Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: What CNI plugin feature is required for enforcing Kubernetes NetworkPolicies?

BGP route advertisement
IPAM (IP Address Management)
Network policy enforcement support (Correct answer)
Overlay encapsulation (VXLAN)

Correct answer: Network policy enforcement support

NetworkPolicy enforcement is not built into Kubernetes itself; the CNI plugin (e.g., Calico, Cilium) must support and implement it.

Question 2: In Kubernetes, what does SNAT (Source Network Address Translation) typically hide when `externalTrafficPolicy: Cluster` is used?

The original client IP address (Correct answer)
The node's hostname
The Pod's namespace
The Service ClusterIP

Correct answer: The original client IP address

With Cluster traffic policy, kube-proxy SNATs cross-node traffic so the Pod sees the node IP instead of the real client IP.

Question 3: What is `terminationGracePeriodSeconds` and what is its default value in Kubernetes?

Time to wait for init containers to finish; default 60s
Time before a failed pod is garbage-collected; default 120s
Time a pod can remain in Terminating state; default 300s
Time between SIGTERM and SIGKILL for graceful shutdown; default 30s (Correct answer)

Correct answer: Time between SIGTERM and SIGKILL for graceful shutdown; default 30s

`terminationGracePeriodSeconds` gives the container time to handle SIGTERM before Kubernetes sends SIGKILL; the default is 30 seconds.

Question 4: Which kubeadm command upgrades the kubelet and kubectl on a control plane node after kubeadm upgrade apply?

kubeadm upgrade kubelet
systemctl restart kubelet
apt-get upgrade kubelet kubectl (Correct answer)
kubeadm upgrade node

Correct answer: apt-get upgrade kubelet kubectl

After kubeadm upgrade apply, you must separately upgrade kubelet and kubectl using the package manager (apt/yum), then restart kubelet.

Question 5: Which of the following ensures that Pods run with restricted permissions in Kubernetes?

Pod Disruption Budget
Security Context (Correct answer)
RBAC Policies
Node Affinity

Correct answer: Security Context

A Security Context defines privilege and access control settings for a Pod or an individual container within a Pod. It allows you to specify parameters like the user ID (UID) and group ID (GID) under which the container's process runs, whether it can run as root, and other Linux capabilities. This ensures that Pods operate with the principle of least privilege, enhancing security.

Question 6: How do you use a Secret to pull images from a private container registry in a Pod spec?

Reference the Secret using envFrom with type=dockerconfigjson
Annotate the Pod with 'kubernetes.io/registry-secret: <name>'
Mount the Secret as a volume at /root/.docker/config.json
Specify the Secret name under the 'imagePullSecrets' field in the Pod spec (Correct answer)

Correct answer: Specify the Secret name under the 'imagePullSecrets' field in the Pod spec

The imagePullSecrets field in a Pod spec (or ServiceAccount) tells the kubelet which Secret to use when authenticating to a private image registry.

Question 7: A Pod needs to reach an external hostname 'db.example.com'. Which DNS resolution path does it use by default?

The node's /etc/resolv.conf directly
An external DNS server configured in the CNI
The cluster DNS (CoreDNS) which then forwards to upstream resolvers (Correct answer)
The kube-apiserver DNS endpoint

Correct answer: The cluster DNS (CoreDNS) which then forwards to upstream resolvers

Pod DNS queries go to the cluster DNS (CoreDNS) first; CoreDNS forwards unresolved names to the upstream resolver configured in its Corefile.

Question 8: What is a Persistent Volume (PV)?

Temporary container storage
A type of ConfigMap
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
A network drive

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 9: A Pod Security Standard level that blocks host namespaces, privileged containers, and requires non-root is called:

Restricted (Correct answer)
Locked
Baseline
Privileged

Correct answer: Restricted

The `Restricted` Pod Security Standard enforces the most stringent hardening requirements including non-root, no privilege escalation, and seccomp.

Question 10: Which kubeadm command is run on a worker node during a cluster upgrade (after the control plane is already upgraded)?

kubeadm join --upgrade
kubeadm upgrade node (Correct answer)
kubeadm upgrade worker
kubeadm upgrade apply

Correct answer: kubeadm upgrade node

kubeadm upgrade node updates the node's configuration to match the new control plane version without a full rejoin.

Question 11: Which command initializes a Kubernetes control plane node using kubeadm?

kubectl create
kubeadm init (Correct answer)
kubeadm join
kubeadm config

Correct answer: kubeadm init

The `kubeadm init` command is specifically designed to bootstrap a Kubernetes control-plane node. It performs the necessary steps to set up the core components, configure the cluster, and generate the required certificates and configuration files, effectively turning a machine into a Kubernetes control plane.

Question 12: Which Kubernetes object is used to ensure that a specific number of replicas of a Pod are running at any time?

DaemonSet
ReplicaSet (Correct answer)
Deployment
StatefulSet

Correct answer: ReplicaSet

A ReplicaSet's primary purpose is to maintain a stable set of replica Pods running at any given time. It ensures that a specified number of identical Pods are always available and automatically replaces any Pods that fail or are terminated. While Deployments use ReplicaSets under the hood to manage Pods, the ReplicaSet itself is the object directly responsible for maintaining the desired replica count.

Question 13: What happens to existing Pods on a node when you run 'kubectl cordon <node>'?

They continue running but no new Pods will be scheduled (Correct answer)
They are deleted and recreated on other nodes
They are immediately evicted
They are rescheduled to other nodes

Correct answer: They continue running but no new Pods will be scheduled

kubectl cordon marks a node as unschedulable, so new Pods won't land there, but existing Pods continue running undisturbed.

Question 14: You want to create a ConfigMap from a directory of config files. Which command accomplishes this?

kubectl generate configmap myconfig --path=./config-dir/
kubectl create configmap myconfig --from-file=./config-dir/ (Correct answer)
kubectl create configmap myconfig --from-literal=./config-dir/
kubectl apply configmap myconfig --directory=./config-dir/

Correct answer: kubectl create configmap myconfig --from-file=./config-dir/

`kubectl create configmap --from-file=<dir>` creates a ConfigMap where each file in the directory becomes a key (filename) with its contents as the value.

Question 15: How is Secret data stored in etcd by default in a Kubernetes cluster?

Plain text
Hashed with SHA-256
Base64-encoded but not encrypted (Correct answer)
AES-256 encrypted

Correct answer: Base64-encoded but not encrypted

By default, Kubernetes stores Secrets as base64-encoded values in etcd without encryption at rest; encryption at rest must be explicitly configured.

Question 16: What is a Kubernetes Deployment?

A network policy
A one-time job
A storage class
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 17: Which kubeadm command is used to generate a new bootstrap token for joining worker nodes?

kubeadm join --generate-token
kubeadm bootstrap token
kubeadm token create (Correct answer)
kubeadm init --token-ttl

Correct answer: kubeadm token create

kubeadm token create generates a new bootstrap token that can be used with kubeadm join to add nodes to the cluster.

Question 18: How does Kubernetes handle service discovery?

External DNS only
Manual IP configuration
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
No service discovery mechanism

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 19: You need pods of service A to prefer running on nodes that also run pods of service B. Which feature enables this?

Pod affinity (Correct answer)
Taints and tolerations
Pod anti-affinity
Node affinity

Correct answer: Pod affinity

Pod affinity lets you express that a pod should be scheduled near other pods matching a label selector, using requiredDuringScheduling or preferredDuringScheduling rules.

Question 20: What does setting `runAsGroup: 3000` in a pod's SecurityContext enforce?

All container processes run with GID 3000 (Correct answer)
The pod's namespace is isolated to group 3000
Only users in group 3000 can schedule the pod
Limits CPU to group 3000 shares

Correct answer: All container processes run with GID 3000

`runAsGroup` sets the primary GID for all container processes, controlling file permission checks and group-owned resource access.

Question 21: Which file on a kubeadm cluster stores the kubeadm configuration used during 'kubeadm init'?

/etc/kubernetes/admin.conf
A ConfigMap named kubeadm-config in kube-system namespace (Correct answer)
/etc/kubeadm/init-config.yaml
/var/lib/kubelet/config.yaml

Correct answer: A ConfigMap named kubeadm-config in kube-system namespace

kubeadm stores the cluster configuration in a ConfigMap named kubeadm-config in the kube-system namespace for use during upgrades.

Question 22: What is the primary purpose of an Ingress resource in Kubernetes?

To create internal cluster DNS records
To manage HTTP/HTTPS routing from outside the cluster to internal services (Correct answer)
To load balance traffic between cluster nodes
To expose services externally via TCP/UDP port forwarding

Correct answer: To manage HTTP/HTTPS routing from outside the cluster to internal services

An Ingress resource defines HTTP/HTTPS routing rules, enabling external traffic to reach internal services with host/path-based routing and TLS termination.

Question 23: Which DNS record type does a headless Service (clusterIP: None) return for Pod lookups?

SRV records only
PTR records
CNAME pointing to a single load-balanced IP
A records for each individual Pod IP (Correct answer)

Correct answer: A records for each individual Pod IP

A headless Service returns individual A records for each Pod IP, enabling clients to discover all endpoints directly.

Question 24: Which etcd command creates a point-in-time snapshot backup of cluster data?

etcdctl snapshot save (Correct answer)
etcdctl backup
etcdctl export
etcdctl dump

Correct answer: etcdctl snapshot save

etcdctl snapshot save <filename> creates a consistent point-in-time snapshot of the etcd database that can be used for disaster recovery.

Question 25: What happens to a Pod if it references a Secret that does not exist in the same namespace?

Kubernetes automatically creates an empty Secret with that name
The Pod remains in Pending state and fails to start (Correct answer)
The Pod starts and the missing Secret key is skipped
The Pod starts but the environment variable is set to an empty string

Correct answer: The Pod remains in Pending state and fails to start

If a referenced Secret is missing, the container cannot be started and the Pod stays in Pending with an error event indicating the missing resource.

Question 26: Which admission controller enforces Pod Security Standards when you label a namespace with `pod-security.kubernetes.io/enforce: restricted`?

PodSecurityPolicy
SecurityContextDeny
PodSecurity (Correct answer)
NodeRestriction

Correct answer: PodSecurity

The PodSecurity admission controller (GA in 1.25) enforces Pod Security Standards using namespace labels.

Question 27: How does Kubernetes handle service discovery?

No service discovery mechanism
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
External DNS only
Manual IP configuration

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 28: Which Service type exposes an application on a static port on every node's IP?

ClusterIP
NodePort (Correct answer)
LoadBalancer
Headless

Correct answer: NodePort

NodePort exposes the service on each Node's IP at a static port in the range 30000–32767.

Question 29: What is a ConfigMap?

A log file
An object storing non-confidential configuration data as key-value pairs (Correct answer)
A password vault
A routing table

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 30: Which condition in kubectl get nodes output indicates that a node's kubelet has stopped sending heartbeats?

Unreachable=True
Ready=False or Ready=Unknown (Correct answer)
HeartbeatFailed=True
NotReady=True

Correct answer: Ready=False or Ready=Unknown

When heartbeats stop, the node condition Ready transitions to Unknown (timeout) or False (kubelet reported not ready); there is no 'NotReady' condition type.

Question 31: What Kubernetes object type records cluster state changes such as pod scheduling failures?

Events (Correct answer)
Conditions
Alerts
Notifications

Correct answer: Events

Kubernetes Event objects capture state changes and notable occurrences like scheduling failures or image pull errors.

Certified Kubernetes Administrator (CKA)

The CKA exam validates hands-on skills in Kubernetes cluster administration, including installation, configuration, networking, storage, workload management, and troubleshooting. It is a performance-based certification offered by the CNCF and Linux Foundation.

Questions

35 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds