CKA Cheat Sheet 2026

The 30 highest-yield CKA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is a Pod in Kubernetes? → The smallest deployable unit that can contain one or more containers
2. Which Service type allows external access to a Kubernetes application through a specific port on each node in the cluster? → NodePort
3. An AppArmor profile is applied to a container using which mechanism in Kubernetes? → An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/`
4. Which ConfigMap in the kube-system namespace stores the kubeadm cluster configuration? → kubeadm-config
5. Which Kubernetes object defines the permissions granted by a ClusterRole to a set of users across all namespaces? → ClusterRoleBinding
6. Which type of workload should you use for a Pod that must run on every node in a Kubernetes cluster? → DaemonSet
7. Which command displays only the last 50 lines of logs from pod 'api'? → kubectl logs api --tail=50
8. What is a ConfigMap? → An object storing non-confidential configuration data as key-value pairs
9. What is a Persistent Volume (PV)? → A storage resource in the cluster provisioned independently of Pod lifecycle
10. How do you restrict communication between Pods in a Kubernetes cluster? → By using Network Policies.
11. What does 'kubectl get pods' show? → A list of all Pods and their status in the current namespace
12. What is a Kubernetes Deployment? → A resource that manages ReplicaSets and provides declarative updates for Pods
13. Which of the following ensures that Pods run with restricted permissions in Kubernetes? → Security Context
14. Which Kubernetes resource is used to securely store sensitive data like API keys and passwords? → Secret
15. What happens when a Service's label selector matches no running pods? → The Endpoints object has no entries and traffic to the service is dropped
16. What is the primary purpose of an Ingress resource in Kubernetes? → To manage HTTP/HTTPS routing from outside the cluster to internal services
17. What flag in kubeadm init allows you to specify the pod network CIDR? → --pod-network-cidr
18. How do you expose all key-value pairs from a ConfigMap named 'app-config' as environment variables in a Pod? → Use envFrom with configMapRef specifying the ConfigMap name
19. In a high-availability control plane, how does the kube-scheduler ensure only one instance is active at a time? → Leader election using a lease object
20. What happens when a liveness probe fails? → Kubernetes restarts the container
21. Which command lists recent events from every namespace in the cluster? → kubectl get events --all-namespaces
22. What is a Kubernetes Deployment? → A resource that manages ReplicaSets and provides declarative updates for Pods
23. What is a Persistent Volume (PV)? → A storage resource in the cluster provisioned independently of Pod lifecycle
24. Which kubeconfig field stores the cluster's certificate authority data used by kubectl to verify the API server? → certificate-authority-data
25. What flag on a container's SecurityContext prevents privilege escalation via setuid binaries? → allowPrivilegeEscalation: false
26. What is a Persistent Volume (PV)? → A storage resource in the cluster provisioned independently of Pod lifecycle
27. What does setting `clusterIP: None` on a Service create? → A Headless Service for direct pod DNS discovery
28. What is the purpose of a Network Policy in Kubernetes? → To control Pod communication at the network level.
29. Which kubectl command creates a ConfigMap from all files in a directory named 'configs/'? → kubectl create configmap my-config --from-file=configs/
30. Which command drains a node and marks it as unschedulable before maintenance? → kubectl drain