View Full CNCF CKA Exam Dumps and Practice Test Dumps

 

Question 81

Which Kubernetes object provides temporary storage tied to a Pod’s lifetime?

1. PersistentVolume
2. StorageClass
3. ConfigMap
4. EmptyDir

Correct Answer: 4

Explanation:

An emptyDir volume provides temporary storage that exists for the lifetime of a Pod. When the Pod is assigned to a node, Kubernetes creates the directory for the containers that use it. Containers within the same Pod can share this storage. When the Pod is removed from the node, the contents of the emptyDir volume are deleted. This makes it useful for temporary files, shared scratch space, caching, or exchanging data between containers. Unlike persistent storage resources, emptyDir is not intended to preserve application data after the Pod itself disappears.

Question 82

Which command displays the active kubeconfig context?

1. kubectl config current-context
2. kubectl config get-contexts
3. kubectl cluster-info
4. kubectl version

Correct Answer: 1

Explanation:

The kubectl config current-context command shows which kubeconfig context is currently active. A context combines information such as a cluster, user credentials, and namespace. This command is particularly useful before performing administrative operations because it confirms the target environment for subsequent kubectl commands. The get-contexts command instead lists available contexts, while cluster-info provides information about cluster endpoints. Checking the current context helps prevent accidental operations against the wrong Kubernetes cluster.

Question 83

What does an init container do before application containers start?

1. Exposes a Service
2. Performs startup preparation
3. Creates a PersistentVolume
4. Changes cluster networking

Correct Answer: 2

Explanation:

Init containers run before the regular application containers in a Pod. Kubernetes requires each init container to complete successfully before starting the next one. They are commonly used for initialization tasks such as preparing files, checking dependencies, generating configuration, or waiting for a prerequisite service. Unlike normal application containers, init containers execute in sequence rather than continuously alongside the main workload. This behavior makes them useful when an application requires a predictable preparation stage before its primary processes can begin.

Question 84

Which field controls how long Kubernetes waits during Pod termination?

1. restartPolicy
2. activeDeadlineSeconds
3. terminationGracePeriodSeconds
4. minReadySeconds

Correct Answer: 3

Explanation:

terminationGracePeriodSeconds specifies the amount of time Kubernetes gives a Pod’s containers to terminate gracefully after termination begins. During this period, containers can perform cleanup and respond to termination signals. If the containers have not stopped when the grace period expires, Kubernetes can forcefully terminate them. This setting is important for workloads that need time to close connections, flush data, or complete cleanup operations. It should be chosen according to the application’s shutdown behavior rather than simply using an arbitrary value.

Question 85

Which Job setting determines how many successful Pod completions are required?

1. completions
2. parallelism
3. backoffLimit
4. suspend

Correct Answer: 1

Explanation:

The completions field specifies the number of successful Pod completions required for a Kubernetes Job to finish successfully. For example, setting completions to 5 means the Job must achieve five successful completions. This differs from parallelism, which controls how many Pods may run simultaneously. backoffLimit controls retry behavior after failures, while suspend can temporarily stop Job execution. Understanding these fields is important when configuring batch workloads that must process a defined number of successful executions.

Question 86

Which CronJob policy prevents overlapping executions?

1. Allow
2. Replace
3. Forbid
4. Suspend

Correct Answer: 3

Explanation:

The Forbid value for a CronJob’s concurrencyPolicy prevents a new Job from starting when the previous scheduled Job is still running. This is useful when simultaneous executions could cause conflicts, duplicate processing, or excessive resource consumption. With Allow, overlapping executions are permitted. Replace terminates the currently running Job before starting the newly scheduled one. Choosing the appropriate policy depends on whether concurrent processing is safe and whether an existing execution should take precedence.

Question 87

What does a headless Service use for service discovery?

1. Node addresses
2. Individual Pod addresses
3. Gateway endpoints
4. Load balancer IPs

Correct Answer: 2

Explanation:

A headless Service is created by setting its clusterIP to None. Instead of providing a conventional virtual ClusterIP, Kubernetes DNS can return the individual Pod IP addresses associated with the Service. This behavior is particularly useful for StatefulSets and applications that need direct access to individual replicas. Clients can discover the actual endpoints through DNS rather than connecting through a single virtual service address. Headless Services are therefore commonly used when application components need endpoint-level awareness.

Question 88

Which Deployment feature lets an administrator inspect previous revisions?

1. EndpointSlice
2. Rollout history
3. ResourceQuota
4. PodDisruptionBudget

Correct Answer: 2

Explanation:

Deployment rollout history records revisions associated with changes to a Deployment’s Pod template. Administrators can inspect this history to determine which revisions exist and use revision information when managing rollbacks. This is particularly helpful when a recent configuration or image update causes unexpected behavior. Kubernetes maintains revision information through ReplicaSets associated with the Deployment. Examining rollout history is therefore an important administrative technique for understanding Deployment changes and identifying a previous revision that may need to be restored.

Question 89

Which container setting determines when an image is pulled?

1. imagePullPolicy
2. pullTimeout
3. downloadPolicy
4. registryMode

Correct Answer: 1

Explanation:

The imagePullPolicy field controls when Kubernetes attempts to pull a container image from its registry. Common policies include Always, IfNotPresent, and Never. Always causes Kubernetes to check the registry when starting the container, while IfNotPresent allows an existing local image to be reused. Never prevents Kubernetes from attempting a registry pull. Selecting the appropriate policy helps administrators control image freshness, registry usage, and behavior when nodes already contain the required image.

Question 90

Which Pod setting specifies the process identity used inside containers?

1. securityContext
2. podIdentity
3. runtimeUser
4. processAccount

Correct Answer: 1

Explanation:

A Pod or container securityContext can define security-related execution settings, including the user and group identity under which processes run. Options such as runAsUser and runAsGroup can be used to avoid running applications with unnecessary privileges. Security contexts can also control other behaviors, such as privilege escalation and filesystem group ownership. Applying an appropriate security context is an important Kubernetes administration practice because it allows workloads to operate with controlled permissions instead of automatically relying on highly privileged container processes.

Question 91

Which QoS class applies when every container has matching CPU and memory requests and limits?

1. Burstable
2. Guaranteed
3. BestEffort
4. Dedicated

Correct Answer: 2

Explanation:

A Pod receives the Guaranteed Quality of Service class when its containers have CPU and memory requests and limits specified appropriately, with each request matching its corresponding limit. QoS classification affects how Kubernetes prioritizes Pods during resource pressure. Burstable applies when resource requirements are specified but do not meet the Guaranteed conditions. BestEffort applies when no CPU or memory requests or limits are defined. Understanding QoS classes helps administrators anticipate Pod behavior during node resource contention and eviction situations.

Question 92

What does a topology spread constraint help distribute?

1. Container images
2. API requests
3. Pods across failure domains
4. Secrets across namespaces

Correct Answer: 3

Explanation:

Topology spread constraints help Kubernetes distribute Pods across topology domains such as zones, regions, or nodes. They are useful for improving workload availability and avoiding excessive concentration of replicas in one failure domain. Administrators can define topology keys and spread requirements that influence where new Pods should be scheduled. This mechanism provides more controlled distribution than simply relying on ordinary scheduling decisions. Properly configured topology spreading can reduce the impact of node or zone failures on replicated applications.

Question 93

Which resource prevents a namespace from exceeding defined aggregate limits?

1. ResourceQuota
2. LimitRange
3. PriorityClass
4. NodeRestriction

Correct Answer: 1

Explanation:

A ResourceQuota limits the aggregate amount of resources or objects that can be consumed within a namespace. Administrators can use quotas for CPU, memory, storage, object counts, and other supported resources. This helps prevent one namespace or team from consuming an excessive share of cluster capacity. A LimitRange serves a different purpose by defining default or permitted resource values for individual Pods or containers. ResourceQuota therefore operates at the namespace-wide level and is useful for enforcing organizational resource boundaries.

Question 94

Which taint effect prevents new Pods from being scheduled unless tolerated?

1. PreferNoSchedule
2. NoExecute
3. ScheduleOnly
4. NoSchedule

Correct Answer: 4

Explanation:

The NoSchedule taint effect prevents Kubernetes from scheduling new Pods onto a tainted node unless those Pods have a matching toleration. Existing Pods are not automatically removed solely because of a NoSchedule taint. NoExecute has stronger behavior because it can also cause existing non-tolerating Pods to be evicted. PreferNoSchedule represents a scheduling preference rather than an absolute prohibition. Administrators commonly use taints to reserve nodes for specific workloads or to keep unsuitable workloads away from specialized nodes.

Question 95

Which PersistentVolume field controls what happens after claim deletion?

1. volumeMode
2. storageClassName
3. persistentVolumeReclaimPolicy
4. mountOptions

Correct Answer: 3

Explanation:

The persistentVolumeReclaimPolicy determines what Kubernetes should do with a PersistentVolume after its associated claim is released. Common policies include Retain and Delete, depending on the storage implementation and configuration. Retain preserves the volume and its data for manual recovery or reuse procedures, while Delete allows supported storage resources to be removed automatically. Choosing the correct reclaim policy is important because it directly affects data preservation and storage cleanup when PersistentVolumeClaims are deleted.

Question 96

Which RBAC binding grants permissions from a ClusterRole within one namespace?

1. ClusterRoleBinding
2. RoleBinding
3. Role
4. ServiceAccount

Correct Answer: 2

Explanation:

A RoleBinding can associate a Role or ClusterRole with subjects such as users, groups, or ServiceAccounts within a specific namespace. When a ClusterRole is referenced by a RoleBinding, its permissions are restricted to the namespace where that binding exists. A ClusterRoleBinding, in contrast, grants the referenced ClusterRole’s permissions at the cluster level. This distinction is important when administrators need reusable permission definitions while still maintaining namespace-level access boundaries.

Question 97

Which Kubernetes mechanism can preserve an object until dependent cleanup finishes?

1. Labels
2. Annotations
3. Finalizers
4. Selectors

Correct Answer: 3

Explanation:

Finalizers are metadata entries that allow controllers or other components to perform cleanup before Kubernetes completes deletion of an object. When an object contains an active finalizer, Kubernetes records the deletion request but waits for the responsible controller to remove that finalizer. This mechanism is useful when external resources or additional cleanup actions must be handled before an object disappears completely. If a controller fails to remove its finalizer, the object can remain in a terminating state until the underlying issue is resolved.

Question 98

Which command displays container resource consumption for Pods?

1. kubectl top pods
2. kubectl describe pods
3. kubectl inspect pods
4. kubectl usage pods

Correct Answer: 1

Explanation:

The kubectl top pods command displays current resource usage for Pods when the cluster has the required metrics infrastructure available. It can show CPU and memory consumption, helping administrators identify workloads using unusually high resources. This command is useful during troubleshooting and resource analysis, especially when investigating performance issues or potential resource pressure. kubectl describe pods provides detailed object information but does not serve as the primary command for current resource metrics.

Question 99

Which Service type maps a DNS name to an external hostname?

1. ClusterIP
2. NodePort
3. ExternalName
4. LoadBalancer

Correct Answer: 3

Explanation:

An ExternalName Service maps a Kubernetes Service name to an external DNS hostname using a CNAME-style response. Unlike ClusterIP, NodePort, or LoadBalancer Services, it does not create a conventional virtual IP for routing traffic to Pods. This can provide a stable Kubernetes service name while the actual destination remains outside the cluster. ExternalName is useful when applications should reference an external service through Kubernetes DNS naming without requiring Kubernetes to manage the external endpoint itself.

Question 100

Which probe checks whether a container should receive network traffic?

1. Startup probe
2. Readiness probe
3. Liveness probe
4. Lifecycle hook

Correct Answer: 2

Explanation:

A readiness probe determines whether a container is currently prepared to receive traffic. When the readiness check fails, Kubernetes removes the Pod from the endpoints used by applicable Services, preventing traffic from being directed to an unready workload. This differs from a liveness probe, which determines whether a container should be restarted, and a startup probe, which helps handle applications requiring extended initialization time. Readiness checks are therefore especially important for applications that need time to become available after startup or during temporary dependency failures.