Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: Which YAML structure correctly defines a Kubernetes Service that exposes port 80 externally and targets port 8080 on pods?

ports: [{externalPort: 80, containerPort: 8080}]
ports: [{exposed: 80, internal: 8080}]
ports: [{port: 80, nodePort: 8080}]
ports: [{port: 80, targetPort: 8080}] (Correct answer)

Correct answer: ports: [{port: 80, targetPort: 8080}]

A Service spec uses `port` for the Service's exposed port and `targetPort` for the container port it forwards traffic to.

Question 2: What is a LoadBalancer service type?

A monitoring service
A service running on a single Pod
An internal-only service
A service that provisions an external load balancer in cloud environments (Correct answer)

Correct answer: A service that provisions an external load balancer in cloud environments

LoadBalancer service type automatically provisions a cloud provider's load balancer, providing an external IP address for accessing the service from outside the cluster.

Question 3: What does a non-zero exit code from a container's main process indicate to Kubernetes?

The container exceeded its resource limits
The container is paused and waiting for input
The container is healthy and completed successfully
The container exited with an error, potentially triggering a restart (Correct answer)

Correct answer: The container exited with an error, potentially triggering a restart

A non-zero exit code signals failure; depending on the pod's restartPolicy, Kubernetes may restart the container to recover from the error.

Question 4: Which YAML field on a PersistentVolumeClaim defines the storage class to use?

metadata.storageClass
spec.storageClass
spec.class
spec.storageClassName (Correct answer)

Correct answer: spec.storageClassName

The `spec.storageClassName` field on a PVC references a StorageClass object that determines the provisioner and volume parameters.

Question 5: In a Linkerd service mesh, what is the equivalent of Istio's Envoy sidecar proxy?

HAProxy
Envoy with Linkerd configuration
linkerd-proxy (written in Rust) (Correct answer)
NGINX reverse proxy

Correct answer: linkerd-proxy (written in Rust)

Linkerd uses its own ultra-lightweight proxy called linkerd-proxy, written in Rust for low latency and minimal resource usage.

Question 6: Which cAdvisor metric tracks the cumulative number of times a container has been throttled due to CPU limits?

container_cpu_blocked_seconds_total
container_cpu_throttle_count_total
container_cpu_limit_exceeded_total
container_cpu_cfs_throttled_periods_total (Correct answer)

Correct answer: container_cpu_cfs_throttled_periods_total

The container_cpu_cfs_throttled_periods_total metric counts the total number of CFS scheduling periods during which the container was CPU-throttled.

Question 7: Which command verifies that Istio's mTLS is actively enforced between two services in the mesh?

istioctl proxy-status
istioctl authn tls-check <pod> <service> (Correct answer)
kubectl logs <istiod-pod> -n istio-system
kubectl describe peerauthentication

Correct answer: istioctl authn tls-check <pod> <service>

The 'istioctl authn tls-check' command shows the effective mTLS policy and whether the connection between a pod and a service is using mTLS.

Question 8: What is phishing?

A network scanning tool
A type of firewall
A social engineering attack using fraudulent communications to steal sensitive data (Correct answer)
A backup system

Correct answer: A social engineering attack using fraudulent communications to steal sensitive data

Phishing uses deceptive emails, websites, or messages that appear legitimate to trick victims into revealing passwords, credit cards, or personal information.

Question 9: What is a zero-day vulnerability?

A vulnerability that was fixed immediately
A security flaw unknown to the vendor with no available patch (Correct answer)
A low-risk security issue
An outdated software version

Correct answer: A security flaw unknown to the vendor with no available patch

Zero-day vulnerabilities are newly discovered security flaws that the vendor doesn't know about yet, giving them 'zero days' to fix it before potential exploitation.

Question 10: In a PodDisruptionBudget YAML, what does `spec.minAvailable: '50%'` mean?

Exactly 50% of pods are replaced during each rolling update
50% of pods are required to be in a Ready state at cluster start
At least 50% of pods must remain available during voluntary disruptions (Correct answer)
At most 50% of pods can be voluntarily disrupted at one time

Correct answer: At least 50% of pods must remain available during voluntary disruptions

`minAvailable: '50%'` ensures that voluntary disruptions (such as node drains) never reduce available pods below 50% of the desired count.

Question 11: Which Kubernetes API group handles CertificateSigningRequest resources?

policy.k8s.io
certificates.k8s.io (Correct answer)
auth.k8s.io
security.k8s.io

Correct answer: certificates.k8s.io

CertificateSigningRequest resources belong to the certificates.k8s.io API group.

Question 12: A user authenticates via OIDC but the API server rejects the token with 'token not yet valid'. What is the most likely cause?

The --oidc-client-id flag does not match the token's audience
The API server and OIDC provider clocks are out of sync (Correct answer)
The OIDC provider's TLS certificate is expired
The user's group membership is missing from the token

Correct answer: The API server and OIDC provider clocks are out of sync

OIDC token validation is time-sensitive; clock skew between the API server and OIDC provider causes 'not yet valid' (nbf claim) rejections.

Question 13: Which Istio resource is used to define end-user (JWT) authentication policies?

AuthorizationPolicy
DestinationRule
RequestAuthentication (Correct answer)
PeerAuthentication

Correct answer: RequestAuthentication

RequestAuthentication defines what JWT issuers are trusted, validating end-user tokens presented in HTTP requests.

Question 14: What does a PersistentVolumeClaim (PVC) do in Kubernetes?

Requests a specific amount and type of storage from the cluster (Correct answer)
Defines a storage class for dynamic provisioning
Creates a new PersistentVolume automatically
Mounts a volume directly into a node

Correct answer: Requests a specific amount and type of storage from the cluster

A PVC is a user's request for storage, specifying size and access mode, which the cluster fulfills by binding to a matching PV.

Question 15: Which YAML structure correctly defines an init container in a Pod spec?

spec.initContainers[] nested inside spec.containers[]
spec.containers[].init: true
spec.initContainers[] alongside spec.containers[] (Correct answer)
metadata.annotations.initContainer

Correct answer: spec.initContainers[] alongside spec.containers[]

`spec.initContainers[]` is a sibling field to `spec.containers[]`, holding containers that run sequentially before app containers start.

Question 16: Which Kubernetes Secret type is automatically created and mounted into pods for service account authentication?

Opaque
kubernetes.io/basic-auth
kubernetes.io/tls
kubernetes.io/service-account-token (Correct answer)

Correct answer: kubernetes.io/service-account-token

kubernetes.io/service-account-token secrets hold the JWT token used by pods to authenticate to the API server as a service account.

Question 17: What is the purpose of Pod affinity rules in Kubernetes scheduling?

To attract or repel Pods from being co-located with other Pods matching certain labels (Correct answer)
To define CPU and memory resource limits for Pods
To configure network policies between Pods
To force Pods onto specific nodes by name

Correct answer: To attract or repel Pods from being co-located with other Pods matching certain labels

Pod affinity and anti-affinity rules let you control whether Pods should be scheduled near (or away from) other Pods that match a given label selector.

Question 18: What is the effect of setting `--pod-eviction-timeout` on the kube-controller-manager?

Determines how long the node controller waits before evicting Pods from an unresponsive node (Correct answer)
Limits how long a terminated Pod's logs are retained
Sets how long a Pod can be pending before being evicted
Controls the timeout for graceful Pod shutdown

Correct answer: Determines how long the node controller waits before evicting Pods from an unresponsive node

The --pod-eviction-timeout parameter defines how long the node lifecycle controller waits after a Node becomes NotReady before deleting its Pods.

Question 19: In a multi-stage Dockerfile build, what is the primary benefit?

Smaller final image by discarding build-time dependencies (Correct answer)
Faster container startup times
Support for multiple base operating systems
Automatic caching of all build steps

Correct answer: Smaller final image by discarding build-time dependencies

Multi-stage builds allow you to use a full build environment in early stages and copy only the compiled artifacts into a minimal final image, significantly reducing image size.

Question 20: Which Kubernetes component logs should a candidate check first when troubleshooting a node that shows as NotReady?

etcd logs
kube-apiserver logs
kube-scheduler logs
kubelet logs on the affected node (Correct answer)

Correct answer: kubelet logs on the affected node

The kubelet runs on every node and manages pod lifecycle; its logs are the first place to diagnose a NotReady node.

Question 21: What is the purpose of the 'minReadySeconds' field in a Deployment spec?

Specifies how many seconds a new Pod must be ready before it is considered available (Correct answer)
Limits how quickly new Pods can be created during a rollout
Sets the minimum time a container must run before probes start
Defines the grace period for Pod termination

Correct answer: Specifies how many seconds a new Pod must be ready before it is considered available

minReadySeconds defines the minimum time (after a Pod becomes ready) that must elapse before the Pod is counted as available, preventing hasty rollout progression.

Question 22: What does 'kubectl apply -f' do?

Describes a resource
Creates or updates resources defined in a file (Correct answer)
Lists all resources
Deletes resources

Correct answer: Creates or updates resources defined in a file

kubectl apply -f applies the configuration from a YAML file, creating the resource if it doesn't exist or updating it if it does.

Question 23: Which Kubernetes feature allows the scheduler to be replaced or extended without modifying core Kubernetes code?

Node Taints
Admission Webhooks
Custom Resource Definitions
Scheduler Profiles and Extenders (Correct answer)

Correct answer: Scheduler Profiles and Extenders

Scheduler Extenders and Scheduler Profiles let you plug in custom scheduling logic or run multiple scheduler configurations without patching core code.

Question 24: Which field in a StorageClass manifest defines the volume provisioner plugin to use?

provisioner (Correct answer)
spec.plugin
spec.driver
volumeBindingMode

Correct answer: provisioner

The `provisioner` field identifies the plugin (e.g., `kubernetes.io/aws-ebs` or `ebs.csi.aws.com`) responsible for creating volumes.

Question 25: What is the difference between 'requiredDuringSchedulingIgnoredDuringExecution' and 'preferredDuringSchedulingIgnoredDuringExecution' in node affinity?

They are interchangeable aliases
Required is a hard constraint the scheduler must satisfy; preferred is a soft hint the scheduler tries but may ignore (Correct answer)
Required uses labels; preferred uses taints
Required applies at runtime; preferred applies only at scheduling

Correct answer: Required is a hard constraint the scheduler must satisfy; preferred is a soft hint the scheduler tries but may ignore

Required affinity rules are mandatory — the Pod will not be scheduled if no node matches — while preferred rules express a preference the scheduler tries to honor but can skip.

Question 26: Which command shows the rollout history of a Kubernetes Deployment?

kubectl rollout history deployment/<name> (Correct answer)
kubectl describe deployment/<name>
kubectl log deployment/<name>
kubectl get events --field-selector=involvedObject.kind=Deployment

Correct answer: kubectl rollout history deployment/<name>

The `kubectl rollout history deployment/<name>` command lists previous revisions of the Deployment along with their change causes.

Question 27: Which component is responsible for issuing certificates to kubelets in a Kubernetes cluster?

kube-controller-manager (Correct answer)
CoreDNS
etcd
kube-proxy

Correct answer: kube-controller-manager

The kube-controller-manager runs the Certificate Signing Request (CSR) controller that approves and issues certificates to kubelets via the certificates.k8s.io API.

Question 28: Which Kubernetes component is the ONLY one that should communicate directly with etcd?

kubelet
kube-scheduler
kube-controller-manager
kube-apiserver (Correct answer)

Correct answer: kube-apiserver

Only the kube-apiserver reads from and writes to etcd; all other components interact with cluster state through the API server.

Question 29: Which Kubernetes object represents a piece of storage provisioned by an administrator in the cluster?

PersistentVolume (Correct answer)
ConfigMap
PersistentVolumeClaim
StorageClass

Correct answer: PersistentVolume

A PersistentVolume (PV) is a cluster-level storage resource provisioned by an admin or dynamically via a StorageClass.

Question 30: What field in a Job spec controls the maximum number of times a failed Pod will be retried before the Job is marked as failed?

spec.activeDeadlineSeconds
spec.completions
spec.parallelism
spec.backoffLimit (Correct answer)

Correct answer: spec.backoffLimit

The `backoffLimit` field sets the number of retries before a Job is declared failed, with an exponential back-off between each retry.

Question 31: How many different Kubernetes clusters may a candidate work across during a single CKA exam session?

10 clusters
2 clusters
Up to 6 clusters (Correct answer)
1 cluster

Correct answer: Up to 6 clusters

The CKA exam environment can include up to 6 distinct clusters, each preconfigured for specific task scenarios.

Certified Kubernetes Administrator (CKA)

The CKA certification validates that candidates have the skills, knowledge, and competency to perform the responsibilities of a Kubernetes administrator. The exam tests cluster architecture, networking, storage, workload management, and troubleshooting in a live Kubernetes environment.

Questions

35 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds