CKA Cheat Sheet 2026

The 30 highest-yield CKA facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the typical cost of the Certified Kubernetes Associate (CKA) exam? → $300.
2. Which geographic job market shows the highest concentration of CKA-relevant job postings in the United States? → Major tech hubs such as San Francisco Bay Area, Seattle, New York, and Austin
3. Which component is responsible for maintaining the desired state of objects in a Kubernetes cluster? → kube-controller-manager
4. What is the primary security risk of binding a ServiceAccount to the `cluster-admin` ClusterRole? → It grants full unrestricted access to all cluster resources, violating least privilege
5. What Kubernetes object enables dynamic provisioning of PersistentVolumes? → StorageClass
6. What happens to container data stored in a writable layer when the container is deleted? → It is permanently lost
7. In Kubernetes, what is an init container and when does it run? → A container that runs to completion before app containers start, used for setup tasks
8. Who is the target audience for the Certified Kubernetes Associate (CKA) certification? → Professionals new to Kubernetes or seeking foundational understanding.
9. What is the minimum RBAC permission needed for a user to view their own CertificateSigningRequests? → get on certificatesigningrequests cluster-scoped resource
10. Which cgroup subsystem is used to limit a container's CPU usage? → cpu and cpuacct
11. Which YAML structure correctly defines an init container in a Pod spec? → spec.initContainers[] alongside spec.containers[]
12. What is the purpose of the --client-ca-file flag on the kube-apiserver? → Specifies the CA used to verify client certificates presented during authentication
13. What is a ConfigMap? → An object storing non-confidential configuration data as key-value pairs
14. What is a Horizontal Pod Autoscaler (HPA)? → A controller that automatically scales Pod replicas based on metrics
15. Which YAML structure correctly defines a Kubernetes Service that exposes port 80 externally and targets port 8080 on pods? → ports: [{port: 80, targetPort: 8080}]
16. What is the primary advantage of using a service mesh over implementing resilience logic (retries, timeouts) directly in application code? → Centralized, language-agnostic policy management without modifying each service
17. To allow a pod to interact with the Kubernetes API server using its service account token, what must be present? → A Role or ClusterRole with the required verbs bound to the service account
18. What is the purpose of a taint applied to a Kubernetes node? → To repel Pods from being scheduled on that node unless they have a matching toleration
19. What does the 'escalate' verb in a Role allow a user to do? → Update a role to have higher permissions than the user themselves possess
20. How is the Certified Kubernetes Associate (CKA) exam conducted? → Online proctored exam with performance-based tasks.
21. In a PodDisruptionBudget YAML, what does `spec.minAvailable: '50%'` mean? → At least 50% of pods must remain available during voluntary disruptions
22. Which Kubernetes object stores credentials for accessing a private container registry? → Secret of type kubernetes.io/dockerconfigjson
23. In a Kubernetes YAML, which field in a container spec maps a host path to a container path? → volumeMounts[].mountPath paired with a volumes[] hostPath entry
24. Which of the following is a recommended prerequisite for the CKA exam? → Basic familiarity with Linux, YAML, and containerization.
25. What financial benefit do some employers offer to incentivize employees to earn the CKA? → Exam fee reimbursement and certification bonuses as part of L&D programs
26. Which command quickly shows all API resources available in a cluster, useful for referencing short names during the CKA exam? → kubectl api-resources
27. Which workload type provides stable network identities and ordered, graceful deployment for stateful applications? → StatefulSet
28. What does the `runAsUser: 1000` field in a securityContext do? → Sets the UID the container process runs as
29. A pod is stuck in the 'Pending' state. Which command provides the most useful diagnostic information? → kubectl describe pod
30. What is the primary function of the kube-scheduler? → Assign Pods to Nodes based on resource availability and constraints