Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: In Kubernetes, what is an init container and when does it run?

A container that runs continuously alongside app containers
A container that runs to completion before app containers start, used for setup tasks (Correct answer)
A container that is only started when the pod is first scheduled
A container that handles health checks for the pod

Correct answer: A container that runs to completion before app containers start, used for setup tasks

Init containers run sequentially to completion before any app containers start, making them ideal for setup tasks like downloading configs or waiting for dependencies.

Question 2: Which flag on the kube-apiserver controls the list of admission controllers that are enabled?

--runtime-config
--admission-control
--enable-admission-plugins (Correct answer)
--feature-gates

Correct answer: --enable-admission-plugins

The --enable-admission-plugins flag on the kube-apiserver specifies which admission controllers are active in the admission chain.

Question 3: Which certification is considered the logical next step after earning the CKA for engineers who want to specialize in application deployment?

AWS Solutions Architect
LPIC-1
CKS (Certified Kubernetes Security Specialist)
CKAD (Certified Kubernetes Application Developer) (Correct answer)

Correct answer: CKAD (Certified Kubernetes Application Developer)

The CKAD focuses on developing and deploying applications on Kubernetes, complementing the infrastructure focus of the CKA.

Question 4: Which admission controller enforces Pod Security Standards at the namespace level?

PodSecurity (Correct answer)
SecurityContextDeny
NodeRestriction
PodSecurityPolicy

Correct answer: PodSecurity

The PodSecurity admission controller (replacing PodSecurityPolicy) enforces Pod Security Standards via namespace labels.

Question 5: To renew an expiring CKA certification, what must the candidate do?

Submit a written application to CNCF
Complete an online course and pay a renewal fee
Get endorsed by two certified Kubernetes professionals
Retake and pass the CKA exam before the expiration date (Correct answer)

Correct answer: Retake and pass the CKA exam before the expiration date

CKA renewal requires retaking and passing the CKA exam; there is no simple renewal-without-exam option.

Question 6: Which YAML field in a Kubernetes Deployment spec ensures pods are spread across availability zones?

spec.topologySpreadConstraints (Correct answer)
spec.placement.zones
spec.template.spec.affinity.podAntiAffinity
spec.template.spec.nodeSelector.zone

Correct answer: spec.topologySpreadConstraints

`topologySpreadConstraints` is the modern, flexible way to spread Pods across topology keys such as zones or nodes.

Question 7: What is the role of a cloud-controller-manager in a Kubernetes cluster?

Schedules Pods on cloud-specific instance types
Integrates Kubernetes with cloud provider APIs for nodes, routes, and load balancers (Correct answer)
Manages container image pulls from cloud registries
Rotates cloud provider credentials stored in Secrets

Correct answer: Integrates Kubernetes with cloud provider APIs for nodes, routes, and load balancers

The cloud-controller-manager runs cloud-specific control loops for node lifecycle, route configuration, and service load balancer provisioning.

Question 8: A user authenticates via OIDC but the API server rejects the token with 'token not yet valid'. What is the most likely cause?

The --oidc-client-id flag does not match the token's audience
The user's group membership is missing from the token
The OIDC provider's TLS certificate is expired
The API server and OIDC provider clocks are out of sync (Correct answer)

Correct answer: The API server and OIDC provider clocks are out of sync

OIDC token validation is time-sensitive; clock skew between the API server and OIDC provider causes 'not yet valid' (nbf claim) rejections.

Question 9: Which component is responsible for issuing certificates to kubelets in a Kubernetes cluster?

kube-controller-manager (Correct answer)
CoreDNS
etcd
kube-proxy

Correct answer: kube-controller-manager

The kube-controller-manager runs the Certificate Signing Request (CSR) controller that approves and issues certificates to kubelets via the certificates.k8s.io API.

Question 10: What happens to a PersistentVolume when its reclaim policy is set to 'Retain' and the PVC is deleted?

The PV remains and must be manually reclaimed by an admin (Correct answer)
The PV is automatically deleted
The PV is immediately available for new claims
The PV is wiped and re-provisioned

Correct answer: The PV remains and must be manually reclaimed by an admin

With the Retain policy, the PV is not deleted and holds the data until an administrator manually reclaims or deletes it.

Question 11: What is distributed tracing in the context of a service mesh, and which header propagation is required for Istio tracing to work correctly?

Logging each service's CPU usage across time using Prometheus
Capturing full request/response payloads for debugging
Tracking a request across multiple services by propagating B3 or W3C trace headers (Correct answer)
Mapping the network topology of all services in the mesh

Correct answer: Tracking a request across multiple services by propagating B3 or W3C trace headers

Distributed tracing correlates spans across services; Istio generates the initial trace context but applications must forward B3 or W3C TraceContext headers to maintain the trace chain.

Question 12: What is the primary security risk of binding a ServiceAccount to the `cluster-admin` ClusterRole?

It grants full unrestricted access to all cluster resources, violating least privilege (Correct answer)
It allows the ServiceAccount to modify etcd directly
It prevents the ServiceAccount from accessing namespaced resources
It disables audit logging for that ServiceAccount

Correct answer: It grants full unrestricted access to all cluster resources, violating least privilege

Binding cluster-admin to a ServiceAccount gives any pod using it complete control over the entire cluster, making it a critical security risk.

Question 13: What is the relationship between a Deployment and a ReplicaSet in Kubernetes?

A Deployment creates and manages ReplicaSets to achieve rolling updates and rollbacks (Correct answer)
A Deployment replaces ReplicaSets entirely
A ReplicaSet manages multiple Deployments
They are identical objects with different names

Correct answer: A Deployment creates and manages ReplicaSets to achieve rolling updates and rollbacks

A Deployment manages one or more ReplicaSets and coordinates rolling updates by creating a new ReplicaSet and scaling it up while scaling down the old one.

Question 14: When a Pod is deleted but its containers keep running on the node, what is the most likely cause?

The container runtime does not support graceful shutdown
A finalizer on the Pod is preventing deletion
The kubelet on that node is not running or not communicating with the API server (Correct answer)
The PodDisruptionBudget is blocking deletion

Correct answer: The kubelet on that node is not running or not communicating with the API server

If the kubelet cannot communicate with the API server, it cannot process the deletion and the containers persist until connectivity is restored.

Question 15: Which service mesh feature allows you to gradually shift 10% of traffic to a new service version while keeping 90% on the old version?

Weighted routing via VirtualService (Correct answer)
Blue-green deployment via DestinationRule subsets
Canary deployment via Kubernetes RollingUpdate strategy
A/B testing via PodDisruptionBudget

Correct answer: Weighted routing via VirtualService

VirtualService supports weight-based routing between DestinationRule subsets, enabling fine-grained canary releases independent of replica counts.

Question 16: What does setting `spec.hostNetwork: true` in a Pod YAML do?

Gives the Pod access to all cluster DNS entries
Creates a host-level LoadBalancer for the Pod
Binds the Pod to the host node's network namespace (Correct answer)
Enables network policies for the Pod

Correct answer: Binds the Pod to the host node's network namespace

Setting `hostNetwork: true` makes the Pod share the host node's network namespace, using the node's IP and ports directly.

Question 17: What is the purpose of the 'minReadySeconds' field in a Deployment spec?

Defines the grace period for Pod termination
Specifies how many seconds a new Pod must be ready before it is considered available (Correct answer)
Limits how quickly new Pods can be created during a rollout
Sets the minimum time a container must run before probes start

Correct answer: Specifies how many seconds a new Pod must be ready before it is considered available

minReadySeconds defines the minimum time (after a Pod becomes ready) that must elapse before the Pod is counted as available, preventing hasty rollout progression.

Question 18: Which field in a kubeconfig user entry stores a base64-encoded client certificate?

client-key-data
token-data
certificate-authority-data
client-certificate-data (Correct answer)

Correct answer: client-certificate-data

The client-certificate-data field holds the base64-encoded PEM client certificate for X.509 user authentication.

Question 19: What Kubernetes object should you use to run a task that executes to completion and then stops?

StatefulSet
Job (Correct answer)
Deployment
CronJob

Correct answer: Job

A Job creates one or more Pods to run a task to completion, tracks successes, and stops creating new Pods once the desired completions are reached.

Question 20: In a Kubernetes YAML, which field in a container spec maps a host path to a container path?

volumeMounts[].mountPath paired with a volumes[] hostPath entry (Correct answer)
bind: {host: ..., container: ...}
mounts[].hostPath
hostMount

Correct answer: volumeMounts[].mountPath paired with a volumes[] hostPath entry

A `hostPath` volume is declared in `spec.volumes[]` and mounted into a container via `spec.containers[].volumeMounts[]` with a `mountPath`.

Question 21: Which component is responsible for maintaining the desired state of objects in a Kubernetes cluster?

kube-scheduler
kube-proxy
kube-controller-manager (Correct answer)
kubelet

Correct answer: kube-controller-manager

The kube-controller-manager runs controllers that continuously watch the cluster state and reconcile it with the desired state.

Question 22: What is the function of the '.dockerignore' file?

It defines which image layers should not be cached
It prevents specific images from being pulled from a registry
It excludes files and directories from being sent to the Docker build context (Correct answer)
It specifies which containers Docker should not start automatically

Correct answer: It excludes files and directories from being sent to the Docker build context

The .dockerignore file lists patterns of files and directories to exclude from the build context sent to the Docker daemon, speeding up builds and preventing sensitive files from being included.

Question 23: Which kubectl command triggers a rolling update on a Deployment by changing its container image?

kubectl set image deployment/<name> <container>=<new-image> (Correct answer)
kubectl rollout restart deployment/<name>
kubectl edit replicaset <name>
kubectl apply -f deployment.yaml

Correct answer: kubectl set image deployment/<name> <container>=<new-image>

The `kubectl set image` command updates a container's image in a running Deployment, triggering a rolling update automatically.

Question 24: What does a PersistentVolumeClaim (PVC) do in Kubernetes?

Defines a storage class for dynamic provisioning
Creates a new PersistentVolume automatically
Mounts a volume directly into a node
Requests a specific amount and type of storage from the cluster (Correct answer)

Correct answer: Requests a specific amount and type of storage from the cluster

A PVC is a user's request for storage, specifying size and access mode, which the cluster fulfills by binding to a matching PV.

Question 25: In a Kubernetes cluster, which component handles east-west (Pod-to-Pod) network traffic routing?

CoreDNS
kube-apiserver
Ingress Controller
kube-proxy (Correct answer)

Correct answer: kube-proxy

kube-proxy runs on each Node and maintains network rules (iptables or IPVS) that enable Pod-to-Service and cross-Node Pod communication.

Question 26: Which Istio resource is used to register and control traffic to external services (outside the mesh)?

Gateway
ServiceEntry (Correct answer)
VirtualService
DestinationRule

Correct answer: ServiceEntry

ServiceEntry adds external services to Istio's internal service registry, allowing mesh-wide policies and traffic management to apply.

Question 27: Which securityContext field drops Linux capabilities from a container?

capabilities.drop (Correct answer)
sysctls
capabilities.add
seccompProfile

Correct answer: capabilities.drop

The capabilities.drop field removes specific Linux capabilities from a container, reducing its attack surface even if it runs as root.

Question 28: What is the primary function of the kube-scheduler?

Expose services via load balancing
Assign Pods to Nodes based on resource availability and constraints (Correct answer)
Store cluster state in etcd
Monitor Node health and restart failed Pods

Correct answer: Assign Pods to Nodes based on resource availability and constraints

The kube-scheduler watches for unscheduled Pods and selects an appropriate Node based on resource requirements, affinity rules, and other constraints.

Question 29: What does a Pod's 'nodeSelector' field do in Kubernetes scheduling?

Sets the priority of the Pod during scheduling
Defines which nodes can tolerate the Pod's resource requests
Assigns a Pod to a specific node by its IP address
Constrains the Pod to run only on nodes with matching key-value labels (Correct answer)

Correct answer: Constrains the Pod to run only on nodes with matching key-value labels

nodeSelector is the simplest node selection constraint; it restricts Pod scheduling to nodes whose labels include all specified key-value pairs.

Question 30: Which Kubernetes feature allows the scheduler to be replaced or extended without modifying core Kubernetes code?

Scheduler Profiles and Extenders (Correct answer)
Admission Webhooks
Custom Resource Definitions
Node Taints

Correct answer: Scheduler Profiles and Extenders

Scheduler Extenders and Scheduler Profiles let you plug in custom scheduling logic or run multiple scheduler configurations without patching core code.

Question 31: Which Kubernetes admission controller enforces Pod Security Standards such as 'baseline' or 'restricted'?

SecurityContextDeny
PodSecurity (Correct answer)
NodeRestriction
PodSecurityPolicy (PSP)

Correct answer: PodSecurity

The PodSecurity admission controller (introduced in 1.22, stable in 1.25) replaced PSP and enforces Pod Security Standards at namespace level.

Question 32: What is the purpose of Istio's Egress Gateway?

Terminate inbound TLS from external clients before forwarding to services
Control and monitor traffic leaving the mesh to external services through a single exit point (Correct answer)
Replace ServiceEntry for services inside the cluster
Provide a UI for managing outbound traffic rules

Correct answer: Control and monitor traffic leaving the mesh to external services through a single exit point

An Egress Gateway centralizes outbound traffic through a dedicated proxy, enabling policy enforcement, logging, and monitoring of all mesh-to-external communications.

Question 33: What is the purpose of a taint applied to a Kubernetes node?

To improve node performance by limiting running Pods
To repel Pods from being scheduled on that node unless they have a matching toleration (Correct answer)
To label a node for use with nodeSelector
To mark a node as ready in the cluster

Correct answer: To repel Pods from being scheduled on that node unless they have a matching toleration

A taint marks a node so that the scheduler will not place Pods on it unless a Pod explicitly tolerates that taint.

Question 34: Which annotation enables automatic Envoy sidecar injection for all pods in a namespace?

sidecar.istio.io/inject=true on each pod
istio.io/proxy=auto on the namespace
inject.istio.io=enabled on each deployment
istio-injection=enabled on the namespace (Correct answer)

Correct answer: istio-injection=enabled on the namespace

Labeling a namespace with istio-injection=enabled causes the Istio admission webhook to automatically inject the Envoy sidecar into new pods.

Question 35: Which Istio resource is used to define end-user (JWT) authentication policies?

PeerAuthentication
AuthorizationPolicy
RequestAuthentication (Correct answer)
DestinationRule

Correct answer: RequestAuthentication

RequestAuthentication defines what JWT issuers are trusted, validating end-user tokens presented in HTTP requests.

Question 36: Which command lists all ClusterRoleBindings that grant permissions to the user 'jane'?

kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="jane")' (Correct answer)
kubectl get bindings --subject=jane
kubectl describe clusterrolebindings --user=jane
kubectl auth list-permissions --user=jane

Correct answer: kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="jane")'

Querying ClusterRoleBindings and filtering by subjects with jq is the correct way to find all bindings for a specific user.

Question 37: What does the kubectl command 'kubectl cordon <node>' do?

Applies a NoExecute taint to the node
Deletes the node from the cluster
Drains all Pods from the node and removes it
Marks the node as unschedulable so no new Pods are placed on it (Correct answer)

Correct answer: Marks the node as unschedulable so no new Pods are placed on it

kubectl cordon marks a node as unschedulable, preventing new Pods from being scheduled on it, but does not evict existing Pods.

Question 38: A practice test reveals a candidate struggles with PersistentVolume binding. Which study scenario best addresses this gap?

Reading the PV concept page once
Memorizing storage class names
Practicing etcd snapshots instead
Manually creating a PV, PVC, and Pod that mounts the volume, then verifying the binding lifecycle end-to-end (Correct answer)

Correct answer: Manually creating a PV, PVC, and Pod that mounts the volume, then verifying the binding lifecycle end-to-end

Walking through the full PV→PVC→Pod lifecycle hands-on reveals how access modes, storage classes, and capacity affect binding.

Question 39: In a service mesh, what does mTLS stand for and what problem does it solve?

Multi-Tenant TLS; it isolates tenant traffic
Mesh TLS; it encrypts control-plane communication only
Mutual TLS; it ensures both client and server authenticate each other (Correct answer)
Managed TLS; it automates certificate renewal only

Correct answer: Mutual TLS; it ensures both client and server authenticate each other

Mutual TLS requires both the client and server to present certificates, enabling two-way authentication and encrypted communication.

Question 40: Which Kubernetes API group handles CertificateSigningRequest resources?

security.k8s.io
policy.k8s.io
auth.k8s.io
certificates.k8s.io (Correct answer)

Correct answer: certificates.k8s.io

CertificateSigningRequest resources belong to the certificates.k8s.io API group.

Question 41: What is the function of the 'garbage collector' controller in kube-controller-manager?

Deletes completed Jobs after a TTL expires
Evicts Pods from nodes when disk pressure is detected
Removes orphaned dependent objects when their owner is deleted (Correct answer)
Compacts old etcd revisions to free disk space

Correct answer: Removes orphaned dependent objects when their owner is deleted

The garbage collector controller watches for objects whose owner references point to non-existent owners and deletes them, implementing cascading deletion.

Question 42: What Kubernetes object enables dynamic provisioning of PersistentVolumes?

StorageClass (Correct answer)
PersistentVolumeClaim
ResourceQuota
VolumeMount

Correct answer: StorageClass

A StorageClass defines the provisioner and parameters used to dynamically create PersistentVolumes on demand when a PVC is submitted.

Question 43: What is the CIA triad in information security?

Cybersecurity Infrastructure Act
Central Intelligence Agency
Confidentiality, Integrity, Availability (Correct answer)
Certified Information Auditor

Correct answer: Confidentiality, Integrity, Availability

The CIA triad represents three core security principles: Confidentiality (keeping data private), Integrity (data accuracy), Availability (systems accessible when needed).

Question 44: What does the 'maxSurge' field in a Deployment's rolling update strategy control?

The maximum CPU usage allowed during a rollout
The maximum number of Pods that can be unavailable during an update
The maximum number of failed Pods before the rollout stops
The maximum number of extra Pods that can exist above the desired replica count during an update (Correct answer)

Correct answer: The maximum number of extra Pods that can exist above the desired replica count during an update

maxSurge sets how many additional Pods beyond the desired count may run simultaneously during a rolling update, allowing new Pods to start before old ones terminate.

Question 45: Which industry trend most directly explains why CKA-certified professionals command premium salaries?

Widespread enterprise adoption of container orchestration at scale (Correct answer)
Declining interest in on-premise infrastructure
Reduction in cloud provider pricing
Consolidation of the DevOps toolchain market

Correct answer: Widespread enterprise adoption of container orchestration at scale

Enterprise-scale container orchestration demand outpaces available talent, driving up compensation for CKA holders.

Question 46: How do you correctly specify an empty value for a key in a Kubernetes YAML manifest?

key: null (Correct answer)
key: NULL
key: ""
key: undefined

Correct answer: key: null

In YAML, `null` (lowercase) is the correct null literal; Kubernetes uses this to represent explicitly unset optional fields.

Question 47: You need to temporarily suspend a deployment's pods for troubleshooting without deleting the deployment. Which command achieves this?

kubectl scale deployment <name> --replicas=0 (Correct answer)
kubectl delete deployment <name> --keep-config
kubectl pause deployment <name>
kubectl stop deployment <name>

Correct answer: kubectl scale deployment <name> --replicas=0

kubectl scale with --replicas=0 terminates all running pods while preserving the deployment configuration, effectively suspending it.

Question 48: What port does Kubernetes API server listen on by default?

6443 (Correct answer)
80
443
8080

Correct answer: 6443

The Kubernetes API server listens on port 6443 by default for secure HTTPS communication.

Question 49: Which field in a PVC spec specifies the minimum storage size required?

limits.storage
spec.size
capacity.storage
resources.requests.storage (Correct answer)

Correct answer: resources.requests.storage

The `resources.requests.storage` field in a PVC spec indicates the amount of storage the claim is requesting.

Question 50: Which exam time management strategy is most recommended for the CKA's 2-hour format?

Focus all time on the highest-weighted domain questions
Spend the first hour only reading all questions
Flag difficult questions, complete easier ones first, then return to flagged items (Correct answer)
Answer every question in order, spending as much time as needed on each

Correct answer: Flag difficult questions, complete easier ones first, then return to flagged items

Skipping and flagging hard questions ensures you capture all easier points before spending extra time on complex tasks.

Question 51: Which command shows the rollout history of a Kubernetes Deployment?

kubectl rollout history deployment/<name> (Correct answer)
kubectl log deployment/<name>
kubectl describe deployment/<name>
kubectl get events --field-selector=involvedObject.kind=Deployment

Correct answer: kubectl rollout history deployment/<name>

The `kubectl rollout history deployment/<name>` command lists previous revisions of the Deployment along with their change causes.

Question 52: A container's memory usage exceeds its memory limit. What does Kubernetes do?

The node is cordoned to prevent further scheduling
The container is throttled until memory usage drops
The pod is evicted from the node
The container is OOMKilled and restarted according to the restart policy (Correct answer)

Correct answer: The container is OOMKilled and restarted according to the restart policy

When a container exceeds its memory limit, the Linux kernel OOM killer terminates the process, and Kubernetes restarts it based on the pod's restartPolicy.

Question 53: Which port does the kubelet API listen on by default for the API server to communicate with it?

10250 (Correct answer)
10255
6443
2379

Correct answer: 10250

The kubelet's read/write API listens on port 10250 (HTTPS); the deprecated read-only port 10255 is disabled by default in modern Kubernetes.

Question 54: What does the term 'stacked etcd topology' mean in a Kubernetes HA setup?

etcd is deployed behind a dedicated load balancer
etcd runs as a DaemonSet on all worker nodes
etcd data is replicated across multiple cloud regions
etcd members run on the same nodes as the control plane components (Correct answer)

Correct answer: etcd members run on the same nodes as the control plane components

In a stacked topology, etcd members are co-located with control plane nodes, coupling etcd availability with control plane availability.

Question 55: What is a LoadBalancer service type?

A service that provisions an external load balancer in cloud environments (Correct answer)
A monitoring service
A service running on a single Pod
An internal-only service

Correct answer: A service that provisions an external load balancer in cloud environments

LoadBalancer service type automatically provisions a cloud provider's load balancer, providing an external IP address for accessing the service from outside the cluster.

Question 56: What does setting `volumeBindingMode: WaitForFirstConsumer` on a StorageClass do?

Delays volume binding until a Pod using the PVC is scheduled (Correct answer)
Prevents new PVCs from being created
Forces all PVCs to use the default storage class
Binds the volume immediately when the PVC is created

Correct answer: Delays volume binding until a Pod using the PVC is scheduled

WaitForFirstConsumer defers PV creation and binding until a Pod that references the PVC is scheduled, enabling topology-aware provisioning.

Question 57: In a Linkerd service mesh, what is the equivalent of Istio's Envoy sidecar proxy?

linkerd-proxy (written in Rust) (Correct answer)
HAProxy
Envoy with Linkerd configuration
NGINX reverse proxy

Correct answer: linkerd-proxy (written in Rust)

Linkerd uses its own ultra-lightweight proxy called linkerd-proxy, written in Rust for low latency and minimal resource usage.

Question 58: What volume type would you use to expose Pod metadata (like labels and annotations) as files to a running container?

emptyDir
configMap
secret
downwardAPI (Correct answer)

Correct answer: downwardAPI

The downwardAPI volume type projects Pod metadata fields such as labels, annotations, and resource limits into files inside the container.

Question 59: Which observability signal does a service mesh provide automatically without application code changes?

Database query execution plans
Application-level business metrics like checkout conversion rates
JVM heap usage and garbage collection pauses
Golden signals: latency, traffic, errors, and saturation metrics per service (Correct answer)

Correct answer: Golden signals: latency, traffic, errors, and saturation metrics per service

Service meshes instrument the sidecar proxies to collect the four golden signals for every service automatically, without requiring changes to application code.

Question 60: Which etcd configuration parameter controls how long a follower waits before triggering a leader election?

--max-snapshots
--heartbeat-interval
--snapshot-count
--election-timeout (Correct answer)

Correct answer: --election-timeout

The --election-timeout parameter defines how long an etcd follower waits without hearing from the leader before starting a new election.

Certified Kubernetes Administrator (CKA)

The CKA certification validates that candidates have the skills, knowledge, and competency to perform the responsibilities of a Kubernetes administrator. The exam tests cluster architecture, networking, storage, workload management, and troubleshooting in a live Kubernetes environment.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds