Mixed Deck — All CKA Topics Flashcards

Which kubeadm command is used to initialize a new Kubernetes control plane node?

Answer: kubeadm init

`kubeadm init` bootstraps a new control plane and is a core task covered in the CKA cluster installation domain.

What is the minimum RBAC permission needed for a user to view their own CertificateSigningRequests?

Answer: get on certificatesigningrequests cluster-scoped resource

CertificateSigningRequest is a cluster-scoped resource; a user needs get permission on certificatesigningrequests at the cluster level to view them.

What does a Pod's 'nodeSelector' field do in Kubernetes scheduling?

Answer: Constrains the Pod to run only on nodes with matching key-value labels

nodeSelector is the simplest node selection constraint; it restricts Pod scheduling to nodes whose labels include all specified key-value pairs.

Which volume type is used to inject a ConfigMap's data as files into a Pod?

Answer: configMap

The configMap volume type allows individual keys from a ConfigMap to be exposed as files inside the container's filesystem.

Which subresource must be approved on a CertificateSigningRequest to issue the certificate?

Answer: certificatesigningrequests/approval

To approve a CSR, an approver must update the certificatesigningrequests/approval subresource, which triggers the signer to issue the certificate.

What is the recommended minimum number of hours of hands-on kubectl practice before attempting the CKA exam?

Answer: 100+ hours

Most successful candidates report 100+ hours of hands-on practice because the CKA is entirely performance-based.

Which Kubernetes API group handles CertificateSigningRequest resources?

Answer: certificates.k8s.io

CertificateSigningRequest resources belong to the certificates.k8s.io API group.

Which command shows the rollout history of a Kubernetes Deployment?

Answer: kubectl rollout history deployment/

The `kubectl rollout history deployment/` command lists previous revisions of the Deployment along with their change causes.

What is the purpose of the --client-ca-file flag on the kube-apiserver?

Answer: Specifies the CA used to verify client certificates presented during authentication

The --client-ca-file flag tells the API server which CA to use when validating X.509 client certificates for mutual TLS authentication.

When using OIDC authentication in Kubernetes, which token field contains the user's identity?

Answer: id_token

The id_token issued by an OIDC provider contains the user's identity claims and is presented to the Kubernetes API server.

What is the primary use case for a DaemonSet in Kubernetes?

Answer: Ensuring exactly one copy of a Pod runs on every (or selected) node

A DaemonSet guarantees that a Pod replica runs on each eligible node, making it ideal for node-level agents like log collectors or monitoring daemons.

What command shows CPU and memory usage of nodes in Kubernetes?

Answer: kubectl top nodes

kubectl top nodes displays real-time CPU and memory usage metrics for all nodes in the cluster, requiring metrics-server to be installed.

Who is the target audience for the Certified Kubernetes Associate (CKA) certification?

Answer: Professionals new to Kubernetes or seeking foundational understanding.

The CKA certification is primarily aimed at professionals who are new to Kubernetes or those seeking to solidify their foundational understanding of the platform. It provides a benchmark for individuals to demonstrate their ability to perform basic Kubernetes tasks. While beneficial for various roles, it's particularly suited for those starting their cloud-native journey.

What does the signerName field in a CertificateSigningRequest specify?

Answer: The CA authority that will sign the certificate

The signerName field identifies which signer (e.g., kubernetes.io/kube-apiserver-client) will issue the certificate after approval.

Which hands-on platform is most commonly recommended for CKA exam practice due to its browser-based Kubernetes terminal environment?

Answer: Katacoda (O'Reilly Labs)

Katacoda (now hosted via O'Reilly Labs) provides free browser-based Kubernetes scenarios widely recommended for CKA practice.

What is the typical cost of the Certified Kubernetes Associate (CKA) exam?

Answer: $300.

The typical cost for the Certified Kubernetes Associate (CKA) exam is $300 USD. This fee covers the exam attempt and often includes a free retake if the initial attempt is unsuccessful, though policies can vary. It's important to check the official Linux Foundation website for the most current pricing and any available bundles or discounts.

What does the abbreviation 'imperative command' mean in the context of CKA exam strategy?

Answer: kubectl commands that create resources directly without YAML files

Imperative commands like `kubectl create deployment` create resources instantly, saving precious time compared to writing YAML.

What does the 'CrashLoopBackOff' status indicate for a pod?

Answer: The pod's container repeatedly crashes and Kubernetes is backing off restart attempts

CrashLoopBackOff means the container starts, crashes, and Kubernetes keeps restarting it with increasing exponential delays.

How should you manage time during a timed test?

Answer: Divide total time by questions and pace yourself, spending less on easy ones

Calculate time per question, spend less on easy questions to bank time for harder ones, and check your pace periodically.

Which reclaim policy in a StorageClass automatically deletes the underlying storage when a PVC is deleted?

Answer: Delete

The Delete reclaim policy causes the associated storage asset (e.g., an EBS volume) to be deleted when its PVC is removed.