View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 21

Which command displays Pods across every namespace?

1. kubectl get pods
2. kubectl get pods -A
3. kubectl list pods
4. kubectl pods –all

Correct Answer: 2

Explanation:

The -A or –all-namespaces option tells kubectl to retrieve resources from every namespace. This is particularly useful during cluster-wide troubleshooting because workloads may exist outside the currently selected namespace. Without this option, kubectl get pods normally queries only the active namespace. Administrators can combine the option with other output formats or resource types when investigating cluster state. Knowing efficient kubectl commands is important during the CKA because practical tasks often require quickly locating resources across different namespaces.

Question 22

Which tool applies reusable configuration overlays to Kubernetes manifests?

1. Helm
2. kubeadm
3. containerd
4. Kustomize

Correct Answer: 4

Explanation:

Kustomize provides a configuration management mechanism for Kubernetes manifests. It allows administrators to maintain a common base configuration and apply overlays for different environments or deployment requirements. This avoids maintaining completely separate copies of similar YAML files. Kustomize is integrated with kubectl, making it convenient for applying customized configurations directly. Helm serves a different purpose as a Kubernetes package manager using charts. Understanding both tools is useful because the current CKA curriculum includes configuration management and cluster component installation using these technologies.

Question 23

Which Kubernetes object defines permissions within one namespace?

1. Role
2. ClusterRole
3. RoleBinding
4. ServiceAccount

Correct Answer: 1

Explanation:

A Role defines a set of permissions within a specific namespace. It specifies which API resources and actions are permitted. A Role alone does not grant those permissions to an identity; a RoleBinding associates the Role with a user, group, or ServiceAccount. ClusterRole can define permissions at cluster scope or reusable permissions that may be bound within namespaces. Understanding the distinction between Roles and bindings is essential when configuring Kubernetes RBAC and troubleshooting authorization failures.

Question 24

What does a taint primarily do to node scheduling?

1. Increases Pod priority
2. Adds network isolation
3. Repels matching workloads
4. Expands node capacity

Correct Answer: 3

Explanation:

A node taint marks a node so that Pods are not scheduled there unless they have an appropriate toleration. Taints are useful for reserving nodes for specific workloads or preventing ordinary workloads from being placed on nodes with particular characteristics. A toleration does not force a Pod onto a tainted node; it merely permits scheduling there when other scheduling requirements are satisfied. This distinction is important when diagnosing why a Pod remains pending despite apparently available node resources.

Question 25

Which API object can expose HTTP routes through Gateway API?

1. PersistentVolume
2. Job
3. ConfigMap
4. HTTPRoute

Correct Answer: 4

Explanation:

HTTPRoute is a Gateway API resource used to define HTTP routing behavior. It allows administrators to describe how HTTP requests should be directed to backend services through a Gateway. Gateway API provides a more expressive and extensible approach to traffic management than relying only on traditional Ingress resources. Other objects such as PersistentVolumes, Jobs, and ConfigMaps serve completely different purposes. Understanding Gateway API concepts is increasingly important because it is included in the current CKA Services and Networking objectives.

Question 26

Which command safely marks a node unavailable for new scheduling?

1. kubectl cordon
2. kubectl expose
3. kubectl label
4. kubectl proxy

Correct Answer: 1

Explanation:

kubectl cordon marks a node as unschedulable, preventing new Pods from being scheduled there while existing workloads remain running. It is commonly used before node maintenance. Cordon differs from drain: cordon changes scheduling behavior, whereas drain attempts to evict suitable workloads from the node. Administrators may use these operations together during maintenance activities. Understanding their different effects is important for safely managing cluster nodes without unnecessarily disrupting currently running workloads.

Question 27

Which resource stores information about a running workload’s desired replicas?

1. Service
2. Deployment
3. Secret
4. Namespace

Correct Answer: 2

Explanation:

A Deployment specifies the desired state of a replicated application, including the number of replicas. Kubernetes controllers continuously work to bring the actual state toward that declared state. If the configured replica count changes, the Deployment coordinates the required workload adjustments through its ReplicaSet. Services provide network access, Secrets hold sensitive configuration, and Namespaces organize resources. Understanding desired versus actual state is fundamental to Kubernetes administration and helps explain how controllers maintain workload availability.

Question 28

Which object can define container CPU and memory constraints?

1. Ingress
2. Service
3. Pod specification
4. StorageClass

Correct Answer: 3

Explanation:

Container resource requests and limits are defined within the Pod specification. Requests indicate the resources needed for scheduling purposes, while limits establish an upper boundary for resource consumption. These settings influence scheduling and runtime behavior and can be important when diagnosing pending Pods or resource pressure. Ingress handles HTTP routing, Services provide network access, and StorageClasses describe storage provisioning. Correctly configuring resource requirements helps Kubernetes make more informed scheduling decisions.

Question 29

What does a CustomResourceDefinition add to Kubernetes?

1. A new node runtime
2. A custom API resource
3. A replacement scheduler
4. A separate DNS server

Correct Answer: 2

Explanation:

A CustomResourceDefinition, or CRD, extends the Kubernetes API with a new resource type. This allows applications and operators to represent domain-specific objects using Kubernetes-style APIs. After a CRD is installed, administrators can create instances of that custom resource just as they work with built-in Kubernetes objects. CRDs are commonly used by operators that need to manage specialized applications or infrastructure. They therefore provide an important extension mechanism within the Kubernetes control plane.

Question 30

Which command reveals detailed information about a specific Pod?

1. kubectl show
2. kubectl inspect
3. kubectl describe
4. kubectl detail

Correct Answer: 3

Explanation:

kubectl describe displays detailed information about a Kubernetes resource. For a Pod, the output can include its status, assigned node, container states, conditions, mounts, events, and other useful information. This makes the command especially valuable when troubleshooting scheduling failures, startup problems, probe failures, or unexpected restarts. Unlike a simple resource listing, describe provides contextual details and recent events that can help administrators identify the reason behind a workload problem.

Question 31

Which scheduling feature requires a Pod to match selected node labels?

1. Required node affinity
2. Service discovery
3. Pod disruption budget
4. Volume attachment

Correct Answer: 1

Explanation:

Required node affinity can enforce a scheduling requirement based on node labels. If no node satisfies the specified affinity rules, the Pod cannot be scheduled. This differs from preferred affinity, which expresses a scheduling preference rather than an absolute requirement. Node labels therefore become important inputs to the scheduling decision. Administrators can use affinity when workloads need particular hardware, geographic placement, operating-system characteristics, or other node attributes.

Question 32

Which Kubernetes object can limit simultaneous voluntary Pod disruptions?

1. DaemonSet
2. PodDisruptionBudget
3. StorageClass
4. EndpointSlice

Correct Answer: 2

Explanation:

A PodDisruptionBudget, or PDB, helps protect application availability during voluntary disruptions such as node maintenance or administrative eviction. It can specify how many Pods must remain available or how much disruption is permitted. A PDB does not prevent every possible failure, particularly involuntary failures such as hardware crashes. Its purpose is to influence voluntary disruption behavior so that highly available workloads are not unnecessarily reduced below an acceptable availability level during planned operations.

Question 33

Which component provides the interface between Kubernetes and container runtimes?

1. CRI
2. CSI
3. CNI
4. Gateway API

Correct Answer: 1

Explanation:

The Container Runtime Interface, or CRI, defines the interface through which Kubernetes interacts with container runtimes. It allows Kubernetes components to work with compatible runtime implementations without embedding a specific runtime directly into Kubernetes. CSI addresses storage integration, while CNI concerns networking. Gateway API defines traffic-routing resources rather than container runtime communication. Understanding these extension interfaces helps administrators troubleshoot issues involving container startup, runtime integration, storage, and networking.

Question 34

Which resource automatically creates Pods on eligible nodes?

1. Job
2. DaemonSet
3. ConfigMap
4. Ingress

Correct Answer: 2

Explanation:

A DaemonSet ensures that a copy of a Pod runs on nodes matching its scheduling requirements. It is commonly used for node-level services such as monitoring agents, logging collectors, or networking components. Unlike a Deployment, which normally maintains a chosen replica count independent of node count, a DaemonSet associates workload placement with eligible nodes. When a matching node is added, the DaemonSet can create the required Pod there automatically.

Question 35

Which command displays recent events for cluster resources?

1. kubectl get events
2. kubectl show events
3. kubectl logs events
4. kubectl inspect events

Correct Answer: 1

Explanation:

kubectl get events retrieves Kubernetes event objects, which can provide valuable information about scheduling, image pulls, container failures, mounting problems, and other cluster activities. Events are particularly useful during troubleshooting because they often reveal what happened shortly before a resource entered an unexpected state. Administrators can further filter or sort event output when investigating a specific namespace or workload. Events complement commands such as kubectl describe and container log inspection.

Question 36

Which Kubernetes resource is commonly used for finite batch processing?

1. Deployment
2. DaemonSet
3. Job
4. Service

Correct Answer: 3

Explanation:

A Job manages a finite task that is expected to complete rather than remain continuously available. Kubernetes tracks the successful completion of the required workload and can create replacement Pods when configured attempts fail. Jobs are useful for batch processing, administrative tasks, migrations, and other one-time or bounded operations. Deployments are intended for continuously running applications, DaemonSets associate Pods with nodes, and Services provide stable networking for workloads.

Question 37

What does kubectl logs primarily retrieve?

1. Container output
2. Node labels
3. API permissions
4. Storage metadata

Correct Answer: 1

Explanation:

kubectl logs retrieves output produced by containers in Pods. These logs are often one of the first sources administrators inspect when an application starts incorrectly, crashes, or produces unexpected behavior. For multi-container Pods, the appropriate container can be selected explicitly. Logs complement other troubleshooting techniques such as examining events, describing the Pod, and checking resource conditions. Understanding container output is a core administrative skill because application-level failures may not always appear as Kubernetes control-plane errors.

Question 38

Which mechanism allows a Pod to use credentials without embedding them in its image?

1. Node affinity
2. Secret volume
3. Service routing
4. Resource request

Correct Answer: 2

Explanation:

A Secret volume allows sensitive data stored in a Kubernetes Secret to be mounted into a Pod as files. This separates credentials from the container image and allows the same image to be deployed with different secret values. Secrets can also be exposed through environment variables when appropriate. Administrators should still apply proper access controls and understand how Secrets are stored and protected within the cluster. Keeping credentials outside images reduces the risk of permanently embedding sensitive information into application artifacts.

Question 39

Which resource enables dynamic storage provisioning?

1. StorageClass
2. ReplicaSet
3. NetworkPolicy
4. ServiceAccount

Correct Answer: 1

Explanation:

A StorageClass defines how storage can be dynamically provisioned for PersistentVolumeClaims. When a compatible provisioner is configured, a PVC requesting a particular StorageClass can trigger creation of an appropriate PersistentVolume automatically. This reduces the need for administrators to manually create every volume beforehand. StorageClasses can also define parameters describing the type or characteristics of the requested storage. Understanding dynamic provisioning is an important part of the CKA storage domain.

Question 40

Which symptom most directly indicates a container restart problem?

1. Service has no selector
2. Pod has repeated restarts
3. Namespace contains no labels
4. StorageClass has no default

Correct Answer: 2

Explanation:

Repeated container restarts are a direct indication that a workload is failing and being restarted by Kubernetes. Administrators should investigate container logs, Pod events, exit codes, resource limits, probes, and application configuration to determine the underlying cause. A restart count alone identifies the symptom rather than the root problem. Service selectors, namespace labels, and StorageClass configuration can cause other issues, but they do not directly indicate repeated container failures.