Practice workspace
Try 12 supported questions from the 12-question bank. Check each answer when you are ready and keep this preview’s progress privately in your browser.
Free preview
This sample includes answers, available explanations, official references and curated community discussion. An Exam Pass unlocks the private complete bank for this exam.
Answer support
12 questions in this bank
Which control plane component is responsible for assigning newly created pods to nodes?
Explanation
The scheduler watches for pods with no assigned node and selects one based on resource requests, affinity rules, taints and tolerations. The kubelet then runs the pod once it is bound, kube-proxy handles service networking, and the controller manager runs reconciliation loops.
You need to take a backup of cluster state so the control plane can be restored. Which component holds that state?
Explanation
etcd is the consistent key-value store holding all cluster objects, so a snapshot of etcd is the backup of cluster state. The API server is stateless in front of it, and kubelets and runtimes hold only node-local information.
A node is marked with a taint. Which pod-level setting allows a pod to be scheduled onto it anyway?
Explanation
Taints repel pods unless the pod carries a matching toleration. nodeSelector and affinity express placement preferences or requirements, and priority class affects preemption order rather than taint handling.
Which two fields should be set on a container to allow the scheduler to place it sensibly and to protect the node from resource exhaustion? (Select TWO.)
Explanation
Requests inform scheduling decisions by reserving capacity, and limits cap what the container may consume at runtime. The other fields control image pulling, where termination messages are written, and pod restart behaviour.
A Deployment is updated with a new image and the rollout stalls. Which command shows the status of the rollout and the reason it is not progressing?
Explanation
rollout status reports progress and blocks until the rollout completes or fails, and pairing it with kubectl describe on the Deployment and its ReplicaSet reveals the cause. The other commands report node, resource usage and endpoint information.
Which Service type makes a pod reachable from outside the cluster by allocating a port on every node?
Explanation
NodePort opens the same port on every node and forwards to the Service. ClusterIP is internal only, ExternalName maps to a DNS name, and a headless service returns pod IPs directly without load balancing.
A NetworkPolicy is applied to a namespace selecting all pods but specifying no ingress rules. What is the effect?
Explanation
Once a pod is selected by any NetworkPolicy with an ingress section, only traffic explicitly allowed by a rule is permitted. A policy with an empty ingress list therefore denies all inbound traffic to the selected pods.
Which object allows a pod to request storage without knowing which specific volume will be provided?
Explanation
A PersistentVolumeClaim expresses a request for storage of a given size and access mode; the control plane binds it to a suitable PersistentVolume or provisions one dynamically through a StorageClass.
What determines whether a dynamically provisioned volume is deleted when its PersistentVolumeClaim is removed?
Explanation
The reclaim policy — Delete or Retain — decides the fate of the underlying volume when the claim goes away. Retain keeps the data for manual recovery, which is the safer setting for anything stateful you care about.
A pod is stuck in Pending state. Which command most directly reveals why the scheduler has not placed it?
Explanation
describe shows the events attached to the pod, which is where the scheduler records failures such as insufficient resources, unsatisfied node selectors or untolerated taints. Logs and exec require a running container, and deleting the pod discards the evidence.
A container repeatedly restarts with CrashLoopBackOff. Which command shows the output from the previous, failed container instance?
Explanation
The --previous flag retrieves logs from the last terminated instance of the container, which is where the crash reason usually appears. The current instance may have no useful output yet if it fails immediately on start.
A node shows status NotReady. Which service should be checked first on that node?
Explanation
A node reports Ready through its kubelet, so a NotReady node usually means the kubelet has stopped, cannot reach the API server, or the container runtime beneath it has failed. etcd and the API server run on control plane nodes, and CoreDNS is a cluster add-on.
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CKA practice, question 1 of 12
Original content — © CertExamHQ. Free to study, not for redistribution.
Written for this site against the published exam objectives, with an explanation for every answer. Not reproduced exam content.
Across the private full bank: 12 explanations, 0 questions with candidate context and 0 questions with direct citations.
Version 1.0.0 · bank updated . How we source questions