Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: What is the primary purpose of an Ingress resource in Kubernetes?

To manage HTTP/HTTPS routing from outside the cluster to internal services (Correct answer)
To create internal cluster DNS records
To expose services externally via TCP/UDP port forwarding
To load balance traffic between cluster nodes

Correct answer: To manage HTTP/HTTPS routing from outside the cluster to internal services

An Ingress resource defines HTTP/HTTPS routing rules, enabling external traffic to reach internal services with host/path-based routing and TLS termination.

Question 2: What CNI plugin feature is required for enforcing Kubernetes NetworkPolicies?

Overlay encapsulation (VXLAN)
BGP route advertisement
IPAM (IP Address Management)
Network policy enforcement support (Correct answer)

Correct answer: Network policy enforcement support

NetworkPolicy enforcement is not built into Kubernetes itself; the CNI plugin (e.g., Calico, Cilium) must support and implement it.

Question 3: Which kubeadm command prints the join command including a fresh token for adding a worker node?

kubeadm join --print
kubeadm token create --print-join-command (Correct answer)
kubeadm token list
kubeadm generate join

Correct answer: kubeadm token create --print-join-command

kubeadm token create --print-join-command generates a new token and prints the complete kubeadm join command ready to run on a worker node.

Question 4: Which kubeconfig field stores the cluster's certificate authority data used by kubectl to verify the API server?

server-tls-data
insecure-skip-tls-verify
certificate-authority-data (Correct answer)
client-certificate-data

Correct answer: certificate-authority-data

`certificate-authority-data` holds the base64-encoded CA bundle that kubectl uses to trust the API server's TLS certificate.

Question 5: What is a ConfigMap?

An object storing non-confidential configuration data as key-value pairs (Correct answer)
A password vault
A log file
A routing table

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 6: What is a node cordon?

Removing a node from the cluster
Restarting a node
Marking a node as unschedulable so no new Pods are placed on it (Correct answer)
Adding labels to a node

Correct answer: Marking a node as unschedulable so no new Pods are placed on it

Cordoning marks a node as unschedulable. Existing Pods continue running, but no new Pods will be scheduled on the cordoned node.

Question 7: What happens to pods managed by a DaemonSet when you run kubectl drain on a node?

They are evicted and rescheduled on other nodes
They are skipped unless --ignore-daemonsets is passed, and not evicted (Correct answer)
The drain fails with an error
They are deleted and not replaced

Correct answer: They are skipped unless --ignore-daemonsets is passed, and not evicted

DaemonSet pods cannot be evicted because they must run on every node; drain skips them when --ignore-daemonsets is specified.

Question 8: How does Kubernetes handle service discovery?

Manual IP configuration
No service discovery mechanism
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
External DNS only

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 9: Which etcd operation should be performed before upgrading the Kubernetes control plane?

etcd compaction
etcd defragmentation
etcd snapshot backup (Correct answer)
etcd member remove

Correct answer: etcd snapshot backup

Taking an etcd snapshot backup before upgrades ensures you can restore cluster state if the upgrade fails.

Question 10: What is a Kubernetes Deployment?

A network policy
A one-time job
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A storage class

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 11: Which command lists recent events from every namespace in the cluster?

kubectl list events --global
kubectl get events --all-namespaces (Correct answer)
kubectl show events -A
kubectl describe events --all

Correct answer: kubectl get events --all-namespaces

`kubectl get events --all-namespaces` (or `-A`) retrieves Event objects from every namespace.

Question 12: You set a Deployment's strategy type to Recreate. What happens during an update?

Pods are updated in place without restart
Half old and half new pods run simultaneously
New pods are created before old pods are terminated
Old pods are terminated before new pods are created (Correct answer)

Correct answer: Old pods are terminated before new pods are created

With Recreate strategy, Kubernetes terminates all existing pods before creating new ones, causing a brief downtime.

Question 13: Which file does kubectl use by default to find cluster connection and authentication information?

~/.kube/config (Correct answer)
~/.kube/credentials
/etc/kubernetes/admin.conf
~/.kubeconfig

Correct answer: ~/.kube/config

kubectl reads cluster, user, and context information from ~/.kube/config by default, or from the path set in KUBECONFIG environment variable.

Question 14: How does Kubernetes handle service discovery?

External DNS only
Manual IP configuration
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
No service discovery mechanism

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 15: When a NetworkPolicy has both ingress and egress rules, which policyTypes field value must be set to enforce both?

policyTypes: ["Ingress", "Egress"] (Correct answer)
policyTypes: ["All"]
policyTypes: ["Both"]
Omitting policyTypes enforces both by default

Correct answer: policyTypes: ["Ingress", "Egress"]

Both directions must be explicitly listed in policyTypes; omitting Egress means only ingress is restricted even if egress rules are written.

Question 16: A pod in namespace 'frontend' needs to access a Service in namespace 'backend'. What DNS name should it use?

backend-svc.cluster.local
backend.svc.backend
backend-svc.frontend.svc.cluster.local
backend-svc.backend.svc.cluster.local (Correct answer)

Correct answer: backend-svc.backend.svc.cluster.local

The full DNS FQDN for a Service is <service>.<namespace>.svc.<cluster-domain>, so cross-namespace access requires including the target namespace.

Question 17: What is the purpose of the `sessionAffinity: ClientIP` setting on a Service?

Pins traffic to a specific node IP
Logs the client IP for auditing purposes
Enables sticky sessions using HTTP cookies
Routes all traffic from the same client IP to the same Pod (Correct answer)

Correct answer: Routes all traffic from the same client IP to the same Pod

ClientIP session affinity ensures requests from the same source IP are consistently forwarded to the same backend Pod for the duration of the timeout.

Question 18: What happens to a Pod if it references a Secret that does not exist in the same namespace?

The Pod remains in Pending state and fails to start (Correct answer)
Kubernetes automatically creates an empty Secret with that name
The Pod starts but the environment variable is set to an empty string
The Pod starts and the missing Secret key is skipped

Correct answer: The Pod remains in Pending state and fails to start

If a referenced Secret is missing, the container cannot be started and the Pod stays in Pending with an error event indicating the missing resource.

Question 19: What does the `externalTrafficPolicy: Local` setting on a LoadBalancer Service do?

Preserves the client source IP and only routes to local node Pods (Correct answer)
Converts the Service to ClusterIP type
Disables health checks on the load balancer
Restricts the Service to internal cluster traffic only

Correct answer: Preserves the client source IP and only routes to local node Pods

With Local policy, kube-proxy only forwards external traffic to Pods on the same node, preserving the original client IP without SNAT.

Question 20: Which Ingress annotation is commonly used with the nginx Ingress controller to enable TLS termination?

ingress.kubernetes.io/force-ssl-redirect
nginx.ingress.kubernetes.io/ssl-redirect: 'true'
kubernetes.io/tls-acme: 'true'
spec.tls with secretName referencing a TLS Secret (Correct answer)

Correct answer: spec.tls with secretName referencing a TLS Secret

TLS termination on an Ingress is configured via spec.tls, referencing a Secret that holds the certificate and key.

Question 21: Which command shows capacity, allocatable resources, and conditions for a specific node 'node01'?

kubectl get node node01 --resources
kubectl get node node01 -o wide
kubectl inspect node node01
kubectl describe node node01 (Correct answer)

Correct answer: kubectl describe node node01

`kubectl describe node <node-name>` shows capacity, allocatable resources, taints, conditions, and running pods.

Question 22: What is the purpose of the 'stringData' field in a Secret manifest?

It allows providing plain text values that Kubernetes will automatically base64-encode (Correct answer)
It accepts only ASCII strings and rejects binary data
It stores decoded values that bypass base64 encoding at runtime
It is an alias for 'data' with no functional difference

Correct answer: It allows providing plain text values that Kubernetes will automatically base64-encode

The stringData field is a write-only convenience field that accepts plain strings; Kubernetes base64-encodes them and merges the result into the data field on save.

Question 23: Which flag with `kubectl top pods` breaks down usage per container instead of per pod?

--all-containers
--containers (Correct answer)
--show-containers
--expand

Correct answer: --containers

The `--containers` flag shows per-container CPU and memory usage within each listed pod.

Question 24: A DaemonSet is configured without a nodeSelector. On which nodes will it schedule pods?

Only nodes with the label app=daemon
Only worker nodes
All nodes in the cluster including control plane (Correct answer)
Only master nodes

Correct answer: All nodes in the cluster including control plane

By default, DaemonSets schedule one pod on every node in the cluster, including control-plane nodes, unless tolerations or nodeSelectors restrict placement.

Question 25: How do you view logs from a running pod named 'webapp'?

kubectl show logs webapp
kubectl get logs webapp
kubectl logs webapp (Correct answer)
kubectl describe logs webapp

Correct answer: kubectl logs webapp

Use `kubectl logs <pod-name>` to retrieve logs from a running pod.

Question 26: What must be deployed in a cluster before Ingress resources can route traffic?

An Ingress Controller (Correct answer)
MetalLB
kube-proxy
CoreDNS

Correct answer: An Ingress Controller

An Ingress Controller (such as ingress-nginx or Traefik) must be running to implement and enforce the rules defined in Ingress resources.

Question 27: Which command drains a node and marks it as unschedulable before maintenance?

kubectl taint
kubectl cordon
kubectl delete node
kubectl drain (Correct answer)

Correct answer: kubectl drain

kubectl drain evicts all pods from a node and marks it unschedulable, making it safe for maintenance.

Question 28: An attacker exploits a container and tries to read `/run/secrets/kubernetes.io/serviceaccount/token`. What is this file?

The etcd encryption key
A projected ServiceAccount JWT used to authenticate to the API server (Correct answer)
The node's kubelet bootstrap token
A TLS client certificate for the kubelet

Correct answer: A projected ServiceAccount JWT used to authenticate to the API server

Kubernetes mounts a projected ServiceAccount JWT at that path, which pods use to authenticate API requests.

Question 29: What flag on a container's SecurityContext prevents privilege escalation via setuid binaries?

runAsNonRoot: true
allowPrivilegeEscalation: false (Correct answer)
readOnlyRootFilesystem: true
privileged: false

Correct answer: allowPrivilegeEscalation: false

`allowPrivilegeEscalation: false` sets the no_new_privs flag, blocking setuid/setgid escalation.

Question 30: A Deployment has 5 replicas and you run `kubectl rollout pause deployment/myapp`. What happens to an in-progress rolling update?

The update is immediately rolled back
All pods restart simultaneously
The update halts at its current state until resumed (Correct answer)
The update completes before pausing

Correct answer: The update halts at its current state until resumed

Pausing a rollout freezes the update mid-progress; new pods already created remain, but no further pod replacements occur until `kubectl rollout resume` is run.

Question 31: How do you expose all key-value pairs from a ConfigMap named 'app-config' as environment variables in a Pod?

Use env with configMapKeyRef for each individual key
Mount the ConfigMap as a volume and source the file
Use valueFrom with configMapRef in the container spec
Use envFrom with configMapRef specifying the ConfigMap name (Correct answer)

Correct answer: Use envFrom with configMapRef specifying the ConfigMap name

The envFrom field with configMapRef injects all ConfigMap keys as environment variables at once, without listing them individually.

Question 32: What happens to existing pods in a namespace when you change its Pod Security Standard enforcement label to `restricted`?

All pods are restarted and re-evaluated
Existing pods are immediately deleted
Existing pods are unaffected; only new or updated pods are evaluated (Correct answer)
Existing pods receive a warning but continue running

Correct answer: Existing pods are unaffected; only new or updated pods are evaluated

Admission control only applies to new admission requests; existing running pods are not re-evaluated when labels change.

Question 33: Which object automatically tracks the IP addresses and ports of Pods backing a Service in large clusters (1000+ endpoints)?

EndpointSlices (Correct answer)
Endpoints
PodIPPool
ServiceEntry

Correct answer: EndpointSlices

EndpointSlices shard endpoint data into smaller objects (default 100 endpoints each), reducing API server load compared to single large Endpoints objects.

Question 34: An AppArmor profile is applied to a container using which mechanism in Kubernetes?

A SecurityContext field `appArmorProfile`
An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/<name>` (Correct answer)
A LimitRange policy
A NetworkPolicy rule

Correct answer: An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/<name>`

AppArmor profiles are applied via pod annotations in the format `container.apparmor.security.beta.kubernetes.io/<container-name>: <profile>`.

Question 35: What field in a projected volume allows you to combine a ConfigMap and a Secret into a single volume mount path?

multi.source
projected.sources (Correct answer)
combined.volumes
projected.configMaps

Correct answer: projected.sources

A projected volume uses the 'sources' field to list multiple sources (ConfigMap, Secret, ServiceAccountToken, etc.) that are merged into one directory.

Question 36: What is the purpose of a Kubernetes health check (probe)?

To monitor network speed
To validate YAML syntax
To check disk space
To determine if a container is running correctly and ready to serve traffic (Correct answer)

Correct answer: To determine if a container is running correctly and ready to serve traffic

Health probes (liveness, readiness, startup) let Kubernetes know if a container is alive, ready for traffic, or still starting up, enabling automatic recovery.

Question 37: A Kubernetes node shows MemoryPressure=True condition. What does the kubelet do in response?

Notifies the API server but takes no action
Cordons the node automatically
Stops accepting new pods and begins evicting lowest-priority pods (Correct answer)
Shuts down all running pods immediately

Correct answer: Stops accepting new pods and begins evicting lowest-priority pods

Under MemoryPressure, the kubelet begins evicting pods based on QoS class (BestEffort first, then Burstable) to reclaim memory.

Question 38: What is the purpose of 'kubectl drain' command?

To safely evict all Pods from a node for maintenance (Correct answer)
To add a new node
To restart all Pods
To delete a node permanently

Correct answer: To safely evict all Pods from a node for maintenance

kubectl drain safely evicts all Pods from a node, cordoning it to prevent new Pod scheduling, allowing maintenance work on the node.

Question 39: What does 'kubectl cordon' do to a node, and how does it differ from 'kubectl drain'?

Cordon marks the node unschedulable without evicting pods; drain also evicts existing pods (Correct answer)
Both commands are identical in behavior
Cordon deletes pods; drain only marks the node unschedulable
Cordon removes the node from the cluster; drain keeps it registered

Correct answer: Cordon marks the node unschedulable without evicting pods; drain also evicts existing pods

cordon only adds the unschedulable taint, while drain additionally evicts existing pods before maintenance.

Question 40: A pod needs to read a Secret value without mounting it as a file. Which approach injects it as an environment variable?

envFrom with a ConfigMap
secretKeyRef in the env block (Correct answer)
configMapKeyRef in the env block
volumeMount with subPath

Correct answer: secretKeyRef in the env block

Using `secretKeyRef` in a container's `env` block injects a specific Secret key as an environment variable.

Question 41: Which component watches the API server for newly created Pods with no assigned node and selects a node for them?

kubelet
kube-controller-manager
kube-scheduler (Correct answer)
cloud-controller-manager

Correct answer: kube-scheduler

The kube-scheduler watches for unbound Pods and assigns them to an appropriate node based on resource requirements and policies.

Question 42: What is a Persistent Volume (PV)?

A network drive
A type of ConfigMap
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
Temporary container storage

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 43: How is Secret data stored in etcd by default in a Kubernetes cluster?

Plain text
Base64-encoded but not encrypted (Correct answer)
AES-256 encrypted
Hashed with SHA-256

Correct answer: Base64-encoded but not encrypted

By default, Kubernetes stores Secrets as base64-encoded values in etcd without encryption at rest; encryption at rest must be explicitly configured.

Question 44: You want to audit all requests that resulted in a 403 response. Which audit policy level captures the request metadata including response code?

Metadata (Correct answer)
None
Request
RequestResponse

Correct answer: Metadata

The `Metadata` audit level records request metadata including verb, user, resource, and response code without capturing the body.

Question 45: What happens when a Service's label selector matches no running pods?

The Service is automatically deleted by the controller
The service returns HTTP 503 automatically
The Endpoints object has no entries and traffic to the service is dropped (Correct answer)
kube-proxy removes the iptables rule for the service

Correct answer: The Endpoints object has no entries and traffic to the service is dropped

When no pods match the selector, the Endpoints/EndpointSlice contains no addresses and traffic sent to the service has no backend to reach.

Question 46: A pod's init container exits with code 0. What does Kubernetes do next?

Restarts the init container per restartPolicy
Starts the next init container or the main app container (Correct answer)
Runs all remaining init containers in parallel
Marks the pod as Failed

Correct answer: Starts the next init container or the main app container

An exit code of 0 signals success; Kubernetes then starts the next init container in order, or starts the main application containers if all init containers have completed.

Question 47: You want to create a ConfigMap from a directory of config files. Which command accomplishes this?

kubectl create configmap myconfig --from-file=./config-dir/ (Correct answer)
kubectl apply configmap myconfig --directory=./config-dir/
kubectl generate configmap myconfig --path=./config-dir/
kubectl create configmap myconfig --from-literal=./config-dir/

Correct answer: kubectl create configmap myconfig --from-file=./config-dir/

`kubectl create configmap --from-file=<dir>` creates a ConfigMap where each file in the directory becomes a key (filename) with its contents as the value.

Question 48: Which flag on the API server enables RBAC authorization mode?

--authorization-policy=rbac
--authorization-mode=RBAC (Correct answer)
--enable-rbac=true
--authorization-mode=ABAC

Correct answer: --authorization-mode=RBAC

Setting `--authorization-mode=RBAC` (often alongside Node and Webhook) activates role-based access control on the API server.

Question 49: Which field controls how many old ReplicaSets are kept for potential rollback in a Deployment?

maxUnavailable
historyRetentionCount
rollbackTimeout
revisionHistoryLimit (Correct answer)

Correct answer: revisionHistoryLimit

`revisionHistoryLimit` specifies how many old ReplicaSets the Deployment controller retains; the default is 10, and older ReplicaSets beyond the limit are garbage-collected.

Question 50: Which command displays only the last 50 lines of logs from pod 'api'?

kubectl logs api --tail=50 (Correct answer)
kubectl logs api --lines=50
kubectl logs api --last=50
kubectl logs api -n 50

Correct answer: kubectl logs api --tail=50

The `--tail=<N>` flag limits log output to the last N lines, mirroring the Unix `tail` command.

Question 51: Where does kubeadm store the root CA certificate and key used to sign all cluster certificates?

/etc/kubernetes/pki/ (Correct answer)
/root/.kube/pki/
/etc/ssl/kubernetes/
/var/lib/kubelet/pki/

Correct answer: /etc/kubernetes/pki/

kubeadm stores the cluster root CA (ca.crt and ca.key) and all other control plane certificates in /etc/kubernetes/pki/.

Question 52: A StatefulSet with 3 replicas is being deleted. In what order are the pods terminated by default?

Reverse ordinal order 2, 1, 0 (Correct answer)
Ordinal order 0, 1, 2
Random order
Simultaneously

Correct answer: Reverse ordinal order 2, 1, 0

StatefulSets terminate pods in reverse ordinal order (highest index first) by default to maintain ordering guarantees.

Question 53: What happens when you scale a Deployment to zero replicas?

The Pods remain running but are not restarted if they fail.
The ReplicaSet is deleted.
All Pods managed by the Deployment are terminated. (Correct answer)
The Deployment is deleted.

Correct answer: All Pods managed by the Deployment are terminated.

When a Deployment's replica count is scaled to zero, it instructs the underlying ReplicaSet to terminate all Pods it manages. This action effectively stops the application or service associated with that Deployment from running within the cluster. The Deployment object itself remains, allowing for easy scaling back up later.

Question 54: What is the purpose of `spec.activeDeadlineSeconds` in a pod spec?

Defines how long init containers can run
Terminates the pod after it has been running for the specified duration (Correct answer)
Sets the timeout for liveness probe failures
Sets the maximum time a pod can be in Pending state

Correct answer: Terminates the pod after it has been running for the specified duration

`activeDeadlineSeconds` sets a hard deadline for the entire pod; once the pod has been active for that many seconds, all containers are killed and the pod is marked as Failed.

Question 55: What does the `ipBlock` field in a NetworkPolicy ingress rule define?

A list of blocked Pod IPs
The block size for IPAM allocations
The IP allocation block for Pods in the namespace
A CIDR range of IP addresses allowed or denied as traffic sources (Correct answer)

Correct answer: A CIDR range of IP addresses allowed or denied as traffic sources

ipBlock specifies a CIDR (and optional except CIDRs) to allow or deny traffic from specific external IP ranges in NetworkPolicy rules.

Question 56: What is the maximum data size allowed in a single Kubernetes ConfigMap?

10 MiB
1 MiB (Correct answer)
512 KiB
Unlimited

Correct answer: 1 MiB

Kubernetes enforces a 1 MiB (1,048,576 byte) limit on ConfigMap data to avoid overwhelming the etcd storage backend.

Question 57: Which ConfigMap in the kube-system namespace stores the kubeadm cluster configuration?

kubeadm-cluster
kubeadm-config (Correct answer)
cluster-config
kube-config

Correct answer: kubeadm-config

kubeadm stores its ClusterConfiguration in the kubeadm-config ConfigMap in the kube-system namespace.

Question 58: What is a ConfigMap?

A password vault
A routing table
A log file
An object storing non-confidential configuration data as key-value pairs (Correct answer)

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 59: Which command shows the upgrade plan and available versions for a kubeadm-managed cluster?

kubeadm upgrade plan (Correct answer)
kubeadm upgrade check
kubectl get upgrades
kubeadm version --upgrade

Correct answer: kubeadm upgrade plan

kubeadm upgrade plan shows the current cluster version, available target versions, and any component version skew warnings.

Question 60: What is the default eviction timeout when draining a node in Kubernetes?

5 minutes
infinite (waits forever) (Correct answer)
2 minutes
30 seconds

Correct answer: infinite (waits forever)

By default, kubectl drain waits indefinitely for pods to terminate; use --timeout to set a deadline.

Question 61: What does 'kubectl get pods' show?

A list of all Pods and their status in the current namespace (Correct answer)
Server hardware info
Network configuration
User accounts

Correct answer: A list of all Pods and their status in the current namespace

This command displays all Pods in the current namespace with their name, ready status, current state, restarts, and age.

Question 62: What happens to Pod-to-Pod traffic between nodes in a flat Kubernetes network model?

Traffic must go through the API server
kube-proxy must proxy all cross-node traffic
Traffic requires a Service ClusterIP as intermediary
Pods can communicate directly without NAT (Correct answer)

Correct answer: Pods can communicate directly without NAT

The Kubernetes network model requires that all Pods can reach each other without NAT, regardless of the node they run on.

Question 63: After restoring etcd from a snapshot, which additional step is required to make etcd operational again?

Re-run kubeadm init to reinitialize the cluster
Update the etcd static pod manifest to point to the new data directory and restart kubelet (Correct answer)
Run kubectl apply -f /etc/kubernetes/manifests/etcd.yaml
Run etcdctl member add to re-register the member

Correct answer: Update the etcd static pod manifest to point to the new data directory and restart kubelet

You must update the etcd static pod manifest's --data-dir and volume hostPath to point to the restored directory, then restart kubelet to reload the static pod.

Question 64: What is a Pod in Kubernetes?

A network switch
A database table
The smallest deployable unit that can contain one or more containers (Correct answer)
A physical server

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 65: What command is used to apply a Pod network in a Kubernetes cluster after initialization?

kubeadm init --network
kubectl apply -f <network-yaml-file> (Correct answer)
kubectl create network
kubeadm network apply

Correct answer: kubectl apply -f <network-yaml-file>

After `kubeadm init` initializes the control plane, a Container Network Interface (CNI) plugin must be installed to enable Pod-to-Pod communication. CNI plugins are typically deployed using a YAML manifest, which is applied to the cluster using the `kubectl apply -f` command. This command reads the configuration from the specified YAML file and creates the necessary Kubernetes objects, such as DaemonSets or Deployments, to install the network plugin.

Question 66: Which field in a NetworkPolicy spec restricts the rule to only apply to traffic on a specific port?

metadata.annotations.ports
spec.ingress[].ports or spec.egress[].ports (Correct answer)
spec.podSelector.ports
spec.ports

Correct answer: spec.ingress[].ports or spec.egress[].ports

Port restrictions are specified within individual ingress or egress rule blocks using the ports field, allowing protocol and port number filtering.

Question 67: What is a Persistent Volume (PV)?

A type of ConfigMap
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
Temporary container storage
A network drive

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Certified Kubernetes Administrator (CKA)

The CKA exam validates hands-on skills in Kubernetes cluster administration, including installation, configuration, networking, storage, workload management, and troubleshooting. It is a performance-based certification offered by the CNCF and Linux Foundation.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds