicting that Pod would not push available replicas below the minAvailable threshold
• C. The PDB blocks the drain forever regardless of how many replicas remain elsewhere
• D. PDBs apply only to StatefulSets, so this Deployment's PDB is not enforced during the drain

32. A cluster administrator wants a Pod to be scheduled preferentially on nodes with SSD-backed storage but still allow scheduling elsewhere if no SSD node is available. Which scheduling mechanism fits this requirement?

• A. A hard nodeSelector matching disktype=ssd
• B. A preferredDuringSchedulingIgnoredDuringExecution node affinity rule targeting disktype=ssd
• C. A taint with effect NoSchedule applied to non-SSD nodes
• D. A ResourceQuota limiting Pods to SSD nodes

33. A StatefulSet named 'db' with 3 replicas is deployed with a headless Service. What distinguishes the network identity of its Pods from Pods managed by a standard Deployment?

• A. StatefulSet Pods get stable, predictable hostnames (db-0, db-1, db-2) and stable DNS entries that persist across rescheduling
• B. StatefulSet Pods share a single Pod IP among all replicas
• C. StatefulSet Pods cannot be addressed via DNS at all, only by IP
• D. StatefulSet Pods are assigned random names identical in format to Deployment-managed Pods

34. A Pod spec includes an initContainer that runs a database schema migration before the main application container starts. What is guaranteed about the execution order and failure behavior?

• A. Init containers run concurrently with the main container to save startup time
• B. Init containers run sequentially to completion before any main container starts, and if an init container fails, the kubelet retries it according to the Pod's restart policy before the main container ever starts
• C. Init container failures are ignored and the main container starts regardless
• D. Init containers share no filesystem or volumes with the main containers

35. A cluster network uses a CNI plugin that assigns each Pod a unique IP from a cluster-wide pod CIDR. Which fundamental Kubernetes networking requirement does this directly satisfy?

• A. Every Pod can communicate with every other Pod across the cluster without NAT, since each has a routable, unique IP
• B. Every Pod must go through a NodePort to reach any other Pod
• C. Only Pods on the same node can communicate with each other
• D. Pods must share the host node's network namespace to communicate

36. A pod is stuck in Pending state and events show no nodes are available. What is the most likely cause?

• A. No node satisfies the pod's requirements, whether insufficient allocatable resources, an unsatisfied node selector or affinity rule, or a taint the pod does not tolerate
• B. The container image failed to pull from the registry
• C. The container process exited with a non-zero status
• D. The pod's liveness probe is failing repeatedly

37. A node is marked with a taint. What effect does this have on scheduling?

• A. Pods are repelled from the node unless they carry a matching toleration, with the effect determining whether they are merely not scheduled or also evicted
• B. Pods are attracted to the node in preference to others
• C. The node is removed from the cluster
• D. All pods on the node are immediately deleted regardless of tolerations

38. A container specifies a memory request of 256Mi and a limit of 512Mi. What do these values control?

• A. The request is used for scheduling and reserves capacity, while the limit is the hard ceiling above which the container is terminated for exceeding memory
• B. The request is the ceiling and the limit is the reservation
• C. Both values are advisory and neither is enforced
• D. The request controls CPU and the limit controls memory

39. A deployment is updated with a new image and the rollout stalls partway. What command-level information identifies the cause?

• A. The rollout status and the events on the new replica set's pods, which report why the new pods are not becoming ready
• B. The node's kernel version
• C. The cluster's total CPU capacity only
• D. The deployment's creation timestamp

40. How do a liveness probe and a readiness probe differ in effect?

• A. A failed liveness probe restarts the container, while a failed readiness probe removes the pod from service endpoints without restarting it
• B. A failed readiness probe restarts the container
• C. Both probes restart the container on failure
• D. Neither probe affects traffic routing

41. A workload requires stable network identity and persistent storage per replica. Which controller fits?

• A. A StatefulSet, which provides ordered stable identities and per-replica persistent volume claims
• B. A Deployment, which manages interchangeable replicas
• C. A DaemonSet, which runs one pod per node
• D. A Job, which runs a workload to completion

42. A batch task must run to completion once, retrying on failure, and must not be restarted after it succeeds. Which controller fits?

• A. A Job, which runs pods to successful completion with a backoff limit bounding retries
• B. A Deployment, which keeps a desired number of pods running indefinitely
• C. A DaemonSet, which places a pod on each node
• D. A StatefulSet, which provides ordered stable identities

43. A Service of type ClusterIP is created. How is it reached?

• A. From within the cluster using its stable virtual IP or DNS name, with no external exposure
• B. From outside the cluster on a port opened on every node
• C. From outside the cluster through a provisioned external load balancer
• D. Only by pods on the same node as the backing pods

44. A Service has no endpoints despite matching pods appearing to run. What should be checked?

• A. Whether the Service's selector matches the pods' labels and whether those pods are passing readiness, since only ready pods become endpoints
• B. Whether the Service has a public IP address assigned
• C. Whether the cluster's DNS add-on is the latest version
• D. Whether the node has sufficient disk space

45. A NetworkPolicy is applied to a namespace selecting all pods with no ingress rules. What is the effect?

• A. All ingress traffic to those pods is denied, because selecting a pod with a policy switches it from default-allow to allowing only what the policies permit
• B. All ingress traffic is allowed, since no rules restrict it
• C. Only traffic from other namespaces is denied
• D. The policy has no effect without a matching egress policy

46. An Ingress resource is created but external traffic does not reach the application. What is a common cause?

• A. The backing Service is of type ClusterIP
• B. No ingress controller is running to act on the resource, since the Ingress object is only a declaration of intent
• C. The pods have readiness probes configured
• D. The namespace lacks a resource quota

47. Cluster DNS resolves a service name. What is the fully qualified form within the cluster?

• A. The node's hostname followed by the service port
• B. The container image name followed by its tag
• C. The pod name followed by the node name
• D. The service name, its namespace, then the svc and cluster domain suffix, so a short name resolves within the same namespace and a qualified name across namespaces

48. A PersistentVolumeClaim remains Pending. What are the likely causes?

• A. No matching PersistentVolume is available and no StorageClass can dynamically provision one satisfying the requested size and access mode
• B. The pod referencing the claim has not been created yet, which always blocks binding
• C. The node lacks sufficient CPU capacity
• D. The claim's namespace has no service account

49. A PersistentVolume has a reclaim policy of Delete. What happens when its claim is deleted?

• A. The volume and the underlying storage asset are deleted, so data is lost unless it was backed up separately
• B. The volume is retained with its data for manual recovery
• C. The volume is made available for another claim with its data intact
• D. Nothing happens until the volume is explicitly deleted

50. A volume access mode of ReadWriteOnce is specified. What does this permit?

• A. Read-write mounting by pods on a single node, which is why a workload spread across nodes cannot share such a volume
• B. Read-write mounting by exactly one pod cluster-wide under all circumstances
• C. Read-write mounting by pods on any number of nodes
• D. Read-only mounting by a single pod

51. Configuration values and credentials must be supplied to a pod. Which resources are used and what is the difference?

• A. ConfigMaps for non-confidential configuration and Secrets for sensitive values, with Secrets base64-encoded at rest by default rather than encrypted unless encryption at rest is configured
• B. Only ConfigMaps can be mounted as files
• C. Secrets for configuration and ConfigMaps for credentials
• D. Both are encrypted by default with no additional configuration

52. A ServiceAccount is bound to a Role through a RoleBinding. What does this achieve?

• A. The workload using that account gains the Role's permissions within the binding's namespace, following least privilege rather than using the default account's implicit access
• B. The workload gains cluster-wide administrative permissions
• C. The workload's network traffic is encrypted
• D. The workload is scheduled to a dedicated node

53. A control plane component stores all cluster state. Which is it and what does its loss mean?

• A. The etcd key-value store, whose loss without a backup means the cluster's entire declared state is unrecoverable
• B. The kubelet, which runs on each node
• C. The kube-proxy, which programs service networking
• D. The container runtime, which executes containers

54. A node must be taken out of service for maintenance without disrupting workloads more than necessary. What is the correct sequence?

• A. Cordon the node to stop new scheduling, then drain it to evict existing pods so they reschedule elsewhere, and uncordon after maintenance
• B. Delete the node object immediately and recreate it afterward
• C. Power off the node without notifying the cluster
• D. Delete each pod on the node manually and leave the node schedulable

55. A PodDisruptionBudget specifies minAvailable of 2 for a three-replica deployment. What does it constrain?

• A. Voluntary disruptions such as node drains, which will not proceed if they would leave fewer than two replicas available
• B. Involuntary disruptions such as node hardware failure
• C. The maximum number of replicas the deployment may scale to
• D. The number of restarts a container may perform

56. A namespace has a ResourceQuota applied. What happens to a pod created without resource requests?

• A. It is rejected where the quota covers that resource, since the quota cannot account for a pod that declares no request
• B. It is admitted and assigned unlimited resources
• C. It is admitted with the quota applied to the whole namespace afterward
• D. It is scheduled to a node outside the namespace

57. A pod in CrashLoopBackOff must be diagnosed but the container restarts too quickly to inspect. What retrieves the failure output?

• A. Requesting the previous container instance's logs, which returns output from the run that terminated
• B. Describing the node the pod is scheduled on
• C. Checking the cluster's API server version
• D. Listing the images present on the node

58. A node reports NotReady. Which component's health should be examined first?

• A. The kubelet on that node, since it reports node status to the API server and its failure or inability to reach the API server produces NotReady
• B. The scheduler on the control plane
• C. The ingress controller
• D. The DNS add-on

59. Pods in one namespace cannot resolve service names. What is the most productive first check?

• A. Whether the affected pods have the correct image tags
• B. Whether the deployment's replica count is correct
• C. Whether the nodes have sufficient disk space for logs
• D. Whether the cluster DNS pods are running and healthy, and whether a NetworkPolicy is blocking pod traffic to them

60. A cluster upgrade is planned. What order should the components be upgraded in?

• A. Control plane first and node components afterward, since the control plane supports nodes running an older version but not a newer one
• B. Nodes first, then the control plane
• C. All components simultaneously to avoid version skew
• D. Only the control plane, since nodes upgrade automatically

61. A pod needs to run a setup task that must complete before the main container starts. What construct provides this?

• A. An init container, which runs to completion before app containers start and blocks the pod if it fails
• B. A sidecar container running alongside the main container
• C. A separate Job in the same namespace
• D. A lifecycle postStart hook on the main container

62. A HorizontalPodAutoscaler is configured on CPU utilization but does not scale. What is a common cause?

• A. Metrics are unavailable because the metrics pipeline is not running, or the pods declare no CPU request so utilization cannot be computed as a percentage
• B. The deployment has too many replicas already declared in its manifest
• C. The nodes lack a container runtime
• D. The service is of type ClusterIP

63. A workload must be prevented from scheduling two replicas onto the same node. What achieves this?

• A. Pod anti-affinity keyed on the node hostname topology, or topology spread constraints distributing replicas across a topology domain
• B. A node selector matching every node in the cluster
• C. Increasing the pod's memory limit
• D. Setting the deployment's replica count equal to the node count

64. A manifest is applied and the API server rejects it as invalid for the resource kind. What should be verified?

• A. The apiVersion and kind against the cluster's supported API versions, since resources graduate between groups and versions across releases
• B. The node's available memory
• C. The container registry's availability
• D. The pod's assigned service account

65. A container image tag of latest is used in a production deployment. What problem does this create?

• A. The running content becomes ambiguous, since nodes may hold different cached versions and a rollback cannot return to a specific prior image
• B. The image will fail to pull entirely
• C. The pod will be rejected by the API server
• D. The deployment will refuse to scale beyond one replica