50 Free CKA Practice Questions — Certified Kubernetes Administrator

Answer: b) kube-apiserver

Explanation: The API server is the front-end of the Kubernetes control plane. It exposes the Kubernetes API and handles all REST requests, processing them before storing state in etcd.

Answer: b) kube-scheduler

Explanation: The scheduler watches for newly created pods with no assigned node and selects the best node for each pod based on resource requirements, policies, and constraints.

Answer: b) Distributed key-value store for cluster state

Explanation: etcd is a consistent, distributed key-value store that stores all cluster data (state, configuration, secrets). It's the single source of truth for the cluster.

Answer: c) kubelet

Explanation: The kubelet runs on every node (worker and master) and ensures containers are running in pods as desired. It communicates with the API server to receive pod specifications.

Answer: b) Maintaining network rules on nodes for service connectivity

Explanation: kube-proxy runs on each node and maintains network rules that allow communication to pods from network sessions inside or outside the cluster.

Answer: b) containerd

Explanation: containerd is the default container runtime interface (CRI) for Kubernetes since Docker was deprecated. It's an industry-standard container runtime that focuses on simplicity and security.

Answer: a) kubeadm init

Explanation: kubeadm init initializes a Kubernetes control plane node. kubeadm join adds worker nodes to the cluster. kubeadm upgrade upgrades the cluster version.

Answer: b) Configuring access to Kubernetes clusters (clusters, contexts, users)

Explanation: The kubeconfig file (usually ~/.kube/config) defines cluster access configuration, including cluster endpoints, user credentials, and contexts for switching between clusters.

Answer: b) kube-controller-manager

Explanation: The controller manager runs controller processes (Node Controller, Replication Controller, Endpoints Controller, etc.) that continuously monitor and reconcile the cluster's actual state with the desired state.

Answer: b) A virtual cluster providing scope for resources

Explanation: Namespaces provide a way to divide cluster resources between multiple users or teams, providing scope for names (resource names must be unique within a namespace, not across namespaces).

Answer: b) kubectl get pods --all-namespaces

Explanation: kubectl get pods --all-namespaces (or -A) lists pods in all namespaces. Without this flag, only pods in the default namespace (or current context namespace) are shown.

Answer: b) Preventing pods from being scheduled unless they tolerate the taint

Explanation: Taints repel pods from nodes unless the pod has a matching toleration. They're used to ensure dedicated nodes (e.g., for GPU workloads, master-only functions).

Answer: b) Constraining pods to run on nodes with specific labels

Explanation: nodeSelector is a simple constraint that limits which nodes a pod can run on based on node labels (e.g., disktype: ssd).

Answer: b) kubectl apply

Explanation: kubectl apply -f manifest.yaml creates or updates resources declaratively, maintaining the desired state defined in the YAML file.

Answer: a) create is imperative; apply is declarative

Explanation: kubectl create is imperative (tells Kubernetes what to do). kubectl apply is declarative (tells Kubernetes the desired state, and Kubernetes makes it happen).

Answer: a) A pod is an instance of containers; a Deployment manages pod replicas and updates

Explanation: A Pod is the smallest deployable unit. A Deployment manages ReplicaSets and provides declarative updates for pods (rollouts, rollbacks, scaling).

Answer: b) StatefulSet

Explanation: StatefulSet is designed for stateful applications that require stable, unique network identifiers, stable persistent storage, and ordered deployment/scaling.

Answer: b) Running a pod on every node in the cluster

Explanation: DaemonSet ensures that a copy of a pod runs on all (or selected) nodes. Typically used for cluster infrastructure like monitoring agents (Prometheus Node Exporter), log collectors (Fluentd), and network plugins.

Answer: c) Job

Explanation: A Job creates one or more pods and ensures they successfully complete their task. When the pod exits successfully, the Job is marked complete. CronJob creates Jobs on a schedule.

Answer: a) A job that runs on a schedule (time-based)

Explanation: A CronJob creates Jobs on a recurring schedule, defined using cron syntax. It's used for periodic tasks like backups, report generation, or cleanup.

Answer: b) A limit on resource consumption per namespace

Explanation: A ResourceQuota sets limits on total resource consumption (CPU, memory, storage, object count) within a namespace, preventing any single team from consuming all cluster resources.

Answer: a) Requests define minimum resources; limits define maximum resources

Explanation: requests specify the minimum resources guaranteed to the container (used for scheduling). limits specify the maximum resources the container can consume (used for throttling/eviction).

Answer: b) Container may be terminated (OOMKilled)

Explanation: When a container exceeds its memory limit, it may be terminated with OOMKilled (Out Of Memory) and potentially restarted depending on the restart policy.

Answer: b) Checking if the container is healthy (restart if not)

Explanation: A liveness probe determines if a container is running properly. If the probe fails, kubelet kills the container and restarts it.

Answer: b) Exposing pods as a network service with stable IP and DNS

Explanation: A Service provides a stable IP address and DNS name for accessing a set of pods, abstracting the underlying pod IPs (which change as pods are created/deleted).

Answer: c) LoadBalancer

Explanation: LoadBalancer exposes the Service externally using a cloud provider's load balancer (e.g., AWS ELB, Azure LB, GCP LB). It's the standard way to expose services to the internet.

Answer: c) ClusterIP

Explanation: ClusterIP is the default Service type. It exposes the Service on a cluster-internal IP, making it accessible only within the cluster.

Answer: b) A resource that manages external access to services via HTTP/HTTPS routes

Explanation: Ingress provides HTTP/HTTPS routing to Services based on hostnames or paths, also handling SSL/TLS termination, load balancing, and name-based virtual hosting.

Answer: b) kube-proxy

Explanation: kube-proxy handles Service networking by maintaining iptables or IPVS rules that route traffic from a Service's ClusterIP to the backend pods.

Answer: a) Service discovery within the cluster

Explanation: coreDNS provides DNS resolution within the cluster, allowing pods to discover services by name (e.g., my-service.namespace.svc.cluster.local).

Answer: a) Pods can communicate with each other across nodes without NAT

Explanation: The Kubernetes network model requires: every pod gets a unique IP, pods can communicate with all other pods without NAT, and agents (kubelet) can communicate with pods.

Answer: a) A firewall rule for pods

Explanation: NetworkPolicy defines how pods are allowed to communicate with each other and other network endpoints. It's like a firewall for pods, using labels and ports.

Answer: b) NodePort

Explanation: NodePort exposes the Service on a static port (30000-32767) on each node's IP address. Traffic to NodeIP:NodePort is forwarded to the Service's ClusterIP and backend pods.

Answer: b) A Service without a ClusterIP (used for DNS-based service discovery)

Explanation: A headless Service (clusterIP: None) doesn't provide load balancing. Instead, DNS returns the pod IPs directly, enabling client-side service discovery for stateful applications.

Answer: a) A volume that exists independently of pods

Explanation: A PersistentVolume (PV) is a cluster-wide storage resource provisioned by an administrator. It exists independently of pods and has its own lifecycle.

Answer: a) A request for storage by a user/pod

Explanation: A PVC is a request for storage resources. Users request storage (size, access mode) and Kubernetes binds the PVC to an appropriate PV.

Answer: b) A way to classify storage and provision PVs dynamically

Explanation: StorageClass defines different storage types (SSD, HDD, network storage) and enables dynamic provisioning of PersistentVolumes when PVCs request them.

Answer: b) The cloud provider's CSI driver (e.g., EBS, Persistent Disk, Azure Disk)

Explanation: Cloud Kubernetes clusters typically use the cloud provider's Container Storage Interface (CSI) driver to dynamically provision block storage volumes.

Answer: a) ReadWriteOnce, ReadOnlyMany, ReadWriteMany

Explanation: RWO (single node read-write), ROX (many nodes read-only), RWX (many nodes read-write). The access mode depends on the underlying storage type.

Answer: a) The PV is also deleted

Explanation: With reclaim policy "Delete," when a PVC is deleted, the PV and its underlying storage are also deleted. "Retain" keeps the PV for manual reclamation. "Recycle" is deprecated.

Answer: a) kubectl logs pod-name

Explanation: kubectl logs pod-name retrieves the logs from a container in a pod. Use -c container-name for multi-container pods and -f to follow logs.

Answer: c) kubectl exec

Explanation: kubectl exec -it pod-name -- /bin/bash opens an interactive shell in a container. kubectl exec pod-name -- ls / runs any command inside the container.

Answer: b) kubectl describe pod pod-name

Explanation: kubectl describe pod shows detailed information about a pod including status, conditions, events, container statuses, and resource usage.

Answer: b) The container is repeatedly crashing after startup

Explanation: CrashLoopBackOff means the container starts, crashes, is restarted, crashes again, and Kubernetes is increasing the backoff delay between restarts.

Answer: c) kubectl drain node

Explanation: kubectl drain node-name safely evicts all pods from a node for maintenance, respecting PodDisruptionBudgets and ensuring workloads are moved to other nodes.

Answer: b) Marks a node as unschedulable (new pods won't be assigned)

Explanation: kubectl cordon node-name marks a node as unschedulable (SchedulingDisabled). Existing pods continue running, but no new pods are scheduled to the node.

Answer: a) kubectl cluster-info

Explanation: kubectl cluster-info shows cluster information including control plane component health. kubectl get componentstatuses (or cs) also shows control plane health but is deprecated.

Answer: a) kubectl get nodes

Explanation: kubectl get nodes lists all nodes in the cluster with their status (Ready, NotReady), roles (master, worker), and Kubernetes version.

Answer: b) Kubernetes cannot pull the container image

Explanation: ImagePullBackOff means kubelet tried to pull the container image but failed (e.g., image not found, wrong tag, authentication error, network issue).

Answer: a) kubectl get pods --field-selector spec.nodeName=node-name

Explanation: You can filter pods by node using field selectors. Alternatively, kubectl get pods -o wide shows the node column for all pods.