CKA Cluster Architecture, Installation, and Configuration 2 — Questions and Answers
Question 1: Which kubeadm command is used to generate a new bootstrap token for joining worker nodes?
- kubeadm token create (Correct answer)
- kubeadm join --generate-token
- kubeadm init --token-ttl
- kubeadm bootstrap token
Correct answer: kubeadm token create
kubeadm token create generates a new bootstrap token that can be used with kubeadm join to add nodes to the cluster.
Question 2: What is the default port that the kube-apiserver listens on for HTTPS traffic?
- 8080
- 6443 (Correct answer)
- 2379
- 10250
Correct answer: 6443
The kube-apiserver listens on port 6443 by default for secure HTTPS client connections.
Question 3: Which component is responsible for persisting Kubernetes cluster state?
- kube-scheduler
- kube-controller-manager
- etcd (Correct answer)
- kube-apiserver
Correct answer: etcd
etcd is the distributed key-value store that persists all Kubernetes cluster state and configuration data.
Question 4: In a kubeadm-bootstrapped cluster, where are the static Pod manifests for control plane components located?
- /etc/kubernetes/manifests (Correct answer)
- /var/lib/kubelet/manifests
- /etc/kubernetes/config
- /opt/kubernetes/manifests
Correct answer: /etc/kubernetes/manifests
kubeadm places control plane static Pod manifests in /etc/kubernetes/manifests, which the kubelet watches to start those Pods.
Question 5: What flag in kubeadm init allows you to specify the pod network CIDR?
- --service-cidr
- --pod-network-cidr (Correct answer)
- --cluster-cidr
- --network-range
Correct answer: --pod-network-cidr
The --pod-network-cidr flag tells kubeadm the IP address range to allocate for pod networking, which is then passed to the CNI plugin.
Question 6: Which Kubernetes object defines the permissions granted by a ClusterRole to a set of users across all namespaces?
- RoleBinding
- ClusterRoleBinding (Correct answer)
- ServiceAccount
- NetworkPolicy
Correct answer: ClusterRoleBinding
A ClusterRoleBinding grants the permissions defined in a ClusterRole to subjects cluster-wide, not limited to a single namespace.
Question 7: What is the purpose of the --authorization-mode flag on the kube-apiserver?
- Sets TLS certificate paths
- Defines which authorization plugins are active (Correct answer)
- Controls audit logging
- Specifies admission controllers
Correct answer: Defines which authorization plugins are active
The --authorization-mode flag enables one or more authorization plugins (e.g., RBAC, Node, Webhook) that the API server uses to authorize requests.
CKA Cluster Architecture, Installation, and Configuration 2
Which kubeadm command is used to generate a new bootstrap token for joining worker nodes?