Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: How is TLS termination configured in an Ingress resource?

Add a tls section referencing a Secret with the certificate and key (Correct answer)
Set spec.tls: true at the top level
Create a separate TLSPolicy resource
Annotate the backend Service with tls: enabled

Correct answer: Add a tls section referencing a Secret with the certificate and key

TLS is configured via the `spec.tls` array in the Ingress, referencing a Kubernetes Secret that contains the TLS certificate and private key.

Question 2: What is a ConfigMap?

A routing table
A log file
A password vault
An object storing non-confidential configuration data as key-value pairs (Correct answer)

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 3: Which Kubernetes object can restrict egress traffic from pods in a namespace to only port 5432 on a specific database pod?

PodSecurityPolicy
NetworkPolicy (Correct answer)
LimitRange
ResourceQuota

Correct answer: NetworkPolicy

NetworkPolicy objects control pod-level ingress and egress traffic using label selectors and port rules.

Question 4: What does `automountServiceAccountToken: false` on a pod spec do?

Prevents the ServiceAccount token from being mounted into the pod (Correct answer)
Deletes the ServiceAccount
Revokes the ServiceAccount's RBAC permissions
Disables network access for the pod

Correct answer: Prevents the ServiceAccount token from being mounted into the pod

Setting `automountServiceAccountToken: false` stops Kubernetes from projecting the token into `/run/secrets/kubernetes.io/serviceaccount/`, reducing attack surface.

Question 5: What is a Kubernetes Deployment?

A network policy
A storage class
A one-time job
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 6: What is a Kubernetes Deployment?

A network policy
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A storage class
A one-time job

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 7: Which Service type allows external access to a Kubernetes application through a specific port on each node in the cluster?

ExternalName
NodePort (Correct answer)
LoadBalancer
ClusterIP

Correct answer: NodePort

The NodePort Service type exposes the Service on a static port on each node's IP address. This means that any traffic sent to that specific port on any node in the cluster will be routed to the Service and its backing Pods. It's a common way to make a service accessible from outside the cluster, especially in development or smaller environments where an external load balancer isn't readily available.

Question 8: What is the purpose of a kube-scheduler in Kubernetes?

To ensure high availability of the control plane.
To allocate resources for Pods across the cluster. (Correct answer)
To monitor the health of nodes and workloads.
To load balance traffic between Pods.

Correct answer: To allocate resources for Pods across the cluster.

The `kube-scheduler` is a control plane component responsible for watching newly created Pods that have no assigned node. It selects the best node for each Pod to run on, considering various factors like resource requirements, hardware constraints, policy constraints, and affinity/anti-affinity specifications. Its primary goal is to ensure efficient resource utilization and optimal placement of workloads across the cluster.

Question 9: What is the role of the Node Authorizer in Kubernetes?

Authorizes API calls made by kubelet based on the node's identity (Correct answer)
Validates node registration certificates
Grants cluster-admin privileges to all nodes
Routes traffic between nodes

Correct answer: Authorizes API calls made by kubelet based on the node's identity

The Node Authorizer is a special-purpose authorization mode that grants kubelets permission to perform API operations for the objects bound to their specific node.

Question 10: What is a Pod in Kubernetes?

A network switch
A physical server
The smallest deployable unit that can contain one or more containers (Correct answer)
A database table

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 11: Which kubeadm phase generates the kubeconfig files for cluster administrators?

kubeadm init phase certs
kubeadm init phase kubeconfig (Correct answer)
kubeadm init phase etcd
kubeadm init phase upload-config

Correct answer: kubeadm init phase kubeconfig

kubeadm init phase kubeconfig generates admin.conf, controller-manager.conf, and scheduler.conf kubeconfig files.

Question 12: What is a ConfigMap?

An object storing non-confidential configuration data as key-value pairs (Correct answer)
A routing table
A password vault
A log file

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 13: Which command displays resource usage (CPU/memory) broken down by each node in the cluster?

kubectl node-metrics
kubectl describe nodes
kubectl top nodes (Correct answer)
kubectl get nodes --resources

Correct answer: kubectl top nodes

`kubectl top nodes` shows current CPU and memory usage for every node in the cluster.

Question 14: Which Kubernetes audit policy level records both the request body and the full response body?

Metadata
Request
RequestResponse (Correct answer)
Full

Correct answer: RequestResponse

`RequestResponse` is the most verbose audit level, capturing request and response bodies — useful for sensitive resource changes.

Question 15: What is a Pod in Kubernetes?

A physical server
A database table
A network switch
The smallest deployable unit that can contain one or more containers (Correct answer)

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 16: What is a Pod in Kubernetes?

A physical server
A database table
The smallest deployable unit that can contain one or more containers (Correct answer)
A network switch

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 17: How do you view logs from a specific container 'nginx' inside a multi-container pod 'mypod'?

kubectl logs nginx mypod
kubectl logs mypod -c nginx (Correct answer)
kubectl logs mypod --name=nginx
kubectl logs mypod --pod=nginx

Correct answer: kubectl logs mypod -c nginx

The `-c <container-name>` (or `--container`) flag targets a specific container in a multi-container pod.

Question 18: What is etcd backup important for?

It is optional for production
It only stores container images
It backs up application code
It stores all cluster state and configuration data (Correct answer)

Correct answer: It stores all cluster state and configuration data

etcd contains all cluster configuration, state, and secrets. Regular backups are critical because losing etcd data means losing the entire cluster state.

Question 19: What must be deployed in a cluster before Ingress resources can route traffic?

MetalLB
CoreDNS
kube-proxy
An Ingress Controller (Correct answer)

Correct answer: An Ingress Controller

An Ingress Controller (such as ingress-nginx or Traefik) must be running to implement and enforce the rules defined in Ingress resources.

Question 20: When upgrading a cluster with kubeadm, what is the correct order of operations?

Upgrade workers first, then control plane
Upgrade control plane first, then workers (Correct answer)
Upgrade etcd first, then drain all nodes simultaneously
Upgrade all nodes simultaneously using kubeadm upgrade all

Correct answer: Upgrade control plane first, then workers

You must upgrade the control plane components first with kubeadm upgrade apply, then upgrade each worker node individually.

Question 21: What is a Pod in Kubernetes?

A database table
The smallest deployable unit that can contain one or more containers (Correct answer)
A network switch
A physical server

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 22: What is the role of the kube-apiserver in a Kubernetes cluster?

It schedules workloads onto nodes.
It provides an interface for the control plane to communicate with the cluster. (Correct answer)
It runs the containers on the nodes.
It stores the cluster's state in a key-value database.

Correct answer: It provides an interface for the control plane to communicate with the cluster.

The kube-apiserver is the front end of the Kubernetes control plane, exposing the Kubernetes API. It acts as the central communication hub, processing REST requests, validating configurations, and enabling all components of the control plane and users to interact with the cluster's resources.

Question 23: Which Kubernetes object defines the permissions granted by a ClusterRole to a set of users across all namespaces?

NetworkPolicy
ClusterRoleBinding (Correct answer)
ServiceAccount
RoleBinding

Correct answer: ClusterRoleBinding

A ClusterRoleBinding grants the permissions defined in a ClusterRole to subjects cluster-wide, not limited to a single namespace.

Question 24: What is a Pod in Kubernetes?

A physical server
The smallest deployable unit that can contain one or more containers (Correct answer)
A database table
A network switch

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 25: What command is used to apply a Pod network in a Kubernetes cluster after initialization?

kubectl apply -f <network-yaml-file> (Correct answer)
kubeadm network apply
kubeadm init --network
kubectl create network

Correct answer: kubectl apply -f <network-yaml-file>

After `kubeadm init` initializes the control plane, a Container Network Interface (CNI) plugin must be installed to enable Pod-to-Pod communication. CNI plugins are typically deployed using a YAML manifest, which is applied to the cluster using the `kubectl apply -f` command. This command reads the configuration from the specified YAML file and creates the necessary Kubernetes objects, such as DaemonSets or Deployments, to install the network plugin.

Question 26: Which Ingress spec field specifies which Ingress controller should handle a given Ingress resource?

spec.ingressClassName (Correct answer)
spec.controller
metadata.ingress.class
spec.class.name

Correct answer: spec.ingressClassName

The `spec.ingressClassName` field references an IngressClass object that maps to a specific Ingress controller.

Question 27: What is a Persistent Volume (PV)?

A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
A type of ConfigMap
Temporary container storage
A network drive

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 28: What happens when a Service's label selector matches no running pods?

The Endpoints object has no entries and traffic to the service is dropped (Correct answer)
kube-proxy removes the iptables rule for the service
The service returns HTTP 503 automatically
The Service is automatically deleted by the controller

Correct answer: The Endpoints object has no entries and traffic to the service is dropped

When no pods match the selector, the Endpoints/EndpointSlice contains no addresses and traffic sent to the service has no backend to reach.

Question 29: Which component must be deployed in a cluster before `kubectl top nodes` works?

Metrics Server (Correct answer)
kube-state-metrics
Prometheus
kube-proxy

Correct answer: Metrics Server

The Metrics Server must be installed to aggregate resource usage data and enable `kubectl top` commands.

Question 30: What is the default port range for NodePort services in Kubernetes?

8080–9090
30000–32767 (Correct answer)
1024–65535
20000–30000

Correct answer: 30000–32767

NodePort services allocate ports from the range 30000–32767 by default, configurable via `--service-node-port-range` on the API server.

Question 31: How does Kubernetes handle service discovery?

Manual IP configuration
No service discovery mechanism
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
External DNS only

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Certified Kubernetes Administrator (CKA)

The CKA exam validates hands-on skills in Kubernetes cluster administration, including installation, configuration, networking, storage, workload management, and troubleshooting. It is a performance-based certification offered by the CNCF and Linux Foundation.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

training.linuxfoundation.org — Test delivery, eligibility, fees, time limit, exam information · verified Nov 2026
docs.linuxfoundation.org — Passing score, renewal, score release, score validity, test dates · verified Oct 2026