Certified Kubernetes Administrator (CKA) Exam Questions

Domain 1: Cluster Architecture, Installation and Configuration (25%)

---

An administrator is bootstrapping a new Kubernetes control-plane node using kubeadm init. Which component is responsible for initializing the cluster’s control-plane components and generating the initial join token for worker nodes?

⬜ kubectl
⬜ kubeadm
⬜ kubelet
⬜ containerd

A cluster administrator wants to upgrade a kubeadm-provisioned cluster from one minor version to the next. Which statement correctly describes the required order of operations?

⬜ Upgrade all worker nodes first, then upgrade the control-plane node last.
⬜ Upgrade the kubeadm tool and the control-plane node first, then upgrade worker nodes one at a time.
⬜ Upgrade kubelet on every node simultaneously without draining any nodes.
⬜ Upgrades can be applied directly by editing the etcd database.

Which Kubernetes object type should be used to grant a specific user permission to read Pods within a single namespace, following the principle of least privilege?

⬜ ClusterRole bound with a ClusterRoleBinding
⬜ Role bound with a RoleBinding
⬜ ServiceAccount only, with no Role
⬜ PodSecurityPolicy

An administrator needs to take a consistent backup of a kubeadm cluster’s cluster state so it can be restored later. Which component’s data must be backed up to fully recover cluster state?

⬜ Only the kubelet configuration files on each node.
⬜ The etcd data store.
⬜ Only the container images cached on each node.
⬜ The local kubeconfig file on the administrator’s laptop.

A Pod needs to run directly on a specific node and be managed by the kubelet on that node without going through the normal scheduler or API-server-managed Deployment mechanism (commonly used to run control-plane components like kube-apiserver in a kubeadm cluster). What kind of Pod is this?

⬜ A DaemonSet Pod
⬜ A static Pod
⬜ A StatefulSet Pod
⬜ A Job Pod

An administrator has multiple kubeconfig files for different clusters and wants to switch between them easily using a single kubectl command context. Which kubeconfig element should be used to switch between clusters and users?

⬜ A context
⬜ A ServiceAccount token
⬜ A NetworkPolicy
⬜ A StorageClass

Which statement about Kubernetes cluster component TLS certificates is correct?

⬜ Kubernetes cluster components never use TLS certificates; all communication is unencrypted by default.
⬜ kubeadm automatically generates and manages the certificates required for control-plane components to communicate securely, and administrators can inspect their expiration with kubeadm certs check-expiration.
⬜ Certificates only need to be renewed once, at initial cluster creation, and never again.
⬜ Worker nodes do not require any certificates to join a cluster.

An administrator needs to perform maintenance on a worker node and wants to safely evict all Pods from it while preventing new Pods from being scheduled there. Which command sequence is correct?

⬜ kubectl delete node, then kubectl create node
⬜ kubectl cordon , then kubectl drain
⬜ kubectl taint only, with no cordon or drain
⬜ kubectl scale node –replicas=0

A platform team wants to extend the Kubernetes API with their own custom object type, such as a Database resource, that can be managed with standard kubectl commands. Which Kubernetes feature enables this?

⬜ A ConfigMap
⬜ A Custom Resource Definition (CRD)
⬜ A NetworkPolicy
⬜ A ResourceQuota

A company wants to package and deploy a complex application (with multiple Kubernetes manifests, configurable values, and versioned releases) more easily than applying raw YAML files individually. Which widely used CNCF tool is designed for this?

⬜ Helm
⬜ etcdctl
⬜ kubeadm
⬜ crictl

For high availability, a company is designing a kubeadm cluster’s control plane with multiple control-plane nodes. Which etcd topology co-locates etcd members on the same nodes as the control-plane components?

⬜ External etcd topology
⬜ Stacked etcd topology
⬜ Single-node etcd topology
⬜ etcd is never required in a highly available cluster

Which statement about Kubernetes user authentication is correct?

⬜ Kubernetes has a built-in, mandatory user-management database for human users, similar to a traditional operating system.
⬜ Kubernetes does not manage human user objects directly; instead it relies on external identity sources (such as client certificates, tokens, or an external identity provider) and authorizes requests via mechanisms like RBAC.
⬜ All users are automatically cluster administrators unless explicitly restricted.
⬜ ServiceAccounts and regular users are functionally identical with no differences in how they authenticate.

Domain 2: Workloads and Scheduling (15%)

---

A team wants to ensure a fixed number of identical Pod replicas of a stateless web application are always running, with automatic rollout of new versions and the ability to roll back. Which Kubernetes object should they use?

⬜ Deployment
⬜ DaemonSet
⬜ Job
⬜ Static Pod

A company wants exactly one instance of a log-collection agent Pod running on every node in the cluster, including new nodes as they’re added. Which Kubernetes object is designed for this?

⬜ Deployment
⬜ DaemonSet
⬜ StatefulSet
⬜ ReplicaSet

A batch process needs to run a Pod to completion exactly once, and Kubernetes should retry it automatically if it fails. Which object should be used?

⬜ CronJob
⬜ Job
⬜ ReplicaSet
⬜ DaemonSet

Which Kubernetes object should be used to run a data-cleanup task automatically every night at 2 AM?

⬜ Job
⬜ CronJob
⬜ Deployment
⬜ ReplicaSet

A Pod’s container needs access to a database password without hardcoding it in the container image or in a plain-text ConfigMap. Which Kubernetes object is designed to hold this kind of sensitive value?

⬜ ConfigMap
⬜ Secret
⬜ PersistentVolumeClaim
⬜ ResourceQuota

A team notices that one Pod is consuming so much CPU that it starves other Pods on the same node. Which Pod spec fields should be set to prevent a single container from exceeding a defined CPU ceiling?

⬜ requests.memory only
⬜ limits.cpu (and limits.memory as needed)
⬜ affinity rules only
⬜ A NetworkPolicy

A company wants Pods to be scheduled only on nodes that have GPUs, using a required (hard) scheduling rule based on node labels. Which mechanism should they use?

⬜ A taint applied to the Pod
⬜ requiredDuringSchedulingIgnoredDuringExecution node affinity
⬜ A NetworkPolicy selector
⬜ A PersistentVolumeClaim selector

A Pod needs a helper container to run and successfully complete a setup task (such as fetching configuration) BEFORE the main application container starts. Which Kubernetes feature is designed for this?

⬜ A sidecar container running continuously alongside the main container.
⬜ An init container.
⬜ A second Deployment.
⬜ A DaemonSet.

Domain 3: Services and Networking (20%)

---

A company wants to expose a set of backend Pods to other Pods within the cluster only, using a stable internal IP address and DNS name, with no external access. Which Service type should they use?

⬜ ClusterIP
⬜ NodePort
⬜ LoadBalancer
⬜ ExternalName

A company needs to route external HTTP traffic to multiple backend Services based on the request’s hostname and URL path, using a single external entry point rather than provisioning a separate load balancer per Service. Which Kubernetes object is designed for this?

⬜ Ingress
⬜ NetworkPolicy
⬜ Endpoints
⬜ PersistentVolume

By default, can Pods in a Kubernetes cluster communicate with any other Pod, across any namespace, without restriction?

⬜ No — Kubernetes blocks all Pod-to-Pod traffic by default until a NetworkPolicy explicitly allows it.
⬜ Yes — by default, Kubernetes networking allows all Pods to communicate with all other Pods, unless a NetworkPolicy is used to restrict traffic.
⬜ Pods can only ever communicate within the same Deployment.
⬜ Pod-to-Pod communication requires manually configuring static routes for every Pod IP.

A security team wants to restrict a set of backend Pods so that they only accept incoming traffic from Pods labeled role=frontend, and reject all other traffic. Which Kubernetes object should be used?

⬜ A ResourceQuota
⬜ A NetworkPolicy with an ingress rule matching the role=frontend label selector
⬜ A Secret
⬜ A StorageClass

Within a Kubernetes cluster using the default cluster DNS add-on, what is the standard DNS name format used to reach a Service named payments in namespace prod from another namespace?

⬜ payments.svc.cluster.local only
⬜ payments.prod.svc.cluster.local
⬜ prod-payments.default.svc
⬜ payments://prod

Which statement about the Container Network Interface (CNI) in Kubernetes is correct?

⬜ Kubernetes includes one single, built-in networking implementation with no plugin architecture.
⬜ CNI is a plugin specification that allows different networking providers (such as Calico, Cilium, or Flannel) to implement Pod networking, and a cluster requires a CNI plugin to be installed for Pod-to-Pod networking to function.
⬜ CNI plugins are only used for Ingress traffic, not Pod-to-Pod communication.
⬜ CNI has been fully replaced by NetworkPolicy objects and is no longer required.

A company wants to expose a Service on a static port on every node’s IP address so it can be reached from outside the cluster, without provisioning a cloud load balancer. Which Service type fits this requirement?

⬜ ClusterIP
⬜ NodePort
⬜ ExternalName
⬜ Headless Service

An application needs to discover the individual, stable network identities of each Pod backing a Service (rather than a single load-balanced virtual IP), such as for a clustered database. Which Service configuration supports this?

⬜ A LoadBalancer Service
⬜ A Headless Service (ClusterIP set to None)
⬜ A NodePort Service
⬜ An Ingress resource

Which statement about how a Service finds the Pods it should route traffic to is correct?

⬜ A Service statically lists Pod IP addresses that never change.
⬜ A Service uses a label selector to dynamically match Pods, and Kubernetes tracks matching Pod IPs (traditionally via an Endpoints object, or EndpointSlices for scalability).
⬜ A Service can only route to Pods within the exact same Deployment object.
⬜ A Service requires manual updates to its Pod IP list every time a Pod restarts.

A platform team is evaluating the newer Kubernetes API for managing ingress traffic that offers more expressive, role-oriented routing configuration than the original Ingress resource. Which API are they most likely evaluating?

⬜ The Gateway API
⬜ The PodDisruptionBudget API
⬜ The Horizontal Pod Autoscaler API
⬜ The Admission Webhook API

Domain 4: Storage (10%)

---

A cluster administrator has provisioned a piece of network storage as a cluster resource, and a developer wants their Pod to consume some of that storage without needing to know the underlying storage implementation details. Which two objects work together to achieve this?

⬜ ConfigMap and Secret
⬜ PersistentVolume (PV) and PersistentVolumeClaim (PVC)
⬜ DaemonSet and StatefulSet
⬜ NetworkPolicy and Ingress

A company wants PersistentVolumes to be automatically created on-demand whenever a developer submits a PersistentVolumeClaim, rather than requiring an administrator to manually pre-provision volumes. Which object enables this dynamic provisioning?

⬜ A StorageClass
⬜ A ConfigMap
⬜ A ResourceQuota
⬜ A LimitRange

A Pod needs temporary scratch space that is shared between two containers in the same Pod, but the data does NOT need to survive if the Pod is deleted. Which volume type is MOST appropriate?

⬜ A PersistentVolumeClaim backed by network storage
⬜ An emptyDir volume
⬜ A StorageClass
⬜ A hostPath volume pointing to a critical system directory

Which PersistentVolume access mode allows the volume to be mounted as read-write by a single node at a time?

⬜ ReadWriteMany (RWX)
⬜ ReadOnlyMany (ROX)
⬜ ReadWriteOnce (RWO)
⬜ ReadWriteOncePod (RWOP), which allows unlimited nodes

A storage vendor wants to provide a Kubernetes-compatible storage driver for their proprietary storage system without modifying Kubernetes’ own source code. Which standard interface should they implement?

⬜ The Container Network Interface (CNI)
⬜ The Container Storage Interface (CSI)
⬜ The Container Runtime Interface (CRI)
⬜ The Custom Resource Definition (CRD) interface

Domain 5: Troubleshooting (30%)

---

A Pod is stuck in Pending status and never gets scheduled. Which command should an administrator run FIRST to see the scheduling-related events explaining why?

⬜ kubectl logs
⬜ kubectl describe pod
⬜ kubectl delete pod
⬜ kubectl top pod

A Pod’s container keeps restarting repeatedly and kubectl get pods shows its status as CrashLoopBackOff. Which command is MOST useful to see why the container is crashing, including logs from its previous run before the restart?

⬜ kubectl logs –previous
⬜ kubectl get nodes
⬜ kubectl cordon
⬜ kubectl scale deployment –replicas=0

An administrator suspects that the kube-scheduler static Pod on the control-plane node has failed to start. Where should they look to find the relevant static Pod manifest and container logs on that node?

⬜ Inside a ConfigMap named kube-scheduler-config.
⬜ The static Pod manifests directory (commonly /etc/kubernetes/manifests) and the container runtime/kubelet logs on that node.
⬜ Only inside the etcd database.
⬜ In the developer’s local kubeconfig file.

kubectl get componentstatuses (or checking control-plane health) shows the kube-controller-manager appears unhealthy on a kubeadm cluster. What is a reasonable next troubleshooting step?

⬜ Immediately reinstall the entire operating system on the node.
⬜ Check the kube-controller-manager static Pod’s status and logs on the control-plane node (e.g., with kubectl -n kube-system describe pod and container runtime logs).
⬜ Delete all Pods in all namespaces.
⬜ Ignore it since the controller-manager is optional for cluster function.

Users report that a web application’s Service is unreachable, even though its backend Pods show as Running. Which of the following is a valid troubleshooting step to isolate whether the issue is with the Service’s Pod selection?

⬜ Check that the Service’s label selector actually matches the labels on the backend Pods, and verify the resulting Endpoints/EndpointSlices are populated.
⬜ Immediately delete the Service and recreate the Deployment from scratch.
⬜ Increase the CPU limit on the backend Pods.
⬜ Change the container image tag to latest.

An administrator wants to view real-time CPU and memory usage of all Pods in a namespace to identify which one is consuming excessive resources. Which command and supporting component are required?

⬜ kubectl top pods, which requires the Metrics Server to be installed in the cluster.
⬜ kubectl get events, with no additional components required.
⬜ kubectl describe node, which always shows live Pod-level CPU/memory usage.
⬜ kubectl logs, which shows historical CPU/memory graphs.

A worker node shows a NotReady status in kubectl get nodes. Which of the following is the MOST relevant next troubleshooting step?

⬜ Check the kubelet’s status and logs on that node (e.g., systemctl status kubelet and journal logs), since kubelet health directly determines node readiness.
⬜ Delete the node object and assume it will self-heal with no other action.
⬜ Edit the ClusterRoleBinding for the default ServiceAccount.
⬜ Increase the replica count of unrelated Deployments in a different namespace.

A Pod remains stuck in ContainerCreating for a long time. kubectl describe pod shows an event about failing to pull the container image. Which of these is a plausible root cause to investigate?

⬜ The container image tag doesn’t exist, or the node lacks correct registry credentials/network access to pull it.
⬜ The Kubernetes API server has crashed and is not restartable.
⬜ The cluster’s etcd database has been corrupted beyond repair.
⬜ The Horizontal Pod Autoscaler was misconfigured.

An application inside a Pod cannot resolve other Services by their DNS names, though the Pod itself is Running. Which of the following is a reasonable early troubleshooting step?

⬜ Verify the Pod’s /etc/resolv.conf points to the cluster DNS service, and confirm the cluster DNS add-on (e.g., CoreDNS) Pods are running and healthy.
⬜ Increase the Pod’s memory limit.
⬜ Restart the kube-scheduler only.
⬜ Apply a new StorageClass.

Which command shows the recent lifecycle events for a specific object (such as a Pod, Deployment, or Node), which is often the fastest way to understand what went wrong?

⬜ kubectl apply -f
⬜ kubectl describe
⬜ kubectl config view
⬜ kubectl api-resources

A company wants application container logs to be collected and made durably available even after Pods are deleted or rescheduled, across the whole cluster. Which Kubernetes-native approach directly provides this out of the box?

⬜ Kubernetes provides this automatically with no additional setup required.
⬜ Kubernetes itself does not provide durable, cluster-wide log aggregation out of the box; a cluster-level logging architecture (e.g., a node-level logging agent shipping logs to a backend) must be deployed.
⬜ Only kubectl logs is needed, and it retains logs indefinitely by default.
⬜ PersistentVolumes automatically capture and store all container stdout/stderr.

An administrator wants to check whether the kube-apiserver itself is reachable and responding, as a first step when kubectl commands are timing out entirely. Which of these is a reasonable diagnostic action?

⬜ Check network connectivity to the API server’s endpoint/port and review the API server’s static Pod status and logs on the control-plane node.
⬜ Immediately restore the entire cluster from an old etcd snapshot without further investigation.
⬜ Delete and recreate all worker nodes.
⬜ Assume the issue is always with a single application Pod and check only that Pod’s logs.

A Pod has been running for a while, but the application inside seems to be serving errors, though the Pod’s status shows Running with 1/1 containers ready. What Kubernetes probe would help automatically detect and restart a container in this exact scenario going forward?

⬜ A startup probe only
⬜ A liveness probe configured to check the application’s actual health
⬜ A resource limit with no probes
⬜ A NetworkPolicy

An administrator wants a general reference for the recommended, systematic workflow to troubleshoot a failing application running in Kubernetes, from checking the Pod status down to container-level issues. Which official resource documents this?

⬜ The Kubernetes ‘Troubleshooting Applications’ task documentation.
⬜ The Kubernetes release notes.
⬜ The etcd API reference.
⬜ The kubeadm command-line reference only.

A container keeps getting terminated with an OOMKilled status shown in kubectl describe pod. What does this status indicate, and what is a reasonable remediation?

⬜ It indicates the container ran out of allocated memory and was killed by the kernel; consider increasing the container’s memory limit or investigating a memory leak in the application.
⬜ It indicates the container’s image failed to pull.
⬜ It indicates a DNS resolution failure inside the container.
⬜ It indicates the node has been cordoned by an administrator.