View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 201

What does an EndpointSlice primarily represent?

1. Node resource limits
2. Pod security settings
3. Storage attachment data
4. Service endpoint information

Correct Answer: 4

Explanation:

EndpointSlice stores information about network endpoints associated with a Kubernetes Service. It provides a scalable way to track groups of endpoints instead of placing every endpoint into a single Endpoints object. Each slice can contain multiple endpoint entries and related information such as addresses, conditions, and topology details. Kubernetes networking components can use EndpointSlices to discover where Service traffic should be sent. Administrators may inspect them when troubleshooting service discovery or connectivity problems. EndpointSlices are particularly useful in clusters with large numbers of Pods because endpoint information can be distributed across multiple objects rather than growing one large resource indefinitely.

Question 202

Which DNS name pattern commonly reaches a Kubernetes Service?

1. pod.namespace.local
2. service.namespace.svc
3. node.cluster.internal
4. endpoint.service.host

Correct Answer: 2

Explanation:

Kubernetes provides DNS-based service discovery so applications can locate Services without manually tracking changing Pod addresses. A Service commonly receives a DNS record using the Service name and namespace, followed by the cluster’s service DNS suffix. For example, an application in one namespace can resolve another namespace’s Service through its namespace-qualified name. This mechanism allows workloads to communicate using stable Service identities even when backend Pods are replaced. CoreDNS normally provides this DNS functionality inside the cluster. Understanding Service DNS naming is important when troubleshooting applications that can reach Pods directly but fail when communicating through Service names.

Question 203

Which resource commonly stores CoreDNS configuration?

1. ConfigMap
2. Secret
3. DaemonSet
4. Lease

Correct Answer: 1

Explanation:

CoreDNS configuration in a Kubernetes cluster is commonly maintained through a ConfigMap. The configuration specifies how CoreDNS should process DNS requests and which plugins or behaviors it should use. Administrators can inspect this configuration when investigating DNS resolution problems. The CoreDNS workload consumes the configuration and provides DNS services to cluster workloads. Changing DNS behavior therefore requires understanding both the CoreDNS Pods and their associated configuration. A Secret is designed for sensitive data, while a DaemonSet controls workload placement and a Lease is used for coordination. Knowing where DNS configuration resides makes cluster-level DNS troubleshooting considerably more direct.

Question 204

What does disabling service-account token automount affect?

1. Container networking
2. Pod scheduling
3. Credential injection
4. Volume provisioning

Correct Answer: 3

Explanation:

Service-account token automount controls whether credentials associated with a Pod’s ServiceAccount are automatically made available inside the Pod. Disabling automount can reduce unnecessary credential exposure for workloads that do not need to communicate with the Kubernetes API. The setting can be specified for a ServiceAccount or directly for a Pod, depending on the required behavior. This control does not change how the Pod is scheduled, how its network operates, or how persistent storage is provisioned. When troubleshooting API authentication from a workload, administrators should verify whether a token is intentionally mounted rather than assuming every Pod automatically receives usable Kubernetes credentials.

Question 205

Which field supplies credentials for pulling from a private registry?

1. registryTokens
2. pullCredentials
3. imageAuth
4. imagePullSecrets

Correct Answer: 4

Explanation:

The imagePullSecrets field allows a Pod to reference Kubernetes Secrets containing authentication information for private container registries. When a container image must be retrieved from a registry requiring credentials, Kubernetes can use the referenced Secret during the image-pull operation. The Secret must contain appropriate registry authentication data. This mechanism separates registry credentials from the container image specification itself. Administrators can also associate image-pull credentials with a ServiceAccount so that multiple Pods can inherit the configuration. When an image fails to download because authentication is required, checking imagePullSecrets is an important troubleshooting step.

Question 206

Which security setting prevents a container from running as root?

1. runAsNonRoot
2. allowRootUser
3. privilegedMode
4. rootExecution

Correct Answer: 1

Explanation:

The runAsNonRoot security setting tells Kubernetes that a container should not run with UID 0. When this requirement is enabled, Kubernetes verifies that the container is configured to operate as a non-root user. This provides an additional runtime security control and can reduce the impact of applications that become compromised. It is commonly used as part of a broader Pod security configuration. The setting is distinct from merely specifying a user ID because it expresses an explicit non-root requirement. If a container image expects to run as root while this restriction is enabled, the workload may fail to start.

Question 207

Which Linux security mechanism can restrict system calls?

1. AppArmor profiles
2. SELinux labels
3. Seccomp profiles
4. Namespace boundaries

Correct Answer: 3

Explanation:

Seccomp can restrict the system calls available to a containerized process. This provides a kernel-level security mechanism that can reduce the system-call surface exposed to workloads. Kubernetes supports configuring seccomp profiles for Pods and containers. A profile can allow or block selected system calls according to the workload’s requirements. AppArmor focuses on application access controls, while SELinux provides mandatory access-control policies using security labels. Linux namespaces isolate various resources. These mechanisms can complement each other, but seccomp is specifically associated with controlling system-call behavior, making it useful when reducing unnecessary kernel interfaces.

Question 208

What does readOnlyRootFilesystem enforce for a container?

1. Immutable container image
2. Read-only root mount
3. Disabled temporary storage
4. Frozen application process

Correct Answer: 2

Explanation:

readOnlyRootFilesystem configures a container so that its root filesystem is mounted read-only. This prevents processes inside the container from modifying files stored in that filesystem during runtime. Applications that require writable locations can still use explicitly mounted writable volumes where appropriate. The setting does not make the underlying container image immutable, nor does it stop the application process from running. It also does not automatically remove all temporary storage. This control can strengthen workload security by limiting the ability of compromised processes to alter binaries, configuration files, or other content located on the container’s root filesystem.

Question 209

Which NetworkPolicy behavior is used for a default-deny ingress posture?

1. Empty ingress rules
2. Open destination ports
3. Broad namespace access
4. Unrestricted peer selection

Correct Answer: 1

Explanation:

A NetworkPolicy can establish a default-deny ingress posture by selecting Pods while providing no allowed ingress sources. Once ingress isolation applies to selected Pods, incoming connections are permitted only when another applicable rule allows them. This approach is commonly used as a starting security posture before explicitly permitting required traffic. Administrators should carefully identify which Pods are selected and which policies apply because multiple NetworkPolicies can combine to authorize traffic. Default-deny behavior is different from simply leaving networking unconfigured. It creates an explicit isolation boundary that requires permitted communication paths to be defined deliberately.

Question 210

Which selector type targets namespaces in a NetworkPolicy?

1. podSelector
2. serviceSelector
3. nodeSelector
4. namespaceSelector

Correct Answer: 4

Explanation:

namespaceSelector allows a NetworkPolicy rule to identify traffic based on labels assigned to namespaces. This is useful when communication should be permitted from workloads belonging to selected namespaces rather than from a fixed list of individual Pods. A policy can combine namespace and Pod selectors to make the source requirement more precise. podSelector identifies Pods within the policy’s namespace context, while nodeSelector is associated with workload scheduling rather than network-policy source selection. Understanding selector scope is important because incorrectly combining selectors can unintentionally allow or block traffic between application environments.

Question 211

What does kubectl port-forward provide?

1. Permanent external exposure
2. Temporary local access
3. Cluster-wide load balancing
4. Automatic DNS publication

Correct Answer: 2

Explanation:

kubectl port-forward creates a temporary connection from a local machine to a selected Kubernetes resource such as a Pod or Service. It is commonly used for debugging, administrative access, or testing applications without creating a permanent externally reachable endpoint. The forwarded connection exists only while the command remains active. It does not configure a LoadBalancer Service, publish public DNS, or permanently expose an application. Because port forwarding is primarily an administrative access mechanism, it is especially useful when an application is running inside the cluster but an administrator needs to inspect or interact with it from a local workstation.

Question 212

What does an IngressClass identify?

1. Persistent storage backend
2. Pod scheduling profile
3. Ingress controller implementation
4. Namespace security level

Correct Answer: 3

Explanation:

IngressClass identifies the controller responsible for handling an Ingress configuration. Different controllers may operate within the same Kubernetes environment, and an IngressClass provides a mechanism for associating an Ingress resource with the intended implementation. This allows administrators to distinguish between controller configurations when multiple ingress solutions are present. The class can also contain controller-specific parameters through its configuration. IngressClass does not determine where Pods are scheduled or how persistent storage is provisioned. When an Ingress appears to be ignored, checking its selected class and the corresponding controller is a useful troubleshooting step.

Question 213

Which probe setting controls consecutive failures before startup failure?

1. timeoutSeconds
2. periodSeconds
3. initialDelaySeconds
4. failureThreshold

Correct Answer: 4

Explanation:

failureThreshold specifies how many consecutive probe failures are required before Kubernetes considers the probe unsuccessful. For a startup probe, this setting can determine how many failed checks are tolerated while an application is still initializing. This is particularly important for applications that need substantial startup time. periodSeconds controls how frequently the probe runs, while timeoutSeconds controls how long an individual probe may take before timing out. initialDelaySeconds delays the beginning of probing. Correctly tuning these values helps prevent slow-starting applications from being treated as failed before they have enough time to initialize.

Question 214

Which probe option adds HTTP request headers?

1. httpHeaders
2. requestFields
3. customHeadersList
4. probeMetadata

Correct Answer: 1

Explanation:

The httpHeaders field allows an HTTP probe to send additional headers with its request. This can be useful when an application’s health endpoint expects a particular header value or when the application distinguishes health requests using custom metadata. Kubernetes HTTP probes can specify parameters such as the path, port, scheme, and headers. Adding headers does not change the fundamental purpose of the probe: Kubernetes uses the response to determine application health according to the configured probe rules. When an endpoint behaves differently depending on request headers, configuring the probe appropriately can prevent misleading health-check failures.

Question 215

What does terminationMessagePath specify?

1. Startup command location
2. Container termination message file
3. Probe configuration directory
4. Mounted secret pathname

Correct Answer: 2

Explanation:

terminationMessagePath specifies the file from which Kubernetes can obtain a container’s termination message. This information can help communicate a concise reason or diagnostic detail when a container terminates. The default location is commonly provided by Kubernetes, but workloads can configure another path when necessary. The termination message is different from standard container logs, which contain the broader runtime output generated by the application. When investigating failed containers, termination information can provide a useful summary alongside exit codes, container states, and logs. It is therefore a valuable field when designing workloads that need meaningful termination diagnostics.

Question 216

Which container state indicates the process has finished?

1. Running
2. Waiting
3. Terminated
4. Pending

Correct Answer: 3

Explanation:

The Terminated container state indicates that a container’s process has finished execution. Kubernetes records information such as the exit code, reason, and timestamps associated with termination. A container can terminate successfully or unsuccessfully depending on how its process exits. The Waiting state represents a container that has not started or is waiting for a condition, while Running means the container process is currently active. Pending is a Pod phase rather than a container state. When troubleshooting completed or failed workloads, examining the terminated state provides useful evidence about how and why a container stopped.

Question 217

What does kubectl debug enable administrators to create?

1. Ephemeral troubleshooting containers
2. Permanent control-plane nodes
3. Replacement storage volumes
4. New scheduler instances

Correct Answer: 1

Explanation:

kubectl debug can be used to assist with troubleshooting by creating debugging environments, including ephemeral containers in suitable scenarios. Ephemeral containers are useful when an existing Pod needs diagnostic tooling but its original containers should not be rebuilt or replaced merely for investigation. An administrator can use an appropriate debugging image containing utilities needed to inspect processes, networking, or filesystems. This approach is especially valuable when production images are intentionally minimal and lack troubleshooting commands. Debugging capabilities should still be used carefully because diagnostic containers operate within the security and namespace context of the workload being investigated.

Question 218

Which feature allows containers in one Pod to share a process namespace?

1. hostPID
2. processSharing
3. shareProcessNamespace
4. podProcessMode

Correct Answer: 3

Explanation:

shareProcessNamespace enables containers within the same Pod to share a process namespace. With this configuration, processes from one container can become visible to other containers in that Pod, depending on the applicable permissions and runtime behavior. This can be useful for tightly coupled containers that need to inspect or coordinate with one another at the process level. It is different from hostPID, which concerns sharing the node’s process namespace. Because process visibility can affect isolation, administrators should enable this feature only when the workload architecture requires it. Understanding namespace boundaries is important when designing multi-container Pods.

Question 219

What does stringData provide when creating a Secret?

1. Binary-only values
2. Encrypted filesystem blocks
3. Plaintext input fields
4. External key references

Correct Answer: 3

Explanation:

The stringData field allows users to provide Secret values as ordinary strings when creating or updating a Kubernetes Secret. Kubernetes processes these values into the Secret’s data representation. This is convenient because users do not need to manually base64-encode values before placing them into the manifest. stringData is therefore particularly useful when writing readable configuration manifests or generating Secrets from command-line workflows. It should not be interpreted as an encryption mechanism. Administrators must still protect manifests and access to the Kubernetes API because sensitive information supplied through configuration should be handled carefully.

Question 220

Which field exposes Pod metadata through an environment variable?

1. serviceAccountName
2. fieldRef
3. resourceField
4. metadataSource

Correct Answer: 2

Explanation:

The Downward API allows a container to obtain selected Pod or container metadata without requiring direct communication with the Kubernetes API. When metadata needs to be exposed as an environment variable, fieldRef can reference supported fields such as the Pod name or namespace. This mechanism is useful for applications that need contextual information about the workload in which they are running. It avoids embedding environment-specific values directly into container images. Resource-related information can also be exposed through appropriate Downward API mechanisms, but fieldRef is specifically used for supported object-field metadata values.