View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 221

Which Kubernetes object defines an external service entry without selecting Pods?

1. ServiceAccount
2. ReplicaSet
3. Service
4. DaemonSet

Correct Answer: 3

Explanation:

A Kubernetes Service can represent a stable network identity even when it does not directly select Pods. This becomes useful when the Service needs to represent an external destination or work with manually managed endpoint information. A ServiceAccount provides workload credentials, a ReplicaSet manages replicated Pods, and a DaemonSet places Pods across nodes. Administrators should distinguish the Service abstraction from its backend discovery mechanism. When troubleshooting a Service that intentionally points outside the cluster, examining its associated endpoint configuration is important rather than assuming that Kubernetes must discover matching Pods automatically.

Question 222

Which Service type exposes an application through each node’s IP?

1. ClusterIP
2. NodePort
3. ExternalName
4. Headless

Correct Answer: 1

Explanation:

A NodePort Service makes an application reachable through a port exposed on each cluster node. Kubernetes associates the chosen port with the Service, allowing traffic arriving at a node to be forwarded toward eligible backends. ClusterIP provides internal virtual access, ExternalName maps a Service name to an external DNS name, and a headless Service avoids the normal virtual-IP behavior. NodePort is useful when external infrastructure or clients need node-level access without directly creating a cloud load balancer. The selected port must fall within the configured NodePort range.

Question 223

What does externalTrafficPolicy: Local preserve?

1. Source client address
2. Pod restart history
3. Storage attachment state
4. Container image digest

Correct Answer: 1

Explanation:

When a Service uses externalTrafficPolicy: Local, traffic arriving from outside the cluster can preserve the original client source address when it reaches the application. The policy also influences which nodes can appropriately serve external traffic because traffic is directed toward local endpoints. This differs from the default behavior, where traffic may be routed through another node and source information can be altered through network translation. The setting is useful when applications or security controls need the actual client IP address for logging, filtering, or auditing purposes.

Question 224

Which field determines whether a Service receives a cluster virtual IP?

1. endpointMode
2. type
3. accessMode
4. networkClass

Correct Answer: 2

Explanation:

The Service type field determines how the Service is exposed. The default ClusterIP type provides a virtual IP reachable within the cluster. Other types, such as NodePort and LoadBalancer, add different exposure mechanisms. ExternalName behaves differently by providing DNS-based indirection rather than the normal virtual-IP model. Understanding the Service type is important when diagnosing accessibility problems because an application may be healthy while the Service exposure method does not match the intended traffic path. Administrators should inspect the Service specification before changing networking components unnecessarily.

Question 225

Which Gateway API object attaches routing rules to a Gateway?

1. HTTPRoute
2. StorageClass
3. PodDisruptionBudget
4. ResourceQuota

Correct Answer: 1

Explanation:

HTTPRoute defines HTTP routing rules that can be associated with a Gateway. It allows administrators to describe how incoming HTTP requests should be matched and forwarded toward backend Services. The Gateway API separates infrastructure-oriented configuration from application routing, enabling different resources to represent distinct responsibilities. StorageClass manages storage provisioning, PodDisruptionBudget controls voluntary disruption limits, and ResourceQuota limits resource consumption within a namespace. When using Gateway API, understanding how Gateway and route resources interact is important for diagnosing traffic-management configuration problems.

Question 226

Which resource can expose a TCP application through Gateway API?

1. HTTPRoute
2. GatewayClass
3. TCPRoute
4. ReferenceGrant

Correct Answer: 3

Explanation:

TCPRoute is designed for routing TCP traffic within Gateway API implementations that support the resource. It allows traffic-management configuration for TCP workloads rather than relying on HTTP-specific routing semantics. HTTPRoute focuses on HTTP requests, GatewayClass identifies the controller implementation, and ReferenceGrant controls permitted cross-namespace references. Gateway API divides responsibilities among several resources so that infrastructure and routing configuration can remain modular. When configuring non-HTTP traffic, administrators should verify that the selected Gateway implementation supports the required route kind.

Question 227

What does a GatewayClass primarily identify?

1. Backend Service
2. Gateway controller
3. Network namespace
4. Load-balancing port

Correct Answer: 2

Explanation:

GatewayClass identifies the controller implementation responsible for managing Gateways of that class. It provides a link between the Gateway API configuration and the controller that implements the desired traffic-management behavior. A Gateway then represents a particular infrastructure entry point, while route resources define how traffic is handled. The Backend Service represents an application destination and is not the purpose of GatewayClass. Understanding this relationship is useful when troubleshooting Gateway resources that exist successfully but are not being reconciled or programmed by the expected controller.

Question 228

Which Kubernetes feature restricts cross-namespace object references?

1. Lease
2. EndpointSlice
3. ResourceQuota
4. ReferenceGrant

Correct Answer: 4

Explanation:

ReferenceGrant is a Gateway API resource that permits specific cross-namespace references. This provides an explicit authorization mechanism for certain resources to reference objects located in another namespace. Without the appropriate permission, a cross-namespace reference may not be accepted by the Gateway API controller. This design helps prevent arbitrary resources from creating unintended relationships across namespace boundaries. The other listed resources serve different purposes: Lease supports coordination, EndpointSlice represents service endpoints, and ResourceQuota limits namespace resource consumption.

Question 229

Which command displays a Service’s assigned cluster IP?

1. kubectl get svc
2. kubectl inspect service
3. kubectl show service
4. kubectl list service-ip

Correct Answer: 1

Explanation:

kubectl get svc displays Service resources and includes important fields such as the Service type, cluster IP, external IP information when applicable, and exposed ports. It is one of the quickest commands for confirming whether a Service received a virtual IP. More detailed investigation can then use commands such as kubectl describe service to inspect selectors, ports, events, and related information. If the Service has no expected connectivity, confirming its assigned address and type is a useful first step before investigating network policies or application-level issues.

Question 230

Which command can reveal a node’s internal IP address?

1. kubectl get node -o wide
2. kubectl list node-address
3. kubectl show node-ip
4. kubectl inspect node-network

Correct Answer: 1

Explanation:

kubectl get node -o wide provides additional node information beyond the standard node listing. Among the displayed fields are addresses and other useful details that help administrators understand node connectivity. This command is particularly useful when troubleshooting networking between nodes or verifying which address Kubernetes associates with a node. The node’s internal address can differ from externally reachable addresses depending on the environment. Administrators should therefore inspect the Kubernetes node information rather than assuming the host’s first network interface is always the address used by cluster components.

Question 231

Which object records a node’s allocated pod CIDR?

1. PodSpec
2. Node
3. Service
4. Namespace

Correct Answer: 4

Explanation:

Kubernetes stores node-level networking information on the Node object, including the Pod CIDR allocated to a node when the cluster networking configuration uses per-node Pod ranges. This information helps networking components determine which address range belongs to workloads scheduled on that node. A PodSpec describes an individual workload, a Service provides stable networking for applications, and a Namespace provides logical resource separation. When investigating Pod-to-Pod connectivity or CNI behavior, examining node networking fields can reveal whether expected address ranges were assigned correctly.

Question 232

Which component assigns Pod CIDRs when configured to manage them?

1. kube-scheduler
2. kube-controller-manager
3. kube-proxy
4. CoreDNS

Correct Answer: 2

Explanation:

The kube-controller-manager contains controllers responsible for managing various cluster resources, including node-related address allocation when the relevant configuration is enabled. Pod CIDR assignment gives nodes dedicated address ranges for workloads, allowing the networking layer to organize Pod addresses. The scheduler determines where Pods should run, kube-proxy handles Service-related networking functions, and CoreDNS provides DNS resolution. If nodes are missing expected Pod CIDR information, administrators should investigate controller-manager configuration and cluster networking assumptions rather than focusing solely on the scheduler.

Question 233

What does kubectl auth can-i determine?

1. Permission for an action
2. Current node pressure
3. Service endpoint health
4. Container restart count

Correct Answer: 1

Explanation:

kubectl auth can-i checks whether a specified identity is authorized to perform an action against a Kubernetes resource. It is especially useful when troubleshooting RBAC because administrators can directly test whether a user or ServiceAccount has a required permission. The command can evaluate verbs such as get, list, create, or delete against specific resources. This is more reliable than inferring permissions solely from Role or ClusterRole definitions because bindings, namespaces, and identity context also affect authorization. It provides a practical way to validate access before changing RBAC configuration.

Question 234

Which RBAC verb permits watching resource changes?

1. inspect
2. monitor
3. watch
4. observe

Correct Answer: 3

Explanation:

The RBAC watch verb permits an identity to observe changes to Kubernetes resources through the API’s watch mechanism. Controllers and operators frequently need this capability because they monitor resource changes and react when objects are created, modified, or deleted. The get and list verbs provide other forms of read access but do not replace the watch permission when continuous change observation is required. When a controller can retrieve objects but fails to react to changes, checking whether its Role or ClusterRole includes watch can reveal the authorization problem.

Question 235

Which RBAC field limits access to named resource instances?

1. selectorNames
2. resourceNames
3. objectFilters
4. instanceScope

Correct Answer: 2

Explanation:

The RBAC resourceNames field restricts permissions to specific named resource instances. This can provide more precise authorization than granting access to every object of a resource type. For example, a rule can allow access to a particular named object while excluding other objects of the same kind. Administrators should understand that not every API operation interacts with named-resource restrictions identically, especially operations that do not specify a resource name. Carefully designing resourceNames rules can reduce unnecessary privileges while still allowing automation to perform its required tasks.

Question 236

What does an aggregated ClusterRole automatically incorporate?

1. Node labels
2. Pod annotations
3. Matching ClusterRole rules
4. Service endpoints

Correct Answer: 3

Explanation:

An aggregated ClusterRole can automatically incorporate rules from other ClusterRoles selected through aggregation labels. This allows administrators to build modular permission sets while maintaining a higher-level role that combines matching rules. It is useful when different components or extensions need to contribute permissions without manually editing one central role every time. Aggregation concerns authorization rules rather than workload scheduling, networking, or endpoint management. When permissions appear in an aggregated role unexpectedly, administrators should inspect the aggregation labels and the contributing ClusterRoles to determine which rules are being combined.

Question 237

Which command displays the kubelet’s recent systemd logs?

1. journalctl -u kubelet
2. systemctl show kubelet
3. kubeadm logs kubelet
4. kubectl logs kubelet

Correct Answer: 4

Explanation:

journalctl -u kubelet retrieves logs associated with the kubelet systemd service. These logs are valuable when diagnosing node-level problems such as failed Pod starts, runtime communication issues, certificate problems, or configuration errors. kubectl logs is intended for container logs rather than the host’s kubelet service. systemctl can inspect service state and configuration but is not the primary command for viewing the service journal. When a node appears unhealthy, examining kubelet logs directly on that node can reveal information that is not visible through ordinary Pod-level inspection.

Question 238

Which command lists containers known to the CRI runtime?

1. crictl ps
2. crictl images
3. crictl info
4. crictl stats

Correct Answer: 1

Explanation:

crictl ps lists containers known to the Kubernetes Container Runtime Interface. It is useful when troubleshooting situations where Kubernetes-level commands do not provide enough information about the underlying runtime state. Administrators can use CRI tooling to inspect containers independently of higher-level Kubernetes objects. crictl images focuses on locally available images, crictl info displays runtime information, and crictl stats provides resource statistics. When investigating container-runtime problems, crictl ps can help determine whether the runtime actually created the expected containers.

Question 239

Which kubeadm command generates a worker join command?

1. kubeadm create-node
2. kubeadm token create –print-join-command
3. kubeadm worker-init
4. kubeadm cluster-join

Correct Answer: 2

Explanation:

kubeadm token create –print-join-command creates a bootstrap token and prints a command that can be used to join a node to the cluster. The generated command contains the information needed by kubeadm to contact the control plane and authenticate the joining node. This is commonly used when adding worker nodes after the initial cluster creation. Administrators should treat bootstrap credentials appropriately because possession of valid join information can have security implications. If the token expires or is unavailable, a new join command can be generated from the control-plane environment.

Question 240

Which command creates an etcd snapshot using etcdctl?

1. etcdctl restore snapshot.db
2. etcdctl check health
3. etcdctl snapshot save backup.db
4. etcdctl endpoint status

Correct Answer: 3

Explanation:

etcdctl snapshot save creates a snapshot of the etcd database and writes it to the specified file. etcd contains critical Kubernetes cluster state, so maintaining reliable snapshots is an important administrative task. The snapshot can later be used as part of an etcd recovery procedure when properly configured. Commands such as endpoint status and health checks provide diagnostic information but do not create backups. Administrators should also ensure that the etcd client is configured with the correct certificates, endpoints, and API version before performing snapshot operations.