Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: A ConfigMap is mounted as a volume in a Pod. After the ConfigMap is updated, what happens to the files inside the running Pod?

The files are updated immediately and synchronously
The Pod must be restarted for changes to take effect
The files are eventually updated automatically by the kubelet (Correct answer)
The volume becomes read-only and cannot reflect changes

Correct answer: The files are eventually updated automatically by the kubelet

When a ConfigMap is mounted as a volume, the kubelet periodically syncs the projected files, so changes propagate eventually without a Pod restart.

Question 2: In a high-availability control plane, how does the kube-scheduler ensure only one instance is active at a time?

Round-robin DNS
Leader election using a lease object (Correct answer)
etcd distributed lock
External load balancer sticky sessions

Correct answer: Leader election using a lease object

The kube-scheduler uses leader election via a Lease API object in the kube-system namespace so only one scheduler instance is active.

Question 3: What is a Kubernetes Deployment?

A storage class
A one-time job
A network policy
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 4: Which Kubernetes object tracks the IP addresses and ports of pods backing a Service?

EndpointSlice (Correct answer)
BackendPool
ServiceAccount
PodList

Correct answer: EndpointSlice

EndpointSlice objects (replacing the older Endpoints object) track the IP/port pairs of pods selected by a Service.

Question 5: Which Ingress `pathType` value matches only the exact URL path with no prefix tolerance?

Exact (Correct answer)
ImplementationSpecific
Strict
Prefix

Correct answer: Exact

The `Exact` pathType matches only requests whose URL path is identical to the specified path, with no trailing slash tolerance.

Question 6: Which Kubernetes object sets default resource limits and requests for containers within a namespace?

ResourcePolicy
ResourceQuota
LimitRange (Correct answer)
PodPolicy

Correct answer: LimitRange

A LimitRange object defines default, min, and max resource limits and requests for containers in a namespace.

Question 7: What is a ConfigMap?

A log file
A routing table
A password vault
An object storing non-confidential configuration data as key-value pairs (Correct answer)

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 8: Which component is responsible for persisting Kubernetes cluster state?

kube-scheduler
etcd (Correct answer)
kube-controller-manager
kube-apiserver

Correct answer: etcd

etcd is the distributed key-value store that persists all Kubernetes cluster state and configuration data.

Question 9: How does Kubernetes handle service discovery?

External DNS only
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
No service discovery mechanism
Manual IP configuration

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 10: When upgrading a cluster with kubeadm, what is the correct order of operations?

Upgrade all nodes simultaneously using kubeadm upgrade all
Upgrade workers first, then control plane
Upgrade etcd first, then drain all nodes simultaneously
Upgrade control plane first, then workers (Correct answer)

Correct answer: Upgrade control plane first, then workers

You must upgrade the control plane components first with kubeadm upgrade apply, then upgrade each worker node individually.

Question 11: Which of the following is the default Kubernetes DNS Service?

SkyDNS
CoreDNS (Correct answer)
ExternalDNS
kube-dns

Correct answer: CoreDNS

CoreDNS is the default DNS server in Kubernetes clusters since version 1.11. It provides DNS resolution for services and Pods within the cluster, allowing them to discover each other by name rather than IP address. This is a critical component for inter-service communication and application functionality.

Question 12: What does the kubelet use to authenticate to the kube-apiserver in a kubeadm cluster?

HTTP Basic Auth
A service account token
A client TLS certificate in /var/lib/kubelet/pki (Correct answer)
A static password file

Correct answer: A client TLS certificate in /var/lib/kubelet/pki

The kubelet uses a client certificate (in /var/lib/kubelet/pki/kubelet-client-current.pem) generated during node bootstrapping to authenticate to the API server.

Question 13: Which command initializes a Kubernetes control plane node using kubeadm?

kubeadm init (Correct answer)
kubeadm join
kubectl create
kubeadm config

Correct answer: kubeadm init

The `kubeadm init` command is specifically designed to bootstrap a Kubernetes control-plane node. It performs the necessary steps to set up the core components, configure the cluster, and generate the required certificates and configuration files, effectively turning a machine into a Kubernetes control plane.

Question 14: You want to audit all requests that resulted in a 403 response. Which audit policy level captures the request metadata including response code?

Metadata (Correct answer)
Request
None
RequestResponse

Correct answer: Metadata

The `Metadata` audit level records request metadata including verb, user, resource, and response code without capturing the body.

Question 15: What is a Pod in Kubernetes?

The smallest deployable unit that can contain one or more containers (Correct answer)
A network switch
A database table
A physical server

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 16: What is a Kubernetes Deployment?

A network policy
A storage class
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A one-time job

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 17: Which command generates a private key and CSR for a new Kubernetes user named `alice`?

kubectl create user alice --csr
kubeadm certs generate alice
kubectl certificate create alice
openssl req -newkey rsa:2048 -keyout alice.key -out alice.csr -subj '/CN=alice/O=dev' (Correct answer)

Correct answer: openssl req -newkey rsa:2048 -keyout alice.key -out alice.csr -subj '/CN=alice/O=dev'

openssl generates the RSA key and CSR with the CN (username) and O (group) fields used by Kubernetes for authentication.

Question 18: How is TLS termination configured in an Ingress resource?

Set spec.tls: true at the top level
Add a tls section referencing a Secret with the certificate and key (Correct answer)
Annotate the backend Service with tls: enabled
Create a separate TLSPolicy resource

Correct answer: Add a tls section referencing a Secret with the certificate and key

TLS is configured via the `spec.tls` array in the Ingress, referencing a Kubernetes Secret that contains the TLS certificate and private key.

Question 19: Which kubectl command creates a ConfigMap named 'app-config' with a literal key-value pair 'ENV=production'?

kubectl create configmap app-config --literal ENV=production
kubectl new configmap app-config ENV=production
kubectl create configmap app-config --from-literal=ENV=production (Correct answer)
kubectl apply configmap app-config --key=ENV --value=production

Correct answer: kubectl create configmap app-config --from-literal=ENV=production

The --from-literal flag is the correct way to pass key=value pairs directly on the command line when creating a ConfigMap.

Question 20: Which command drains a node and marks it as unschedulable before maintenance?

kubectl delete node
kubectl cordon
kubectl drain (Correct answer)
kubectl taint

Correct answer: kubectl drain

kubectl drain evicts all pods from a node and marks it unschedulable, making it safe for maintenance.

Question 21: Which tool is built into Kubernetes to encrypt etcd data at rest for Secrets?

HashiCorp Vault
TLS termination at the API server
RBAC policies
EncryptionConfiguration with a provider like AES-CBC (Correct answer)

Correct answer: EncryptionConfiguration with a provider like AES-CBC

An EncryptionConfiguration file referenced by the API server's `--encryption-provider-config` flag encrypts etcd data at rest.

Question 22: How do you reference a single key 'DB_HOST' from a ConfigMap named 'db-config' as an environment variable in a container?

Use volumes with configMap and the key as a subPath
Use envFrom with configMapRef and a keySelector field
Use env with configMapRef and specify the key as a prefix
Use env with valueFrom.configMapKeyRef specifying the ConfigMap name and key (Correct answer)

Correct answer: Use env with valueFrom.configMapKeyRef specifying the ConfigMap name and key

To inject a specific key from a ConfigMap as an env var, use the env field with valueFrom.configMapKeyRef referencing the name and key.

Question 23: How are individual StatefulSet pods addressed via DNS using a headless service 'mysvc' in namespace 'default'?

<pod-name>.default.svc.cluster.local
<pod-name>.pod.cluster.local
<pod-name>.mysvc.default.svc.cluster.local (Correct answer)
<pod-index>.mysvc.cluster.local

Correct answer: <pod-name>.mysvc.default.svc.cluster.local

StatefulSet pods are individually addressable as `<pod-name>.<governing-headless-service>.<namespace>.svc.cluster.local`.

Question 24: What is a Pod in Kubernetes?

A network switch
A database table
The smallest deployable unit that can contain one or more containers (Correct answer)
A physical server

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 25: Which flag streams live log output continuously from a pod?

--tail
--live
--follow (Correct answer)
--stream

Correct answer: --follow

The `--follow` (or `-f`) flag streams live log output from a pod, similar to `tail -f`.

Question 26: What is a Persistent Volume (PV)?

A type of ConfigMap
Temporary container storage
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
A network drive

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 27: What is the purpose of a kube-scheduler in Kubernetes?

To load balance traffic between Pods.
To allocate resources for Pods across the cluster. (Correct answer)
To monitor the health of nodes and workloads.
To ensure high availability of the control plane.

Correct answer: To allocate resources for Pods across the cluster.

The `kube-scheduler` is a control plane component responsible for watching newly created Pods that have no assigned node. It selects the best node for each Pod to run on, considering various factors like resource requirements, hardware constraints, policy constraints, and affinity/anti-affinity specifications. Its primary goal is to ensure efficient resource utilization and optimal placement of workloads across the cluster.

Question 28: What is a Kubernetes Deployment?

A one-time job
A network policy
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A storage class

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 29: Which component provides DNS resolution for service names within a Kubernetes cluster?

kubelet
kube-dns (only)
etcd
CoreDNS (Correct answer)

Correct answer: CoreDNS

CoreDNS is the default DNS server deployed in Kubernetes clusters since v1.13, resolving service and pod hostnames.

Question 30: What is a Kubernetes Deployment?

A network policy
A one-time job
A storage class
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 31: What is a node cordon?

Restarting a node
Removing a node from the cluster
Adding labels to a node
Marking a node as unschedulable so no new Pods are placed on it (Correct answer)

Correct answer: Marking a node as unschedulable so no new Pods are placed on it

Cordoning marks a node as unschedulable. Existing Pods continue running, but no new Pods will be scheduled on the cordoned node.

Certified Kubernetes Administrator (CKA)

The CKA exam validates hands-on skills in Kubernetes cluster administration, including installation, configuration, networking, storage, workload management, and troubleshooting. It is a performance-based certification offered by the CNCF and Linux Foundation.

Questions

35 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

training.linuxfoundation.org — Test delivery, eligibility, fees, time limit, exam information · verified Nov 2026
docs.linuxfoundation.org — Passing score, renewal, score release, score validity, test dates · verified Oct 2026