Practice Test Geeks(CKA) Certified Kubernetes Associate Practice Test
← All CKA Flashcard Decks

Credential Overview Flashcards

7 cards from real CKA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Credential Overview flashcards as text

  1. What is the function of bootstrap tokens in Kubernetes?

    Answer: They are used to authenticate nodes during the cluster join process

    Bootstrap tokens are short-lived credentials used by new nodes to authenticate to the API server during the kubeadm join process.

  2. Where are bootstrap token Secrets stored in a Kubernetes cluster?

    Answer: In the kube-system namespace

    Bootstrap token Secrets are stored in the kube-system namespace with the naming pattern bootstrap-token-.

  3. Which field in the Kubernetes API server configuration enables the Node Authorizer for kubelet credentials?

    Answer: --authorization-mode=Node

    Adding Node to --authorization-mode enables the Node authorizer, which grants kubelets permission to access only the resources related to their own node.

  4. What credential does a kubelet use to authenticate to the Kubernetes API server?

    Answer: An X.509 client certificate with CN=system:node:

    Kubelets authenticate using an X.509 client certificate where the CN is system:node: and the Organization is system:nodes.

  5. Which kubectl flag merges an additional kubeconfig file with the default ~/.kube/config for a single command?

    Answer: --kubeconfig

    The --kubeconfig flag specifies an alternate or additional kubeconfig file; setting KUBECONFIG env var to a colon-separated list merges multiple files.

  6. A user authenticates via OIDC but the API server rejects the token with 'token not yet valid'. What is the most likely cause?

    Answer: The API server and OIDC provider clocks are out of sync

    OIDC token validation is time-sensitive; clock skew between the API server and OIDC provider causes 'not yet valid' (nbf claim) rejections.

  7. Which Kubernetes object allows a cluster administrator to delegate the ability to approve CertificateSigningRequests to another user?

    Answer: A ClusterRole with approve verb on certificatesigningrequests/approval

    A ClusterRole granting the approve verb on the certificatesigningrequests/approval subresource allows the bound user to approve CSRs cluster-wide.

How this page was made: written with AI tools and published by Nathan Beja, founder of Practice Test Geeks, who is responsible for its content. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

  1. docs.linuxfoundation.org — Exam format, test delivery, passing score, renewal, retake policy, score release, score validity, exam information · verified Oct 2026
  2. training.linuxfoundation.org — Eligibility, fees, test dates, time limit · verified Oct 2026