View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 261

Which object stores a Pod’s disruption budget?

1. ReplicaSet
2. LimitRange
3. ResourceQuota
4. PodDisruptionBudget

Correct Answer: 4

Explanation:

A PodDisruptionBudget defines how many replicas of an application can be voluntarily disrupted at the same time. It helps protect application availability during operations such as node maintenance or voluntary Pod eviction. A PDB can specify either a minimum number of available Pods or a maximum number of unavailable Pods. It does not prevent every possible Pod failure; involuntary disruptions such as hardware failures are different. ReplicaSets manage replica counts, LimitRanges define namespace-level resource defaults and constraints, and ResourceQuotas restrict aggregate resource consumption. PDBs are therefore primarily concerned with maintaining application availability during planned disruptions.

Question 262

Which field specifies a Pod’s priority class?

1. priorityClassName
2. importanceLevel
3. schedulingPriority
4. podRank

Correct Answer: 1

Explanation:

The priorityClassName field associates a Pod with a PriorityClass. The resulting priority value influences scheduling order and can participate in preemption when cluster resources are insufficient. Higher-priority workloads can receive preferential scheduling treatment under appropriate conditions. The field references the name of an existing PriorityClass rather than directly containing a numeric priority value. Administrators should understand that priority does not guarantee immediate placement because other scheduling constraints still apply. Resource requests, taints, affinity rules, and available capacity can all affect whether a higher-priority Pod has a feasible node.

Question 263

What does preemption allow the scheduler to do?

1. Increase node capacity
2. Modify resource requests
3. Remove lower-priority Pods
4. Disable scheduling constraints

Correct Answer: 3

Explanation:

Pod preemption allows the scheduler to consider removing lower-priority Pods when doing so can create a feasible placement for a higher-priority pending Pod. The scheduler evaluates whether preemption can satisfy the higher-priority workload’s requirements while respecting relevant constraints. Preemption does not increase physical node capacity or modify a Pod’s resource requests. It also does not simply disable scheduling rules. Because preemption can disrupt existing workloads, administrators should design priorities carefully and use appropriate disruption controls. Understanding priority and preemption is important when diagnosing why a high-priority Pod remains pending or causes other Pods to be evicted.

Question 264

Which object defines reusable scheduling priority values?

1. SchedulingProfile
2. PriorityClass
3. PlacementPolicy
4. SchedulerRule

Correct Answer: 2

Explanation:

PriorityClass defines reusable priority values that Pods can reference through priorityClassName. It provides a named representation of scheduling importance and can influence scheduling order and preemption decisions. A PriorityClass is cluster-scoped, allowing multiple namespaces to use the same priority definition. Scheduling profiles configure scheduler behavior, while the other listed terms are not standard Kubernetes objects for defining Pod priority. When reviewing workload scheduling, administrators should inspect both the Pod’s selected PriorityClass and the actual numeric value associated with that class.

Question 265

Which resource limits the combined object count in a namespace?

1. ResourceQuota
2. PriorityClass
3. LimitRange
4. PodDisruptionBudget

Correct Answer: 1

Explanation:

ResourceQuota can limit aggregate consumption within a namespace, including counts of selected Kubernetes objects. For example, a namespace can be restricted to a defined number of Pods, Services, or other supported resource types. This differs from LimitRange, which applies constraints or defaults to individual resources such as Pods or containers. PriorityClass affects scheduling importance, while PodDisruptionBudget concerns voluntary availability disruptions. When a new object is rejected even though the individual workload appears valid, checking the namespace’s ResourceQuota is a useful troubleshooting step.

Question 266

Which feature supplies default resource requests for containers?

1. PriorityClass
2. PodSecurity
3. NetworkPolicy
4. LimitRange

Correct Answer: 4

Explanation:

A LimitRange can define default CPU or memory requests and limits for containers created within a namespace. This helps ensure that workloads receive defined resource settings even when the Pod specification does not explicitly provide them. LimitRange can also establish minimum and maximum resource boundaries. It applies to individual resources rather than the namespace-wide aggregate consumption controlled by ResourceQuota. When a newly created Pod unexpectedly receives resource values, administrators should inspect the namespace’s LimitRange objects to determine whether defaults were automatically applied.

Question 267

Which QoS class applies when every container has equal CPU and memory requests and limits?

1. Burstable
2. Guaranteed
3. BestEffort
4. Flexible

Correct Answer: 2

Explanation:

A Pod receives the Guaranteed QoS class when its containers meet the required CPU and memory request-and-limit conditions, including matching values for those resources. Guaranteed workloads receive stronger resource guarantees compared with less constrained QoS classes. Burstable applies when at least some resource requests or limits are specified without meeting Guaranteed requirements. BestEffort applies when no CPU or memory requests or limits are configured. QoS classification can influence eviction behavior when a node experiences resource pressure, so understanding how Kubernetes categorizes workloads is important during resource-related troubleshooting.

Question 268

What does emptyDir provide to containers in one Pod?

1. Persistent cloud storage
2. Cluster-wide shared storage
3. Temporary shared filesystem
4. Remote database storage

Correct Answer: 3

Explanation:

An emptyDir volume provides temporary storage associated with a Pod. The directory is created when the Pod is assigned to a node and can be shared among containers within that Pod. Its contents remain available while the Pod exists on that node but are removed when the Pod is deleted. emptyDir is useful for scratch files, temporary processing data, or communication between containers. It should not be treated as durable application storage. PersistentVolume-based storage is more appropriate when data must survive Pod replacement or rescheduling.

Question 269

Which volume type exposes a ConfigMap as files?

1. configMap
2. settingsVolume
3. configurationMount
4. configFiles

Correct Answer: 4

Explanation:

A ConfigMap can be mounted into a Pod using a volume whose source references the ConfigMap. Kubernetes presents selected ConfigMap keys as files within the mounted directory. This allows applications to consume configuration without embedding values directly into container images. Individual keys can be mapped to specific paths when more control is required. ConfigMaps are intended for non-sensitive configuration data; credentials should generally use Secrets instead. When a mounted configuration appears stale, administrators should also consider how the application reads files and whether it reloads changed configuration automatically.

Question 270

Which object stores non-sensitive application configuration?

1. ConfigMap
2. Secret
3. Lease
4. Event

Correct Answer: 1

Explanation:

A ConfigMap stores non-confidential configuration data that applications can consume through environment variables, command arguments, or mounted files. It is useful for separating configuration from container images so the same image can be deployed in different environments with different settings. Secrets are intended for sensitive information such as credentials, while Leases support coordination and Events record cluster-related occurrences. ConfigMaps do not provide encryption simply because they are configuration objects, so sensitive values should not be placed there merely for convenience.

Question 271

Which object is intended for sensitive configuration values?

1. ConfigMap
2. Lease
3. Secret
4. EndpointSlice

Correct Answer: 3

Explanation:

A Secret is Kubernetes’ resource for holding sensitive information such as passwords, tokens, or certificates. Pods can consume Secrets through environment variables or mounted volumes. Although Kubernetes provides mechanisms for protecting Secret data, administrators must still configure appropriate access controls and storage protections because authorization to read Secrets can expose their contents. ConfigMaps are intended for non-sensitive configuration, Leases support coordination, and EndpointSlices represent network endpoints. When designing workload access, Secret permissions should follow least-privilege principles so that applications receive only the credentials they actually require.

Question 272

Which API object coordinates leader ownership among components?

1. EndpointSlice
2. Lease
3. Secret
4. ConfigMap

Correct Answer: 2

Explanation:

The Lease object is commonly used for coordination mechanisms such as leader election. Components can update Lease information to indicate which participant currently holds leadership and to maintain a renewal timestamp. This allows distributed components to coordinate without relying on a custom external locking system. EndpointSlices describe Service endpoints, Secrets hold sensitive data, and ConfigMaps provide configuration. When investigating controller or scheduler coordination issues, examining Lease objects can reveal whether expected leadership records are being created and renewed.

Question 273

Which resource records notable cluster occurrences?

1. Lease
2. ConfigMap
3. Event
4. Secret

Correct Answer: 4

Explanation:

Kubernetes Events record notable occurrences associated with resources, such as scheduling failures, image-pull problems, mount errors, or successful lifecycle operations. They are particularly useful for troubleshooting because they often provide concise explanations of what Kubernetes attempted to do. Events are not intended to replace application logs or provide permanent audit history. Administrators commonly inspect Events when a Pod remains pending, fails to start, or repeatedly encounters infrastructure problems. Other resources such as ConfigMaps and Secrets serve configuration purposes rather than recording operational occurrences.

Question 274

Which object represents a lease used for coordination?

1. Event
2. Secret
3. Lease
4. ConfigMap

Correct Answer: 3

Explanation:

A Lease is a coordination object maintained through the Kubernetes API. It can record information such as the current holder identity and renewal timing, enabling distributed components to implement leader-election or other coordination patterns. Leases are lightweight compared with storing coordination state in larger configuration objects. Events record cluster occurrences, Secrets contain sensitive values, and ConfigMaps hold configuration. When a control-plane or application component uses leader election, Lease objects can help administrators understand which participant currently holds leadership.

Question 275

Which resource provides declarative validation for custom API objects?

1. CustomResourceDefinition
2. ConfigMap
3. Service
4. PriorityClass

Correct Answer: 1

Explanation:

A CustomResourceDefinition, or CRD, extends the Kubernetes API with a new custom resource type. Its schema can define the structure and validation rules for instances of that custom resource. This allows Kubernetes to store and validate domain-specific objects using the same API machinery used by built-in resources. ConfigMaps store configuration, Services provide networking abstractions, and PriorityClasses define scheduling priority values. When building or troubleshooting operators, understanding the CRD is essential because it establishes the API structure that the controller watches and manages.

Question 276

Which controller typically reconciles resources created from a CRD?

1. kube-proxy
2. Custom controller
3. CoreDNS
4. kubelet

Correct Answer: 2

Explanation:

A custom controller or operator commonly watches custom resources and reconciles their desired state with the actual cluster state. The CRD defines the API resource, while the controller supplies the behavior that gives that resource operational meaning. For example, a controller might create Deployments, Services, or other resources based on a custom object. kube-proxy manages Service networking, CoreDNS handles DNS, and kubelet manages workloads on individual nodes. If a custom resource exists but nothing happens after it is created, administrators should investigate whether the responsible controller is running and watching the correct resource.

Question 277

Which field in a CRD defines its served API version?

1. storage
2. conversion
3. served
4. names

Correct Answer: 3

Explanation:

Within a CRD version definition, the served field indicates whether that version is served through the Kubernetes API. A CRD can contain multiple versions, allowing APIs to evolve while maintaining compatibility. The storage field identifies the version used for persisted representation, while conversion configuration can control how objects move between versions. The names section defines resource naming information. When a custom resource version unexpectedly returns a “not found” response, administrators should inspect the CRD’s version configuration and verify whether that version is currently served.

Question 278

What does the CRD storage flag identify?

1. Preferred client version
2. External storage system
3. Network storage driver
4. Persisted API version

Correct Answer: 4

Explanation:

For a CRD with multiple versions, the storage flag identifies the version used to persist custom resource objects in the Kubernetes storage layer. Exactly one served version must be designated as the storage version. This is separate from deciding which API versions clients can access. Conversion mechanisms can translate objects between served versions and the storage representation. The storage flag does not identify a physical storage driver or an external storage system. Understanding this distinction becomes important when evolving custom APIs and troubleshooting version conversion or migration behavior.

Question 279

Which API group contains Role and ClusterRole resources?

1. apps
2. rbac.authorization.k8s.io
3. scheduling.k8s.io
4. storage.k8s.io

Correct Answer: 2

Explanation:

Role and ClusterRole belong to the rbac.authorization.k8s.io API group. This group provides Kubernetes Role-Based Access Control resources used to define permissions. Role is namespace-scoped, while ClusterRole is cluster-scoped and can also describe permissions that are later granted within a namespace through an appropriate binding. The apps group contains workload resources such as Deployments, while scheduling and storage groups contain resources for their respective functions. Knowing the correct API group is useful when writing manifests, querying resources, or diagnosing authorization configuration.

Question 280

Which binding grants a Role’s permissions to subjects?

1. RoleBinding
2. RoleGrant
3. PermissionLink
4. AccessBinding

Correct Answer: 1

Explanation:

A RoleBinding grants the permissions defined by a Role or, in some cases, a ClusterRole to specified subjects within a namespace. Subjects can include users, groups, or ServiceAccounts. The binding connects the identity to the permission set; creating a Role alone does not automatically grant anyone access. ClusterRoleBinding provides cluster-wide binding behavior for a ClusterRole. When troubleshooting an authorization failure, administrators should examine both the role rules and the relevant binding because either side can prevent the intended permission from being effective.