How are CKA questions generated?

dotCreds builds CKA practice questions from public exam objectives and Linux Foundation exam and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start CKA practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free CKA Practice Test

CKA Practice Test

Start today's 10-question CKA set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 150 Verified Questions

Questions updated at Aug 12, 2026, 3:38 PM CDT

Unlock the full CKA bank

150 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Unlock the full CKA bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

150 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 140 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Why candidates miss this

Assuming a Role automatically confers administrative privileges is a common misunderstanding. RBAC Roles and ClusterRoles grant only the permissions explicitly defined within their rules; neither inherently provides admin access. This likely stems from a conflation of RBAC with broader cluster administrator privileges, overlooking the granular control RBAC provides. Likely wrong answer: A Role always grants admin access, while a ClusterRole never grants permissions Review focus: Kubernetes RBAC Authorization

Interview question

Q: Let's say your team is rolling out a new microservice to a Kubernetes cluster. You want to grant a specific developer the ability to deploy and manage that service, but you want to limit their access to only that namespace. How would you approach defining their permissions, and what Kubernetes objects would you use? Strong answer: My priority would be to follow the principle of least privilege. I'd start by creating a Role within that specific namespace. This Role would define the permissions needed for deploying and managing the microservice, such as `create`, `update`, and `delete` on Pods, Deployments, and Services. Then, I'd create a RoleBinding to associate that Role with the developer's user account. Using a Role ensures the permissions are scoped to the namespace, preventing accidental or malicious actions affecting other parts of the cluster. A ClusterRole would grant broader permissions, which isn't what we want here.

Understanding of least privilege
Ability to differentiate between Role and ClusterRole
Knowledge of RoleBindings
Namespace scoping
Operational thinking

Caution: Simply stating 'use Roles' without explaining the scope difference and the importance of RoleBindings. Also, suggesting a ClusterRole without understanding the implications.

Why this matters

RBAC Role and ClusterRole Scope helps administrators understand how cluster components, access, and lifecycle operations behave during setup and maintenance.

Question 1 An RBAC permission set should be limited to resources inside one namespace. How does a Role differ from a ClusterRole for this scope?

Answer choices

A. A Role is namespace-scoped, while a ClusterRole is cluster-scoped, as the selected approach for the stated technical and business outcome.
B. A Role always grants admin access, while a ClusterRole never grants permissions, when applied.
C. A Role stores Pod logs, while a ClusterRole stores images, for the described technical objective and its associated operational control requirements.
D. A Role is for storage only, while a ClusterRole is for DNS only, as the primary proposed approach.

Correct answer

A Role is namespace-scoped, while a ClusterRole is cluster-scoped, as the selected approach for the stated technical and business outcome.

In Kubernetes RBAC, a Role defines permissions within a namespace, while a ClusterRole defines permissions at cluster scope or can be reused across namespaces through bindings. The correct choice, A Role is namespace-scoped, while a ClusterRole is cluster-scoped, captures the scope difference used for least-privilege access.

Wrong-answer review

B. A Role always grants admin access, while a ClusterRole never grants permissions, when applied.: Admin access is not automatic in RBAC; both resources grant only the verbs and resources listed in their rules.
C. A Role stores Pod logs, while a ClusterRole stores images, for the described technical objective and its associated operational control requirements.: Log storage and image storage are workload or registry concerns; RBAC resources define API permissions.
D. A Role is for storage only, while a ClusterRole is for DNS only, as the primary proposed approach.: Storage-only and DNS-only categories are not how RBAC scope works; RBAC can control access to many Kubernetes resource types.

Extra learning features

Objective/domain: Cluster Architecture, Installation, and Configuration

Source: Using RBAC Authorization

Question 2 A PersistentVolume is available, but the application requires a mount mode supported by the volume, such as read-write on one node or read-only by many nodes. What PV setting describes this capability?

A. Which scheduler queue stores pending Pods, as the selected approach for the stated technical and business outcome, as presented.
B. Which Service type exposes HTTP routing, for the described technical objective and its associated operational control requirements, for this decision.
C. Which user can run kubectl, for the described technical objective and its associated operational control requirements, as the organization’s selected response.
D. How a volume can be mounted, such as read-write by one node or many nodes when supported

How a volume can be mounted, such as read-write by one node or many nodes when supported

Objective/domain: Storage

Source: Persistent Volumes

Question 3 A Kubernetes controller notices that actual cluster state has drifted from the declared state. What behavior describes the controller's core responsibility?

A. The kubelet scheduling Pods across all nodes, under the organization’s defined implementation and exception-management process.
B. A controller loop reconciling actual state with desired state, when applied.
C. A ServiceAccount replacing the API server, as the selected response to the described condition.
D. A PersistentVolume reclaim policy changing DNS, for this decision.

A controller loop reconciling actual state with desired state, when applied.

Source: Kubernetes Components

Question 4 A distributed database needs each replica to keep a predictable ordinal name and storage association across rescheduling. Which statement describes the controller designed for that kind of workload?

A. StatefulSets provide stable network identities and persistent identity for Pods
B. StatefulSets replace kubelet on every node, within the documented scope, ownership, and validation boundaries.
C. StatefulSets can never use persistent storage, for the stated implementation and support requirements.
D. StatefulSets only create RBAC Roles, as the proposed workloads and scheduling approach.

StatefulSets provide stable network identities and persistent identity for Pods

Objective/domain: Workloads and Scheduling

Source: StatefulSets

Question 5 A cluster has multiple Ingress controllers installed. A new Ingress must be handled by the nginx controller rather than another controller. What should identify the intended controller?

A. The Pod's emptyDir volume, for the stated security, delivery, and accountability requirements.
B. The IngressClass referenced by the Ingress, in this situation.
C. The CronJob schedule expression, within this context.
D. The kubeconfig user allowed to delete backups, for the required outcome.

The IngressClass referenced by the Ingress, in this situation.

Objective/domain: Services and Networking

Source: Ingress

Question 6 A Pod remains Pending and never gets assigned to a node. Which evidence should an administrator inspect first to understand scheduling failures?

A. Pod events and scheduling constraints with kubectl describe, as presented.
B. Only the Ingress hostname spelling, for the stated security, delivery, and accountability requirements.
C. Only the homepage title tag, within the troubleshooting context.
D. Only a random Secret in another namespace, within the described operational context.

Pod events and scheduling constraints with kubectl describe, as presented.

Objective/domain: Troubleshooting

Source: Debug Applications

Question 7 A Deployment update is in progress, and an administrator needs to inspect rollout status, view revision history, or undo a bad revision. Which kubectl command family is built for those operations?

A. kubectl port-forward only, as selected.
B. kubectl certificate approve only
C. kubectl rollout, for the required workloads and scheduling outcome.
D. kubectl top pod only, for the required outcome.

kubectl rollout, for the required workloads and scheduling outcome.

Source: Deployments

Question 8 An administrator needs a Kubernetes controller for a one-time database migration that should create Pods, retry failed attempts as configured, and stop after successful completion. Which controller fits?

A. Job, as the recommended response to this scenario.
B. ClusterRole, for this decision.
C. ServiceAccount token only, as described.
D. DaemonSet, for the required business outcome.

Job, as the recommended response to this scenario.

Source: Jobs

Question 9 A cluster needs HTTP and HTTPS host/path routing from outside the cluster to internal Services. What capability does an Ingress provide?

A. HTTP and HTTPS routing from outside the cluster to Services
B. The etcd snapshot schedule only, for the stated services and networking requirement.
C. A node’s kubelet process state, within the documented scope, ownership, and validation boundaries.
D. A Pod’s local emptyDir storage, as the recommended implementation across the complete governed service lifecycle.

HTTP and HTTPS routing from outside the cluster to Services

Question 10 A container needs a declared volume to appear at /data inside its filesystem. Which part of the Pod configuration defines that location?

A. Which node the scheduler must select, for the affected environment.
B. Where declared volumes are mounted inside the container filesystem, as described.
C. Which Ingress controller handles traffic, as the recommended response to this scenario.
D. Which RBAC subject gets admin permissions, for the required operational result and control objective.

Where declared volumes are mounted inside the container filesystem, as described.

Source: Volumes

CKA Practice Test

Unlock the full CKA bank

Practice with explanations that teach.

What you get with free practice

An RBAC permission set should be limited to resources inside one namespace. How does a Role differ from a ClusterRole for this scope?

A PersistentVolume is available, but the application requires a mount mode supported by the volume, such as read-write on one node or read-only by many nodes. What PV setting describes this capability?

A Kubernetes controller notices that actual cluster state has drifted from the declared state. What behavior describes the controller's core responsibility?

A distributed database needs each replica to keep a predictable ordinal name and storage association across rescheduling. Which statement describes the controller designed for that kind of workload?

A cluster has multiple Ingress controllers installed. A new Ingress must be handled by the nginx controller rather than another controller. What should identify the intended controller?

A Pod remains Pending and never gets assigned to a node. Which evidence should an administrator inspect first to understand scheduling failures?

A Deployment update is in progress, and an administrator needs to inspect rollout status, view revision history, or undo a bad revision. Which kubectl command family is built for those operations?

An administrator needs a Kubernetes controller for a one-time database migration that should create Pods, retry failed attempts as configured, and stop after successful completion. Which controller fits?

A cluster needs HTTP and HTTPS host/path routing from outside the cluster to internal Services. What capability does an Ingress provide?

A container needs a declared volume to appear at /data inside its filesystem. Which part of the Pod configuration defines that location?

You are viewing today’s free 10. Unlock 140 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full CKA bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why candidates miss this

Interview question

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are CKA questions generated?

How are explanations sourced?

What score do I get?

Why use this site?