Certified Kubernetes Administrator (CKA) practice questions
8 sample questions from our 300-question CKA bank — one from each official domain, with the answer and a full explanation under each. Every question is original, written against the published exam objectives, and quality-checked before it reaches you.
Question 1 · Troubleshooting
A payments pod at Ostrella Bank keeps restarting and `kubectl get pods` reports `CrashLoopBackOff`. The container exits about one second after starting, and by the time Priya runs `kubectl logs ledger-api-6c9d5`, the freshly started container has written nothing yet. Which command is most likely to reveal why the container keeps dying?
- A.kubectl get pod ledger-api-6c9d5 -o yaml
- B.kubectl exec -it ledger-api-6c9d5 -- cat /var/log/app.log
- C.kubectl describe node ledger-api-6c9d5
- D.kubectl logs ledger-api-6c9d5 --previous
Show answer & explanation
Answer: D
`--previous` prints the logs of the last terminated instance of the container, which captured whatever the process wrote before it crashed. `kubectl exec` fails because there is no stable running container to attach to during a crash loop, and the pod's YAML shows status fields but not the application's own error output.
Question 2 · Cluster Architecture, Installation & Configuration
Sundry Cloud runs a three-node kubeadm cluster on v1.34 and wants v1.35. After updating the kubeadm binary on the primary control-plane node, what is the correct next step in the supported upgrade workflow?
- A.Upgrade every worker's kubelet in parallel to shorten the maintenance window
- B.Run `kubeadm upgrade node` on each worker before touching the control plane
- C.Drain all workers and reinstall them from images built with v1.35 components
- D.Run `kubeadm upgrade plan`, then `kubeadm upgrade apply v1.35.x` on that control-plane node
Show answer & explanation
Answer: D
kubeadm upgrades start on the first control-plane node: `kubeadm upgrade plan` validates the path and `kubeadm upgrade apply` moves the control-plane components to the target version, with workers following one at a time via `kubeadm upgrade node`. Upgrading worker kubelets first would violate the version skew policy, since a kubelet must not be newer than the API server.
Question 3 · Services & Networking
Yarrow Systems runs an internal gRPC service that must be reachable from other pods at a stable virtual IP but must stay unreachable from outside the cluster. Which Service type fits?
- A.ExternalName
- B.LoadBalancer
- C.ClusterIP
- D.NodePort
Show answer & explanation
Answer: C
ClusterIP allocates a virtual IP routable only inside the cluster, giving pods a stable address without any external exposure. NodePort and LoadBalancer both open externally reachable entry points, and ExternalName is just a DNS alias to an outside hostname with no proxying at all.
Question 4 · Workloads & Scheduling
A Deployment at Tessera Logistics runs 8 replicas of a booking API with: ```yaml strategy: type: RollingUpdate rollingUpdate: maxSurge: 3 maxUnavailable: 0 ``` What happens during a rollout of a new image?
- A.All 8 pods are replaced simultaneously because the surge exceeds 25%
- B.The rollout pauses after each batch until an operator resumes it
- C.Up to 3 old pods are terminated first, then their replacements start
- D.New pods are added up to a total of 11, and old ones are removed only as replacements become Ready, keeping at least 8 Ready replicas throughout
Show answer & explanation
Answer: D
`maxUnavailable: 0` forbids dropping below the desired Ready count, so the controller must surge first: it creates up to 3 extra pods (11 total) and scales the old ReplicaSet down only as new pods pass readiness. This is the standard shape for zero-downtime rollouts, at the cost of temporary extra capacity.
Question 5 · Storage
At Ferrous Labs, a PVC requesting `ReadWriteMany` and 40Gi stays `Pending`. The cluster holds one unbound PV: 100Gi, `accessModes: [ReadWriteOnce]`, a matching storageClassName, and status `Available`. Why does binding fail?
- A.Claims cannot bind statically provisioned PVs once a StorageClass is set
- B.The claim must also set `volumeName` before any static PV can bind
- C.The PV does not offer the `ReadWriteMany` access mode the claim requires
- D.The PV is larger than the claim, and capacities must match exactly
Show answer & explanation
Answer: C
A PV binds only if it satisfies every requirement of the claim, and access modes are part of that contract: an RWO-only volume cannot satisfy an RWX claim. Capacity merely needs to be at least the requested size, so the 100Gi volume would otherwise be acceptable, and `volumeName` is optional.
Question 6 · Troubleshooting
Node `metal-worker-07` in Kestrel Freight's cluster has been `NotReady` for ten minutes. Dario connects over SSH and finds that containerd is healthy, but `systemctl status kubelet` reports `inactive (dead)`. What should he do to bring the node back?
- A.Start the kubelet with `systemctl enable --now kubelet` and watch its journal for errors
- B.Run `kubeadm join` again from the node to rebuild its configuration
- C.Delete the Node object so the control plane re-registers it automatically
- D.Restart containerd, since the kubelet depends on the runtime socket
Show answer & explanation
Answer: A
The kubelet is the agent that reports node health, so when its systemd unit is dead the node goes NotReady even though the runtime is fine; starting and enabling the unit restores the heartbeat. Restarting containerd changes nothing because the runtime is already healthy, and re-running `kubeadm join` is unnecessary on a node that is already part of the cluster.
Question 7 · Cluster Architecture, Installation & Configuration
Thea is adding a worker to Oakline CRM's cluster, but the `kubeadm join` command saved from the original bootstrap fails with `token has expired`. What is the quickest supported way to proceed?
- A.Copy `/etc/kubernetes/admin.conf` to the worker and start the kubelet against it
- B.On a control-plane node, run `kubeadm token create --print-join-command` and use its output on the worker
- C.Re-run `kubeadm init phase bootstrap-token` with the expired token to reactivate it
- D.Set `--token-ttl=0` on the API server and retry the old command
Show answer & explanation
Answer: B
Bootstrap tokens default to a 24-hour TTL, so joins attempted later need a fresh token; `kubeadm token create --print-join-command` mints one and prints a complete join command including the CA certificate hash. An expired token cannot be reactivated, and copying admin.conf around bypasses the join flow while handing the node cluster-admin credentials.
Question 8 · Services & Networking
A manifest at Optern Media declares: ```yaml apiVersion: v1 kind: Service spec: type: NodePort ports: - port: 443 targetPort: 8443 nodePort: 9443 ``` The API server rejects it with `provided port is not in the valid range`. Why?
- A.Ports below 10000 are reserved for system daemons on the node
- B.NodePort values must fall inside the cluster's service node port range, 30000-32767 by default
- C.`nodePort` must equal `port` so kube-proxy can map traffic consistently
- D.A NodePort Service cannot forward to a `targetPort` different from `port`
Show answer & explanation
Answer: B
Node ports are allocated from the API server's `--service-node-port-range`, which defaults to 30000-32767, so 9443 is out of range; either pick a port inside the range or omit `nodePort` and let the control plane allocate one. The three fields are otherwise independent — `port`, `targetPort`, and `nodePort` may all differ.
292+ more questions, free
Full-length, timed or practice mode, weighted to the official blueprint — with per-domain scoring so you know exactly where you stand.
Start the full practice exam →