CKA Credential Overview 4

Question 1

What does the signerName field in a CertificateSigningRequest specify?

Accepted Answer

The CA authority that will sign the certificate

Answer

The signerName field identifies which signer (e.g., kubernetes.io/kube-apiserver-client) will issue the certificate after approval.

Question 2

Which built-in signer name should be used when creating a CSR for a new kubectl user with client authentication?

Accepted Answer

kubernetes.io/kube-apiserver-client

Answer

The kubernetes.io/kube-apiserver-client signer is used for certificates that authenticate to the kube-apiserver as a user.

Question 3

How can an administrator revoke a compromised user's X.509 client certificate in Kubernetes?

Accepted Answer

Rotate the cluster CA to invalidate all existing certificates

Answer

Kubernetes does not support CRL or OCSP; revoking a single certificate requires rotating the cluster CA, which invalidates all certificates signed by it.

Question 4

In a kubeconfig file, where is the cluster CA certificate typically stored?

Accepted Answer

Under clusters[].cluster.certificate-authority-data

Answer

The base64-encoded cluster CA certificate is stored in clusters[].cluster.certificate-authority-data to verify the API server's TLS certificate.

Question 5

Which Kubernetes authentication strategy uses the --token-auth-file flag on the API server?

Accepted Answer

Static token file

Answer

The --token-auth-file flag enables static token file authentication, which reads bearer tokens from a CSV file on the API server's filesystem.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Credential Overview 4