CKA Certified Kubernetes Administrator Free Practice Test — 30 Questions

Question 1

Consider a Kubernetes cluster where a new Deployment creates several Pods. One of these Pods, named `data-processor-7f8b9c4d6-xyz12`, has been stuck in the `Pending` state for an extended period. Upon inspecting the Pod\'s events using `kubectl describe pod data-processor-7f8b9c4d6-xyz12`, the output indicates a recurring message: \"0/3 nodes are available: 3 Insufficient cpu.\" Assuming the cluster has three worker nodes, each with a defined CPU capacity, and no other Pods are currently scheduled that would prevent this Pod from being placed, what is the most accurate explanation for the Pod\'s persistent `Pending` state?

Accepted Answer

The Pod will remain unscheduled until a node with sufficient available CPU capacity becomes available or the Pod's CPU request is reduced.

Question 2

A newly formed development team, codenamed \"Phoenix,\" has been tasked with managing application deployments and network services exclusively within the \"staging\" Kubernetes namespace. To ensure adherence to the principle of least privilege and maintain operational security, what is the most appropriate sequence of Kubernetes RBAC objects to create and configure to grant the Phoenix team the ability to create, view, and update Deployments and Services, without any other elevated permissions?

Accepted Answer

Create a Role named `phoenix-deployer` in the `staging` namespace with `create`, `get`, `list`, `watch`, `update` permissions for `deployments` and `services`. Then, create a RoleBinding in the `staging` namespace linking this Role to the Phoenix team's ServiceAccount.

Question 3

A critical stateless web application deployed across multiple Pods within a Kubernetes cluster is exhibiting intermittent unavailability. Upon investigation, it\'s discovered that the Pods are frequently entering a `CrashLoopBackOff` state, with application logs consistently indicating "failure to establish database connections." The cluster administrator needs to quickly identify and rectify the root cause to restore service stability.

What is the most effective initial step to diagnose and resolve this persistent Pod restart issue?

Accepted Answer

Analyze application logs for detailed database connection error messages and examine Pod events for probe failures or resource constraints.

Question 4

A Kubernetes cluster\'s core functionality is severely degraded, manifesting as frequent Pod evictions, intermittent network connectivity issues between Pods, and unresponsiveness from `kubectl` commands. Initial checks reveal that the control plane components are struggling to maintain quorum and are reporting high error rates in their logs. The operations team is under immense pressure to restore service rapidly. What is the most prudent initial diagnostic step to take to identify the root cause of this widespread instability?

Accepted Answer

Systematically assess the health, resource utilization (CPU, memory, network), and logs of the API Server, Controller Manager, Scheduler, and etcd instances.

Question 5

Consider a Kubernetes cluster where a specific worker Node is provisioned with 4 CPU cores and 8 GiB of memory, and these are designated as the allocatable resources for Pods. A cluster administrator is attempting to deploy two new Pods: Pod Alpha, which has a CPU request of 2 cores and a memory request of 4 GiB, and Pod Beta, which has a CPU request of 1 core and a memory request of 2 GiB. Assuming no other Pods are currently scheduled on this Node, what is the outcome of the scheduler\'s placement decision for these two Pods on this particular Node?

Accepted Answer

Both Pod Alpha and Pod Beta will be successfully scheduled onto the Node.

Question 6

A multi-team Kubernetes cluster is experiencing sporadic performance issues with a critical business application. Investigation reveals that the application\'s Pods are frequently experiencing resource throttling and preemption due to competing workloads from other teams, particularly during peak usage hours. The primary goal is to ensure the consistent availability and performance of this critical application without impacting the ability of other teams to utilize cluster resources within reasonable bounds. The administrator needs to implement a configuration change that directly addresses the Pod\'s resource guarantees to mitigate these intermittent degradations.

Accepted Answer

Configure the critical application's Pods to have identical CPU and memory requests and limits.

Question 7

A distributed financial services platform running on Kubernetes is experiencing frequent evictions of its critical transaction processing pods during peak load periods, which are characterized by high memory utilization across the cluster nodes. The cluster administrator has observed that these evictions occur even when other non-essential workloads are running. The current configuration utilizes default priority settings for all workloads. To ensure the uninterrupted operation of the transaction processing system, what is the most effective proactive measure to implement within the Kubernetes cluster?

Accepted Answer

Create a `PriorityClass` object with the highest possible integer value and assign it to the critical transaction processing pods.

Question 8

Consider a scenario where a critical Kubernetes worker Node, designated as `worker-node-alpha`, experiences a severe kernel panic, rendering its kubelet unresponsive. A Deployment manages a stateless application, ensuring three replicas are always running. One of these replicas, Pod `app-xyz-12345-abcde`, is running on `worker-node-alpha`. The `terminationGracePeriodSeconds` for this Pod is set to 60 seconds. What is the most accurate description of the Pod\'s lifecycle and the subsequent actions taken by the Kubernetes control plane in this situation, assuming the Node remains unreachable for 10 minutes?

Accepted Answer

The Pod `app-xyz-12345-abcde` will enter a `Terminating` state and remain so until the Node controller's eviction timeout is reached, at which point a new Pod will be scheduled on a healthy Node.

Question 9

A cluster administrator is alerted to intermittent failures impacting several critical production workloads deployed across various namespaces. Users report sporadic unavailability and slow response times. The administrator suspects a systemic issue rather than an isolated application bug. Which course of action is most likely to lead to a swift and stable resolution while minimizing further disruption?

Accepted Answer

Systematically review cluster-level logs from the API server, controller manager, scheduler, and kubelets on affected nodes, alongside application logs and metrics for the impacted deployments, to identify common error patterns or resource exhaustion.

Question 10

Observing a cluster\'s external accessibility patterns, a platform engineer notices that a critical microservice, responsible for user authentication, is currently exposed via a `NodePort` Service. This setup, while functional, lacks the ability to perform host-based routing or SSL termination directly at the edge. The team is exploring more advanced methods to manage external access, aiming to simplify the ingress path and enhance security configurations for this specific service. They are keen on a Kubernetes-native solution that can intelligently route incoming HTTP requests based on the requested hostname.

Which Kubernetes resource would best facilitate this requirement, allowing for sophisticated HTTP traffic management and direct exposure of the authentication microservice?

Accepted Answer

An Ingress resource, configured to route traffic to the authentication microservice's ClusterIP Service.

Question 11

A Kubernetes cluster is consistently operating at near-maximum capacity, leading to a significant number of application Pods frequently entering a `Pending` state due to insufficient CPU and memory. The operations team needs to ensure that a newly deployed set of critical microservices, essential for real-time data processing, are scheduled and run reliably, even during periods of high cluster load. What is the most direct and effective Kubernetes-native mechanism to achieve this prioritization for the critical microservices?

Accepted Answer

Define a `PriorityClass` object with a high integer value and reference it in the Pod specifications of the critical microservices.

Question 12

A Kubernetes cluster\'s control plane has become entirely unresponsive. Users report that `kubectl get pods` commands time out, and no new deployments can be initiated. Node status within the cluster also appears stale. The cluster was recently upgraded to a new Kubernetes version, and several custom admission controllers were deployed shortly before the outage. What is the most immediate and critical diagnostic action to pinpoint the root cause of this widespread cluster malfunction?

Accepted Answer

Directly inspect the logs of the `kube-apiserver` pods for error messages and stack traces.

Question 13

A distributed team managing a large, multi-tenant Kubernetes cluster notices a recurring pattern of sporadic API server unresponsiveness. This unresponsiveness manifests as significant delays in pod scheduling and occasional application errors attributed to configuration drift. Initial investigations into network latency and etcd quorum health show no anomalies. Digging deeper, the team observes that the API server\'s CPU utilization spikes during periods of increased webhook activity from custom admission controllers, particularly those that perform complex validation logic. The team\'s lead operator, Elara, suspects a recent, undocumented change to one of these controllers might be overwhelming the API server\'s request processing pipeline. Which of the following actions would be the most effective initial step to diagnose and mitigate this issue, demonstrating adaptability in the face of ambiguous symptoms?

Accepted Answer

Temporarily disable all custom admission controllers and observe cluster stability to isolate the problematic component.

Question 14

A newly deployed monitoring agent, running as a Pod with the service account `monitoring-agent-sa` in the `default` namespace, needs to retrieve sensitive configuration data stored in Kubernetes Secrets located exclusively within the `monitoring-ns` namespace. The agent must not have any permissions to create, update, delete, or even list resources in any namespace, nor should it be able to access ConfigMaps or other resource types. Which combination of RBAC objects and configurations is the most secure and effective way to grant the agent precisely these permissions?

Accepted Answer

Create a `Role` named `secret-reader-role` in `monitoring-ns` with rules allowing `get` verb on `secrets` in the `core` API group. Then, create a `RoleBinding` in `monitoring-ns` that binds the `monitoring-agent-sa` from the `default` namespace to this `secret-reader-role`.

Question 15

Consider a Kubernetes cluster where the user \"Anya\" has been granted permissions via a `ClusterRoleBinding` that links her to a `ClusterRole` named \"cluster-admin.\" This `ClusterRole` explicitly includes permissions for `create`, `get`, `list`, `watch`, `update`, `patch`, and `delete` operations on all resources (`*`) across all API groups (`*`). Additionally, there exists a `RoleBinding` within the `default` namespace that binds a group \"dev-team\" to a `Role` named \"developer,\" which only permits `create` and `get` operations on `pods` within that specific namespace. Given this configuration, can Anya successfully execute the command `kubectl delete pod --namespace=prod-env my-app-pod-xyz`?

Accepted Answer

Yes, Anya can delete the pod because her `ClusterRoleBinding` grants cluster-wide delete permissions, which are not restricted by namespace-specific `RoleBindings`.

Question 16

Consider a Kubernetes cluster where a specific Node is configured with 2 CPU cores (represented as 2000m) and 4 GiB of memory. A Pod is defined with the following resource specifications: `resources.requests.cpu: \"1000m\"`, `resources.limits.cpu: \"1000m\"`, `resources.requests.memory: \"2Gi\"`, and `resources.limits.memory: \"2Gi\"`. If another Pod is already running on this Node that has requested 500m CPU and 1 GiB of memory, what is the most accurate determination regarding the schedulability of the new Pod on this Node?

Accepted Answer

The Pod will be scheduled because its resource requests are within the Node's available allocatable resources after accounting for the existing Pod's requests.

Question 17

Consider a cluster managed by Kubernetes where two distinct Deployments are managed. The first Deployment, named `frontend-app`, defines a Pod template with a single container that has a CPU request of $100m$, a CPU limit of $200m$, and a memory request of $256Mi$. The second Deployment, `backend-service`, also defines a Pod template with a single container, but this one specifies a CPU request of $500m$, a CPU limit of $500m$, a memory request of $1024Mi$, and a memory limit of $1024Mi$. Based on Kubernetes\' Quality of Service (QoS) class assignment mechanisms, which of these Pods will be classified as `Guaranteed`?

Accepted Answer

The Pod managed by the `backend-service` Deployment

Question 18

Consider a Kubernetes cluster provisioned in an environment where multiple distinct external IP addresses are actively managed and routable to the cluster\'s ingress points. A Service of type `LoadBalancer` is created to expose a stateless application deployed across several Pods. If no specific `externalTrafficPolicy` is defined for this Service, what is the most accurate description of how incoming traffic, arriving at any of these external IPs, is ultimately distributed to the Pods backing the Service?

Accepted Answer

Traffic is distributed across all available pods, regardless of which node the external IP is directed to.

Question 19

Consider a Kubernetes cluster where a default-deny network policy is in effect for all namespaces, meaning no ingress or egress traffic is allowed by default unless explicitly permitted. A specific application pod, identified by the label `app: data-processor`, is running in the `default` namespace. This pod successfully communicates with the Kubernetes API server (e.g., `kubernetes.default.svc.cluster.local`) but fails to establish an HTTP connection to an external service located at `192.0.2.100` on port `80`. Which of the following `NetworkPolicy` configurations, when applied to the `default` namespace, would resolve this connectivity issue for the `data-processor` pod?

Accepted Answer

```yaml

Question 20

A cluster administrator is tasked with enabling a specific application\'s Service Account, named `frontend-manager`, to manage all Deployment resources within the `staging` namespace. The Service Account itself resides in the `default` namespace. The administrator must ensure that this Service Account can create new Deployments, update existing ones, and delete Deployments when necessary, without granting broader permissions across other resource types or namespaces. Which combination of RBAC resources, correctly configured, would achieve this objective?

Accepted Answer

A `Role` named `deployment-admin` in the `staging` namespace with rules allowing `create`, `update`, and `delete` verbs for the `deployments` resource in the `apps` API group, bound to the `frontend-manager` Service Account via a `RoleBinding` in the `staging` namespace.

Question 21

During a routine operational review, a cluster administrator notices a recurring pattern of application pods being unexpectedly evicted across multiple nodes in a highly available Kubernetes cluster. The node conditions are all reported as healthy, and the kubelet logs on the affected nodes do not indicate any local issues like disk pressure or memory starvation that would trigger local pod evictions. The cluster utilizes a custom-built Horizontal Pod Autoscaler (HPA) and a network policy controller that dynamically adjusts network configurations. Given these observations, what is the most effective initial step to diagnose the root cause of these intermittent, cluster-wide pod evictions?

Accepted Answer

Analyze the Kubernetes API server audit logs for suspicious or high-frequency pod eviction requests.

Question 22

Consider a scenario where a Kubernetes cluster is experiencing sporadic pod evictions across multiple nodes, consistently accompanied by `MemoryPressure` taint on those nodes. Application teams report intermittent unavailability of their services, particularly during peak load times. Investigations reveal that while the nodes have sufficient allocatable memory, the kubelet is aggressively evicting pods. What strategic adjustment should the cluster operations team implement to proactively prevent these involuntary evictions and ensure service stability for critical workloads?

Accepted Answer

Assign appropriate `requests` and `limits` to all pod specifications, especially for critical workloads, and leverage `PriorityClass` to influence scheduling and eviction priority.

Question 23

Anya, an administrator managing a Kubernetes cluster for a SaaS provider, is troubleshooting connectivity issues for a newly deployed microservice within the \"customer-data-ns\" namespace. This microservice, identified by the label `app=customer-api`, needs to receive traffic from an external partner\'s application running in the \"partner-integration-ns\" namespace. Anya has implemented a `NetworkPolicy` in \"customer-data-ns\" to enforce strict ingress control. The existing policy targets pods with `app=customer-api` and permits ingress only from pods within the same namespace labeled `role=internal-gateway`. However, the partner application in \"partner-integration-ns\" is unable to connect. Assuming the \"partner-integration-ns\" namespace is correctly labeled with `purpose=external-api-access`, what modification to Anya\'s `NetworkPolicy` is necessary to enable the required communication while adhering to best practices for isolation?

Accepted Answer

Add a `namespaceSelector` to the existing `ingress` rule that matches `purpose=external-api-access` and include a `podSelector` for `app=partner-app` within that `namespaceSelector`.

Question 24

An e-commerce platform running on Kubernetes is experiencing intermittent performance degradation. Customer support reports a rise in failed transactions, but the engineering team struggles to pinpoint the exact cause. Different microservices are deployed across multiple clusters, and each team uses varying logging configurations and monitoring tools. This makes correlating events and diagnosing issues across the entire system extremely challenging, leading to slow response times and an inability to effectively manage the escalating customer complaints. The team needs a strategy to gain better visibility into the system\'s behavior to quickly identify and resolve these performance bottlenecks.

What foundational strategy should the team prioritize to effectively diagnose and resolve these complex, cross-cluster performance issues?

Accepted Answer

Implement a unified observability pipeline that aggregates and correlates logs, metrics, and traces from all microservices across all clusters.

Question 25

Anya, a senior site reliability engineer managing a critical stateless microservice within a large Kubernetes cluster, has observed that during periods of high load or unexpected node maintenance, the service experiences significant latency spikes and occasional unreachability. The current deployment uses a `Deployment` object with a replica count of 3. Anya\'s primary objective is to enhance the service\'s resilience and availability, ensuring that the failure of a single node does not lead to a complete service outage or prolonged degradation. She needs to implement a configuration change within the Deployment\'s Pod template that will instruct the Kubernetes scheduler to distribute the application\'s Pods as widely as possible across the available nodes, thereby minimizing the blast radius of any node-specific failures.

Accepted Answer

Configure `podAntiAffinity` in the Pod template with `topologyKey: kubernetes.io/hostname` and `whenUnsatisfiable: ScheduleAnyway` to encourage spreading across nodes.

Question 26

A newly deployed microservice, \"NebulaFlow,\" is exhibiting erratic resource consumption patterns within a production Kubernetes cluster. This behavior is causing frequent pod evictions for unrelated workloads and impacting overall cluster stability. You, as the cluster administrator, need to implement an immediate containment strategy that prioritizes the availability of critical, pre-existing services while you investigate NebulaFlow\'s root cause. Which of the following actions would be the most prudent initial step to safeguard the cluster\'s operational integrity?

Accepted Answer

Apply a `PodDisruptionBudget` to all existing, stable application deployments to ensure their minimum availability during potential node disruptions.

Question 27

Consider a Kubernetes cluster where a worker node, designated as `worker-03`, begins to exhibit severe disk I/O contention, leading to the `DiskPressure` condition being reported by its kubelet. A new Deployment is then created, aiming to deploy five replicas of a stateless application. What is the most probable immediate impact on the scheduler\'s ability to place the new Pods originating from this Deployment onto `worker-03`?

Accepted Answer

The scheduler will avoid placing new Pods onto `worker-03` due to the `DiskPressure` taint, unless the Pods have a specific toleration.

Question 28

Consider a Kubernetes cluster where a developer initially creates a PersistentVolumeClaim (PVC) requesting 5Gi of storage with `volumeMode: Block` but omits the `storageClassName` field. Subsequently, a cluster administrator defines a new StorageClass named `fast-ssd` that is configured to dynamically provision `Block` mode volumes. What is the most likely outcome for the previously created PVC once the `fast-ssd` StorageClass is applied to the cluster?

Accepted Answer

The PVC will remain unbound because it was created without an initial `storageClassName` and the system does not automatically retroactively assign a StorageClass.

Question 29

A development team has successfully deployed a stateless microservice application across several Pods managed by a Kubernetes Deployment. They require that this application be reliably accessible from outside the cluster, with traffic distributed evenly across all healthy application instances, and that users interact with a single, consistent IP address and port for access. Which Kubernetes Service type should be provisioned to meet these specific requirements most effectively?

Accepted Answer

LoadBalancer

Question 30

A cluster administrator is troubleshooting a critical application deployment where pods on different nodes are experiencing intermittent connectivity failures, preventing inter-service communication. Individual pods appear healthy, and logs indicate no application-level errors. The `kube-proxy` component is configured to use `iptables` mode. The administrator has already confirmed that pods on the same node can communicate without issue. What is the most effective next step to diagnose and resolve this inter-node communication problem?

Accepted Answer

Investigate node-level firewall configurations and test general network reachability between the affected nodes.

CKA Certified Kubernetes Administrator Free Practice Test — 30 Questions

A lot more is already mapped out

About the CKA Certified Kubernetes Administrator Certification