CKA practice questions
CNCF · CKA · 300 questions
Original practice questions for the CNCF/Linux Foundation Certified Kubernetes Administrator (CKA) exam, covering cluster architecture installation and configuration, workloads and scheduling, services and networking, storage, and troubleshooting. Tests administrator-level judgment on kubeadm cluster lifecycle, RBAC, networking, storage provisioning, and production cluster troubleshooting.
This course contains the use of artificial intelligence.
About the CKA exam
- Exam fee
- $445 USD
- Time allowed
- 2 hours
- Format
- Online, proctored, performance-based: solve tasks from a command line running Kubernetes
Schedule this exam The certification this earns
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Cluster Architecture, Installation & Configuration · 75 questions
- A county clerk portal needs a ServiceAccount that can list Pods only in the permits namespace, not cluster-wide. Which RBAC approach meets least privilege?
- City auditors need read-only access to Deployments across every namespace for inventory. Which RBAC design fits?
- A municipal CI bot must create Secrets only in billing, but someone bound a ClusterRole with a ClusterRoleBinding by mistake. What should ops change first to restore least privilege?
- Library consortium apps currently share one ServiceAccount; ops wants each app to carry its own identity for RBAC. What should they do?
- A new hire’s kubeconfig user can get Nodes but cannot create NetworkPolicies. What is the most likely RBAC gap?
- Transit ops needs a Role in schedules that can update ConfigMaps but must not touch Secrets. How should the Role rules be written?
- Emergency-management wants group oncall to use the built-in view ClusterRole, but only inside the incident namespace. Which binding achieves that?
- Someone deleted a RoleBinding used by human operators; apps keep running, but staff lose kubectl access. Why can workloads continue?
- A court-records platform must forbid anonymous API access and require authenticated subjects for any authorized action. Which statement matches Kubernetes authorization posture?
- Public-works IoT operators ask whether a Pod’s ServiceAccount automatically inherits the Role of the human who applied the manifest. What is correct?
- Before kubeadm, city DC techs left swap enabled and control-plane init fails mysteriously. What infrastructure fix aligns with typical kubeadm/kubelet prerequisites?
- County firewalls block TCP 6443 between worker nodes and the API server VIP. What breaks, and what should networking open?
- Municipal hosts still assume an old Docker Engine–only dockershim setup; the team needs a runtime for current Kubernetes. What should they prepare?
- School-district VMs were cloned with duplicate hostnames and overlapping machine-ids before join. What should admins fix first?
- Time skew across city racks breaks certificate validation during kubeadm join. What infrastructure practice prevents that class of failure?
- Public-health cluster nodes need bridged IPv4 traffic sysctl settings before CNI networking works reliably. Which preparation is appropriate?
- Building-permits VMs have tiny root disks; after join, kubelet is expected to hit DiskPressure quickly. What should platform ops correct before install?
- Sanitation cluster planners ask which packages to stage on nodes before kubeadm init. Which set is the standard baseline?
- Open-data portal ops wonders whether worker nodes need a public internet VIP for the API or only private reachability. What is required?
- City platform runs kubeadm init and must pass a pod-network CIDR that will not clash with the civic WAN. What should admins do?
- After kubeadm init, county control-plane components look healthy, but Pods stay Pending without network. What admin step is still missing?
- Transit authority workers fail kubeadm join because the bootstrap token expired. What should admins do?
- A library cluster finished control-plane init and must add workers using the printed join instructions. What is the correct action on each worker?
- A municipal admin needs kubectl access right after kubeadm init without weakening kubeconfig file permissions. What is the usual approach?
- A court cluster must prepare for later HA expansion. What should be set during initial kubeadm planning for a stable API endpoint?
- A water-utility platform runs kubeadm on a dual-homed control-plane host and must make the API advertise on the correct NIC while including that address in the API server certificate. Which ClusterConfiguration approach should the admin use?
- After a parks booking platform joins its first worker pool with kubeadm, operators need a second pool of GPU nodes for GIS jobs without re-running kubeadm init. What is the correct admin approach?
- A city SRE accidentally runs kubeadm init a second time on a node that still has leftover cluster state from a prior attempt. What should they do before a clean re-initialization?
- Emergency-management builds a single-node kubeadm lab and needs application Pods to schedule on the control-plane node. What must they understand about the default control-plane taint?
- A county must upgrade a kubeadm cluster from an N-2 minor release toward the current supported minor. Which upgrade ordering principle should platform ops follow?
- Before a weekend control-plane upgrade, a city platform team wants durable recovery for cluster state. What lifecycle action should they take?
- After a failed upgrade, municipal ops must recover API object state from a previously taken etcd snapshot. What does a successful etcd restore primarily recover?
- Certificate expiration is approaching for kubeadm-managed certificates on a civic control plane. Which action reduces the risk of API outages due to expired certs?
- A school district upgrades kubelet on a worker while keeping applications available. Which node lifecycle pattern matches standard practice?
- Transit platform ops must decommission a worker permanently. What clean removal sequence avoids stale node registrations?
- Public-works plans to restart kubelets after a config change and wants to avoid unsupported version skew with the API server. What constraint should they respect?
- An open-data cluster needs a sustained operational change to kube-proxy’s ConfigMap as part of lifecycle maintenance. What does this illustrate about cluster lifecycle work?
- An HR self-service platform schedules a quarterly OS patch weekend on worker nodes. How should ops keep applications available during node maintenance?
- After finishing a kubeadm upgrade, budget analytics operators must confirm components moved forward. Which verification approach best matches admin practice?
- A city wants three control-plane nodes reachable through a stable VIP for API high availability. What kubeadm HA building block is required?
- County architects debate stacked etcd on control-plane nodes versus an external etcd cluster for HA. What is the accurate admin-level distinction?
- A library consortium runs three control-plane nodes with stacked etcd. One control-plane VM fails. Why can the API often remain available?
- After the first kubeadm init, a municipal team must expand to additional control-plane nodes. Which join pattern applies?
- A 911 dispatch platform sizes etcd for HA. Why do operators typically choose an odd etcd member count?
- Court records asks whether a single-node etcd member deployment is highly available. What is the correct assessment?
- A water utility places control-plane and etcd members for an HA cluster. Which placement practice improves failure tolerance?
- Sanitation ops configures kubelets and admin kubeconfigs after building an HA control plane. Where should they point API clients?
- Parks platform validates that API service continues while one control-plane node is drained for patching. Under what HA condition is this safe?
- A city installs ingress-nginx as a shared cluster component. Which packaging approach matches CKA-style cluster-component management with Helm?
- A county deploys metrics-server and must raise replicas and resource requests without forking upstream YAML by hand each time. Which Kustomize approach fits cluster-component customization?
- A city library upgrades its cert-manager Helm chart during a change window so the release tracks a newer chart and app version. Which Helm action best describes moving that installed release forward?
- A transit agency’s Helm-managed addon starts failing after a bad release; ops needs the previous working revision back. Which Helm capability restores that earlier release revision?
- A school district keeps shared Kubernetes manifests in git and needs lab versus production differences without duplicating every file. Which Kustomize pattern best separates common definitions from environment-specific changes?
- A public-health platform team debates one-off kubectl apply of raw YAML versus packaging cluster addons. Why do teams commonly prefer Helm or Kustomize for repeatable addon installs?
- Building-permits ops must raise replicaCount for a Helm-packaged cluster component without maintaining a full fork of the upstream chart. Which approach customizes that setting correctly?
- An open-data portal stores a cluster component as a Kustomize directory and wants to deploy the built output with kubectl. Which invocation applies that Kustomize tree?
- A municipal SRE needs an operational inventory of which Helm-managed cluster components are installed and their status. Which Helm commands provide that release inventory?
- City architects evaluating Calico- or Cilium-style plugins ask which Kubernetes extension interface provides Pod network connectivity?
- A county storage vendor integrates a driver that dynamically provisions volumes for PersistentVolumeClaims. Which extension interface is that driver implementing?
- Library cluster nodes run containerd as the low-level runtime that kubelet talks to when starting Pod containers. Which interface defines that kubelet-to-runtime contract?
- A transit engineer claims that installing a CNI plugin removes the need for Services and kube-proxy because CNI already load-balances ClusterIP traffic. What distinction should platform leads teach?
- A school district workload uses only emptyDir volumes and no PersistentVolumeClaims. Must the cluster install a CSI driver for those Pods to run?
- Public-works brings up a new kubeadm cluster but forgets to install a CNI plugin. What typically happens to workloads?
- A court platform wants to swap container runtimes on worker nodes while keeping kubelet’s integration model stable. Which design makes that runtime choice possible?
- A water utility asks which Kubernetes extension mechanism adds custom cluster APIs, as distinct from CNI, CSI, or CRI node plugins?
- A sanitation training poster must map responsibilities correctly: Pod networking, volume plugins, and container runtime integration. Which mapping is accurate?
- A city installs a backup operator that introduces a new BackupSchedule kind into the cluster. What does the CustomResourceDefinition provide in that install?
- A county applies an operator manifest; afterward a controller continuously reconciles custom resources toward desired state. What is the operator’s essential role?
- Library staff try kubectl get on a custom resource and fail until the matching CRD is installed. What rule explains that behavior?
- Transit installs a cert-manager-like operator as a cluster component, often packaging CRDs and controllers together. Which statement best describes that install pattern?
- A school district upgrades a cluster operator and must roll forward CRD schemas carefully. Why does upgrade order and compatibility matter?
- A public-health team labels every Deployment an “Operator” because it runs in the cluster. What distinction should architects enforce?
- Building-permits platform engineers consider deleting a CRD while custom resource instances still exist. What operational caution applies?
- An open-data portal chooses an operator to manage a clustered datastore addon rather than only a raw Deployment manifest. What advantage are they seeking?
- During an audit, a municipal SRE needs to see which API extensions are installed. Which approach inventories CustomResourceDefinitions in the cluster?
Workloads & Scheduling · 45 questions
- A city CMS Deployment must bump its container image while the citizen portal keeps answering requests. Which update behavior should the platform team rely on?
- A county GIS rollout introduced bad tiles after an image change. Ops need to restore the previous ReplicaSet revision quickly. Which action matches that goal?
- A library catalog Deployment must stay available to citizens during an update. Which rollingUpdate setting directly limits how many Pods may be down at once?
- Transit ops must confirm a schedule API Deployment finished updating before announcing the new version. Which kubectl workflow best observes that progress?
- A school district public portal briefly went dark during an image change because every Pod was terminated before new ones started. Which Deployment strategy causes that downtime pattern?
- Public-health sees error spikes mid-rollout on a vaccination-status API and must stop further Pod replacements without undoing what already shipped. Which Deployment control fits?
- A building-permits platform wants a controlled image bump through the Deployment controller. Which change correctly triggers a new rollout?
- An open-data portal engineer asks whether patching a live Pod's image by hand is the supported way to roll a new release under a Deployment. What should the admin answer?
- Municipal SRE needs to see which Deployment revisions and images shipped last week for audit. Which kubectl view is purpose-built for that?
- A city permits API needs non-sensitive feature flags injected as environment variables. Which object is the appropriate store for that configuration?
- A county database password must be supplied to Pods as mounted files rather than plain ConfigMap data. Which Kubernetes object type is intended for that confidential material?
- A library updates keys in a ConfigMap used as environment variables by catalog Pods. What should ops expect about those running Pods?
- Transit mounts a TLS key pair into a gateway Pod from cluster-managed confidential data. Which approach matches common CKA practice?
- A school district discovers API tokens stored in a ConfigMap that was committed to git. What correction aligns with Kubernetes configuration practice?
- Public-health wants every key from a ConfigMap loaded as environment variables on a stats API Pod without listing each key. Which consumption pattern does that?
- A building-permits app needs public endpoint URLs and database credentials in the same Pod. How should those settings typically be split?
- An open-data portal needs an opaque Secret from literal values in a demo Namespace so the app is not baked with passwords in the image. What is the admin's responsibility?
- A municipal HR app's Pods fail to start because the Deployment references a ConfigMap name that does not exist in the Namespace. What does that illustrate?
- A city 311 API spikes at lunch and should gain Pods when CPU is high. Which control plane object scales Deployment replicas from resource metrics like CPU?
- County analytics must keep HPA from scaling a batch API below a floor or above a cost ceiling. Which HPA fields constrain that range?
- A library HPA targeting CPU utilization never changes replica counts. Investigation shows resource metrics are unavailable. What dependency is typically missing?
- Transit sets an HPA CPU utilization target on a schedules API, but utilization percentages are meaningless without a baseline. What must Pods define for those targets to work?
- A school district attaches HPA to a gradebook Deployment. What operational practice avoids fighting the autoscaler?
- Public-health expects a known parade-day surge at 09:00 and asks whether only waiting for HPA is always enough. Which statement is accurate?
- A building-permits platform sees Pod counts thrash up and down under bursty traffic while HPA is enabled. What scale-down awareness should admins apply?
- An open-data portal team sees CPU-bound app pods and wants the Horizontal Pod Autoscaler to fix capacity. What does HPA actually change?
- During an incident, a municipal SRE needs to confirm whether an HPA has raised desired replicas and what its current status reports. Which approach best answers that?
- A city website Pod managed by a Deployment crashes and disappears from the node. What should restore the desired replica count?
- A county GIS team wants pods that are still warming up to stay off Service traffic until they can serve requests. Which probe controls that behavior?
- A library catalog container is still marked Running but has stopped answering requests after a deadlock. Which probe is designed to restart that wedged process?
- A transit agency runs long-lived API Pods under a Deployment and needs failed containers to restart automatically. Which restartPolicy is correct for those Deployment-managed Pods?
- After a school district rolls a bad image, Pods repeatedly fail to start and show CrashLoopBackOff. What does that status primarily indicate?
- A public-health dashboard must survive losing a single worker node that hosted one of its Pods. Which design choice most directly improves that resilience?
- A building-permits JVM app takes minutes to initialize and would fail early liveness checks. Which probe gives it time before liveness restarts begin?
- An engineer deletes an unmanaged (naked) Pod that served an open-data API. What happens compared with deleting a Pod owned by a Deployment?
- A municipal app is 'not healthy': some Pods never leave Pending while others CrashLoopBackOff. What should the admin conclude about self-healing controllers?
- City GPU GIS Pods must run only on workers labeled for GPUs. Which scheduling mechanism most directly constrains them to those nodes?
- A county app occasionally leaks memory and risks starving other workloads on the same node. Which container setting caps that usage?
- Library catalog Pods should prefer SSD-backed nodes when available but still schedule elsewhere if needed. Which construct expresses that soft preference?
- Transit taints dedicated ingestion nodes so ordinary apps stay off them, while ETL Pods may still schedule there. What must those ETL Pods include?
- School-district Pods without CPU requests share nodes with heavy batch jobs and suffer throttling. What do CPU requests primarily influence in this situation?
- Public-health students deploy apps without resource fields. How can the namespace automatically supply default container CPU and memory at admission?
- Building-permits engineers cannot create new Pods because the namespace CPU budget is exhausted. Which object enforces that namespace-level ceiling at admission?
- An open-data portal wants Deployment replicas to avoid co-locating on the same host for higher availability. Which scheduling feature helps spread those Pods?
- Under node resource contention, how does a higher PriorityClass typically affect scheduling for a municipal critical Pod versus lower-priority Pods?
Services & Networking · 60 questions
- City application Pods on different worker nodes must communicate using Pod IPs. What connectivity model should administrators expect from a standard CNI setup (absent NetworkPolicy denials)?
- A county engineer claims every Pod shares the node's network namespace by default. What is the correct default networking behavior?
- A library frontend in namespace web cannot resolve a backend Service named catalog in namespace data using only the short name catalog. What DNS name should it use instead?
- A transit platform team debates whether enabling a CNI plugin is the same as enforcing NetworkPolicies. What distinction should they apply?
- A school-district Pod runs a main API container and a sidecar. How do those containers reach each other on the network by default?
- A public-health team notices that application clients lose connectivity after a Deployment recreates Pods, because clients were given Pod IPs. What should the administrator explain about Pod addressing?
- A building-permits application hard-coded a Pod IP in its config and failed after the Pod was rescheduled to another node. Which change restores stable reachability for other in-cluster callers?
- An open-data platform schedules Pods successfully on every node, but Pods on different nodes cannot ping each other. Control-plane and kubelet appear healthy. What should the administrator investigate first?
- A municipal Wi-Fi backend needs Pods to reach the public Internet for vendor API calls. At CKA administrator depth, how do Pods typically obtain outbound Internet access?
- Before blaming an application bug, a 911 platform team wants to confirm that one Service can resolve another Service by DNS inside the cluster. Which component should they verify is healthy?
- A city cluster must isolate Pods in the finance namespace so that, by default, no other Pods can reach them until explicit allow rules are added. Which NetworkPolicy approach achieves that default-deny posture for selected Pods?
- A county platform must allow only Pods labeled role=frontend to connect to Pods labeled app=api on TCP port 8080. Which NetworkPolicy design matches that requirement?
- A library namespace applies a strict egress NetworkPolicy that blocks nearly all outbound traffic. Name resolution for Services immediately fails. What egress allowance is typically still required?
- A transit team creates a NetworkPolicy whose podSelector matches only Pods with tier=backend. Unlabeled Pods in the same namespace still accept connections from anywhere. Why?
- A school-district admin proposes using a NetworkPolicy to stop developers from listing Secrets via kubectl. What misconception should the CKA candidate correct?
- Public-health API Pods should accept ingress from any Pod running in namespaces labeled team=intake. Which NetworkPolicy peer selector expresses that?
- Building-permits administrators apply several NetworkPolicy objects, but traffic is never filtered. Pods and Services look correct. What dependency is most likely missing?
- An open-data team wants one NetworkPolicy object to restrict both inbound connections to selected Pods and outbound connections from those Pods. What must they configure?
- Municipal HR applies a deny-all NetworkPolicy in a shared namespace and immediately loses access from their management Pods to the API Pods they still need. What operational lesson applies?
- A sanitation cluster wants to stop unrelated apps from talking east-west inside the same namespace without adopting CKS-only tooling. Which CKA-depth control fits?
- A city internal API must be reachable only from inside the cluster. Which Service type should the administrator choose?
- A county kiosk network needs to reach a demo app using each node's IP address on a static high port without a cloud load balancer. Which Service type fits?
- A library runs on a cloud Kubernetes environment and wants the platform to provision an external load balancer IP for a public web Service. Which Service type requests that?
- A transit Service shows no ready backends even though Pods are running. The Service selector is app=scheduler but Pods are labeled app=sched. What is the likely result?
- School-district clients time out connecting to a ClusterIP Service. Which objects should the administrator inspect to see which Pod IPs currently back the Service?
- Public-health Pods keep running but fail readiness probes. How does that affect a Service that selects those Pods?
- Building-permits developers need DNS that returns the Pod IPs themselves for direct discovery, not a single ClusterIP. Which Service configuration fits?
- An open-data portal Service listens on port 80 for clients but containers listen on port 8080. How should the Service map those ports?
- Municipal external users need HTTPS host-based routing to several in-cluster apps. Operators prefer not to expose NodePorts on every worker. Which exposure model is most appropriate?
- A 911 platform observes that Endpoints already list new Pod IPs after a rollout, yet a few connections still hit old backends for a short time. What should the administrator understand?
- A city platform team wants one shared north-south HTTP entrypoint that can host many municipal host and path routes with portable, role-friendly resources. Which Kubernetes approach best matches that goal?
- A county wants infrastructure operators to own the shared public entrypoint while application teams only attach their own HTTP routes. How should Gateway API ownership typically be split?
- A library consortium is tired of Ingress objects that only work after controller-specific annotations. What is a primary motivation for moving toward Gateway API?
- Transit needs citizen traffic for host schedules.city.example to reach the schedules Service through an existing Gateway listener. Which Gateway API action is correct?
- A school district creates Gateways but must choose which implementation will reconcile them. Which resource selects the controller that implements a Gateway?
- Public-health engineers ask whether adopting Gateway API means they can delete ClusterIP Services in front of their Pods. What should you tell them?
- Building-permits needs HTTPS termination on a Gateway listener using a certificate already stored in the cluster. What configuration approach fits Gateway API?
- After applying an HTTPRoute for an open-data API, operators want to confirm the shared Gateway actually accepted the attachment. Where should they look first?
- A municipal team applies Gateway, GatewayClass, and HTTPRoute objects, but no traffic is handled at the edge. What critical dependency is still missing?
- Sanitation must publish several citizen HTTP apps with host- and path-based routing on a shared entrypoint. When is Gateway API a better fit than exposing each app with only a raw NodePort?
- The city still runs ingress-nginx for legacy portals. What is the purpose of an Ingress resource in that model?
- A county creates several Ingress objects for internal tools, but none of the hostnames respond. What prerequisite is most likely missing?
- A library wants catalog.library.example and events.library.example to reach different backend Services through one Ingress. Which capability are they using?
- Transit runs more than one Ingress controller in the cluster and must ensure a new portal Ingress is handled by the nginx implementation. What should they set?
- A school district wants TLS for an Ingress hostname using a certificate already in a Kubernetes Secret. Where is that Secret referenced in the classic Ingress API?
- Public-health publishes an Ingress that returns edge errors for a citizen API. Investigation shows the Ingress backend Service name does not exist in the namespace. What is the correct diagnosis?
- Building-permits needs many HTTP apps reachable on one shared external entrypoint and IP-friendly hostname routing. Why choose Ingress (or Gateway API) over one LoadBalancer Service per app?
- Open-data platform engineers copy an Ingress that relies on many vendor annotations when switching controllers and routing breaks. What lesson should they take?
- A municipal CMS must send /v2 traffic to a green Service and keep / on blue through one hostname. Which Ingress capability provides that split?
- A 911-related portal’s Ingress objects look correct, yet every external route fails. Controllers and app Pods were not checked yet. What should operators verify early?
- City application Pods reach api.permits.svc.cluster.local successfully. Which component primarily provides that in-cluster Service DNS resolution?
- A county needs Pods to resolve an on-prem Active Directory DNS zone for internal directories. How is that commonly configured with CoreDNS?
- Library applications across many namespaces suddenly cannot resolve Service names even though the Service objects still exist. CoreDNS replicas recently crashed. What is the impact?
- Transit troubleshoots DNS from inside an application Pod and inspects /etc/resolv.conf. What should that file typically show regarding cluster DNS?
- A school district app resolves short name api inside its own namespace but fails when the same short name is used to reach a Service in another namespace. Why?
- A public-health cluster sees DNS latency during a surge. CoreDNS runs as a Deployment behind the cluster DNS Service. Which admin action correctly scales name resolution capacity?
- Building-permits pods report failures talking to an internal API. One symptom is NXDOMAIN from dig; another is connection refused after a name resolves to the Service ClusterIP. What distinction should the admin draw?
- An open-data portal needs DNS that returns Pod IPs for a discovery pattern similar to StatefulSet peers, not a single load-balanced ClusterIP. Which Service configuration produces that DNS behavior?
- Municipal SRE sees intermittent DNS failures for in-cluster names. Which first admin check best targets CoreDNS configuration and runtime behavior?
- The sanitation platform team asks which object supplies the stable ClusterIP that application Pods use as their nameserver for cluster DNS. What is the correct answer?
Storage · 30 questions
- A city platform team wants SSD-backed volumes for municipal databases created automatically via CSI. What must their StorageClass define to enable that dynamic path?
- A county PVC sets storageClassName: fast and stays unbound until a matching volume appears. What normally causes the PersistentVolume to be created automatically?
- Library operators omit storageClassName on some PVCs and still receive dynamically provisioned volumes. What cluster setting explains that behavior?
- Transit wants a new storage tier with different disk type and IOPS. Where should those backend flavor settings be expressed for newly provisioned volumes?
- A school district wants to stop surprise dynamic volumes from expensive default storage. Which admin control directly addresses that risk?
- A public-health PVC remains Pending and events indicate the named StorageClass cannot provision. What is the most likely cause among these options?
- Building-permits admins debate pre-creating PersistentVolumes versus letting a StorageClass mint them. Which statement correctly contrasts the workflows?
- An open-data team uses cloud disks that must land in the same zone as the scheduled Pod. Which StorageClass volumeBindingMode delays binding until a consumer Pod is scheduled?
- Municipal GIS needs to grow an existing PVC’s capacity without recreating the volume. What StorageClass setting must be enabled (with CSI support) for that expansion?
- Sanitation platform engineers want a catalog of storage tiers available to application teams. Which objects should they list?
- A city database PVC uses access mode ReadWriteOnce. Two application Pods on different nodes both try to mount it read-write. What should the admin expect?
- County web replicas on many nodes must all mount the same shared content read-write. Which access mode matches that requirement when the backend supports it?
- A library publishes static content that many reader Pods on different nodes should mount without write access. Which access mode fits?
- Transit sets a PV reclaimPolicy of Delete for dynamically provisioned disks. What happens when the bound PVC is deleted?
- A school district needs disk contents preserved after a PVC is deleted so staff can recover data manually. Which reclaim policy should the PV use?
- Public-health workloads need scratch space that disappears when the Pod is removed and must not outlive that Pod. Which volume type fits?
- Building-permits considers hostPath for a privileged node agent. What caveat should guide that decision?
- An open-data PVC requests an access mode the provisioner cannot offer, and binding fails. What rule explains the failure?
- Municipal backup volumes hold irreplaceable archives. Admins fear an accidental PVC deletion. Which reclaim policy best reduces automatic wipe risk?
- A 911 media store confuses volume sharing rules with disk performance tiers. How should the admin separate those concepts?
- A city PVC must bind to an existing PV. Which combination of PVC requirements must match the PV for binding to succeed?
- A county app pod mounts a PersistentVolumeClaim as a volume. What must be true before that pod can become Ready using the claim?
- A library StorageClass has allowVolumeExpansion enabled. How does an administrator expand a Bound PVC’s capacity?
- A transit PVC stays Pending. No matching static PV exists and no dynamic provisioner is available for its StorageClass. What is the most accurate diagnosis?
- A school-district operator deletes a PVC while pods still mount it. What should the administrator understand about release behavior?
- A public-health team has an existing NFS export and wants static provisioning. What is the correct workflow?
- A building-permits namespace must not over-request PVC storage. Which Kubernetes control caps total PVC storage requests in that namespace?
- An open-data team has one ReadWriteOnce PersistentVolume. What happens if two PVCs try to bind that same PV at once?
- A municipal SRE’s PV uses reclaimPolicy Retain after its PVC is deleted. What must happen before that volume can be safely reused?
- A sanitation application needs a raw block device rather than a mounted filesystem. Which PVC setting presents the volume as a block device to the pod?
Troubleshooting · 90 questions
- A city worker node shows NotReady after a patch window. Investigation finds the kubelet service is stopped. What is the most direct explanation?
- A county node reports DiskPressure. What operational effect should administrators expect?
- A library node shows MemoryPressure while several containers are OOMKilled. What does MemoryPressure indicate?
- A transit node enters PIDPressure after a process fork storm. What should an administrator recognize?
- A school-district node remains Ready but is cordoned. Why do new pods refuse to schedule there?
- After a partial cluster upgrade, public-health operators run kubectl get nodes and see mixed kubelet versions. What does that symptom indicate?
- A building-permits worker is NotReady and node conditions point to an unhealthy CNI/plugin network. What is the appropriate conclusion?
- An open-data kubelet is still configured with an old API server VIP after a control-plane endpoint change. What is the likely result?
- Municipal workloads stay Pending with events citing insufficient CPU on every node, yet all nodes are Ready. What distinguishes this from a node-health outage?
- A 911 cluster node has significant clock skew and begins failing TLS authentication to the API server. What should administrators suspect?
- On a sanitation worker, containerd has crashed and the kubelet cannot start pods. What failure class does this represent?
- A parks worker node runs out of inodes after image sprawl even though df -h still shows free bytes. What problem should be investigated?
- Court-records pods stay Pending because their nodeSelector requires a label the target nodes do not have. Nodes themselves are Ready. How should this be classified?
- A water-utility admin begins node troubleshooting. Which first-line kubectl inspection best surfaces conditions, taints, and allocatable resources together?
- An HR cluster accidentally applies a NoSchedule taint to every worker. What is the expected scheduling symptom?
- Budget analytics reports one worker as NotReady and kubelet logs show TLS client authentication failures to the API server. What is the most likely cause?
- During a city maintenance window, kubectl drain hangs and reports that eviction is blocked for a critical pod. Which condition most often causes this drain to stall?
- After joining a new county worker, nodes show Ready but pods on different racks cannot reach each other. Firewall review shows VXLAN or CNI overlay ports between racks are closed. What does this pattern indicate?
- After a control-plane disk fills, city operators find the API server unreachable and the kube-apiserver static pod missing under /etc/kubernetes/manifests. What should they recognize first?
- New county workloads stay Pending with no nodeName and events do not show ordinary capacity or affinity fit failures. Which control-plane component failure best explains this?
- Library Deployments no longer create or heal pods after replica changes, while existing running pods keep serving. Which component is most likely down?
- Transit operators see API create and update calls become very slow while read-mostly traffic still sometimes works. etcd disk latency alerts are firing. What is the best first interpretation?
- A school district runs a three-member etcd cluster and two members fail. What is the expected impact on cluster API availability?
- Public-health Services stop delivering traffic to healthy pods after kube-proxy DaemonSet pods begin crash-looping on several nodes. What should administrators conclude?
- Building-permits workloads suddenly cannot resolve Kubernetes Service DNS names cluster-wide, and CoreDNS pods are down. How should this be classified?
- Open-data staff accidentally delete the control-plane static pod YAML files from /etc/kubernetes/manifests on a kubeadm node. What is the immediate operational risk?
- Municipal operators run kubectl against the cluster and receive TLS certificate errors talking to the API server after a long uptime without cert renewal. What is the most likely root cause?
- 911 platform engineers report that HorizontalPodAutoscalers never scale and kubectl top nodes/pods returns errors. Which missing component most directly explains both symptoms?
- Sanitation teams create new PersistentVolumeClaims that remain Pending while the CSI controller pod crash-loops. What does this indicate?
- Parks staff see pods on one rack fail to obtain network interfaces while other racks work, and the CNI DaemonSet shows unhealthy pods only on that rack. What is the right troubleshooting focus?
- Court-records operators find kube-scheduler is not scheduling after a network partition, and leader-election leases look stuck. What concept explains this failure mode?
- Water-utility admins still rely on kubectl get componentstatuses during outages, but results are confusing on modern clusters. What is the better troubleshooting approach?
- After etcd data corruption, HR restores from a recent etcd snapshot and API objects reappear. What skill does this exercise demonstrate?
- Budget analytics finds valid object creates rejected after a recent kube-apiserver flag change around admission. What should be investigated first?
- One city control-plane node is NotReady, yet etcd still has quorum on remaining peers and clients reach the API through the load-balanced VIP. How should this partial failure be interpreted?
- During a county control-plane reinstall, kubelet cannot pull apiserver and etcd images because the registry is unreachable. What fails as a result?
- During a council-demo traffic spike, city SREs want a quick view of CPU and memory pressure per node. Which command is appropriate when metrics are available?
- County engineers suspect a memory leak in the permits API and need to identify which pods are consuming abnormal memory right now. Which approach fits?
- Library HPA objects are not scaling and kubectl top in that namespace also returns no metrics. What does this combination most strongly suggest?
- Transit wants to rightsize GIS worker requests after observing that pods request far more CPU than they use in steady state. What comparison guides that decision?
- A school-district worker node reports high CPU while kubectl top pods shows only modest application usage. What should the administrator investigate next?
- A public-health namespace's ResourceQuota is nearly exhausted and new creates begin failing. What does the used-versus-hard ratio primarily signal?
- Building-permits developers notice pods consume more CPU and memory than their manifests declare. A LimitRange applies default requests and limits in the namespace. What is the most accurate explanation?
- An open-data node fills /var/lib/containerd and workloads fail with ephemeral-storage pressure. What should the administrator treat as a first-class usage concern?
- A municipal SRE dashboard highlights elevated container restart counts on several pods. What do persistently high restart counts most strongly indicate?
- A 911 operations dashboard shows the count of Pending pods rising steadily. What does that trend most often indicate?
- Under node memory pressure, a sanitation platform team must reason about which pods the kubelet is more likely to evict first. Which statement is correct?
- A parks team sees pods stuck Pending and exports kubectl describe output focused on Events. Which event reason most directly explains a resource-fit scheduling failure?
- Court-records operators suspect a noisy-neighbor pod before tightening CPU limits. What should they use to justify the change?
- A water-utility container shows CPU throttling metrics even though the node still has spare CPU. What is the most likely cause?
- HR cluster administrators find that kubectl top nodes and kubectl top pods error, and HPA cannot obtain resource metrics. What is the usual fix?
- Budget analytics reviews weeks of node and pod usage before opening hardware renewal tickets. What operational purpose does that monitoring primarily serve?
- City platform engineers aggregate kubectl top pod views and notice one namespace dominating cluster CPU. What capability does that analysis demonstrate?
- County operators receive user latency tickets while ingress-controller pods show sustained CPU saturation. What troubleshooting principle does correlating those signals illustrate?
- A city engineer needs the application's recent stdout and stderr after a crash to begin debugging. Which approach retrieves the current container's output stream?
- A county pod crashed and restarted; engineers need logs from the terminated instance, not only the new one. Which kubectl behavior addresses that need?
- A library pod runs an app container and a logging sidecar. kubectl logs without a container name fails with an ambiguous-container error. What must the administrator do?
- During a live transit incident, operators want new log lines as they appear and only the most recent backlog. Which kubectl logs options best match that need?
- A school-district pod is in CrashLoopBackOff. Inspecting logs reveals repeated configuration parse errors on startup. What does this demonstrate about using logs in troubleshooting?
- A public-health pod never starts its main app because an init container failed. Where should the administrator look first for the failure details?
- Building-permits engineers find kubectl logs empty even though the application writes detailed files under /var/log inside the container. What is the correct explanation?
- Open-data analysts notice kubectl logs timestamps that disagree with wall-clock incident times. What underlying factor most directly affects interpretation of those stamps?
- A municipal SRE plans to delete a failing pod after collecting evidence. Why should logs be dumped before deletion when no centralized logging is in place?
- 911 platform staff need application log streams from many pods belonging to one Deployment amid noisy neighbors. What is an appropriate kubectl approach?
- Sanitation engineers compare kubectl describe Events with kubectl logs while diagnosing a failing pod. How do these signals differ?
- A parks department Pod runs an app container that writes error lines and a sidecar that writes access logs—operators need both streams for an outage review. What is the sound multi-container logging model?
- A court-records Pod terminates with OOMKilled and the remaining log snippet is short. What should the administrator still do when reviewing the failure?
- A water-utility engineer runs kubectl logs and receives a permission denied / forbidden response for their personal user. What is the most likely authorization gap?
- An HR application emits structured JSON log lines on stdout. How does that change kubectl log retrieval for the administrator?
- Budget analytics Pods restart several times overnight. An engineer needs logs from an earlier crash, not only the latest termination. What limitation of kubectl logs --previous must they understand?
- After a city worker node reboots, local container logs that were never shipped elsewhere are gone. What durability lesson should administrators take?
- A county runbook allows kubectl exec or attach, but the first triage step for a misbehaving app is unclear. What practice best matches non-invasive troubleshooting?
- A city Service shows no Endpoints even though Pods are Running. What is the most common configuration cause?
- A county lookup of a Service DNS name fails inside a Pod before any TCP connection is attempted. Where should triage start?
- A library client reaches a Service ClusterIP but receives connection refused. Endpoints list a Pod IP. What is a likely cause?
- Transit app docs say traffic is newly allowed, Endpoints look healthy, yet connections from a client Pod time out. What should administrators suspect?
- A school-district NodePort Service works from inside the cluster but workstations on the LAN cannot reach the node’s NodePort. The Service and Endpoints are correct. What is a common external cause?
- A public-health Ingress returns HTTP 503 while the backing Service exists. What readiness condition commonly explains the 503?
- Building-permits Services show correct Endpoints, yet traffic still fails on some nodes. Objects look healthy in the API. What plane should administrators investigate next?
- An open-data client in namespace analytics calls a short Service name that exists in both analytics and shared namespaces and resolves incorrectly. What DNS pitfall is involved?
- A municipal Gateway API HTTPRoute is not taking effect. What should administrators check first in status troubleshooting?
- A 911 workload sets hostNetwork: true and unexpectedly conflicts with ports already used on the node. What side effect should operators remember?
- A sanitation Pod tries to reach its own ClusterIP Service address and sees inconsistent or surprising behavior depending on the dataplane. What concept should the administrator keep in mind?
- Parks staff created an ExternalName Service pointing at an in-cluster app hostname instead of using a normal selector-based Service. What is wrong with that choice?
- Court-records nodes stop placing networking for new Pods and CNI reports address allocation failures. What failure mode fits?
- A water-utility cluster spans VPN-connected racks. Large pod-to-pod payloads stall while small pings work. What networking issue fits this pattern?
- An HR LoadBalancer Service remains External IP Pending in a bare-metal lab with no cloud load-balancer controller. What explains the stuck state?
- Budget analytics teams debug client source IPs and see node addresses instead of Pod IPs for egress to external systems. What mechanism commonly explains this?
- City operators need a standard way to test DNS and ClusterIP connectivity without changing the app Deployment. What approach fits?
- County in-cluster Service DNS works, but browsers on the public Internet cannot resolve the Ingress hostname. Where is the gap?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the Cloud Native Computing Foundation or The Linux Foundation.