Free CKA practice test: 30 questions with answers

RollingUpdate with a controlled maxUnavailable keeps capacity available during the change. Recreate stops all pods first, scaling to zero causes downtime, and deleting the Deployment removes the workload.

A Job runs pods to completion and retries up to backoffLimit. DaemonSets run continuously on nodes, StatefulSets provide stable identities for stateful apps, and ReplicaSets keep long-running replicas.

A DaemonSet ensures one pod runs on each eligible node, including nodes that join later. A Job or CronJob runs to completion, and a fixed ReplicaSet does not cover every node.

The scheduler reports insufficient CPU when the requested resources do not fit on any node. Image errors appear as image pull failures, DNS policy and probes affect running pods rather than scheduling.

nodeSelector restricts scheduling to nodes carrying the matching label. hostAliases edits hosts files, containerPort declares ports, and probes check health.

Cordoning stops new scheduling, and draining evicts pods gracefully so controllers recreate them elsewhere. Deleting the node object or rebooting without draining causes abrupt disruption.

kubeadm must be upgraded first, then the plan is checked and applied on the control plane, after which kubelet and kubectl are upgraded with the node drained. Upgrading kubelet first or reinstalling the control plane breaks the supported order, and workers come after the control plane.

The kubelet runs as a systemd service, and its unit and drop-in files define startup flags and config paths. Application ConfigMaps, Dockerfiles and Ingress manifests do not control kubelet startup.

A RoleBinding in the staging namespace that references the view ClusterRole limits the granted permissions to that namespace. A ClusterRoleBinding would apply cluster-wide, a delete Role grants the wrong verb, and a label does not grant access.

spec.serviceAccountName selects the service account whose token the pod uses. nodeName pins scheduling, hostAliases edits /etc/hosts, and priorityClassName sets scheduling priority.

kubectl auth can-i checks authorization for a verb and resource in a namespace. Listing nodes, describing pods and showing resource usage do not answer the permission question.

etcdctl snapshot save, with the correct endpoint and TLS flags, creates a consistent etcd backup. kubectl has no etcd backup subcommand, kubelet directories do not contain cluster state, and kubeadm reset removes the node's configuration.

kubectl logs with --previous shows output from the last terminated container, which usually contains the crash reason. The other commands do not show container logs from the crashed instance.

A NotReady node usually means the kubelet is not reporting properly, so its service status and logs are the first check. Snapshot schedules, Ingress replicas and Helm history are unrelated to node readiness.

Checking selectors, endpoints and port mappings identifies where traffic is lost. Rebooting, image changes and namespace deletion are disruptive and do not target the likely cause.

Scheduler events and node capacity or taint mismatches explain why a pod cannot be placed. Application logs from crashes, Ingress host names and label colors do not explain scheduling failures.

Finding and freeing disk space, such as unused images and large logs, resolves pressure and stops evictions. Removing kubelet, adding pods and disabling networking make the problem worse.

kubectl logs with a label selector and --tail retrieves recent logs from matching pods. Watch, node description and top do not display the application logs.

NodePort exposes the Service on a port on each node so external clients can reach it. ClusterIP is internal only, ExternalName maps DNS names, and a headless Service without a selector does not route to pods.

Endpoints are populated from pods matching the selector that are Ready, so a mismatch or unready pods leaves endpoints empty. Name length and CPU do not control endpoints, and DNS problems produce name resolution errors.

LoadBalancer and NodePort make a Service reachable from outside the cluster. ClusterIP is internal only, and headless and ExternalName services do not provide that exposure by themselves.

The fully qualified cluster DNS name includes the service, namespace and svc.cluster.local suffix. The other formats do not follow the Kubernetes service DNS pattern.

An Ingress resource does nothing without an Ingress controller that implements it. Storage, ConfigMaps and ServiceAccounts do not route HTTP traffic.

Setting clusterIP to None creates a headless Service, which returns pod addresses through DNS. NodePort, external traffic policy and session affinity do not make a Service headless.

A PVC requests storage that is dynamically provisioned through a StorageClass and persists beyond the pod. ConfigMaps hold configuration, emptyDir is ephemeral, and the downward API exposes metadata.

A pending claim usually means the provisioner is unavailable or the requested class, size or access mode cannot be satisfied. Image tags, Service types and unrelated labels do not affect claim binding.

A Delete reclaim policy removes the underlying volume when its claim is deleted, which removes the data. Retaining, converting to ConfigMaps and ignoring claims do not describe this policy.

emptyDir gives containers in the same pod shared scratch space that lives with the pod. A PersistentVolume is unnecessary for scratch data, NetworkPolicies do not provide storage, and Secret volumes are read-only data sources.

ReadWriteMany allows many nodes to mount the volume for read and write, which requires a backend that supports it. ReadWriteOnce limits mounting to one node, and ReadOnlyOnce is not the standard mode for shared writes.

The StorageClass must set allowVolumeExpansion to true before a claim can be resized. Deleting pods, rebooting nodes and renaming claims are not requirements.