Medium — CKA Practice Quiz

Question 1

You SSH into a control-plane node after users report that all kubectl commands fail with 'The connection to the server 10.0.1.5:6443 was refused - did you specify the right host or port?'. The node itself is up and other cluster nodes are Ready according to a monitoring dashboard cached minutes ago. The API server runs as a static pod managed by kubelet. Which command sequence will most directly help you diagnose why the API server is not responding?

Accepted Answer

Run 'sudo crictl ps -a' to check the kube-apiserver container state, then 'sudo crictl logs <container-id>' to inspect its output

Answer

Run 'kubectl logs -n kube-system kube-apiserver-<node>' to view the API server logs

Answer

Run 'kubectl describe pod -n kube-system kube-apiserver-<node>' to see recent events

Answer

Run 'systemctl restart kubelet' immediately to force the API server to restart

Question 2

You created a ClusterRole named 'pod-reader' that grants get, list, and watch on pods. A developer's ServiceAccount 'ci-bot' in the 'dev' namespace needs to read pods only within the 'dev' namespace. Which binding correctly grants exactly this access using the existing ClusterRole?

Accepted Answer

Create a RoleBinding in the 'dev' namespace that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot'.

Answer

Create a ClusterRoleBinding that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot' in namespace 'dev'.

Answer

Create a RoleBinding in the 'default' namespace that references the ClusterRole 'pod-reader' and the ServiceAccount 'ci-bot'.

Answer

Convert the ClusterRole to a Role in the 'dev' namespace, then create a ClusterRoleBinding referencing it.

Question 3

After bootstrapping a new single-control-plane cluster with kubeadm, you notice all nodes report NotReady and every Pod (including CoreDNS) remains stuck in ContainerCreating. Running 'kubectl describe pod' on a CoreDNS Pod shows the event: 'Failed to create pod sandbox: ... failed to find plugin "..." in path [/opt/cni/bin] ... network plugin is not ready: cni config uninitialized'. What is the correct action to bring the cluster to a healthy state?

Accepted Answer

Deploy a CNI plugin (e.g., apply the Calico or Flannel manifest) so the Pod network add-on initializes the node network.

Answer

Restart the kubelet on all nodes with 'systemctl restart kubelet' to force sandbox recreation.

Answer

Re-run 'kubeadm init' with the '--pod-network-cidr' flag to reconfigure the cluster networking.

Answer

Increase the CoreDNS Deployment replica count and add tolerations for the node.kubernetes.io/not-ready taint.

Question 4

You maintain a Deployment for a payments service. The team stores 12 application settings in a ConfigMap named 'payments-config' and wants ALL of them injected as environment variables into the container without listing each key individually in the Pod spec. Which configuration achieves this?

Accepted Answer

Add an 'envFrom' entry with 'configMapRef' pointing to 'payments-config' in the container spec.

Answer

Add 12 separate 'env' entries, each with a 'valueFrom.configMapKeyRef' referencing 'payments-config'.

Answer

Mount 'payments-config' as a volume at '/etc/config' so the keys become environment variables automatically.

Answer

Add an 'envFrom' entry with 'secretRef' pointing to 'payments-config' in the container spec.

Question 5

You mount a ConfigMap named app-config into a Deployment's pod using a volume with a subPath reference (mountPath: /etc/app/config.yaml, subPath: config.yaml). After editing the ConfigMap with 'kubectl edit configmap app-config', you notice the running pods still see the old file contents even after several minutes. Other Deployments that mount the same ConfigMap as a full directory (no subPath) do receive the update automatically. What is the correct explanation and fix?

Accepted Answer

ConfigMap volumes mounted with subPath do not receive automatic updates; you must trigger a rollout (e.g. 'kubectl rollout restart deployment') to pick up the new values.

Answer

ConfigMap updates only propagate to pods that reference the ConfigMap via envFrom; convert the mount to environment variables to fix it.

Answer

The kubelet sync period must be lowered on every node before subPath mounts will update; edit the kubelet config and restart it.

Answer

ConfigMaps become immutable once mounted with subPath; you must delete and recreate the ConfigMap with a new name and update the volume reference.

Question 6

You create a Deployment named 'web' with replicas set to 3, but after several minutes 'kubectl get pods' shows no pods at all for that Deployment. 'kubectl get deployment web' shows DESIRED 3 but CURRENT and AVAILABLE both 0, and no ReplicaSet exists. The scheduler and kubelets are healthy, and other existing pods run fine. Which action is the most appropriate first step to diagnose the root cause?

Accepted Answer

Inspect the kube-controller-manager static pod status and logs on the control-plane node (e.g., crictl/kubectl logs or /var/log/pods and the manifest in /etc/kubernetes/manifests)

Answer

Restart kube-scheduler because it is failing to bind the pods to nodes

Answer

Increase the Deployment's replica count to force the API server to create the ReplicaSet

Answer

Delete and recreate the CoreDNS pods to restore controller reconciliation

Question 7

Pods in your cluster can resolve internal service names (e.g., my-svc.default.svc.cluster.local) but all attempts to resolve external domains (e.g., api.github.com) return NXDOMAIN. CoreDNS pods are Running with no restarts, and the CoreDNS Service has valid endpoints. You inspect the CoreDNS ConfigMap and find that the 'forward' plugin line was recently edited. What is the MOST likely cause and the correct fix?

Accepted Answer

The Corefile's 'forward . /etc/resolv.conf' directive was replaced or removed, so CoreDNS no longer forwards external queries upstream; restore the forward plugin pointing to a valid upstream resolver and reload.

Answer

The kube-dns Service ClusterIP changed; update every pod's /etc/resolv.conf nameserver entry to the new ClusterIP.

Answer

kube-proxy is not programming iptables rules for the DNS Service; restart the kube-proxy DaemonSet to fix external resolution.

Answer

The pods' dnsPolicy is set to None; change it to ClusterFirst so external names resolve.

Question 8

Users report that all applications in the cluster suddenly cannot resolve any DNS names, both internal (svc.cluster.local) and external. Pods themselves start fine and node-to-node connectivity works. Running 'kubectl get pods -n kube-system' shows no CoreDNS pods listed at all, and 'kubectl get deploy coredns -n kube-system' shows READY 0/0. Recent cluster maintenance was performed by another engineer. What is the most likely cause and the correct fix?

Accepted Answer

The CoreDNS Deployment was scaled to 0 replicas; scale it back up with 'kubectl scale deployment coredns -n kube-system --replicas=2'

Answer

The CoreDNS ConfigMap Corefile is corrupted; edit the ConfigMap to restore the default forward directive

Answer

kube-proxy is not programming iptables rules for the kube-dns Service; restart the kube-proxy DaemonSet

Answer

The nodes are under memory pressure and evicted CoreDNS pods; drain and reboot the affected nodes

Question 9

Users report that pods across the cluster cannot resolve any DNS names, both internal and external. You check the CoreDNS deployment and see two CoreDNS pods in Running state with 0 restarts, and the pods' logs show no errors. From a test pod, 'nslookup kubernetes.default' times out. You run 'kubectl get svc -n kube-system' and notice there is no service named 'kube-dns'. What is the most likely cause of the DNS failure?

Accepted Answer

The kube-dns Service (ClusterIP fronting CoreDNS) was deleted, so pods have no reachable DNS endpoint even though CoreDNS pods are healthy

Answer

The CoreDNS Corefile is misconfigured and needs the 'forward' plugin re-added

Answer

The CoreDNS deployment must be renamed to kube-dns for kubelet to inject the correct nameserver

Answer

kube-proxy is down on all nodes, breaking iptables rules for every service

Question 10

A worker node's kubelet is running, but you suspect containers are failing at the runtime level. The node uses containerd as its CRI. You need to list all running containers and inspect a specific container's status directly at the runtime layer, bypassing the Kubernetes API. Which tool and configuration is the correct approach?

Accepted Answer

Use crictl with the runtime endpoint set to unix:///run/containerd/containerd.sock (e.g., via /etc/crictl.yaml or --runtime-endpoint) to run 'crictl ps' and 'crictl inspect'.

Answer

Use 'docker ps' and 'docker inspect' since Kubernetes always manages containers through the Docker daemon socket.

Answer

Run 'kubectl get pods -o wide' on the node, since kubectl communicates directly with the container runtime when run locally.

Answer

Use 'ctr --namespace k8s.io containers list' after setting the CRI endpoint to unix:///var/run/crio/crio.sock.

Question 11

You maintain a monitoring DaemonSet that must run a node-exporter pod on every node in the cluster, including the control-plane nodes. After deploying, you notice the DaemonSet pods are running on all worker nodes but not on the control-plane nodes. Describing a control-plane node shows the taint 'node-role.kubernetes.io/control-plane:NoSchedule'. Which change to the DaemonSet pod spec will allow the pods to also be scheduled on the control-plane nodes without affecting scheduling elsewhere?

Accepted Answer

Add a toleration with key 'node-role.kubernetes.io/control-plane', operator 'Exists', and effect 'NoSchedule'

Answer

Add a nodeSelector matching the label 'node-role.kubernetes.io/control-plane: ""' to target the control-plane nodes

Answer

Add a required nodeAffinity rule selecting nodes with the 'node-role.kubernetes.io/control-plane' label

Answer

Remove the 'node-role.kubernetes.io/control-plane:NoSchedule' taint from every control-plane node with kubectl taint

Question 12

A developer creates a PVC named 'cache-data' that dynamically provisions a PV through a StorageClass whose reclaimPolicy is 'Delete'. After testing, the developer deletes the PVC to free resources. A day later, the team asks you to recover the data that was on that volume. Which statement correctly describes what happened and why?

Accepted Answer

The PV and its underlying storage asset were automatically deleted when the PVC was removed, so the data is unrecoverable from Kubernetes.

Answer

The PV entered the 'Released' state and retained the data, so you can simply re-bind a new PVC to recover it.

Answer

The PV remains 'Bound' until an administrator manually deletes it, so the data is still intact and available.

Answer

Deleting a PVC never affects the PV regardless of reclaim policy; only deleting the StorageClass triggers volume cleanup.

Question 13

You manage a Deployment named 'billing-api' whose pods mount a ConfigMap named 'billing-config' as environment variables using envFrom. After a colleague updates several values in 'billing-config' with 'kubectl edit configmap billing-config', users report the application is still using the old configuration values. The pods are all Running and healthy. What is the correct explanation and remediation?

Accepted Answer

Environment variables from a ConfigMap are injected only at pod startup and are not updated in-place; trigger a rolling restart with 'kubectl rollout restart deployment/billing-api' so new pods pick up the updated values.

Answer

ConfigMap changes propagate to environment variables automatically within about 60 seconds; the delay indicates the kubelet sync period must be lowered on each node.

Answer

The ConfigMap must be deleted and recreated with the same name for changes to take effect; editing in place is silently ignored by the API server.

Answer

You must scale the Deployment to zero replicas and back up so the ReplicaSet re-reads the ConfigMap; a rolling restart alone will not reload environment values.

Question 14

A Deployment named web has 10 replicas and uses the default RollingUpdate strategy with maxSurge: 0 and maxUnavailable: 25%. You trigger a rolling update with a new image. During the rollout, you observe that only some old pods are terminated at a time and no extra pods beyond 10 are ever created. What is the maximum number of pods that can be unavailable at any moment during this rollout?

Accepted Answer

2 pods (25% of 10, rounded down)

Answer

3 pods (25% of 10, rounded up)

Answer

5 pods (half of the replicas)

Answer

0 pods (maxSurge is 0, so no unavailability is allowed)

Question 15

You need to apply several changes to a running Deployment named 'web': update the container image, add a new environment variable, and increase the CPU request. You want to make all these edits without triggering a separate rolling update for each change, then roll them all out together as a single revision. Which sequence of commands achieves this?

Accepted Answer

kubectl rollout pause deployment/web, apply the image/env/resource changes, then kubectl rollout resume deployment/web

Answer

kubectl rollout undo deployment/web, apply all changes, then kubectl rollout restart deployment/web

Answer

kubectl scale deployment/web --replicas=0, apply all changes, then kubectl scale deployment/web --replicas=3

Answer

kubectl annotate deployment/web kubernetes.io/change-cause, apply all changes, then kubectl rollout status deployment/web

Question 16

A platform engineer manages a Deployment named 'payments-api'. After several rolling updates, they attempt to roll back two revisions using 'kubectl rollout undo deployment/payments-api --to-revision=3', but the command fails with an error stating that the revision was not found. Running 'kubectl rollout history deployment/payments-api' shows only the two most recent revisions. What is the most likely cause?

Accepted Answer

The Deployment's spec.revisionHistoryLimit is set to a low value, so older ReplicaSets (and their revisions) were garbage-collected.

Answer

Rollbacks to a specific revision are only supported for StatefulSets, not Deployments.

Answer

The Deployment uses the Recreate strategy, which does not retain any revision history.

Answer

The --to-revision flag must be set to 0 to roll back to any previous revision.

Question 17

A Deployment named 'payments' runs 10 replicas behind a Service that must never drop below full capacity during updates. The team also wants updates to proceed as fast as possible while guaranteeing that at no point are fewer than 10 Pods Ready. Which rollingUpdate strategy configuration satisfies these requirements?

Accepted Answer

maxUnavailable: 0 and maxSurge: 3

Answer

maxUnavailable: 3 and maxSurge: 0

Answer

maxUnavailable: 0 and maxSurge: 0

Answer

maxUnavailable: 25% and maxSurge: 25%

Question 18

A frontend Deployment reports intermittent 502 errors when calling the 'payments' Service. The Service selector matches the pods, and `kubectl get endpoints payments` shows several IPs listed. However, inspecting `kubectl get endpointslices -l kubernetes.io/service-name=payments -o yaml` reveals that some endpoints have `conditions.ready: false` while their pods show STATUS Running. What is the most likely cause of the endpoints being marked not ready?

Accepted Answer

The affected pods are failing their readiness probe, so kube-proxy excludes them from load balancing even though the containers are running.

Answer

The Service is missing a targetPort, so the EndpointSlice controller cannot populate ready addresses.

Answer

CoreDNS is returning stale records, causing the EndpointSlice to mark addresses as not ready.

Answer

The pods are on a node that is cordoned, which automatically sets their EndpointSlice condition to not ready.

Question 19

After a maintenance reboot of a single-node control plane, `kubectl get nodes` fails with 'The connection to the server 10.0.0.5:6443 was refused'. You SSH into the control-plane node. `systemctl status kubelet` shows kubelet is active and running. You need to find out why the kube-apiserver static pod is not serving requests. What is the BEST first step to diagnose the failure?

Accepted Answer

Inspect container runtime logs directly with `crictl ps -a` and `crictl logs <apiserver-container-id>` on the node

Answer

Run `kubectl logs -n kube-system kube-apiserver-<node>` to view the API server logs

Answer

Restart the kubelet with `systemctl restart kubelet` and wait for the API server to recover

Answer

Edit `/etc/kubernetes/manifests/kube-apiserver.yaml` to add a readiness probe and let kubelet recreate the pod

Question 20

Your production cluster uses an external etcd topology (etcd runs on dedicated nodes outside the control-plane machines). You need to take an etcd snapshot for backup from one of the etcd nodes using etcdctl v3. The etcd cluster is secured with client certificate authentication. Which command correctly produces the snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snap.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/etcd/ca.crt --cert=/etc/etcd/server.crt --key=/etc/etcd/server.key

Answer

ETCDCTL_API=3 etcdctl snapshot save /backup/snap.db --endpoints=http://127.0.0.1:2379

Answer

kubectl exec -n kube-system etcd-master -- etcdctl snapshot save /backup/snap.db

Answer

ETCDCTL_API=2 etcdctl backup --data-dir=/var/lib/etcd --backup-dir=/backup

Question 21

You are responsible for etcd backups on a kubeadm-provisioned cluster where etcd runs as a stacked static pod on the control-plane node. Before a risky upgrade, you must take a manual snapshot of the etcd data from the control-plane host. The etcd server certificates are located in /etc/kubernetes/pki/etcd/. Which command correctly captures a consistent snapshot?

Accepted Answer

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key

Answer

ETCDCTL_API=3 etcdctl snapshot save /opt/etcd-backup.db --endpoints=https://127.0.0.1:2379 --insecure-skip-tls-verify

Answer

kubectl get etcd -n kube-system -o yaml > /opt/etcd-backup.db

Answer

cp -r /var/lib/etcd /opt/etcd-backup.db while the etcd static pod is running

Question 22

You are administering a three-node stacked etcd control plane provisioned with kubeadm. After a network partition, users report intermittent API server errors. You want to inspect the etcd cluster membership and confirm each member's health directly from one control-plane node. Which command correctly queries etcd using the certificates that kubeadm places on the node?

Accepted Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key endpoint health --cluster

Answer

ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/ca.crt --cert=/etc/kubernetes/pki/apiserver.crt --key=/etc/kubernetes/pki/apiserver.key endpoint health --cluster

Answer

kubectl get --raw /healthz/etcd --server=https://127.0.0.1:2379

Answer

ETCDCTL_API=2 etcdctl cluster-health --endpoints=https://127.0.0.1:2379 --ca-file=/etc/kubernetes/pki/etcd/ca.crt

Question 23

You are deploying a Cassandra cluster as a StatefulSet named 'cassandra' in the 'data' namespace. The application requires each pod to be individually addressable via a stable DNS name so peers can discover each other directly, rather than routing through a single virtual IP that load-balances requests. Which Service configuration will produce per-pod DNS A records like 'cassandra-0.cassandra.data.svc.cluster.local'?

Accepted Answer

A Service with 'clusterIP: None' (headless) and a selector matching the StatefulSet pods

Answer

A standard ClusterIP Service with a selector matching the StatefulSet pods

Answer

A NodePort Service so each pod is exposed on a unique node port

Answer

A Service with 'clusterIP: None' but with no selector, relying on manual Endpoints

Question 24

You are deploying an application named 'billing' with Helm. The chart's values.yaml sets 'replicaCount: 2'. Your team maintains an environment file prod-values.yaml that sets 'replicaCount: 4'. During a hotfix rollout you run: helm install billing ./billing-chart -f prod-values.yaml --set replicaCount=6. After the release completes, how many replicas will the Deployment be configured with, and why?

Accepted Answer

6 replicas, because --set has the highest precedence and overrides both values.yaml and the -f file

Answer

4 replicas, because the -f file is applied last and overrides both the chart default and --set

Answer

2 replicas, because the chart's built-in values.yaml always takes priority over runtime overrides

Answer

The install fails because you cannot combine -f and --set in a single helm command

Question 25

A platform engineer reports that a Helm release named 'billing-api' was installed several days ago, but running `helm list` in their current shell shows no releases. Other teammates confirm the workload pods are running in the 'finance' namespace. Which command will correctly reveal the 'billing-api' release and its status?

Accepted Answer

helm list --all-namespaces

Answer

helm status billing-api --revision 0

Answer

helm repo list | grep billing-api

Answer

kubectl get releases -A