CKA practice questions and answers
All 15 questions from Practice Test 1 for Certified Kubernetes Administrator, with the correct answer and a full explanation for each — including why the other options are wrong. Free to read, no signup.
What this set covers
Questions are weighted to match the official CKA exam guide. The real exam is Hands-on tasks questions in 120 minutes with a pass mark of 66%.
- Cluster Architecture, Installation and Configuration4 q · 25%
- Workloads and Scheduling3 q · 15%
- Services and Networking3 q · 20%
- Storage2 q · 10%
- Troubleshooting3 q · 30%
Which control plane component watches for newly created Pods with no assigned node and picks a node for them?
- Akube-controller-manager
- Bkube-scheduler✓
- Ckubelet
- Dkube-proxy
Correct answer: B — kube-scheduler
The scheduler assigns Pods to nodes based on resource requests, affinity rules, taints and other constraints. The controller manager runs control loops such as the ReplicaSet controller, the kubelet runs containers on a node, and kube-proxy programs Service networking rules.
Kubernetes componentsWhere does a kubeadm-built cluster store all its API objects?
- AIn etcd✓
- BIn a PostgreSQL database on the control plane node
- CIn files under /var/lib/kubelet
- DIn the container runtime's local store
Correct answer: A — In etcd
etcd is the key-value store that holds all cluster state, which is why backing up etcd is the way to back up a cluster. /var/lib/kubelet holds node-level kubelet data, not cluster objects.
Operating etcd clusters for KubernetesA node is tainted with `node-role.kubernetes.io/control-plane:NoSchedule`. What must a Pod have to be scheduled on that node?
- AA nodeSelector matching the node label
- BA toleration that matches the taint✓
- CA higher priorityClassName
- DA resource request smaller than the node's capacity
Correct answer: B — A toleration that matches the taint
Taints repel Pods unless the Pod carries a matching toleration. Node selectors and affinity attract Pods to nodes but do not overcome a taint. Priority affects preemption order, not taints.
Taints and tolerationsWhat happens when a container sets a memory limit and the process inside exceeds it?
- AThe container is throttled until memory use falls.
- BThe container is terminated with an OOMKilled reason and restarted according to its restart policy.✓
- CThe Pod is evicted and rescheduled to another node.
- DThe kubelet increases the limit automatically.
Correct answer: B — The container is terminated with an OOMKilled reason and restarted according to its restart policy.
Memory is not compressible: exceeding a memory limit gets the container OOMKilled. CPU is different — exceeding a CPU limit only throttles the container. Eviction happens when the node itself is under memory pressure.
Resource management for Pods and containersWhich Service type gives Pods a stable in-cluster IP address that is not reachable from outside the cluster?
- AClusterIP✓
- BNodePort
- CLoadBalancer
- DExternalName
Correct answer: A — ClusterIP
ClusterIP is the default and is only reachable inside the cluster. NodePort opens a port on every node, LoadBalancer asks the cloud provider for an external load balancer, and ExternalName just returns a CNAME record.
Kubernetes ServicesA NetworkPolicy is applied to a namespace selecting all Pods, with an empty ingress rule list. What is the effect?
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
namespace: app
spec:
podSelector: {}
policyTypes:
- Ingress- AAll ingress traffic to Pods in the namespace is denied.✓
- BAll ingress traffic is allowed, because no rules restrict it.
- COnly traffic from the same namespace is allowed.
- DThe policy has no effect without a CNI-specific annotation.
Correct answer: A — All ingress traffic to Pods in the namespace is denied.
Once any NetworkPolicy selects a Pod for Ingress, only traffic matching a rule is allowed. With no rules listed, nothing matches, so this is the standard default-deny policy. It does require a CNI plugin that implements NetworkPolicy, but no annotation.
Network policiesWhich object lets a cluster create PersistentVolumes on demand when a PersistentVolumeClaim is created?
- AStorageClass✓
- BVolumeAttachment
- CConfigMap
- DCSIDriver
Correct answer: A — StorageClass
A StorageClass describes a provisioner and its parameters, so a matching PVC triggers dynamic provisioning of a PV. VolumeAttachment tracks attach operations, CSIDriver registers a driver, and ConfigMaps hold configuration data.
Storage classesA PersistentVolume has `persistentVolumeReclaimPolicy: Retain`. What happens to the volume when its PVC is deleted?
- AThe PV and the underlying storage are deleted.
- BThe PV moves to Released and the data stays until an administrator handles it.✓
- CThe PV is immediately available for another claim.
- DThe PV is archived to object storage.
Correct answer: B — The PV moves to Released and the data stays until an administrator handles it.
Retain keeps the volume and its data; the PV becomes Released and must be cleaned up or recycled manually before reuse. Delete would remove the PV and the backing storage.
Persistent volumes — reclaimingA Pod stays in `Pending` state. Which command is the fastest way to find out why?
- Akubectl logs <pod>
- Bkubectl describe pod <pod>✓
- Ckubectl exec -it <pod> -- sh
- Dkubectl top pod <pod>
Correct answer: B — kubectl describe pod <pod>
`describe` shows the Events section, where the scheduler explains problems such as insufficient CPU, unbound PVCs, or taints. Logs and exec need a running container, and `top` reports resource usage of running Pods.
Debug PodsKubelet on a worker node is not registering the node as Ready. Which two checks are most useful first? (Select TWO.)
- ARun `systemctl status kubelet` and read `journalctl -u kubelet` on the node.✓
- BCheck that the container runtime (containerd or CRI-O) is running on the node.✓
- CDelete and recreate all Pods in the cluster.
- DRotate the cluster's etcd encryption key.
- EIncrease the replica count of the affected Deployment.
Correct answer: A, B — Run `systemctl status kubelet` and read `journalctl -u kubelet` on the node. · Check that the container runtime (containerd or CRI-O) is running on the node.
A NotReady node is almost always a kubelet or runtime problem on that node, or a broken CNI. Start with the kubelet service and its logs, then confirm the container runtime is healthy. Recreating Pods, touching etcd keys, or scaling Deployments does not address the node itself.
Troubleshooting clustersWhich command safely prepares a node for maintenance by evicting its Pods and marking it unschedulable?
- Akubectl cordon node01
- Bkubectl drain node01 --ignore-daemonsets✓
- Ckubectl delete node node01
- Dkubectl taint nodes node01 maintenance=true:NoExecute
Correct answer: B — kubectl drain node01 --ignore-daemonsets
`drain` cordons the node and evicts its Pods, respecting PodDisruptionBudgets; `--ignore-daemonsets` is needed because DaemonSet Pods cannot be evicted. `cordon` alone only stops new Pods from being scheduled. Deleting the node removes it from the cluster without a graceful eviction.
Safely drain a nodeWhich workload controller guarantees that exactly one Pod runs on every matching node, including nodes added later?
- ADeployment
- BStatefulSet
- CDaemonSet✓
- DJob
Correct answer: C — DaemonSet
DaemonSets are used for per-node agents such as log shippers and CNI plugins — one Pod per node, added automatically to new nodes. Deployments manage a replica count anywhere in the cluster, StatefulSets give stable identity and storage, and Jobs run to completion.
DaemonSetWhich resource routes external HTTP and HTTPS traffic to Services based on host name and URL path?
- AIngress✓
- BEndpoint
- CNetworkPolicy
- DService of type NodePort
Correct answer: A — Ingress
An Ingress defines HTTP routing rules that an ingress controller implements. Endpoints list the Pod IPs behind a Service, NetworkPolicy filters traffic, and NodePort exposes a raw port with no host or path routing.
IngressYou need to upgrade a kubeadm cluster. Which order is correct?
- AUpgrade worker nodes first, then the control plane.
- BUpgrade the control plane first, then the worker nodes one at a time.✓
- CUpgrade every node at the same time to avoid version skew.
- DUpgrade etcd last, after all kubelets.
Correct answer: B — Upgrade the control plane first, then the worker nodes one at a time.
Kubernetes supports the control plane being newer than the kubelets, not the other way round. So you upgrade the control plane first (`kubeadm upgrade apply`), then drain, upgrade and uncordon each worker in turn.
Upgrading kubeadm clustersA container keeps restarting and `kubectl get pod` shows CrashLoopBackOff. Which command shows the output from the run that crashed?
- Akubectl logs <pod> --previous✓
- Bkubectl get events --all-namespaces
- Ckubectl describe node <node>
- Dkubectl rollout status deploy/<name>
Correct answer: A — kubectl logs <pod> --previous
`--previous` prints the logs from the container instance that exited, which is where the crash reason usually is. Events help with scheduling problems, node description helps with capacity issues, and rollout status only reports deployment progress.
kubectl logsReady to try it under exam conditions?
Reading answers is not the same as recalling them with a clock running. Take the same 15 questions as a timed mock exam — 25 minutes, no feedback until you submit, then a score broken down by exam domain so you know what to study.
Start the timed CKA test →