Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: Which flag streams live log output continuously from a pod?

--follow (Correct answer)
--stream
--tail
--live

Correct answer: --follow

The `--follow` (or `-f`) flag streams live log output from a pod, similar to `tail -f`.

Question 2: In Kubernetes RBAC, what is the difference between a Role and a ClusterRole?

Roles are namespaced; ClusterRoles are cluster-scoped (Correct answer)
Roles support more verbs than ClusterRoles
Roles can include non-resource URLs; ClusterRoles cannot
ClusterRoles cannot be bound with RoleBindings

Correct answer: Roles are namespaced; ClusterRoles are cluster-scoped

Roles are namespaced and only grant permissions within a specific namespace, while ClusterRoles are cluster-scoped and can cover cluster-wide or non-namespaced resources.

Question 3: Which topologySpreadConstraint field specifies the maximum difference in pod count between the most and least loaded topology zones?

labelSelector
whenUnsatisfiable
maxSkew (Correct answer)
minDomains

Correct answer: maxSkew

maxSkew defines the maximum allowed difference in pod count across topology domains; a lower value spreads pods more evenly.

Question 4: What is the effect of the toleration operator 'Exists' when used without a value in a pod toleration?

Removes the taint from the node
Tolerates all taints on the node
Tolerates any taint with the specified key, regardless of value (Correct answer)
Tolerates only taints with an empty value

Correct answer: Tolerates any taint with the specified key, regardless of value

With operator: Exists and no value field, the toleration matches any taint that has the specified key, regardless of what value the taint carries.

Question 5: When upgrading a cluster with kubeadm, what is the correct order of operations?

Upgrade workers first, then control plane
Upgrade control plane first, then workers (Correct answer)
Upgrade all nodes simultaneously using kubeadm upgrade all
Upgrade etcd first, then drain all nodes simultaneously

Correct answer: Upgrade control plane first, then workers

You must upgrade the control plane components first with kubeadm upgrade apply, then upgrade each worker node individually.

Question 6: An AppArmor profile is applied to a container using which mechanism in Kubernetes?

A SecurityContext field `appArmorProfile`
An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/<name>` (Correct answer)
A LimitRange policy
A NetworkPolicy rule

Correct answer: An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/<name>`

AppArmor profiles are applied via pod annotations in the format `container.apparmor.security.beta.kubernetes.io/<container-name>: <profile>`.

Question 7: An Ingress resource requires which cluster component to actually route HTTP traffic?

CoreDNS
An Ingress controller (Correct answer)
kube-proxy
kubelet

Correct answer: An Ingress controller

An Ingress resource is only a configuration object; an Ingress controller (e.g., nginx-ingress, Traefik) must be deployed to act on it.

Question 8: What does setting `runAsGroup: 3000` in a pod's SecurityContext enforce?

Only users in group 3000 can schedule the pod
The pod's namespace is isolated to group 3000
Limits CPU to group 3000 shares
All container processes run with GID 3000 (Correct answer)

Correct answer: All container processes run with GID 3000

`runAsGroup` sets the primary GID for all container processes, controlling file permission checks and group-owned resource access.

Question 9: Which Kubernetes object is used to ensure that a specific number of replicas of a Pod are running at any time?

ReplicaSet (Correct answer)
StatefulSet
Deployment
DaemonSet

Correct answer: ReplicaSet

A ReplicaSet's primary purpose is to maintain a stable set of replica Pods running at any given time. It ensures that a specified number of identical Pods are always available and automatically replaces any Pods that fail or are terminated. While Deployments use ReplicaSets under the hood to manage Pods, the ReplicaSet itself is the object directly responsible for maintaining the desired replica count.

Question 10: Which ConfigMap in the kube-system namespace stores the kubeadm cluster configuration?

kubeadm-cluster
cluster-config
kubeadm-config (Correct answer)
kube-config

Correct answer: kubeadm-config

kubeadm stores its ClusterConfiguration in the kubeadm-config ConfigMap in the kube-system namespace.

Question 11: Where does Kubernetes store container log files on the node by default?

/etc/kubernetes/logs/
/run/kubernetes/logs/
/var/log/containers/ (Correct answer)
/tmp/kubernetes/logs/

Correct answer: /var/log/containers/

Container logs are written to `/var/log/containers/` on the node, symlinked from `/var/log/pods/`.

Question 12: What is a Persistent Volume (PV)?

A type of ConfigMap
A network drive
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
Temporary container storage

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 13: What is a node cordon?

Adding labels to a node
Removing a node from the cluster
Restarting a node
Marking a node as unschedulable so no new Pods are placed on it (Correct answer)

Correct answer: Marking a node as unschedulable so no new Pods are placed on it

Cordoning marks a node as unschedulable. Existing Pods continue running, but no new Pods will be scheduled on the cordoned node.

Question 14: What is a Pod in Kubernetes?

The smallest deployable unit that can contain one or more containers (Correct answer)
A network switch
A physical server
A database table

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 15: What is a ConfigMap?

A routing table
A log file
A password vault
An object storing non-confidential configuration data as key-value pairs (Correct answer)

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 16: Which field in a Deployment spec controls the maximum number of pods that can be unavailable during a rolling update?

minReadySeconds
maxSurge
revisionHistoryLimit
maxUnavailable (Correct answer)

Correct answer: maxUnavailable

`maxUnavailable` defines how many pods can be taken down simultaneously during a rolling update, expressed as an absolute number or percentage.

Question 17: What is a ConfigMap?

A log file
An object storing non-confidential configuration data as key-value pairs (Correct answer)
A routing table
A password vault

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 18: Which status field shows the detailed reason a specific container is not running?

status.message
status.phase
status.conditions
status.containerStatuses[].state (Correct answer)

Correct answer: status.containerStatuses[].state

The `status.containerStatuses[].state` field contains Waiting, Running, or Terminated state details including the reason.

Question 19: A PodDisruptionBudget specifies minAvailable: 3 for a Deployment with 4 replicas. How many pods can kubectl drain evict at once?

All 4 pods
1 pod (Correct answer)
3 pods
2 pods

Correct answer: 1 pod

With minAvailable: 3, only 1 pod may be disrupted at a time (4 - 3 = 1), so drain can evict at most 1 pod.

Question 20: What is etcd backup important for?

It is optional for production
It stores all cluster state and configuration data (Correct answer)
It backs up application code
It only stores container images

Correct answer: It stores all cluster state and configuration data

etcd contains all cluster configuration, state, and secrets. Regular backups are critical because losing etcd data means losing the entire cluster state.

Question 21: What happens to Pod-to-Pod traffic between nodes in a flat Kubernetes network model?

Traffic requires a Service ClusterIP as intermediary
Pods can communicate directly without NAT (Correct answer)
Traffic must go through the API server
kube-proxy must proxy all cross-node traffic

Correct answer: Pods can communicate directly without NAT

The Kubernetes network model requires that all Pods can reach each other without NAT, regardless of the node they run on.

Question 22: An application Pod references a ConfigMap key that does not exist. The container spec uses 'configMapKeyRef' without any optional setting. What will happen?

The environment variable will be set to an empty string
The Pod will start and the environment variable will be unset
The Pod will fail to start because the missing key causes an error (Correct answer)
Kubernetes will create the missing key with an empty value

Correct answer: The Pod will fail to start because the missing key causes an error

By default, configMapKeyRef is required; if the referenced key is missing, the Pod will not start and an error event is generated.

Question 23: Which Kubernetes object tracks the IP addresses and ports of pods backing a Service?

ServiceAccount
PodList
BackendPool
EndpointSlice (Correct answer)

Correct answer: EndpointSlice

EndpointSlice objects (replacing the older Endpoints object) track the IP/port pairs of pods selected by a Service.

Question 24: What happens when a liveness probe fails?

Kubernetes restarts the container (Correct answer)
The node is removed
The Pod is deleted
Nothing happens

Correct answer: Kubernetes restarts the container

When a liveness probe fails, Kubernetes determines the container is unhealthy and restarts it, following the Pod's restart policy.

Question 25: What is a Pod in Kubernetes?

A network switch
A physical server
A database table
The smallest deployable unit that can contain one or more containers (Correct answer)

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 26: How are individual StatefulSet pods addressed via DNS using a headless service 'mysvc' in namespace 'default'?

<pod-name>.default.svc.cluster.local
<pod-name>.mysvc.default.svc.cluster.local (Correct answer)
<pod-index>.mysvc.cluster.local
<pod-name>.pod.cluster.local

Correct answer: <pod-name>.mysvc.default.svc.cluster.local

StatefulSet pods are individually addressable as `<pod-name>.<governing-headless-service>.<namespace>.svc.cluster.local`.

Question 27: Which command shows the upgrade plan and available versions for a kubeadm-managed cluster?

kubeadm upgrade plan (Correct answer)
kubeadm version --upgrade
kubectl get upgrades
kubeadm upgrade check

Correct answer: kubeadm upgrade plan

kubeadm upgrade plan shows the current cluster version, available target versions, and any component version skew warnings.

Question 28: Which Deployment field controls how many old ReplicaSets are retained after an update?

spec.progressDeadlineSeconds
spec.revisionHistoryLimit (Correct answer)
spec.minReadySeconds
spec.paused

Correct answer: spec.revisionHistoryLimit

spec.revisionHistoryLimit (default 10) determines how many old ReplicaSets are kept for rollback purposes.

Question 29: What is a Kubernetes Deployment?

A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A network policy
A storage class
A one-time job

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 30: What is `terminationGracePeriodSeconds` and what is its default value in Kubernetes?

Time before a failed pod is garbage-collected; default 120s
Time between SIGTERM and SIGKILL for graceful shutdown; default 30s (Correct answer)
Time to wait for init containers to finish; default 60s
Time a pod can remain in Terminating state; default 300s

Correct answer: Time between SIGTERM and SIGKILL for graceful shutdown; default 30s

`terminationGracePeriodSeconds` gives the container time to handle SIGTERM before Kubernetes sends SIGKILL; the default is 30 seconds.

Question 31: What command is used to apply a Pod network in a Kubernetes cluster after initialization?

kubeadm network apply
kubectl apply -f <network-yaml-file> (Correct answer)
kubectl create network
kubeadm init --network

Correct answer: kubectl apply -f <network-yaml-file>

After `kubeadm init` initializes the control plane, a Container Network Interface (CNI) plugin must be installed to enable Pod-to-Pod communication. CNI plugins are typically deployed using a YAML manifest, which is applied to the cluster using the `kubectl apply -f` command. This command reads the configuration from the specified YAML file and creates the necessary Kubernetes objects, such as DaemonSets or Deployments, to install the network plugin.

Question 32: What is a ConfigMap?

An object storing non-confidential configuration data as key-value pairs (Correct answer)
A log file
A routing table
A password vault

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 33: Which Kubernetes admission controller validates and mutates resources based on custom policies using webhooks?

LimitRanger
NamespaceLifecycle
ValidatingAdmissionWebhook (Correct answer)
NodeRestriction

Correct answer: ValidatingAdmissionWebhook

`ValidatingAdmissionWebhook` calls external webhook servers to accept or reject API requests based on custom policy logic.

Question 34: Which file on a kubeadm cluster stores the kubeadm configuration used during 'kubeadm init'?

/var/lib/kubelet/config.yaml
A ConfigMap named kubeadm-config in kube-system namespace (Correct answer)
/etc/kubeadm/init-config.yaml
/etc/kubernetes/admin.conf

Correct answer: A ConfigMap named kubeadm-config in kube-system namespace

kubeadm stores the cluster configuration in a ConfigMap named kubeadm-config in the kube-system namespace for use during upgrades.

Question 35: What is the purpose of a Kubernetes LimitRange object?

Controls network bandwidth per node
Defines CPU limits for an entire cluster
Sets default and maximum resource limits per pod/container in a namespace (Correct answer)
Restricts total resource usage across a namespace

Correct answer: Sets default and maximum resource limits per pod/container in a namespace

LimitRange sets default requests/limits and enforces min/max constraints on individual pods and containers within a namespace.

Question 36: Which of the following ensures that Pods run with restricted permissions in Kubernetes?

Pod Disruption Budget
Security Context (Correct answer)
Node Affinity
RBAC Policies

Correct answer: Security Context

A Security Context defines privilege and access control settings for a Pod or an individual container within a Pod. It allows you to specify parameters like the user ID (UID) and group ID (GID) under which the container's process runs, whether it can run as root, and other Linux capabilities. This ensures that Pods operate with the principle of least privilege, enhancing security.

Question 37: Which kubectl command (using a short alias) shows the current endpoints for service 'webapp'?

kubectl get ep webapp (Correct answer)
kubectl get svc webapp --endpoints
kubectl describe svc webapp --ep
kubectl show ep webapp

Correct answer: kubectl get ep webapp

`kubectl get ep webapp` uses 'ep' as the short alias for 'endpoints' to display the endpoint IPs backing the service.

Question 38: How do you restrict communication between Pods in a Kubernetes cluster?

By using Network Policies. (Correct answer)
By setting resource limits on Pods.
By using RBAC policies.
By adding taints to nodes.

Correct answer: By using Network Policies.

Network Policies are Kubernetes resources that allow you to define rules for how Pods are allowed to communicate with each other and with external network endpoints. They act as a firewall for Pods, enabling you to restrict ingress (incoming) and egress (outgoing) traffic based on labels, namespaces, and IP ranges. This is essential for implementing micro-segmentation and enhancing security within the cluster.

Question 39: You need to check the etcd cluster health. Which etcdctl command and flag combination is correct?

etcdctl status --cluster
etcdctl member health --all
etcdctl cluster-info
etcdctl endpoint health (Correct answer)

Correct answer: etcdctl endpoint health

etcdctl endpoint health checks the health of each etcd endpoint and reports whether each member is healthy.

Question 40: What does 'kubectl get pods' show?

Network configuration
User accounts
A list of all Pods and their status in the current namespace (Correct answer)
Server hardware info

Correct answer: A list of all Pods and their status in the current namespace

This command displays all Pods in the current namespace with their name, ready status, current state, restarts, and age.

Question 41: A pod in namespace 'frontend' needs to access a Service in namespace 'backend'. What DNS name should it use?

backend.svc.backend
backend-svc.cluster.local
backend-svc.frontend.svc.cluster.local
backend-svc.backend.svc.cluster.local (Correct answer)

Correct answer: backend-svc.backend.svc.cluster.local

The full DNS FQDN for a Service is <service>.<namespace>.svc.<cluster-domain>, so cross-namespace access requires including the target namespace.

Question 42: After upgrading a worker node's kubeadm and kubelet packages, which command applies the node configuration upgrade?

kubeadm upgrade apply
kubeadm node upgrade
kubeadm upgrade node (Correct answer)
kubeadm worker upgrade

Correct answer: kubeadm upgrade node

On worker nodes, kubeadm upgrade node updates the local kubelet configuration to match the new cluster version after the package upgrade.

Question 43: You need to grant a CI/CD pipeline read-only access to pods in only the `staging` namespace. Which combination is correct?

Role in staging + RoleBinding in staging (Correct answer)
Role in staging + ClusterRoleBinding
ClusterRole + ClusterRoleBinding
ClusterRole + RoleBinding in staging

Correct answer: Role in staging + RoleBinding in staging

A Role scoped to `staging` combined with a RoleBinding in `staging` grants access limited to that namespace only.

Question 44: What Kubernetes object type records cluster state changes such as pod scheduling failures?

Events (Correct answer)
Notifications
Conditions
Alerts

Correct answer: Events

Kubernetes Event objects capture state changes and notable occurrences like scheduling failures or image pull errors.

Question 45: Which etcd operation should be performed before upgrading the Kubernetes control plane?

etcd defragmentation
etcd compaction
etcd snapshot backup (Correct answer)
etcd member remove

Correct answer: etcd snapshot backup

Taking an etcd snapshot backup before upgrades ensures you can restore cluster state if the upgrade fails.

Question 46: Which NetworkPolicy `podSelector: {}` (empty) in the spec means?

No Pods in the namespace are selected
Only Pods with no labels are selected
The policy is disabled
All Pods in the namespace are selected (Correct answer)

Correct answer: All Pods in the namespace are selected

An empty podSelector matches all Pods in the namespace, making it useful for default-deny policies.

Question 47: A cluster administrator wants to schedule maintenance pods exclusively on a specific node. Which approach is correct?

Use kubectl cordon on all other nodes so only the target accepts pods (Correct answer)
Label the node and use nodeSelector in the pod spec
Apply a taint to the target node with NoExecute effect
Drain all other nodes and leave only the target node schedulable

Correct answer: Use kubectl cordon on all other nodes so only the target accepts pods

Cordoning all other nodes makes only the target node schedulable, ensuring new pods land there without disrupting existing workloads on other nodes.

Question 48: Which Service type exposes an application on a static port on every node's IP?

LoadBalancer
ClusterIP
NodePort (Correct answer)
Headless

Correct answer: NodePort

NodePort exposes the service on each Node's IP at a static port in the range 30000–32767.

Question 49: How does Kubernetes handle service discovery?

No service discovery mechanism
Manual IP configuration
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
External DNS only

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 50: A pod is stuck in 'Pending' state. Which resource type shortage most likely causes this when node capacity appears sufficient?

Service endpoint not ready
Insufficient PersistentVolume
Node has a NoSchedule taint the pod doesn't tolerate (Correct answer)
ConfigMap not found

Correct answer: Node has a NoSchedule taint the pod doesn't tolerate

A NoSchedule taint on all matching nodes prevents the scheduler from placing the pod, even when CPU/memory is available, causing it to stay Pending.

Question 51: What happens to a Pod if it references a Secret that does not exist in the same namespace?

The Pod remains in Pending state and fails to start (Correct answer)
The Pod starts but the environment variable is set to an empty string
Kubernetes automatically creates an empty Secret with that name
The Pod starts and the missing Secret key is skipped

Correct answer: The Pod remains in Pending state and fails to start

If a referenced Secret is missing, the container cannot be started and the Pod stays in Pending with an error event indicating the missing resource.

Question 52: What is the purpose of a Network Policy in Kubernetes?

To implement TLS for Kubernetes API access.
To control Pod communication at the network level. (Correct answer)
To encrypt traffic between Pods.
To restrict API access to specific users.

Correct answer: To control Pod communication at the network level.

Network Policies are Kubernetes resources that specify how groups of Pods are allowed to communicate with each other and with other network endpoints. They enable network segmentation and security by defining rules for ingress and egress traffic, acting as a firewall for Pods. This helps to isolate applications and prevent unauthorized communication within the cluster.

Question 53: How does Kubernetes handle service discovery?

Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
No service discovery mechanism
External DNS only
Manual IP configuration

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 54: Which field in a NetworkPolicy spec restricts the rule to only apply to traffic on a specific port?

spec.ingress[].ports or spec.egress[].ports (Correct answer)
spec.podSelector.ports
metadata.annotations.ports
spec.ports

Correct answer: spec.ingress[].ports or spec.egress[].ports

Port restrictions are specified within individual ingress or egress rule blocks using the ports field, allowing protocol and port number filtering.

Question 55: How does Kubernetes handle service discovery?

External DNS only
Manual IP configuration
No service discovery mechanism
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 56: Which flag with `kubectl top pods` breaks down usage per container instead of per pod?

--show-containers
--containers (Correct answer)
--expand
--all-containers

Correct answer: --containers

The `--containers` flag shows per-container CPU and memory usage within each listed pod.

Question 57: Which Service type allows external access to a Kubernetes application through a specific port on each node in the cluster?

ClusterIP
ExternalName
NodePort (Correct answer)
LoadBalancer

Correct answer: NodePort

The NodePort Service type exposes the Service on a static port on each node's IP address. This means that any traffic sent to that specific port on any node in the cluster will be routed to the Service and its backing Pods. It's a common way to make a service accessible from outside the cluster, especially in development or smaller environments where an external load balancer isn't readily available.

Question 58: How is Secret data stored in etcd by default in a Kubernetes cluster?

Plain text
AES-256 encrypted
Base64-encoded but not encrypted (Correct answer)
Hashed with SHA-256

Correct answer: Base64-encoded but not encrypted

By default, Kubernetes stores Secrets as base64-encoded values in etcd without encryption at rest; encryption at rest must be explicitly configured.

Question 59: What is a ConfigMap?

A log file
A routing table
A password vault
An object storing non-confidential configuration data as key-value pairs (Correct answer)

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 60: What is a Pod in Kubernetes?

A database table
The smallest deployable unit that can contain one or more containers (Correct answer)
A physical server
A network switch

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 61: What is the purpose of a Kubernetes health check (probe)?

To monitor network speed
To validate YAML syntax
To determine if a container is running correctly and ready to serve traffic (Correct answer)
To check disk space

Correct answer: To determine if a container is running correctly and ready to serve traffic

Health probes (liveness, readiness, startup) let Kubernetes know if a container is alive, ready for traffic, or still starting up, enabling automatic recovery.

Question 62: Which object automatically tracks the IP addresses and ports of Pods backing a Service in large clusters (1000+ endpoints)?

ServiceEntry
PodIPPool
Endpoints
EndpointSlices (Correct answer)

Correct answer: EndpointSlices

EndpointSlices shard endpoint data into smaller objects (default 100 endpoints each), reducing API server load compared to single large Endpoints objects.

Question 63: Which flag must be passed to etcdctl snapshot save to authenticate when etcd uses TLS?

--auth-token <token>
--tls-verify=true
--cacert, --cert, --key flags pointing to etcd certificates (Correct answer)
--endpoints only

Correct answer: --cacert, --cert, --key flags pointing to etcd certificates

etcdctl requires --cacert, --cert, and --key to authenticate to a TLS-secured etcd; without them the connection is rejected.

Question 64: An attacker exploits a container and tries to read `/run/secrets/kubernetes.io/serviceaccount/token`. What is this file?

A TLS client certificate for the kubelet
A projected ServiceAccount JWT used to authenticate to the API server (Correct answer)
The node's kubelet bootstrap token
The etcd encryption key

Correct answer: A projected ServiceAccount JWT used to authenticate to the API server

Kubernetes mounts a projected ServiceAccount JWT at that path, which pods use to authenticate API requests.

Question 65: Which condition in kubectl get nodes output indicates that a node's kubelet has stopped sending heartbeats?

HeartbeatFailed=True
NotReady=True
Unreachable=True
Ready=False or Ready=Unknown (Correct answer)

Correct answer: Ready=False or Ready=Unknown

When heartbeats stop, the node condition Ready transitions to Unknown (timeout) or False (kubelet reported not ready); there is no 'NotReady' condition type.

Question 66: Which Kubernetes object sets default resource limits and requests for containers within a namespace?

PodPolicy
ResourceQuota
LimitRange (Correct answer)
ResourcePolicy

Correct answer: LimitRange

A LimitRange object defines default, min, and max resource limits and requests for containers in a namespace.

Question 67: Which Ingress annotation is commonly used with the nginx Ingress controller to enable TLS termination?

nginx.ingress.kubernetes.io/ssl-redirect: 'true'
spec.tls with secretName referencing a TLS Secret (Correct answer)
kubernetes.io/tls-acme: 'true'
ingress.kubernetes.io/force-ssl-redirect

Correct answer: spec.tls with secretName referencing a TLS Secret

TLS termination on an Ingress is configured via spec.tls, referencing a Secret that holds the certificate and key.

Certified Kubernetes Administrator (CKA)

The CKA exam validates hands-on skills in Kubernetes cluster administration, including installation, configuration, networking, storage, workload management, and troubleshooting. It is a performance-based certification offered by the CNCF and Linux Foundation.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds