View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 281

Which file commonly defines a static Pod on a kubeadm control plane?

1. /etc/kubernetes/config.yaml
2. /etc/kubernetes/manifests/
3. /var/lib/kubelet/static/
4. /opt/kubernetes/pods/

Correct Answer: 2

Explanation:

Static Pods are managed directly by the kubelet from a configured manifest directory. In a typical kubeadm control-plane installation, the static Pod manifests for components such as the API server, scheduler, and controller manager are located under /etc/kubernetes/manifests/. The kubelet watches this directory and creates or updates the corresponding Pods when manifest files change. These Pods are different from ordinary workload Pods because they are not created through a Deployment or another controller. When a control-plane component unexpectedly disappears, checking the static Pod manifest directory and kubelet configuration is an important troubleshooting step.

Question 282

Which command shows kubeadm certificate expiration information?

1. kubeadm certs list
2. kubeadm certs inspect
3. kubeadm certificate-status
4. kubeadm show-certificates

Correct Answer: 1

Explanation:

kubeadm certs list displays information about certificates managed by kubeadm, including their expiration dates. This is useful when administering clusters because expired control-plane certificates can prevent components from communicating correctly. Administrators can use the command proactively to identify certificates approaching expiration rather than waiting for authentication failures. Certificate management should be performed carefully because Kubernetes control-plane components depend on these credentials for secure communication. When diagnosing TLS-related failures in a kubeadm cluster, checking certificate status is a useful step before replacing configuration or restarting unrelated components.

Question 283

Which kubeadm command renews control-plane certificates?

1. kubeadm certs refresh
2. kubeadm certs renew
3. kubeadm certificates update
4. kubeadm tls rotate

Correct Answer: 2

Explanation:

kubeadm certs renew is used to renew certificates managed by kubeadm. Certificate renewal is an important cluster-maintenance task because control-plane components rely on valid certificates for authenticated communication. After renewal, administrators may need to restart affected static Pods or otherwise ensure components reload their updated credentials, depending on the certificate involved. Renewal should be performed with awareness of the cluster’s certificate-management model. In a troubleshooting scenario involving expired control-plane credentials, confirming certificate validity first helps distinguish certificate problems from issues involving the API server, etcd, or kubelet.

Question 284

Which kubeadm command prepares a node to join a cluster?

1. kubeadm cluster-init
2. kubeadm node-register
3. kubeadm join
4. kubeadm worker-add

Correct Answer: 3

Explanation:

kubeadm join connects a new node to an existing Kubernetes cluster. The command uses bootstrap information supplied by the control plane to establish trust and configure the joining node. Worker nodes commonly use the generated join command after the control plane has been initialized. Control-plane nodes can also join using additional kubeadm parameters appropriate for that role. If joining fails, administrators should inspect connectivity to the API server, bootstrap credentials, system prerequisites, and kubelet status. The join operation is distinct from cluster initialization, which is performed with kubeadm init.

Question 285

Which control-plane component stores cluster state persistently?

1. kubelet
2. etcd
3. kube-proxy
4. CoreDNS

Correct Answer: 2

Explanation:

etcd is the distributed key-value store used by Kubernetes to persist API server data representing cluster state. Resources such as Pods, Services, ConfigMaps, Secrets, and many other objects ultimately have their state represented through the Kubernetes API and stored in etcd. The API server provides access to this state, while kubelet manages workloads on nodes and kube-proxy implements Service networking behavior. Because etcd contains critical cluster information, reliable backups and careful access controls are important. Data loss or corruption in etcd can seriously affect the ability to recover the cluster’s desired state.

Question 286

Which control-plane component validates API requests?

1. kube-apiserver
2. kube-scheduler
3. kube-controller-manager
4. etcd

Correct Answer: 1

Explanation:

The kube-apiserver is the central component that exposes the Kubernetes API and processes API requests. It performs authentication and authorization checks as part of request handling and applies admission processing before accepted objects are persisted. The scheduler selects nodes for unscheduled Pods, the controller manager runs reconciliation controllers, and etcd stores API data. Because the API server is the primary entry point for Kubernetes operations, failures there can affect nearly every cluster management operation. Troubleshooting API connectivity therefore often begins by checking the API server process, endpoint, certificates, and related control-plane dependencies.

Question 287

Which component watches unscheduled Pods and selects nodes?

1. kubelet
2. kube-scheduler
3. kube-proxy
4. cloud-controller-manager

Correct Answer: 4

Explanation:

The kube-scheduler is responsible for finding Pods that do not yet have a node assignment and selecting suitable nodes for them. It evaluates scheduling constraints such as resource availability, affinity rules, taints, topology requirements, and other conditions. The kubelet runs workloads after they are assigned to a node, while kube-proxy handles Service networking. The cloud-controller-manager integrates Kubernetes with cloud-provider functionality. When a Pod remains pending without an obvious application-level problem, scheduler behavior and events can provide clues about why no suitable node was selected.

Question 288

Which component maintains node-local container execution?

1. kube-scheduler
2. kubelet
3. etcd
4. kube-controller-manager

Correct Answer: 3

Explanation:

The kubelet is the primary node agent responsible for ensuring that the containers described by assigned Pod specifications are running and healthy. It communicates with the container runtime and reports workload status back to the Kubernetes control plane. The scheduler determines placement, etcd stores cluster state, and the controller manager runs reconciliation loops. If a Pod has already been assigned to a node but its containers are not starting, examining kubelet logs and the container runtime is often more useful than investigating scheduler behavior. Node-level configuration and resource conditions can also influence kubelet operations.

Question 289

Which API component persists accepted object state through etcd?

1. kube-apiserver
2. kubelet
3. kube-scheduler
4. kube-proxy

Correct Answer: 1

Explanation:

The kube-apiserver is responsible for handling Kubernetes API operations and interacting with etcd to persist accepted resource state. Clients normally communicate with the API server rather than directly modifying etcd. This architecture provides centralized API validation, authentication, authorization, and admission processing. The kubelet operates on individual nodes, the scheduler handles Pod placement, and kube-proxy manages Service networking. When an object appears to be accepted but does not persist correctly, administrators should investigate API server behavior and its connection to etcd rather than treating the kubelet as the storage component.

Question 290

Which Linux service commonly supervises kubelet startup?

1. kubeadm
2. systemd
3. containerd
4. crictl

Correct Answer: 2

Explanation:

On many Linux Kubernetes nodes, systemd manages the kubelet service. Administrators can use systemd tools to start, stop, restart, enable, and inspect kubelet status. The container runtime, such as containerd, is responsible for running containers but does not generally supervise the kubelet process itself. kubeadm performs cluster setup and configuration tasks, while crictl provides a command-line interface to the container runtime. When a kubelet fails to start after a configuration change, systemd status and journal information are useful sources of diagnostic details.

Question 291

Which command shows the current Kubernetes client context?

1. kubectl current-context
2. kubectl context-current
3. kubectl active-context
4. kubectl show-context

Correct Answer: 3

Explanation:

The kubectl config current-context command identifies the kubeconfig context currently selected by kubectl. A context combines information such as a cluster, user credentials, and optionally a namespace. Knowing the active context is essential when working with multiple clusters because commands may otherwise be executed against an unintended environment. Administrators should verify the context before performing destructive operations. If a command appears to affect the wrong cluster, inspecting the current context and available contexts is an important first troubleshooting step.

Question 292

Which kubeconfig section contains cluster endpoint information?

1. users
2. contexts
3. preferences
4. clusters

Correct Answer: 4

Explanation:

The clusters section of a kubeconfig contains information describing Kubernetes API endpoints and associated certificate authority data. The users section contains authentication information, while contexts connect a cluster with a user and optional namespace. Preferences contain client configuration preferences. Understanding these sections is useful when diagnosing authentication or connectivity problems because an incorrect server address belongs to the cluster configuration, whereas incorrect credentials belong to the user configuration. Administrators managing several environments should carefully maintain separate and clearly identifiable contexts.

Question 293

Which kubeconfig field selects a default namespace for a context?

1. namespace
2. defaultNamespace
3. contextNamespace
4. scope

Correct Answer: 1

Explanation:

A kubeconfig context can specify a namespace value that becomes the default namespace for kubectl commands using that context. This allows administrators to avoid repeatedly adding -n when working primarily within one namespace. The setting does not restrict the user’s permissions to that namespace; it only establishes the default target for commands that do not explicitly specify another namespace. When kubectl appears to return unexpected resources, checking the active context and its configured namespace can explain why commands are operating against a different namespace than expected.

Question 294

Which output format exposes complete resource fields as JSON?

1. -o yaml
2. -o wide
3. -o json
4. -o name

Correct Answer: 3

Explanation:

The -o json output option displays a Kubernetes resource in JSON form, including its structured API fields. This is useful for scripting, inspecting fields that are not visible in table output, and extracting information with JSON-processing tools. YAML provides a different structured representation, wide adds selected columns to human-readable output, and name prints resource names. When writing automation, JSON output can provide predictable structured data for tools that process JSON directly. Administrators should still verify the exact resource schema when scripting against API fields.

Question 295

Which kubectl option filters resources using a label expression?

1. –selector
2. –label-filter
3. –match-label
4. –labels-only

Correct Answer: 3

Explanation:

The –selector option allows kubectl commands to select resources using Kubernetes label selectors. Labels provide a flexible mechanism for grouping and identifying resources without relying on resource names alone. Selectors can use equality-based or set-based expressions depending on the command and syntax. This is useful when administrators need to inspect or operate on a group of related resources, such as all Pods belonging to a particular application. Label selection should be used carefully with commands that modify or delete resources because a broad selector can affect many objects.

Question 296

Which command displays labels attached to a resource in the standard table?

1. kubectl get pods –labels
2. kubectl get pods –show-labels
3. kubectl get pods –display-tags
4. kubectl get pods –with-labels

Correct Answer: 4

Explanation:

The –show-labels option causes kubectl to display resource labels alongside the normal table output. This is useful when checking whether Pods or other objects have the labels expected by selectors used by Services, Deployments, or policies. Labels are metadata used for organization and selection, so incorrect labels can cause resources to behave unexpectedly even when the workloads themselves are healthy. If a Service has no matching backends, checking the labels on the Pods and comparing them with the Service selector is a practical troubleshooting technique.

Question 297

Which command displays the resources supported by an API server?

1. kubectl api-resources
2. kubectl supported-objects
3. kubectl resource-types
4. kubectl api-list

Correct Answer: 4

Explanation:

The kubectl api-resources command lists the resource types available through the Kubernetes API server. Its output includes information such as resource names, short names, API groups, namespaced status, and supported verbs. This makes the command useful when an administrator knows the general type of object needed but is unsure of its exact Kubernetes resource name or API group. It can also help verify whether a custom resource has been successfully registered. The command queries the server’s discovery information rather than relying solely on locally remembered resource names.

Question 298

Which command explains fields available in a Kubernetes resource?

1. kubectl schema
2. kubectl inspect
3. kubectl explain
4. kubectl reference

Correct Answer: 1

Explanation:

kubectl explain provides documentation about Kubernetes resource fields using the API schema information available to kubectl. It can be used at different levels of a resource hierarchy to inspect fields and understand their purpose. This is especially helpful during the CKA because administrators often need to construct or modify manifests without relying on external references. The command can reveal nested fields within objects, helping users determine where a particular configuration belongs. When uncertain about a field’s spelling or location, kubectl explain is a practical built-in reference tool.

Question 299

Which command checks whether a user can delete Pods in a namespace?

1. kubectl auth can-i delete pods
2. kubectl permission check pods
3. kubectl verify-access pods
4. kubectl rbac-test pods

Correct Answer: 4

Explanation:

kubectl auth can-i delete pods checks whether the current identity is authorized to perform the delete operation on Pod resources. The command is useful for validating RBAC permissions before attempting an operation that might fail. It can also be used with a specified namespace or impersonated identity when troubleshooting access for another user or ServiceAccount. Authorization depends on the effective combination of roles and bindings, so directly testing the permission can be faster than manually inspecting every relevant RBAC object. This makes auth can-i particularly useful during permission troubleshooting.

Question 300

Which command lists Pods together with their assigned node names?

1. kubectl get pods –nodes
2. kubectl get pods -o wide
3. kubectl get pods –placement
4. kubectl get pods –node-info

Correct Answer: 2

Explanation:

kubectl get pods -o wide adds additional information to the standard Pod listing, including the node on which each Pod is running. This is useful when troubleshooting scheduling distribution, node-specific failures, or workloads concentrated unexpectedly on particular nodes. The output can also provide other details beyond the default columns. When a Pod is behaving differently from its replicas, identifying its assigned node can help determine whether the issue is related to node configuration, capacity, networking, or runtime health. This makes wide output a practical first step for node-placement investigations.