CKA Practice Test

A. ✓ Correct: Pods that run to completion for batch work is the correct answer because jobs create Pods and track successful completion.

B. × Incorrect: Persistent identity for stateful Pods only is incorrect because it does not answer this stem as directly as Pods that run to completion for batch work.

C. × Incorrect: Permanent cluster DNS for Services is incorrect because it does not answer this stem as directly as Pods that run to completion for batch work.

D. × Incorrect: Node-level packet forwarding rules only is incorrect because it does not answer this stem as directly as Pods that run to completion for batch work.

A. × Incorrect: A CronJob is incorrect because it does not answer this stem as directly as ClusterIP.

B. × Incorrect: A hostPath volume is incorrect because it does not answer this stem as directly as ClusterIP.

C. × Incorrect: A ClusterRoleBinding is incorrect because it does not answer this stem as directly as ClusterIP.

D. ✓ Correct: ClusterIP is the correct answer because clusterIP Services provide internal-only virtual IP access.

A. × Incorrect: IngressClass is incorrect because it does not answer this stem as directly as emptyDir.

B. ✓ Correct: emptyDir is the correct answer because emptyDir is useful for temporary Pod-scoped shared storage.

C. × Incorrect: ClusterRole is incorrect because it does not answer this stem as directly as emptyDir.

D. × Incorrect: EndpointSlice is incorrect because it does not answer this stem as directly as emptyDir.

A. × Incorrect: Which Ingress host to rewrite is incorrect because it does not answer this stem as directly as Which container’s logs to show.

B. × Incorrect: Which StorageClass to provision is incorrect because it does not answer this stem as directly as Which container’s logs to show.

C. × Incorrect: Which kubeadm token to create is incorrect because it does not answer this stem as directly as Which container’s logs to show.

D. ✓ Correct: Which container’s logs to show is the correct answer because for multi-container Pods, logs may require specifying the container name.

A. ✓ Correct: After authentication and authorization, before objects are persisted is the correct answer because admission controllers intercept API requests after authn/authz and before persistence.

B. × Incorrect: Only in kube-proxy after Service routing is incorrect because it does not answer this stem as directly as After authentication and authorization, before objects are persisted.

C. × Incorrect: Only after a container exits is incorrect because it does not answer this stem as directly as After authentication and authorization, before objects are persisted.

D. × Incorrect: Only inside CoreDNS after name resolution is incorrect because it does not answer this stem as directly as After authentication and authorization, before objects are persisted.

A. × Incorrect: A StorageClass provisioner is incorrect because it does not answer this stem as directly as Readiness probe.

B. ✓ Correct: Readiness probe is the correct answer because readiness probes gate traffic to Pods.

C. × Incorrect: A NodePort external IP is incorrect because it does not answer this stem as directly as Readiness probe.

D. × Incorrect: A ClusterRole only is incorrect because it does not answer this stem as directly as Readiness probe.

A. ✓ Correct: The Pods to which the policy applies is the correct answer because a NetworkPolicy podSelector selects the target Pods governed by the policy.

B. × Incorrect: The PersistentVolumes that must be deleted is incorrect because it does not answer this stem as directly as The Pods to which the policy applies.

C. × Incorrect: The kubeconfig users who can run kubectl is incorrect because it does not answer this stem as directly as The Pods to which the policy applies.

D. × Incorrect: The nodes that store etcd snapshots is incorrect because it does not answer this stem as directly as The Pods to which the policy applies.

A. ✓ Correct: What happens to the underlying volume after its claim is released is the correct answer because reclaim policy controls PV handling after the associated claim is released.

B. × Incorrect: Whether a Pod receives DNS search domains is incorrect because it does not answer this stem as directly as What happens to the underlying volume after its claim is released.

C. × Incorrect: How a Service selects endpoints is incorrect because it does not answer this stem as directly as What happens to the underlying volume after its claim is released.

D. × Incorrect: Which user is allowed to create Roles is incorrect because it does not answer this stem as directly as What happens to the underlying volume after its claim is released.

A. × Incorrect: A full replacement for etcd backups is incorrect because it does not answer this stem as directly as Object details and recent events.

B. × Incorrect: A guaranteed fix for every cluster issue is incorrect because it does not answer this stem as directly as Object details and recent events.

C. × Incorrect: The official app store status is incorrect because it does not answer this stem as directly as Object details and recent events.

D. ✓ Correct: Object details and recent events is the correct answer because describe shows resource details and events, which often explain scheduling or startup failures.

A. × Incorrect: A kubelet restart only is incorrect because it does not answer this stem as directly as Namespaces.

B. ✓ Correct: Namespaces is the correct answer because namespaces let teams organize resources and avoid name conflicts across scopes.

C. × Incorrect: The same Pod name in the same namespace is incorrect because it does not answer this stem as directly as Namespaces.

D. × Incorrect: A single hostPath volume is incorrect because it does not answer this stem as directly as Namespaces.

A. × Incorrect: Only the Ingress TLS secret name is incorrect because it does not answer this stem as directly as The Pod resource requests and node allocatable resources.

B. × Incorrect: Only the CoreDNS Deployment image tag is incorrect because it does not answer this stem as directly as The Pod resource requests and node allocatable resources.

C. ✓ Correct: The Pod resource requests and node allocatable resources is the correct answer because requests influence placement and can make a Pod unschedulable.

D. × Incorrect: Only the ServiceAccount name is incorrect because it does not answer this stem as directly as The Pod resource requests and node allocatable resources.

A. ✓ Correct: Network endpoints that back a Service is the correct answer because endpointSlices provide a scalable way to track Service endpoints.

B. × Incorrect: Pod volume mount paths only is incorrect because it does not answer this stem as directly as Network endpoints that back a Service.

C. × Incorrect: Kubelet certificate signing requests only is incorrect because it does not answer this stem as directly as Network endpoints that back a Service.

D. × Incorrect: RBAC roles for ServiceAccounts is incorrect because it does not answer this stem as directly as Network endpoints that back a Service.

A. × Incorrect: Which node the scheduler must select is incorrect because it does not answer this stem as directly as Where declared volumes are mounted inside the container filesystem.

B. ✓ Correct: Where declared volumes are mounted inside the container filesystem is the correct answer because a volumeMount defines the mount path and related options for a volume in a container.

C. × Incorrect: Which Ingress controller handles traffic is incorrect because it does not answer this stem as directly as Where declared volumes are mounted inside the container filesystem.

D. × Incorrect: Which RBAC subject gets admin permissions is incorrect because it does not answer this stem as directly as Where declared volumes are mounted inside the container filesystem.

A. ✓ Correct: Whether the Service selector matches labels on ready Pods is the correct answer because services route to endpoints derived from matching Pods.

B. × Incorrect: Whether kubeadm init was run twice on a worker is incorrect because it does not answer this stem as directly as Whether the Service selector matches labels on ready Pods.

C. × Incorrect: Whether the PVC access mode is ReadOnlyMany only is incorrect because it does not answer this stem as directly as Whether the Service selector matches labels on ready Pods.

D. × Incorrect: Whether the Service has an unrelated RBAC Role is incorrect because it does not answer this stem as directly as Whether the Service selector matches labels on ready Pods.

A. × Incorrect: Allocating Service ClusterIP addresses is incorrect because it does not answer this stem as directly as Running containers for Pods on the node.

B. ✓ Correct: Running containers for Pods on the node is the correct answer because a container runtime such as containerd runs containers under kubelet control.

C. × Incorrect: Serving the Kubernetes API to kubectl is incorrect because it does not answer this stem as directly as Running containers for Pods on the node.

D. × Incorrect: Approving RBAC RoleBindings is incorrect because it does not answer this stem as directly as Running containers for Pods on the node.

A. × Incorrect: Creating a one-time batch completion object only is incorrect because it does not answer this stem as directly as Ensuring a copy of a Pod runs on selected nodes.

B. × Incorrect: Authorizing users to list Secrets is incorrect because it does not answer this stem as directly as Ensuring a copy of a Pod runs on selected nodes.

C. × Incorrect: Providing a stable virtual IP for a Service is incorrect because it does not answer this stem as directly as Ensuring a copy of a Pod runs on selected nodes.

D. ✓ Correct: Ensuring a copy of a Pod runs on selected nodes is the correct answer because daemonSets run node-level Pods such as log collectors or agents.

A. ✓ Correct: An external load balancer from the underlying provider when supported is the correct answer because loadBalancer Services integrate with supported environments to provision external load balancers.

B. × Incorrect: A namespace resource quota is incorrect because it does not answer this stem as directly as An external load balancer from the underlying provider when supported.

C. × Incorrect: An etcd member replacement is incorrect because it does not answer this stem as directly as An external load balancer from the underlying provider when supported.

D. × Incorrect: A kubeconfig context switch is incorrect because it does not answer this stem as directly as An external load balancer from the underlying provider when supported.

A. × Incorrect: Only by creating a LoadBalancer Service is incorrect because it does not answer this stem as directly as They can be mounted as volumes or used through environment variables.

B. × Incorrect: Only by draining every node is incorrect because it does not answer this stem as directly as They can be mounted as volumes or used through environment variables.

C. ✓ Correct: They can be mounted as volumes or used through environment variables is the correct answer because kubernetes supports consuming ConfigMaps and Secrets through environment variables and volumes.

D. × Incorrect: Only by changing the kube-scheduler binary is incorrect because it does not answer this stem as directly as They can be mounted as volumes or used through environment variables.

A. × Incorrect: Add hostnames to Ingress rules is incorrect because it does not answer this stem as directly as Evict Pods when node resources such as memory, disk, or PID availability fall below thresholds.

B. × Incorrect: Create RBAC bindings for every user is incorrect because it does not answer this stem as directly as Evict Pods when node resources such as memory, disk, or PID availability fall below thresholds.

C. × Incorrect: Automatically pass the CKA exam is incorrect because it does not answer this stem as directly as Evict Pods when node resources such as memory, disk, or PID availability fall below thresholds.

D. ✓ Correct: Evict Pods when node resources such as memory, disk, or PID availability fall below thresholds is the correct answer because node-pressure eviction protects node stability when resources are constrained.

A. × Incorrect: A StorageClass provisioner is incorrect because it does not answer this stem as directly as kube-scheduler.

B. × Incorrect: kube-proxy is incorrect because it does not answer this stem as directly as kube-scheduler.

C. ✓ Correct: kube-scheduler is the correct answer because the scheduler makes node placement decisions for unscheduled Pods.

D. × Incorrect: The container runtime alone is incorrect because it does not answer this stem as directly as kube-scheduler.

A. × Incorrect: A ServiceAccount image pull secret only is incorrect because it does not answer this stem as directly as Node affinity or node selector based on labels.

B. ✓ Correct: Node affinity or node selector based on labels is the correct answer because node label based scheduling is handled by node selectors and affinity.

C. × Incorrect: A PersistentVolume reclaim policy only is incorrect because it does not answer this stem as directly as Node affinity or node selector based on labels.

D. × Incorrect: A CoreDNS stub domain only is incorrect because it does not answer this stem as directly as Node affinity or node selector based on labels.

A. × Incorrect: The Pod uses a container image is incorrect because it does not answer this stem as directly as The Service selector does not match the intended Pod labels.

B. × Incorrect: The cluster has more than one namespace is incorrect because it does not answer this stem as directly as The Service selector does not match the intended Pod labels.

C. ✓ Correct: The Service selector does not match the intended Pod labels is the correct answer because service selectors determine which Pods become endpoints for the Service.

D. × Incorrect: The Service has a sourceTitle field is incorrect because it does not answer this stem as directly as The Service selector does not match the intended Pod labels.

A. × Incorrect: Which scheduler queue stores pending Pods is incorrect because it does not answer this stem as directly as How a volume can be mounted, such as read-write by one node or many nodes when supported.

B. × Incorrect: Which Service type exposes HTTP routing is incorrect because it does not answer this stem as directly as How a volume can be mounted, such as read-write by one node or many nodes when supported.

C. × Incorrect: Which user can run kubectl is incorrect because it does not answer this stem as directly as How a volume can be mounted, such as read-write by one node or many nodes when supported.

D. ✓ Correct: How a volume can be mounted, such as read-write by one node or many nodes when supported is the correct answer because access modes describe supported mount semantics for PersistentVolumes.

A. × Incorrect: The Service automatically becomes a ClusterRole is incorrect because it does not answer this stem as directly as The kubelet can restart the container.

B. × Incorrect: The PVC becomes a Namespace is incorrect because it does not answer this stem as directly as The kubelet can restart the container.

C. × Incorrect: The scheduler stops assigning every Pod cluster-wide is incorrect because it does not answer this stem as directly as The kubelet can restart the container.

D. ✓ Correct: The kubelet can restart the container is the correct answer because liveness probe failures indicate the container should be restarted.

A. × Incorrect: It assigns cluster DNS names inside Pods is incorrect because it does not answer this stem as directly as It runs controllers that watch cluster state and move current state toward desired state.

B. ✓ Correct: It runs controllers that watch cluster state and move current state toward desired state is the correct answer because the controller manager runs control loops such as node and job controllers.

C. × Incorrect: It replaces the API server for kubectl requests is incorrect because it does not answer this stem as directly as It runs controllers that watch cluster state and move current state toward desired state.

D. × Incorrect: It stores every container image layer is incorrect because it does not answer this stem as directly as It runs controllers that watch cluster state and move current state toward desired state.

A. × Incorrect: Only outside the Pod lifecycle is incorrect because it does not answer this stem as directly as Before the app containers in a Pod start.

B. × Incorrect: Only when a Service receives traffic is incorrect because it does not answer this stem as directly as Before the app containers in a Pod start.

C. ✓ Correct: Before the app containers in a Pod start is the correct answer because init containers run to completion before regular app containers start.

D. × Incorrect: Only after every app container has permanently exited is incorrect because it does not answer this stem as directly as Before the app containers in a Pod start.

A. ✓ Correct: A headless Service is the correct answer because stateful workloads commonly use headless Services for stable network identity.

B. × Incorrect: A namespace quota with no selectors is incorrect because it does not answer this stem as directly as A headless Service.

C. × Incorrect: A LoadBalancer Service for every volume is incorrect because it does not answer this stem as directly as A headless Service.

D. × Incorrect: A ClusterRoleBinding named after the Pod is incorrect because it does not answer this stem as directly as A headless Service.

A. ✓ Correct: A user request for storage that can bind to a PersistentVolume or dynamic provisioner is the correct answer because pVCs request storage and can bind to matching PVs or dynamically provisioned volumes.

B. × Incorrect: A request to expose a Service externally is incorrect because it does not answer this stem as directly as A user request for storage that can bind to a PersistentVolume or dynamic provisioner.

C. × Incorrect: A request to schedule a Pod every minute is incorrect because it does not answer this stem as directly as A user request for storage that can bind to a PersistentVolume or dynamic provisioner.

D. × Incorrect: A request to add a user to cluster-admin is incorrect because it does not answer this stem as directly as A user request for storage that can bind to a PersistentVolume or dynamic provisioner.

A. ✓ Correct: Inspect container logs, previous logs, events, and container command/configuration is the correct answer because logs and events normally reveal why the container exits.

B. × Incorrect: Delete every namespace immediately is incorrect because it does not answer this stem as directly as Inspect container logs, previous logs, events, and container command/configuration.

C. × Incorrect: Rotate kubeadm certificates first without evidence is incorrect because it does not answer this stem as directly as Inspect container logs, previous logs, events, and container command/configuration.

D. × Incorrect: Create an unrelated LoadBalancer Service is incorrect because it does not answer this stem as directly as Inspect container logs, previous logs, events, and container command/configuration.

A. ✓ Correct: A ServiceAccount bound to appropriate RBAC permissions is the correct answer because pods can use ServiceAccounts, and RBAC can grant those identities specific permissions.

B. × Incorrect: An Ingress path rewrite only is incorrect because it does not answer this stem as directly as A ServiceAccount bound to appropriate RBAC permissions.

C. × Incorrect: A PersistentVolume reclaim policy is incorrect because it does not answer this stem as directly as A ServiceAccount bound to appropriate RBAC permissions.

D. × Incorrect: A container liveness probe is incorrect because it does not answer this stem as directly as A ServiceAccount bound to appropriate RBAC permissions.