The CKA is for people who run Kubernetes clusters: administrators, platform engineers and anyone who wants to show they can fix a broken cluster from a terminal. This page has free practice sets for each official domain, worked explanations, a study plan and plain answers about the $445 fee, the 2-hour limit and the 66% passing score. Practice with the free Certified Kubernetes Associate practice test on PracticeTestGeeks (7 questions with answer explanations).

Free Certified Kubernetes Associate Study Tools

Interactive Certified Kubernetes Associate resources on PracticeTestGeeks, free to start:

• CKA Troubleshooting 1 — 7 questions with answer explanations
• Certified Kubernetes Associate flashcards — review key terms and concepts card by card
• Certified Kubernetes Associate study guide — topic-by-topic overview of what the exam covers
• Certified Kubernetes Associate cheat sheet — one-page printable summary for last-minute review

CKA Exam at a Glance

Facts verified Oct 22, 2026 against The Linux Foundation, with the Cloud Native Computing Foundation. Dates that have passed are removed automatically.

What the CKA is and how it works

According to The Linux Foundation, with the Cloud Native Computing Foundation, “The exam is based on Kubernetes v1.37. The CKA exam environment will be aligned with the most recent K8s minor version within approximately 4 to 8 weeks of the K8s release date.”^[1]

The CKA is the Linux Foundation's hands-on Kubernetes certification, run with the Cloud Native Computing Foundation. Its official title is Certified Kubernetes Administrator. Some listings call it Certified Kubernetes Associate, but it is the same exam.

It is not a multiple-choice test. You get 2 hours in an online, remotely proctored session to solve tasks from a command line on live Kubernetes clusters. The exam is based on Kubernetes v1.37. The Linux Foundation updates the exam environment to the newest Kubernetes minor version within about 4 to 8 weeks of each release, so check the current version before you book.

Scoring is automatic. You need 66% or higher to pass. Unless there is a technical problem, your score report arrives by email within 24 hours of finishing. There are no prerequisites.

The exam-only price is $445. That covers one retake if you do not pass, whatever the reason, plus two simulator attempts. You have 12 months from purchase to take the exam. The certification is valid for 2 years. To renew it, you retake and pass the exam before it expires.

Prices, bundles and policies change. Before you pay, check the CKA page on the Linux Foundation training site and the Linux Foundation's CKA, CKAD and CKS FAQ.

CKA content outline and where to practise each area

The content areas below are copied from the official CKA content outline published by The Linux Foundation, with the Cloud Native Computing Foundation, with the share of the exam each area carries. The right-hand column shows which of our practice sets covers it.

Worked examples: how to reason through CKA questions

These are practice questions written for this site, not questions from the real exam. Each explanation shows why the right answer is right and why the others are wrong.

Example 1

Question: Which QoS class is the LAST to be evicted when a node is under resource pressure?

1. Guaranteed
2. Burstable
3. BestEffort
4. Critical

Answer: A. Guaranteed

Explanation:

Guaranteed is correct. A Pod is Guaranteed when every container sets CPU and memory requests equal to its limits. When a node runs short of resources, the kubelet evicts BestEffort Pods first, then Burstable Pods, and Guaranteed Pods last.

• BestEffort is the reverse: these Pods set no requests or limits at all, so they are evicted first.
• Burstable is in the middle: some requests are set, but they do not match the limits.
• Critical is not a QoS class. Kubernetes has priority classes such as system-node-critical, but priority is a separate mechanism from QoS.

Rule to remember: the QoS class comes from how you set requests and limits. Setting requests equal to limits is how you protect a Pod from eviction.

Example 2

Question: A static Pod manifest is placed in /etc/kubernetes/manifests/. Which component is responsible for starting that Pod?

1. kube-scheduler
2. kube-controller-manager
3. kubelet
4. kube-apiserver

Answer: C. kubelet

Explanation:

kubelet is correct. Static Pods are read straight from a directory on the node, such as /etc/kubernetes/manifests/, by that node's kubelet. The kubelet starts them, restarts them if they fail, and creates a read-only mirror Pod in the API server so they show up in kubectl.

• kube-scheduler is wrong because a static Pod already belongs to the node whose kubelet reads the file, so there is nothing to schedule.
• kube-controller-manager runs controllers such as the Deployment and node controllers. It never reads local manifest files.
• kube-apiserver only holds the mirror Pod. Deleting the Pod through the API does not stop it.

Rule to remember: to change or remove a static Pod, edit or move its file on the node. This is how kubeadm runs the control plane components.

Example 3

Question: What does Istio's fault injection feature allow you to do?

1. Simulate delays and HTTP errors to test service resilience
2. Inject custom sidecar containers into pods automatically
3. Replace a failing service with a mock response permanently
4. Inject network policies to drop packets between services

Answer: A. Simulate delays and HTTP errors to test service resilience

Explanation:

Option A is correct. In Istio you add a fault rule to a VirtualService route. It can delay requests or abort them with an HTTP error for a chosen share of traffic, so you can test timeouts, retries and fallbacks before a real outage.

• B describes sidecar injection. That is a separate feature, turned on with a namespace label or istioctl.
• C is wrong because faults are temporary test conditions you add and remove. They do not permanently replace a service.
• D describes access control, such as Kubernetes NetworkPolicy or Istio authorization policies, not failure testing.

Rule to remember: fault injection tests resilience at the application layer. Service mesh tools are not one of the official CKA domains, so treat this set as background knowledge.

How to use these practice tests

Start with the official curriculum on the Linux Foundation site and the Kubernetes documentation. The docs are the reference you will rely on most while preparing. Then work in this order:

1. Find your gaps. Take the full practice test without notes and write down which domains you missed.
2. Spend time where the weight is. Troubleshooting is worth 30% and Cluster Architecture 25%, so start with the Troubleshooting and Cluster Architecture sets. Then move on to Networking, Workloads and Scheduling and Storage.
3. Turn each missed question into a terminal task. Our questions check that you understand a concept. The exam checks that you can do it. Rebuild each scenario on a practice cluster and fix it with kubectl.
4. Work on speed. All the tasks must fit into 2 hours, so get fast with imperative kubectl commands, generating YAML with --dry-run=client -o yaml, and finding the right page in the docs.
5. Save the simulator for late in your prep. Your $445 purchase includes two simulator attempts. Use them once you can get through our sets without notes, and go back over every task you could not finish.

Book the exam within your 12-month window once your simulator results are steady.