Linux Foundation / CNCF CKA: Certified Kubernetes Administrator

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Workloads and Scheduling

   A Deployment named web must roll out a new image while keeping at least two replicas available at all times. Which strategy setting should be configured?

   1. AA Recreate strategy which scales the old ReplicaSet down to zero before the new pods are scheduled
   2. BA RollingUpdate strategy with maxUnavailable set to 0 or 1 and an appropriate maxSurge
   3. CSetting replicas to 0 with kubectl scale deployment web --replicas=0 before using the new image
   4. DDeleting the web Deployment, then creating a new one from a revised manifest with the new image tag
   Show answer and explanationHide answer

   Correct answer: B

   RollingUpdate with a controlled maxUnavailable keeps capacity available during the change. Recreate stops all pods first, scaling to zero causes downtime, and deleting the Deployment removes the workload.

2. Question 2Cluster Architecture, Installation and Configuration

   An administrator needs to upgrade a kubeadm-based control plane from v1.31 to v1.32. Which order of operations is correct on the first control-plane node?

   1. AUpgrade the kubelet first on node, then run kubeadm upgrade apply without changing the kubeadm binary from v1.31
   2. BUpgrade the worker nodes first using kubeadm upgrade node, then move on to the control plane components
   3. CUpgrade the kubeadm binary, run kubeadm upgrade plan, then kubeadm upgrade apply, then drain and upgrade kubelet and kubectl
   4. DDelete the control plane static pod manifests and reinstall it from scratch with a fresh kubeadm init on this node
   Show answer and explanationHide answer

   Correct answer: C

   kubeadm must be upgraded first, then the plan is checked and applied on the control plane, after which kubelet and kubectl are upgraded with the node drained. Upgrading kubelet first or reinstalling the control plane breaks the supported order, and workers come after the control plane.

3. Question 3Troubleshooting

   A pod is in CrashLoopBackOff. Which command shows the logs from the previous container instance that crashed?

   1. Akubectl get nodes --all-namespaces
   2. Bkubectl logs pod-name --previous
   3. Ckubectl describe namespace default
   4. Dkubectl top pods only
   Show answer and explanationHide answer

   Correct answer: B

   kubectl logs with --previous shows output from the last terminated container, which usually contains the crash reason. The other commands do not show container logs from the crashed instance.

4. Question 4Services and Networking

   An application outside the cluster must reach a Service on a node port. Which Service type should be used?

   1. AClusterIP
   2. BNodePort
   3. CExternalName only for internal DNS
   4. DHeadless Service with no selector
   Show answer and explanationHide answer

   Correct answer: B

   NodePort exposes the Service on a port on each node so external clients can reach it. ClusterIP is internal only, ExternalName maps DNS names, and a headless Service without a selector does not route to pods.

5. Question 5Storage

   A pod needs persistent storage that survives pod restarts and is provisioned on demand from a StorageClass. Which object should the pod reference?

   1. AAn emptyDir volume only
   2. BA downward API volume
   3. CA ConfigMap
   4. DA PersistentVolumeClaim
   Show answer and explanationHide answer

   Correct answer: D

   A PVC requests storage that is dynamically provisioned through a StorageClass and persists beyond the pod. ConfigMaps hold configuration, emptyDir is ephemeral, and the downward API exposes metadata.