Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: What is the purpose of Pod affinity rules in Kubernetes scheduling?

To configure network policies between Pods
To define CPU and memory resource limits for Pods
To attract or repel Pods from being co-located with other Pods matching certain labels (Correct answer)
To force Pods onto specific nodes by name

Correct answer: To attract or repel Pods from being co-located with other Pods matching certain labels

Pod affinity and anti-affinity rules let you control whether Pods should be scheduled near (or away from) other Pods that match a given label selector.

Question 2: What is the purpose of a taint applied to a Kubernetes node?

To improve node performance by limiting running Pods
To mark a node as ready in the cluster
To label a node for use with nodeSelector
To repel Pods from being scheduled on that node unless they have a matching toleration (Correct answer)

Correct answer: To repel Pods from being scheduled on that node unless they have a matching toleration

A taint marks a node so that the scheduler will not place Pods on it unless a Pod explicitly tolerates that taint.

Question 3: What Kubernetes object enables dynamic provisioning of PersistentVolumes?

PersistentVolumeClaim
StorageClass (Correct answer)
ResourceQuota
VolumeMount

Correct answer: StorageClass

A StorageClass defines the provisioner and parameters used to dynamically create PersistentVolumes on demand when a PVC is submitted.

Question 4: What Kubernetes object should you use to run a task that executes to completion and then stops?

StatefulSet
CronJob
Deployment
Job (Correct answer)

Correct answer: Job

A Job creates one or more Pods to run a task to completion, tracks successes, and stops creating new Pods once the desired completions are reached.

Question 5: What should you do when encountering a difficult question?

Guess immediately without reading
Stare at it until you figure it out
Skip it permanently
Mark it, move on, and return to it later (Correct answer)

Correct answer: Mark it, move on, and return to it later

Mark difficult questions and move on to avoid wasting time. After completing easier questions, return with fresh perspective and remaining time.

Question 6: What is a NetworkPolicy in Kubernetes?

A DNS configuration
A load balancer rule
A firewall appliance
A resource that controls network traffic flow between Pods (Correct answer)

Correct answer: A resource that controls network traffic flow between Pods

NetworkPolicies define rules for which Pods can communicate with each other and with external endpoints, implementing network-level security.

Question 7: How should you manage time during a timed test?

Divide total time by questions and pace yourself, spending less on easy ones (Correct answer)
Rush through the entire test
Spend equal time on every question
Only work on hard questions

Correct answer: Divide total time by questions and pace yourself, spending less on easy ones

Calculate time per question, spend less on easy questions to bank time for harder ones, and check your pace periodically.

Question 8: How does kubectl top differ from Prometheus when monitoring Kubernetes resource usage?

kubectl top queries Prometheus directly, while Prometheus queries Metrics Server
kubectl top shows only current instantaneous metrics from Metrics Server, while Prometheus stores historical time-series data (Correct answer)
kubectl top provides more granular metrics than Prometheus
kubectl top and Prometheus use identical data sources and retention

Correct answer: kubectl top shows only current instantaneous metrics from Metrics Server, while Prometheus stores historical time-series data

kubectl top fetches a single current snapshot from the Metrics Server API with no history, whereas Prometheus scrapes and stores time-series data enabling historical queries and alerting.

Question 9: What is container orchestration?

Building container images
Automated management of container deployment, scaling, and networking (Correct answer)
Manual container management
Writing application code

Correct answer: Automated management of container deployment, scaling, and networking

Container orchestration automates deploying, managing, scaling, and networking containers across clusters of hosts, with Kubernetes being the most popular orchestration platform.

Question 10: When a study resource mentions 'static Pods', what distinguishes them from regular Pods in a CKA context?

Static Pods cannot be scheduled on worker nodes
Static Pods are managed by the Deployment controller
Static Pods are defined by YAML files in a directory monitored directly by the kubelet, not the API server (Correct answer)
Static Pods require a PersistentVolume

Correct answer: Static Pods are defined by YAML files in a directory monitored directly by the kubelet, not the API server

Static Pods are placed in the kubelet's staticPodPath directory and managed by the kubelet directly, bypassing the scheduler and API server.

Question 11: What is a Kubernetes Service?

A storage volume
A running container
An abstraction providing stable networking for a set of Pods (Correct answer)
A cluster node

Correct answer: An abstraction providing stable networking for a set of Pods

A Service provides a stable IP address and DNS name for accessing a set of Pods, with built-in load balancing regardless of Pod lifecycle changes.

Question 12: What is the state of a PersistentVolume when it is successfully bound to a PersistentVolumeClaim?

Available
Pending
Bound (Correct answer)
Released

Correct answer: Bound

Once a PV is matched and bound to a PVC, its status changes to 'Bound', meaning it is exclusively reserved for that claim.

Question 13: What does RBAC stand for in Kubernetes?

Resource-Based Allocation Configuration
Role-Based Access Control (Correct answer)
Replica-Based Auto Configuration
Runtime Binary Access Control

Correct answer: Role-Based Access Control

RBAC (Role-Based Access Control) regulates access to Kubernetes resources based on the roles assigned to users or service accounts.

Question 14: What port does Kubernetes API server listen on by default?

443
8080
6443 (Correct answer)
80

Correct answer: 6443

The Kubernetes API server listens on port 6443 by default for secure HTTPS communication.

Question 15: What is a Kubernetes Deployment?

A storage class
A one-time job
A resource that manages ReplicaSets and provides declarative updates for Pods (Correct answer)
A network policy

Correct answer: A resource that manages ReplicaSets and provides declarative updates for Pods

Deployments manage the rollout, scaling, and updating of Pod replicas, enabling rolling updates, rollbacks, and declarative state management.

Question 16: When should you change an answer on a test?

Only when you have a clear reason the new answer is better (Correct answer)
Change every answer you doubt
Always change your first answer
Never change answers

Correct answer: Only when you have a clear reason the new answer is better

Research shows changing answers is beneficial only when you have a specific reason, such as recalling new information or catching a misread question.

Question 17: What is the role of the 'groups' claim in an OIDC token when used with Kubernetes?

It maps to Kubernetes namespaces the user can access
It provides the list of RBAC group memberships for the user (Correct answer)
It defines the user's resource quotas
It specifies which API versions the user can call

Correct answer: It provides the list of RBAC group memberships for the user

The groups claim in an OIDC id_token maps to Kubernetes RBAC groups, enabling group-based access control via ClusterRoleBindings or RoleBindings.

Question 18: Which access mode allows a PersistentVolume to be mounted as read-write by a single node?

ReadWriteAll
ReadWriteOnce (Correct answer)
ReadWriteMany
ReadOnlyMany

Correct answer: ReadWriteOnce

ReadWriteOnce (RWO) allows the volume to be mounted as read-write by exactly one node at a time.

Question 19: Where are bootstrap token Secrets stored in a Kubernetes cluster?

In the kube-system namespace (Correct answer)
In the kube-public namespace
In the default namespace
Directly in etcd without a namespace

Correct answer: In the kube-system namespace

Bootstrap token Secrets are stored in the kube-system namespace with the naming pattern bootstrap-token-<token-id>.

Question 20: Which Kubernetes component logs should a candidate check first when troubleshooting a node that shows as NotReady?

kube-scheduler logs
kubelet logs on the affected node (Correct answer)
kube-apiserver logs
etcd logs

Correct answer: kubelet logs on the affected node

The kubelet runs on every node and manages pod lifecycle; its logs are the first place to diagnose a NotReady node.

Question 21: What does 'kubectl get pods' show?

Network configuration
A list of all Pods and their status in the current namespace (Correct answer)
User accounts
Server hardware info

Correct answer: A list of all Pods and their status in the current namespace

This command displays all Pods in the current namespace with their name, ready status, current state, restarts, and age.

Question 22: What is a LoadBalancer service type?

A monitoring service
A service running on a single Pod
An internal-only service
A service that provisions an external load balancer in cloud environments (Correct answer)

Correct answer: A service that provisions an external load balancer in cloud environments

LoadBalancer service type automatically provisions a cloud provider's load balancer, providing an external IP address for accessing the service from outside the cluster.

Question 23: What is phishing?

A type of firewall
A backup system
A network scanning tool
A social engineering attack using fraudulent communications to steal sensitive data (Correct answer)

Correct answer: A social engineering attack using fraudulent communications to steal sensitive data

Phishing uses deceptive emails, websites, or messages that appear legitimate to trick victims into revealing passwords, credit cards, or personal information.

Question 24: Who is the target audience for the Certified Kubernetes Associate (CKA) certification?

Experienced Kubernetes architects.
Experts in container security.
Individuals with no prior knowledge of Linux.
Professionals new to Kubernetes or seeking foundational understanding. (Correct answer)

Correct answer: Professionals new to Kubernetes or seeking foundational understanding.

The CKA certification is primarily aimed at professionals who are new to Kubernetes or those seeking to solidify their foundational understanding of the platform. It provides a benchmark for individuals to demonstrate their ability to perform basic Kubernetes tasks. While beneficial for various roles, it's particularly suited for those starting their cloud-native journey.

Question 25: In a StatefulSet, what naming convention are Pod identities given?

User-defined labels only
Random UUID suffixes like Deployments
IP address-based names
Sequential ordinal suffixes (e.g., web-0, web-1, web-2) (Correct answer)

Correct answer: Sequential ordinal suffixes (e.g., web-0, web-1, web-2)

StatefulSet Pods receive names combining the StatefulSet name and an ordinal index (0, 1, 2...), providing stable, predictable identities across restarts.

Question 26: What does the 'CrashLoopBackOff' status indicate for a pod?

The pod failed to pull its container image from the registry
The pod is waiting for a PersistentVolume to be provisioned
The pod was evicted due to node memory pressure
The pod's container repeatedly crashes and Kubernetes is backing off restart attempts (Correct answer)

Correct answer: The pod's container repeatedly crashes and Kubernetes is backing off restart attempts

CrashLoopBackOff means the container starts, crashes, and Kubernetes keeps restarting it with increasing exponential delays.

Question 27: What does 'kubectl apply -f' do?

Creates or updates resources defined in a file (Correct answer)
Describes a resource
Deletes resources
Lists all resources

Correct answer: Creates or updates resources defined in a file

kubectl apply -f applies the configuration from a YAML file, creating the resource if it doesn't exist or updating it if it does.

Question 28: What is the purpose of resource limits in a Pod spec?

To set disk quotas
To cap the maximum CPU and memory a container can use (Correct answer)
To restrict network access
To limit the number of Pods

Correct answer: To cap the maximum CPU and memory a container can use

Resource limits define the maximum amount of CPU and memory a container can consume, preventing any single container from monopolizing cluster resources.

Question 29: What is a Kubernetes namespace?

A physical server
A container image
A virtual cluster partition for organizing resources (Correct answer)
A network subnet

Correct answer: A virtual cluster partition for organizing resources

Namespaces provide virtual cluster partitioning, allowing teams or projects to share a cluster while isolating their resources.

Question 30: How does Kubernetes handle service discovery?

No service discovery mechanism
External DNS only
Through Services that provide stable DNS names and IP addresses for Pods (Correct answer)
Manual IP configuration

Correct answer: Through Services that provide stable DNS names and IP addresses for Pods

Kubernetes Services provide stable network endpoints with DNS names, automatically routing traffic to healthy Pods regardless of their changing IP addresses.

Question 31: What is encryption?

Compressing files
Deleting data
Converting data into coded format to prevent unauthorized access (Correct answer)
Backing up data

Correct answer: Converting data into coded format to prevent unauthorized access

Encryption transforms readable data into unreadable ciphertext using algorithms and keys, ensuring only authorized parties can access the information.

Question 32: What is Docker Hub?

A container runtime
A Kubernetes component
A cloud-based registry for storing and sharing container images (Correct answer)
A physical data center

Correct answer: A cloud-based registry for storing and sharing container images

Docker Hub is the default public registry for Docker images, where developers can store, share, and discover container images.

Question 33: Which field in the Kubernetes API server configuration enables the Node Authorizer for kubelet credentials?

--authorization-mode=Node (Correct answer)
--kubelet-auth=true
--enable-node-auth
--node-restriction=enabled

Correct answer: --authorization-mode=Node

Adding Node to --authorization-mode enables the Node authorizer, which grants kubelets permission to access only the resources related to their own node.

Question 34: What is the difference between 'requiredDuringSchedulingIgnoredDuringExecution' and 'preferredDuringSchedulingIgnoredDuringExecution' in node affinity?

They are interchangeable aliases
Required applies at runtime; preferred applies only at scheduling
Required uses labels; preferred uses taints
Required is a hard constraint the scheduler must satisfy; preferred is a soft hint the scheduler tries but may ignore (Correct answer)

Correct answer: Required is a hard constraint the scheduler must satisfy; preferred is a soft hint the scheduler tries but may ignore

Required affinity rules are mandatory — the Pod will not be scheduled if no node matches — while preferred rules express a preference the scheduler tries to honor but can skip.

Question 35: What is the relationship between a Deployment and a ReplicaSet in Kubernetes?

A Deployment replaces ReplicaSets entirely
They are identical objects with different names
A ReplicaSet manages multiple Deployments
A Deployment creates and manages ReplicaSets to achieve rolling updates and rollbacks (Correct answer)

Correct answer: A Deployment creates and manages ReplicaSets to achieve rolling updates and rollbacks

A Deployment manages one or more ReplicaSets and coordinates rolling updates by creating a new ReplicaSet and scaling it up while scaling down the old one.

Question 36: Which simulator is often recommended as a paid resource that closely mimics the real CKA exam environment?

killer.sh CKA simulator (Correct answer)
AWS Skill Builder
Udemy practice tests (multiple choice)
Linux Foundation's free sandbox

Correct answer: killer.sh CKA simulator

killer.sh provides a browser-based terminal environment nearly identical to the real PSI exam interface and is bundled free with exam registration.

Question 37: What command shows CPU and memory usage of nodes in Kubernetes?

kubectl get nodes
kubectl describe nodes
kubectl top nodes (Correct answer)
kubectl status nodes

Correct answer: kubectl top nodes

kubectl top nodes displays real-time CPU and memory usage metrics for all nodes in the cluster, requiring metrics-server to be installed.

Question 38: What is a Pod in Kubernetes?

A network switch
The smallest deployable unit that can contain one or more containers (Correct answer)
A database table
A physical server

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 39: What is multi-factor authentication (MFA)?

Requiring two or more verification methods to confirm identity (Correct answer)
Using multiple passwords
Logging in from multiple devices
Having multiple accounts

Correct answer: Requiring two or more verification methods to confirm identity

MFA combines two or more authentication factors (something you know, have, or are) for stronger identity verification.

Question 40: How do you roll back a Deployment to its previous revision in Kubernetes?

kubectl rollout undo deployment/<name> (Correct answer)
kubectl delete deployment <name>
kubectl scale deployment/<name> --replicas=0
kubectl revert deployment/<name>

Correct answer: kubectl rollout undo deployment/<name>

The `kubectl rollout undo deployment/<name>` command reverts the Deployment to its previous revision by scaling up the old ReplicaSet.

Question 41: What is an Ingress in Kubernetes?

A storage solution
A monitoring tool
A type of Pod
An API object that manages external access to services, typically HTTP (Correct answer)

Correct answer: An API object that manages external access to services, typically HTTP

Ingress defines rules for routing external HTTP/HTTPS traffic to internal services, providing features like SSL termination, path-based routing, and virtual hosting.

Question 42: You need a temporary interactive debug pod to troubleshoot network connectivity in the cluster. Which command is most appropriate?

kubectl run debug --image=busybox --restart=Never --rm -it -- /bin/sh (Correct answer)
kubectl create debug --image=busybox -it
kubectl exec debug -- /bin/sh
kubectl apply -f debug-pod.yaml --interactive

Correct answer: kubectl run debug --image=busybox --restart=Never --rm -it -- /bin/sh

kubectl run with --restart=Never --rm -it creates a temporary interactive pod that is automatically deleted when you exit the shell.

Question 43: Which workload type provides stable network identities and ordered, graceful deployment for stateful applications?

ReplicaSet
Deployment
StatefulSet (Correct answer)
DaemonSet

Correct answer: StatefulSet

A StatefulSet gives each Pod a persistent, stable hostname and ordinal index, and manages ordered startup and shutdown for stateful apps like databases.

Question 44: What happens to a PersistentVolume when its reclaim policy is set to 'Retain' and the PVC is deleted?

The PV is immediately available for new claims
The PV remains and must be manually reclaimed by an admin (Correct answer)
The PV is wiped and re-provisioned
The PV is automatically deleted

Correct answer: The PV remains and must be manually reclaimed by an admin

With the Retain policy, the PV is not deleted and holds the data until an administrator manually reclaims or deletes it.

Question 45: Which command shows the rollout history of a Kubernetes Deployment?

kubectl describe deployment/<name>
kubectl rollout history deployment/<name> (Correct answer)
kubectl log deployment/<name>
kubectl get events --field-selector=involvedObject.kind=Deployment

Correct answer: kubectl rollout history deployment/<name>

The `kubectl rollout history deployment/<name>` command lists previous revisions of the Deployment along with their change causes.

Question 46: What are the four required fields in a Kubernetes manifest?

version, resource, labels, ports
image, container, volume, network
name, type, data, config
apiVersion, kind, metadata, spec (Correct answer)

Correct answer: apiVersion, kind, metadata, spec

Every Kubernetes manifest requires apiVersion (API group), kind (resource type), metadata (name and labels), and spec (desired state).

Question 47: What is a Persistent Volume (PV)?

A type of ConfigMap
A storage resource in the cluster provisioned independently of Pod lifecycle (Correct answer)
Temporary container storage
A network drive

Correct answer: A storage resource in the cluster provisioned independently of Pod lifecycle

PVs are storage resources that exist beyond Pod lifecycle, ensuring data persistence even when Pods are destroyed and recreated.

Question 48: What is a firewall?

A fire-resistant building component
A security device that monitors and controls network traffic based on rules (Correct answer)
An antivirus program
A password manager

Correct answer: A security device that monitors and controls network traffic based on rules

Firewalls filter incoming and outgoing network traffic based on security rules, creating a barrier between trusted and untrusted networks.

Question 49: Which certification is considered the logical next step after earning the CKA for engineers who want to specialize in application deployment?

LPIC-1
AWS Solutions Architect
CKAD (Certified Kubernetes Application Developer) (Correct answer)
CKS (Certified Kubernetes Security Specialist)

Correct answer: CKAD (Certified Kubernetes Application Developer)

The CKAD focuses on developing and deploying applications on Kubernetes, complementing the infrastructure focus of the CKA.

Question 50: What is Pod Security context used for?

Scheduling Pod placement
Defining privilege and access control settings for Pods and containers (Correct answer)
Logging Pod events
Monitoring Pod performance

Correct answer: Defining privilege and access control settings for Pods and containers

Security context defines security settings like user IDs, group IDs, capabilities, and read-only filesystems for Pods and their containers.

Question 51: What does a PersistentVolumeClaim (PVC) do in Kubernetes?

Requests a specific amount and type of storage from the cluster (Correct answer)
Defines a storage class for dynamic provisioning
Mounts a volume directly into a node
Creates a new PersistentVolume automatically

Correct answer: Requests a specific amount and type of storage from the cluster

A PVC is a user's request for storage, specifying size and access mode, which the cluster fulfills by binding to a matching PV.

Question 52: What is a Kubernetes label?

A type of container
A key-value pair attached to resources for identification and selection (Correct answer)
A network policy
A storage class

Correct answer: A key-value pair attached to resources for identification and selection

Labels are key-value pairs attached to Kubernetes objects that can be used to organize, select, and filter resources.

Question 53: What is a zero-day vulnerability?

A low-risk security issue
A security flaw unknown to the vendor with no available patch (Correct answer)
An outdated software version
A vulnerability that was fixed immediately

Correct answer: A security flaw unknown to the vendor with no available patch

Zero-day vulnerabilities are newly discovered security flaws that the vendor doesn't know about yet, giving them 'zero days' to fix it before potential exploitation.

Question 54: What is DNS resolution used for in Kubernetes?

To register domain names
To monitor services
To resolve Service names to IP addresses within the cluster (Correct answer)
To encrypt traffic

Correct answer: To resolve Service names to IP addresses within the cluster

Kubernetes provides internal DNS that automatically resolves Service names to their ClusterIP addresses, enabling Pods to communicate using names instead of IPs.

Question 55: What is the CIA triad in information security?

Cybersecurity Infrastructure Act
Certified Information Auditor
Confidentiality, Integrity, Availability (Correct answer)
Central Intelligence Agency

Correct answer: Confidentiality, Integrity, Availability

The CIA triad represents three core security principles: Confidentiality (keeping data private), Integrity (data accuracy), Availability (systems accessible when needed).

Question 56: Which volume type is used to inject a ConfigMap's data as files into a Pod?

configMap (Correct answer)
projected
downwardAPI
secret

Correct answer: configMap

The configMap volume type allows individual keys from a ConfigMap to be exposed as files inside the container's filesystem.

Question 57: What is a ConfigMap?

A routing table
An object storing non-confidential configuration data as key-value pairs (Correct answer)
A password vault
A log file

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 58: What is the difference between ClusterIP and NodePort services?

ClusterIP is internal only; NodePort exposes the service on each node's IP (Correct answer)
ClusterIP uses external load balancers
They are the same
NodePort is internal only

Correct answer: ClusterIP is internal only; NodePort exposes the service on each node's IP

ClusterIP services are only accessible within the cluster, while NodePort services expose a port on every node's IP address, making the service accessible externally.

Question 59: What is the primary reason CKA candidates are advised to practice with vim or nano before the exam?

The exam blocks all other editors
YAML manifests must be written and edited in a terminal text editor during the performance-based exam (Correct answer)
The exam grading script only reads vim files
vim is required for etcd operations

Correct answer: YAML manifests must be written and edited in a terminal text editor during the performance-based exam

Since the CKA is entirely terminal-based, candidates must edit YAML files using a terminal text editor like vim or nano.

Question 60: What format are Kubernetes manifest files typically written in?

YAML (Correct answer)
CSV
XML
HTML

Correct answer: YAML

Kubernetes uses YAML (YAML Ain't Markup Language) for manifest files that define resources like Pods, Services, and Deployments.

Certified Kubernetes Administrator (CKA)

The CKA certification validates that candidates have the skills, knowledge, and competency to perform the responsibilities of a Kubernetes administrator. The exam tests cluster architecture, networking, storage, workload management, and troubleshooting in a live Kubernetes environment.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

docs.linuxfoundation.org — Exam format, test delivery, passing score, renewal, retake policy, score release, score validity, exam information · verified Oct 2026
training.linuxfoundation.org — Eligibility, fees, test dates, time limit · verified Oct 2026