Troubleshooting

CKA · 90 questions

• A city worker node shows NotReady after a patch window. Investigation finds the kubelet service is stopped. What is the most direct explanation?
• A county node reports DiskPressure. What operational effect should administrators expect?
• A library node shows MemoryPressure while several containers are OOMKilled. What does MemoryPressure indicate?
• A transit node enters PIDPressure after a process fork storm. What should an administrator recognize?
• A school-district node remains Ready but is cordoned. Why do new pods refuse to schedule there?
• After a partial cluster upgrade, public-health operators run kubectl get nodes and see mixed kubelet versions. What does that symptom indicate?
• A building-permits worker is NotReady and node conditions point to an unhealthy CNI/plugin network. What is the appropriate conclusion?
• An open-data kubelet is still configured with an old API server VIP after a control-plane endpoint change. What is the likely result?
• Municipal workloads stay Pending with events citing insufficient CPU on every node, yet all nodes are Ready. What distinguishes this from a node-health outage?
• A 911 cluster node has significant clock skew and begins failing TLS authentication to the API server. What should administrators suspect?
• On a sanitation worker, containerd has crashed and the kubelet cannot start pods. What failure class does this represent?
• A parks worker node runs out of inodes after image sprawl even though df -h still shows free bytes. What problem should be investigated?
• Court-records pods stay Pending because their nodeSelector requires a label the target nodes do not have. Nodes themselves are Ready. How should this be classified?
• A water-utility admin begins node troubleshooting. Which first-line kubectl inspection best surfaces conditions, taints, and allocatable resources together?
• An HR cluster accidentally applies a NoSchedule taint to every worker. What is the expected scheduling symptom?
• Budget analytics reports one worker as NotReady and kubelet logs show TLS client authentication failures to the API server. What is the most likely cause?
• During a city maintenance window, kubectl drain hangs and reports that eviction is blocked for a critical pod. Which condition most often causes this drain to stall?
• After joining a new county worker, nodes show Ready but pods on different racks cannot reach each other. Firewall review shows VXLAN or CNI overlay ports between racks are closed. What does this pattern indicate?
• After a control-plane disk fills, city operators find the API server unreachable and the kube-apiserver static pod missing under /etc/kubernetes/manifests. What should they recognize first?
• New county workloads stay Pending with no nodeName and events do not show ordinary capacity or affinity fit failures. Which control-plane component failure best explains this?
• Library Deployments no longer create or heal pods after replica changes, while existing running pods keep serving. Which component is most likely down?
• Transit operators see API create and update calls become very slow while read-mostly traffic still sometimes works. etcd disk latency alerts are firing. What is the best first interpretation?
• A school district runs a three-member etcd cluster and two members fail. What is the expected impact on cluster API availability?
• Public-health Services stop delivering traffic to healthy pods after kube-proxy DaemonSet pods begin crash-looping on several nodes. What should administrators conclude?
• Building-permits workloads suddenly cannot resolve Kubernetes Service DNS names cluster-wide, and CoreDNS pods are down. How should this be classified?
• Open-data staff accidentally delete the control-plane static pod YAML files from /etc/kubernetes/manifests on a kubeadm node. What is the immediate operational risk?
• Municipal operators run kubectl against the cluster and receive TLS certificate errors talking to the API server after a long uptime without cert renewal. What is the most likely root cause?
• 911 platform engineers report that HorizontalPodAutoscalers never scale and kubectl top nodes/pods returns errors. Which missing component most directly explains both symptoms?
• Sanitation teams create new PersistentVolumeClaims that remain Pending while the CSI controller pod crash-loops. What does this indicate?
• Parks staff see pods on one rack fail to obtain network interfaces while other racks work, and the CNI DaemonSet shows unhealthy pods only on that rack. What is the right troubleshooting focus?
• Court-records operators find kube-scheduler is not scheduling after a network partition, and leader-election leases look stuck. What concept explains this failure mode?
• Water-utility admins still rely on kubectl get componentstatuses during outages, but results are confusing on modern clusters. What is the better troubleshooting approach?
• After etcd data corruption, HR restores from a recent etcd snapshot and API objects reappear. What skill does this exercise demonstrate?
• Budget analytics finds valid object creates rejected after a recent kube-apiserver flag change around admission. What should be investigated first?
• One city control-plane node is NotReady, yet etcd still has quorum on remaining peers and clients reach the API through the load-balanced VIP. How should this partial failure be interpreted?
• During a county control-plane reinstall, kubelet cannot pull apiserver and etcd images because the registry is unreachable. What fails as a result?
• During a council-demo traffic spike, city SREs want a quick view of CPU and memory pressure per node. Which command is appropriate when metrics are available?
• County engineers suspect a memory leak in the permits API and need to identify which pods are consuming abnormal memory right now. Which approach fits?
• Library HPA objects are not scaling and kubectl top in that namespace also returns no metrics. What does this combination most strongly suggest?
• Transit wants to rightsize GIS worker requests after observing that pods request far more CPU than they use in steady state. What comparison guides that decision?
• A school-district worker node reports high CPU while kubectl top pods shows only modest application usage. What should the administrator investigate next?
• A public-health namespace's ResourceQuota is nearly exhausted and new creates begin failing. What does the used-versus-hard ratio primarily signal?
• Building-permits developers notice pods consume more CPU and memory than their manifests declare. A LimitRange applies default requests and limits in the namespace. What is the most accurate explanation?
• An open-data node fills /var/lib/containerd and workloads fail with ephemeral-storage pressure. What should the administrator treat as a first-class usage concern?
• A municipal SRE dashboard highlights elevated container restart counts on several pods. What do persistently high restart counts most strongly indicate?
• A 911 operations dashboard shows the count of Pending pods rising steadily. What does that trend most often indicate?
• Under node memory pressure, a sanitation platform team must reason about which pods the kubelet is more likely to evict first. Which statement is correct?
• A parks team sees pods stuck Pending and exports kubectl describe output focused on Events. Which event reason most directly explains a resource-fit scheduling failure?
• Court-records operators suspect a noisy-neighbor pod before tightening CPU limits. What should they use to justify the change?
• A water-utility container shows CPU throttling metrics even though the node still has spare CPU. What is the most likely cause?
• HR cluster administrators find that kubectl top nodes and kubectl top pods error, and HPA cannot obtain resource metrics. What is the usual fix?
• Budget analytics reviews weeks of node and pod usage before opening hardware renewal tickets. What operational purpose does that monitoring primarily serve?
• City platform engineers aggregate kubectl top pod views and notice one namespace dominating cluster CPU. What capability does that analysis demonstrate?
• County operators receive user latency tickets while ingress-controller pods show sustained CPU saturation. What troubleshooting principle does correlating those signals illustrate?
• A city engineer needs the application's recent stdout and stderr after a crash to begin debugging. Which approach retrieves the current container's output stream?
• A county pod crashed and restarted; engineers need logs from the terminated instance, not only the new one. Which kubectl behavior addresses that need?
• A library pod runs an app container and a logging sidecar. kubectl logs without a container name fails with an ambiguous-container error. What must the administrator do?
• During a live transit incident, operators want new log lines as they appear and only the most recent backlog. Which kubectl logs options best match that need?
• A school-district pod is in CrashLoopBackOff. Inspecting logs reveals repeated configuration parse errors on startup. What does this demonstrate about using logs in troubleshooting?
• A public-health pod never starts its main app because an init container failed. Where should the administrator look first for the failure details?
• Building-permits engineers find kubectl logs empty even though the application writes detailed files under /var/log inside the container. What is the correct explanation?
• Open-data analysts notice kubectl logs timestamps that disagree with wall-clock incident times. What underlying factor most directly affects interpretation of those stamps?
• A municipal SRE plans to delete a failing pod after collecting evidence. Why should logs be dumped before deletion when no centralized logging is in place?
• 911 platform staff need application log streams from many pods belonging to one Deployment amid noisy neighbors. What is an appropriate kubectl approach?
• Sanitation engineers compare kubectl describe Events with kubectl logs while diagnosing a failing pod. How do these signals differ?
• A parks department Pod runs an app container that writes error lines and a sidecar that writes access logs—operators need both streams for an outage review. What is the sound multi-container logging model?
• A court-records Pod terminates with OOMKilled and the remaining log snippet is short. What should the administrator still do when reviewing the failure?
• A water-utility engineer runs kubectl logs and receives a permission denied / forbidden response for their personal user. What is the most likely authorization gap?
• An HR application emits structured JSON log lines on stdout. How does that change kubectl log retrieval for the administrator?
• Budget analytics Pods restart several times overnight. An engineer needs logs from an earlier crash, not only the latest termination. What limitation of kubectl logs --previous must they understand?
• After a city worker node reboots, local container logs that were never shipped elsewhere are gone. What durability lesson should administrators take?
• A county runbook allows kubectl exec or attach, but the first triage step for a misbehaving app is unclear. What practice best matches non-invasive troubleshooting?
• A city Service shows no Endpoints even though Pods are Running. What is the most common configuration cause?
• A county lookup of a Service DNS name fails inside a Pod before any TCP connection is attempted. Where should triage start?
• A library client reaches a Service ClusterIP but receives connection refused. Endpoints list a Pod IP. What is a likely cause?
• Transit app docs say traffic is newly allowed, Endpoints look healthy, yet connections from a client Pod time out. What should administrators suspect?
• A school-district NodePort Service works from inside the cluster but workstations on the LAN cannot reach the node’s NodePort. The Service and Endpoints are correct. What is a common external cause?
• A public-health Ingress returns HTTP 503 while the backing Service exists. What readiness condition commonly explains the 503?
• Building-permits Services show correct Endpoints, yet traffic still fails on some nodes. Objects look healthy in the API. What plane should administrators investigate next?
• An open-data client in namespace analytics calls a short Service name that exists in both analytics and shared namespaces and resolves incorrectly. What DNS pitfall is involved?
• A municipal Gateway API HTTPRoute is not taking effect. What should administrators check first in status troubleshooting?
• A 911 workload sets hostNetwork: true and unexpectedly conflicts with ports already used on the node. What side effect should operators remember?
• A sanitation Pod tries to reach its own ClusterIP Service address and sees inconsistent or surprising behavior depending on the dataplane. What concept should the administrator keep in mind?
• Parks staff created an ExternalName Service pointing at an in-cluster app hostname instead of using a normal selector-based Service. What is wrong with that choice?
• Court-records nodes stop placing networking for new Pods and CNI reports address allocation failures. What failure mode fits?
• A water-utility cluster spans VPN-connected racks. Large pod-to-pod payloads stall while small pings work. What networking issue fits this pattern?
• An HR LoadBalancer Service remains External IP Pending in a bare-metal lab with no cloud load-balancer controller. What explains the stuck state?
• Budget analytics teams debug client source IPs and see node addresses instead of Pod IPs for egress to external systems. What mechanism commonly explains this?
• City operators need a standard way to test DNS and ClusterIP connectivity without changing the app Deployment. What approach fits?
• County in-cluster Service DNS works, but browsers on the public Internet cannot resolve the Ingress hostname. Where is the gap?