Certified Kubernetes Administrator (CKA) — Practice Exam

Question 1

A payments pod at Ostrella Bank keeps restarting and `kubectl get pods` reports `CrashLoopBackOff`. The container exits about one second after starting, and by the time Priya runs `kubectl logs ledger-api-6c9d5`, the freshly started container has written nothing yet. Which command is most likely to reveal why the container keeps dying?

Accepted Answer

kubectl logs ledger-api-6c9d5 --previous

Answer

kubectl get pod ledger-api-6c9d5 -o yaml

Answer

kubectl exec -it ledger-api-6c9d5 -- cat /var/log/app.log

Answer

kubectl describe node ledger-api-6c9d5

Question 2

Node `metal-worker-07` in Kestrel Freight's cluster has been `NotReady` for ten minutes. Dario connects over SSH and finds that containerd is healthy, but `systemctl status kubelet` reports `inactive (dead)`. What should he do to bring the node back?

Accepted Answer

Start the kubelet with `systemctl enable --now kubelet` and watch its journal for errors

Answer

Run `kubeadm join` again from the node to rebuild its configuration

Answer

Delete the Node object so the control plane re-registers it automatically

Answer

Restart containerd, since the kubelet depends on the runtime socket

Question 3

A batch pod at Calderon Foods sits in `Pending` and `kubectl describe pod nightly-etl-x2v` shows the event:

```
0/8 nodes are available: 8 Insufficient cpu.
```

The pod requests 6 CPUs, but the largest node in the cluster has 4 allocatable. Without adding hardware, what change lets the pod schedule?

Accepted Answer

Lower the pod's `requests.cpu` to a value that fits within a node's allocatable CPU

Answer

Raise `limits.cpu` so the kubelet grants the container more shares

Answer

Add a toleration so the scheduler can place the pod on a tainted node

Answer

Set `priorityClassName` so the scheduler preempts lower-priority pods

Question 4

Requests to the Service `quote-svc` at Trivena Insurance fail instantly, and `kubectl get endpoints quote-svc` prints `<none>` even though three healthy pods are running. The Service selector is `app: quote`, while the pods carry the label `app: quote-engine`. What is the correct fix?

Accepted Answer

Align the labels by updating the Service selector to `app: quote-engine` (or relabeling the pods)

Answer

Add a `readinessProbe` so the endpoints controller starts tracking the pods

Answer

Recreate the Service as type NodePort so it can find pods on every node

Answer

Point the Service's `targetPort` at the port number the containers expose

Question 5

A new Deployment at Sablewood Games shows `ImagePullBackOff`, and the pod events include:

```
Failed to pull image "registry.sablewood.internal/match/lobby:2.4.1":
pull access denied, authentication required
```

The registry requires a username and token. What is the standard way to let the kubelet pull this image?

Accepted Answer

Create a docker-registry Secret and reference it from the pod spec's `imagePullSecrets`

Answer

Add the registry hostname to the `insecure-registries` list on every node

Answer

Store the registry token in a ConfigMap mounted at `/root/.docker/config.json`

Answer

Switch the container's `imagePullPolicy` to `IfNotPresent` so a cached layer is used

Related practice exams