Certified Kubernetes Administrator (CKA) — Questions and Answers

Question 1: What Kubernetes object should you use to run a task that executes to completion and then stops?

Job (Correct answer)
StatefulSet
CronJob
Deployment

Correct answer: Job

A Job creates one or more Pods to run a task to completion, tracks successes, and stops creating new Pods once the desired completions are reached.

Question 2: What is a container image?

A configuration file
A read-only template containing the application and its dependencies (Correct answer)
A running instance of an application
A virtual machine snapshot

Correct answer: A read-only template containing the application and its dependencies

A container image is a lightweight, read-only template that includes everything needed to run an application: code, runtime, libraries, and settings.

Question 3: What does the kubectl command 'kubectl cordon <node>' do?

Marks the node as unschedulable so no new Pods are placed on it (Correct answer)
Deletes the node from the cluster
Drains all Pods from the node and removes it
Applies a NoExecute taint to the node

Correct answer: Marks the node as unschedulable so no new Pods are placed on it

kubectl cordon marks a node as unschedulable, preventing new Pods from being scheduled on it, but does not evict existing Pods.

Question 4: A practice test reveals a candidate struggles with PersistentVolume binding. Which study scenario best addresses this gap?

Memorizing storage class names
Practicing etcd snapshots instead
Reading the PV concept page once
Manually creating a PV, PVC, and Pod that mounts the volume, then verifying the binding lifecycle end-to-end (Correct answer)

Correct answer: Manually creating a PV, PVC, and Pod that mounts the volume, then verifying the binding lifecycle end-to-end

Walking through the full PV→PVC→Pod lifecycle hands-on reveals how access modes, storage classes, and capacity affect binding.

Question 5: What is the most effective study technique according to research?

Listening to music while studying
Re-reading notes multiple times
Highlighting text
Active recall with spaced repetition (Correct answer)

Correct answer: Active recall with spaced repetition

Active recall (testing yourself) combined with spaced repetition (reviewing at intervals) is the most effective study method per cognitive science research.

Question 6: What is a Pod in Kubernetes?

A physical server
A database table
A network switch
The smallest deployable unit that can contain one or more containers (Correct answer)

Correct answer: The smallest deployable unit that can contain one or more containers

A Pod is Kubernetes' atomic deployment unit, wrapping one or more containers that share storage, networking, and a specification for how to run.

Question 7: What is a ConfigMap?

An object storing non-confidential configuration data as key-value pairs (Correct answer)
A password vault
A log file
A routing table

Correct answer: An object storing non-confidential configuration data as key-value pairs

ConfigMaps store configuration data separately from application code, allowing configuration changes without rebuilding container images.

Question 8: What is phishing?

A network scanning tool
A type of firewall
A backup system
A social engineering attack using fraudulent communications to steal sensitive data (Correct answer)

Correct answer: A social engineering attack using fraudulent communications to steal sensitive data

Phishing uses deceptive emails, websites, or messages that appear legitimate to trick victims into revealing passwords, credit cards, or personal information.

Question 9: Which command shows the rollout history of a Kubernetes Deployment?

kubectl rollout history deployment/<name> (Correct answer)
kubectl log deployment/<name>
kubectl get events --field-selector=involvedObject.kind=Deployment
kubectl describe deployment/<name>

Correct answer: kubectl rollout history deployment/<name>

The `kubectl rollout history deployment/<name>` command lists previous revisions of the Deployment along with their change causes.

Question 10: What format are Kubernetes manifest files typically written in?

CSV
YAML (Correct answer)
HTML
XML

Correct answer: YAML

Kubernetes uses YAML (YAML Ain't Markup Language) for manifest files that define resources like Pods, Services, and Deployments.

Question 11: What is a Kubernetes label?

A network policy
A storage class
A key-value pair attached to resources for identification and selection (Correct answer)
A type of container

Correct answer: A key-value pair attached to resources for identification and selection

Labels are key-value pairs attached to Kubernetes objects that can be used to organize, select, and filter resources.

Question 12: What is the purpose of resource limits in a Pod spec?

To restrict network access
To limit the number of Pods
To cap the maximum CPU and memory a container can use (Correct answer)
To set disk quotas

Correct answer: To cap the maximum CPU and memory a container can use

Resource limits define the maximum amount of CPU and memory a container can consume, preventing any single container from monopolizing cluster resources.

Question 13: What command shows resource usage of Pods?

kubectl top pods (Correct answer)
kubectl exec
kubectl get pods
kubectl logs

Correct answer: kubectl top pods

kubectl top pods displays CPU and memory consumption for each Pod, helping identify resource-hungry workloads.

Question 14: What is one of the key benefits of holding a Certified Kubernetes Associate (CKA) certification for career advancement?

It helps in gaining credibility and recognition within the Kubernetes and cloud-native ecosystem. (Correct answer)
It makes you a Kubernetes expert immediately after certification.
It focuses only on security-related Kubernetes practices.
The certification only allows for entry-level positions.

Correct answer: It helps in gaining credibility and recognition within the Kubernetes and cloud-native ecosystem.

A key benefit of holding a CKA certification for career advancement is gaining credibility and recognition within the Kubernetes and broader cloud-native ecosystem. It signals to peers and employers that you have a verified skill set in a critical and in-demand technology. This recognition can lead to more opportunities, promotions, and a stronger professional network.

Question 15: What port does Kubernetes API server listen on by default?

8080
80
6443 (Correct answer)
443

Correct answer: 6443

The Kubernetes API server listens on port 6443 by default for secure HTTPS communication.

Question 16: What does 'kubectl apply -f' do?

Lists all resources
Deletes resources
Creates or updates resources defined in a file (Correct answer)
Describes a resource

Correct answer: Creates or updates resources defined in a file

kubectl apply -f applies the configuration from a YAML file, creating the resource if it doesn't exist or updating it if it does.

Question 17: How should you manage time during a timed test?

Divide total time by questions and pace yourself, spending less on easy ones (Correct answer)
Rush through the entire test
Spend equal time on every question
Only work on hard questions

Correct answer: Divide total time by questions and pace yourself, spending less on easy ones

Calculate time per question, spend less on easy questions to bank time for harder ones, and check your pace periodically.

Question 18: What command shows CPU and memory usage of nodes in Kubernetes?

kubectl status nodes
kubectl describe nodes
kubectl get nodes
kubectl top nodes (Correct answer)

Correct answer: kubectl top nodes

kubectl top nodes displays real-time CPU and memory usage metrics for all nodes in the cluster, requiring metrics-server to be installed.

Question 19: Which volume type is used to inject a ConfigMap's data as files into a Pod?

projected
downwardAPI
configMap (Correct answer)
secret

Correct answer: configMap

The configMap volume type allows individual keys from a ConfigMap to be exposed as files inside the container's filesystem.

Question 20: What is encryption?

Converting data into coded format to prevent unauthorized access (Correct answer)
Compressing files
Deleting data
Backing up data

Correct answer: Converting data into coded format to prevent unauthorized access

Encryption transforms readable data into unreadable ciphertext using algorithms and keys, ensuring only authorized parties can access the information.

Question 21: Which field in a PVC spec specifies the minimum storage size required?

spec.size
resources.requests.storage (Correct answer)
capacity.storage
limits.storage

Correct answer: resources.requests.storage

The `resources.requests.storage` field in a PVC spec indicates the amount of storage the claim is requesting.

Question 22: What is DNS resolution used for in Kubernetes?

To register domain names
To monitor services
To encrypt traffic
To resolve Service names to IP addresses within the cluster (Correct answer)

Correct answer: To resolve Service names to IP addresses within the cluster

Kubernetes provides internal DNS that automatically resolves Service names to their ClusterIP addresses, enabling Pods to communicate using names instead of IPs.

Question 23: What is an Ingress in Kubernetes?

A monitoring tool
A storage solution
A type of Pod
An API object that manages external access to services, typically HTTP (Correct answer)

Correct answer: An API object that manages external access to services, typically HTTP

Ingress defines rules for routing external HTTP/HTTPS traffic to internal services, providing features like SSL termination, path-based routing, and virtual hosting.

Question 24: Which exam time management strategy is most recommended for the CKA's 2-hour format?

Answer every question in order, spending as much time as needed on each
Spend the first hour only reading all questions
Flag difficult questions, complete easier ones first, then return to flagged items (Correct answer)
Focus all time on the highest-weighted domain questions

Correct answer: Flag difficult questions, complete easier ones first, then return to flagged items

Skipping and flagging hard questions ensures you capture all easier points before spending extra time on complex tasks.

Question 25: A user authenticates via OIDC but the API server rejects the token with 'token not yet valid'. What is the most likely cause?

The --oidc-client-id flag does not match the token's audience
The OIDC provider's TLS certificate is expired
The API server and OIDC provider clocks are out of sync (Correct answer)
The user's group membership is missing from the token

Correct answer: The API server and OIDC provider clocks are out of sync

OIDC token validation is time-sensitive; clock skew between the API server and OIDC provider causes 'not yet valid' (nbf claim) rejections.

Question 26: What happens to a Job's completed Pods by default after the Job finishes?

They are restarted automatically
They are deleted immediately
They transition to a Pending state
They remain in Completed state so their logs can be inspected (Correct answer)

Correct answer: They remain in Completed state so their logs can be inspected

Completed Pods from a Job are retained in a Completed state by default, allowing administrators to retrieve logs, until the Job or Pods are manually deleted.

Question 27: What is a Kubernetes namespace?

A network subnet
A virtual cluster partition for organizing resources (Correct answer)
A physical server
A container image

Correct answer: A virtual cluster partition for organizing resources

Namespaces provide virtual cluster partitioning, allowing teams or projects to share a cluster while isolating their resources.

Question 28: What happens to a PersistentVolume when its reclaim policy is set to 'Retain' and the PVC is deleted?

The PV is automatically deleted
The PV remains and must be manually reclaimed by an admin (Correct answer)
The PV is immediately available for new claims
The PV is wiped and re-provisioned

Correct answer: The PV remains and must be manually reclaimed by an admin

With the Retain policy, the PV is not deleted and holds the data until an administrator manually reclaims or deletes it.

Question 29: What is a Kubernetes Service?

A storage volume
A cluster node
A running container
An abstraction providing stable networking for a set of Pods (Correct answer)

Correct answer: An abstraction providing stable networking for a set of Pods

A Service provides a stable IP address and DNS name for accessing a set of Pods, with built-in load balancing regardless of Pod lifecycle changes.

Question 30: What does 'kubectl get pods' show?

A list of all Pods and their status in the current namespace (Correct answer)
User accounts
Server hardware info
Network configuration

Correct answer: A list of all Pods and their status in the current namespace

This command displays all Pods in the current namespace with their name, ready status, current state, restarts, and age.

Question 31: How do you roll back a Deployment to its previous revision in Kubernetes?

kubectl delete deployment <name>
kubectl scale deployment/<name> --replicas=0
kubectl revert deployment/<name>
kubectl rollout undo deployment/<name> (Correct answer)

Correct answer: kubectl rollout undo deployment/<name>

The `kubectl rollout undo deployment/<name>` command reverts the Deployment to its previous revision by scaling up the old ReplicaSet.

Certified Kubernetes Administrator (CKA)

The CKA certification validates that candidates have the skills, knowledge, and competency to perform the responsibilities of a Kubernetes administrator. The exam tests cluster architecture, networking, storage, workload management, and troubleshooting in a live Kubernetes environment.

Questions

35 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

docs.linuxfoundation.org — Exam format, test delivery, passing score, renewal, retake policy, score release, score validity, exam information · verified Oct 2026
training.linuxfoundation.org — Eligibility, fees, test dates, time limit · verified Oct 2026