View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 241

Which setting prevents a process from gaining additional privileges?

1. allowPrivilegeEscalation: false
2. privileged: true
3. hostNetwork: true
4. runAsUser: 0

Correct Answer: 1

Explanation:

The allowPrivilegeEscalation security setting controls whether a container process can gain more privileges than its parent process. Setting it to false enables the Linux no_new_privs behavior for the container process, preventing privilege escalation through mechanisms such as set-user-ID binaries. This is an important hardening control for workloads that should operate with tightly restricted privileges. It is different from runAsUser, which determines the process identity, and from privileged, which provides broad access to host capabilities. Administrators commonly combine several security-context controls when hardening production Pods.

Question 242

Which field identifies the Linux group for a container process?

1. runAsUser
2. fsGroup
3. runAsGroup
4. supplementalGroups

Correct Answer: 3

Explanation:

The runAsGroup field specifies the primary group ID used by a container process. It complements runAsUser, which specifies the process’s user ID. fsGroup serves a different purpose by influencing ownership and permissions for supported Pod volumes, while supplementalGroups provides additional group memberships. Correctly configuring user and group identities can help applications access only the filesystem resources they require. When troubleshooting permission problems inside a container, administrators should inspect the effective UID and GID as well as volume ownership rather than changing permissions indiscriminately.

Question 243

Which security context field controls ownership of supported Pod volumes?

1. fsGroup
2. runAsGroup
3. seLinuxOptions
4. supplementalGroups

Correct Answer: 1

Explanation:

fsGroup specifies a group identity that can be applied to supported volumes mounted into a Pod. This can help containers access files on persistent storage when the volume’s ownership would otherwise prevent the application from writing or reading required data. The behavior depends on the volume type and filesystem. runAsGroup controls the primary group of the process, while seLinuxOptions configures SELinux labeling and supplementalGroups adds supplementary group memberships. When an application encounters volume permission errors despite running with the expected user ID, checking the Pod’s filesystem group configuration can be useful.

Question 244

Which Pod security profile permits unrestricted configuration?

1. Restricted
2. Baseline
3. Privileged
4. Enforced

Correct Answer: 3

Explanation:

The Privileged Pod Security Standard is the least restrictive profile. It permits configurations that would be prohibited under Baseline or Restricted policies, including workloads requiring elevated host-related capabilities. Baseline is intended to prevent known privilege-escalation configurations while retaining broader compatibility, whereas Restricted applies substantially stronger hardening requirements. The profile is normally relevant to trusted infrastructure workloads rather than ordinary application Pods. When a namespace enforces a Pod Security Standard, administrators should understand which profile is active because that policy can determine whether a particular Pod specification is accepted.

Question 245

Which admission mode reports a Pod Security violation without blocking it?

1. enforce
2. warn
3. reject
4. terminate

Correct Answer: 2

Explanation:

The warn mode of Pod Security Admission reports policy violations to the user without preventing the Pod from being created. This can be useful during a migration toward stronger security controls because administrators can identify workloads that need changes before enforcement becomes mandatory. enforce blocks workloads that violate the configured policy, while other terms do not represent standard Pod Security Admission modes. A namespace can use different modes to support gradual adoption of security requirements. This approach allows teams to discover incompatible workloads while minimizing unexpected deployment interruptions.

Question 246

Which resource determines a Pod’s container runtime selection?

1. RuntimeClass
2. PriorityClass
3. StorageClass
4. IngressClass

Correct Answer: 1

Explanation:

RuntimeClass allows a Pod to request a particular container runtime configuration available on the cluster. Different runtime classes can represent distinct runtime implementations or isolation characteristics configured by the cluster administrator. The Pod references the desired class through runtimeClassName. PriorityClass affects scheduling priority, StorageClass concerns persistent storage provisioning, and IngressClass identifies an ingress controller. RuntimeClass is particularly relevant in environments that offer multiple runtime choices, such as a standard runtime alongside a more isolated sandboxed runtime.

Question 247

What does runtimeClassName reference inside a Pod specification?

1. Security policy
2. RuntimeClass object
3. Node label
4. Container image

Correct Answer: 2

Explanation:

The runtimeClassName field identifies the RuntimeClass that should be used for the Pod. Kubernetes uses this reference to determine the runtime configuration requested by the workload. The RuntimeClass itself is a cluster-scoped object containing information about the available runtime configuration. A node label can influence scheduling, but it does not define the container runtime selection directly. Similarly, the container image identifies application software rather than the runtime implementation. When a Pod fails because its requested runtime is unavailable, administrators should verify the referenced RuntimeClass and its node compatibility.

Question 248

Which scheduling field directly names a specific node?

1. nodeAffinity
2. nodeSelector
3. nodeName
4. schedulerName

Correct Answer: 3

Explanation:

The nodeName field directly assigns a Pod to a specific node name, bypassing the normal scheduler placement process for that Pod. This is different from nodeSelector and node affinity, which provide scheduling constraints that the scheduler evaluates when choosing a suitable node. schedulerName selects which scheduler should process an unscheduled Pod. Direct node assignment can be useful in certain administrative or specialized scenarios, but it reduces the flexibility normally provided by Kubernetes scheduling. Administrators should use it carefully because the named node must be suitable for the workload.

Question 249

What does tolerationSeconds control for a NoExecute taint?

1. Pod CPU reservation
2. Graceful deletion duration
3. Allowed presence time
4. Container startup delay

Correct Answer: 3

Explanation:

tolerationSeconds specifies how long a Pod can remain bound to a node after encountering a matching NoExecute taint when the toleration includes this duration. Once the specified period expires, the Pod may be evicted from the node. This mechanism is useful when workloads should tolerate a temporary node condition rather than being removed immediately. It does not control container startup, CPU allocation, or the normal termination grace period. Understanding the distinction between taints, tolerations, and termination settings is important when diagnosing unexpected Pod movement during node failures or maintenance.

Question 250

Which taint effect can evict already-running Pods?

1. NoSchedule
2. PreferNoSchedule
3. NoExecute
4. NoPlacement

Correct Answer: 3

Explanation:

The NoExecute taint effect can cause existing Pods that do not tolerate the taint to be removed from the node. It also prevents new Pods without a matching toleration from being scheduled there. NoSchedule primarily affects new scheduling decisions, while PreferNoSchedule expresses a preference rather than an absolute restriction. NoPlacement is not a standard Kubernetes taint effect. Administrators often use NoExecute during node maintenance or when a node condition requires workloads to leave the machine.

Question 251

Which StorageClass setting delays volume binding until scheduling?

1. Immediate
2. WaitForFirstConsumer
3. DeferredMount
4. ScheduleBeforeBind

Correct Answer: 2

Explanation:

WaitForFirstConsumer causes dynamic volume provisioning or binding to wait until a Pod using the PersistentVolumeClaim has been scheduled. This allows storage selection to consider the Pod’s scheduling constraints and topology requirements. It is particularly useful for storage systems where volume placement is tied to a particular zone or topology location. With immediate binding, storage may be provisioned before the scheduler knows where the consuming Pod will run. Using delayed binding can therefore help avoid creating a volume in a location that cannot satisfy the workload’s eventual placement requirements.

Question 252

Which PersistentVolume phase means storage is available for claiming?

1. Bound
2. Released
3. Available
4. Failed

Correct Answer: 3

Explanation:

The Available phase indicates that a PersistentVolume exists and is not currently bound to a PersistentVolumeClaim. It can therefore be considered for a compatible claim. Bound means the PV is associated with a claim, while Released indicates that a claim was deleted but the volume has not necessarily been made available for another claim. Failed indicates that recovery from an error has not succeeded. When investigating why a PVC remains pending, administrators can inspect available PVs and compare their capacity, access modes, storage class, and other matching requirements.

Question 253

What does the Retain reclaim policy preserve?

1. Volume object and data
2. Pod scheduling preference
3. Service virtual address
4. Container restart policy

Correct Answer: 1

Explanation:

The Retain reclaim policy keeps the PersistentVolume and its associated storage resources after the bound PersistentVolumeClaim is deleted. This gives administrators an opportunity to recover or manually manage the underlying data rather than automatically deleting the storage. Other reclaim behaviors can remove or recycle resources depending on the storage implementation and configuration. Retain is useful when preserving data is more important than automatic cleanup. Administrators should understand that retaining a PV does not automatically make it ready for a new claim; additional manual handling may be required before reuse.

Question 254

Which PVC access mode restricts mounting to one Pod on one node?

1. ReadOnlyMany
2. ReadWriteMany
3. ReadWriteOnce
4. ReadWriteOncePod

Correct Answer: 4

Explanation:

ReadWriteOncePod is an access mode that restricts a volume so it can be mounted as read-write by only one Pod across the cluster. This is more restrictive than ReadWriteOnce, which permits read-write mounting from multiple Pods as long as they are on the same node, depending on the storage implementation. ReadOnlyMany permits multiple readers, while ReadWriteMany supports multiple read-write consumers when the storage backend supports it. Choosing the appropriate access mode helps ensure that the workload’s storage requirements match the capabilities and semantics of the underlying CSI driver.

Question 255

Which object identifies a CSI storage driver installed in a cluster?

1. CSIDriver
2. CSINode
3. VolumeAttachment
4. StorageProfile

Correct Answer: 1

Explanation:

The CSIDriver object describes a Container Storage Interface driver installed in the cluster. It allows Kubernetes to understand driver capabilities and configuration characteristics, such as whether the driver supports certain volume features. CSINode describes CSI driver information available on a particular node, while VolumeAttachment represents attachment-related state for a volume. StorageClass defines how storage should be dynamically provisioned but does not itself identify the installed driver object. When troubleshooting CSI provisioning or mounting behavior, checking both the StorageClass and CSIDriver information can provide useful context.

Question 256

Which object represents a volume attachment operation to a node?

1. CSIDriver
2. VolumeAttachment
3. PersistentVolumeClaim
4. StorageClass

Correct Answer: 2

Explanation:

VolumeAttachment represents the relationship between a persistent volume and a node when a CSI driver performs the attachment operation. It is a cluster-scoped resource used by Kubernetes and CSI components to track volume attachment state. A PersistentVolumeClaim expresses a user’s request for storage, while a StorageClass defines provisioning characteristics. CSIDriver describes driver capabilities. When a Pod cannot mount a volume because attachment is incomplete, examining VolumeAttachment resources can help determine whether the expected storage device was successfully attached to the target node.

Question 257

Which scheduling feature distributes Pods across topology domains?

1. PodTopologySpread
2. RuntimeClass
3. VolumeSnapshot
4. Lease

Correct Answer: 1

Explanation:

Pod topology spread constraints help distribute Pods across failure or infrastructure domains such as zones, regions, or nodes. This can improve application resilience by preventing too many replicas from concentrating in one location. Administrators configure constraints that describe the desired distribution and acceptable skew. RuntimeClass concerns container runtime selection, VolumeSnapshot represents storage snapshots, and Lease supports coordination. Topology-aware scheduling is particularly valuable for replicated applications where maintaining copies across separate infrastructure domains can reduce the impact of a node or zone failure.

Question 258

What does maxSkew define in topology spreading?

1. Maximum replica imbalance
2. Maximum container memory
3. Maximum node count
4. Maximum storage size

Correct Answer: 1

Explanation:

maxSkew defines the maximum permitted difference in Pod counts between topology domains under a topology spread constraint. A smaller value generally demands a more even distribution, while a larger value permits greater imbalance. The actual result also depends on other constraint fields and scheduling conditions. maxSkew does not define resource limits, storage capacity, or the number of cluster nodes. When a workload must remain distributed across zones or nodes, understanding this value helps administrators predict how strictly the scheduler will attempt to maintain the desired spread.

Question 259

Which field chooses a non-default scheduler for a Pod?

1. schedulerClass
2. schedulingPolicy
3. schedulerName
4. podScheduler

Correct Answer: 3

Explanation:

The schedulerName field specifies which scheduler should handle a Pod. If it is omitted, Kubernetes normally uses the default scheduler. A cluster can run additional scheduler implementations when specialized scheduling behavior is required. The scheduler watches for Pods assigned to its configured name and makes placement decisions according to its scheduling logic. This field is therefore useful when multiple schedulers operate within the same cluster. If a Pod remains unscheduled because the expected scheduler is not available, checking schedulerName can help identify the source of the problem.

Question 260

What does a PodSchedulingGate initially prevent?

1. Container image pulls
2. Volume mounting
3. Scheduler placement
4. Service registration

Correct Answer: 4

Explanation:

A Pod scheduling gate can prevent a Pod from being considered ready for scheduling until the required gate is removed. This allows an external controller or workflow to perform prerequisite processing before the scheduler places the Pod onto a node. The mechanism does not directly prevent image pulling, volume mounting, or Service registration as its primary purpose. Scheduling gates are useful for advanced workload orchestration where placement should depend on conditions established by another component. When diagnosing a Pod that is created but not scheduled, administrators should inspect whether scheduling gates are still present in its specification.