Practice Test Geeks(CKA) Certified Kubernetes Associate Practice Test
← All CKA Flashcard Decks

Credential Overview Flashcards

7 cards from real CKA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Credential Overview flashcards as text

  1. Which Kubernetes API group handles CertificateSigningRequest resources?

    Answer: certificates.k8s.io

    CertificateSigningRequest resources belong to the certificates.k8s.io API group.

  2. When using OIDC authentication in Kubernetes, which token field contains the user's identity?

    Answer: id_token

    The id_token issued by an OIDC provider contains the user's identity claims and is presented to the Kubernetes API server.

  3. What is the purpose of the --client-ca-file flag on the kube-apiserver?

    Answer: Specifies the CA used to verify client certificates presented during authentication

    The --client-ca-file flag tells the API server which CA to use when validating X.509 client certificates for mutual TLS authentication.

  4. Which subresource must be approved on a CertificateSigningRequest to issue the certificate?

    Answer: certificatesigningrequests/approval

    To approve a CSR, an approver must update the certificatesigningrequests/approval subresource, which triggers the signer to issue the certificate.

  5. A ServiceAccount named 'app-sa' in namespace 'prod' is referenced in a pod spec. Which Secret naming convention did older Kubernetes versions use for its auto-generated token?

    Answer: app-sa-token-

    Kubernetes historically auto-created a Secret named -token- and mounted it into pods automatically.

  6. Which field in a kubeconfig user entry stores a base64-encoded client certificate?

    Answer: client-certificate-data

    The client-certificate-data field holds the base64-encoded PEM client certificate for X.509 user authentication.

  7. What is the minimum RBAC permission needed for a user to view their own CertificateSigningRequests?

    Answer: get on certificatesigningrequests cluster-scoped resource

    CertificateSigningRequest is a cluster-scoped resource; a user needs get permission on certificatesigningrequests at the cluster level to view them.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. docs.linuxfoundation.org — Exam format, test delivery, passing score, renewal, retake policy, score release, score validity, exam information · verified Oct 2026
  2. training.linuxfoundation.org — Eligibility, fees, test dates, time limit · verified Oct 2026