CKA Credential Overview 2 — Questions and Answers
Question 1: Which Kubernetes resource type stores TLS certificates and private keys used by Ingress controllers?
- ConfigMap
- Secret of type kubernetes.io/tls (Correct answer)
- ServiceAccount token
- PersistentVolume
Correct answer: Secret of type kubernetes.io/tls
A Secret of type kubernetes.io/tls stores a TLS certificate (tls.crt) and private key (tls.pem) for use by Ingress controllers.
Question 2: What is the default expiration duration for a Kubernetes ServiceAccount token created via the TokenRequest API?
- 1 hour (Correct answer)
- 24 hours
- 1 year
- Never expires
Correct answer: 1 hour
The default expiration for tokens issued by the TokenRequest API is 1 hour, though it can be configured.
Question 3: Which field in a kubeconfig file specifies the cluster's API server address?
- server (Correct answer)
- endpoint
- address
- host
Correct answer: server
The 'server' field under a cluster entry in kubeconfig specifies the URL of the Kubernetes API server.
Question 4: How does Kubernetes authenticate a request when a client presents an X.509 certificate?
- It checks the certificate serial number against an allowlist
- It validates the certificate against the cluster CA and uses the CN as the username (Correct answer)
- It queries the LDAP server for certificate ownership
- It forwards the certificate to the kubelet for validation
Correct answer: It validates the certificate against the cluster CA and uses the CN as the username
Kubernetes validates the client certificate against the cluster CA and extracts the Common Name (CN) as the username and Organization (O) as groups.
Question 5: Which command creates a CertificateSigningRequest (CSR) resource in Kubernetes?
- kubectl create csr
- kubectl apply -f csr.yaml (Correct answer)
- kubectl sign certificate
- kubectl request cert
Correct answer: kubectl apply -f csr.yaml
You create a CertificateSigningRequest by applying a YAML manifest with kind: CertificateSigningRequest using kubectl apply.
Question 6: What happens to a projected ServiceAccount token when the pod it is mounted in is deleted?
- The token is revoked immediately by the API server
- The token continues to be valid until its expiration time (Correct answer)
- The token is rotated to a new one with extended TTL
- The token is stored in etcd for audit purposes
Correct answer: The token continues to be valid until its expiration time
Projected tokens remain cryptographically valid until their expiry time; Kubernetes does not maintain a revocation list.
Question 7: Which kubeconfig context field links a user credential to a cluster?
- binding
- context (Correct answer)
- namespace
- role
Correct answer: context
A context in kubeconfig binds a cluster, a user credential, and optionally a namespace together under a named entry.
CKA Credential Overview 2
Which Kubernetes resource type stores TLS certificates and private keys used by Ingress controllers?