I85PREP
⌘ K
CKA study materials
CKA study resources

CKA (Other exams) practice questions

One question at a time. Build your CKA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cluster Architecture, Installation & Configuration

A cluster administrator wants to upgrade the control plane of a kubeadm-managed cluster from v1.30 to v1.31. Which command should be run first on the first control plane node?

  1. kubeadm upgrade node
  2. kubectl upgrade cluster v1.31.0
  3. kubeadm upgrade apply v1.31.0 Correct answer.
  4. kubeadm init --upgrade

Explanation

On the first control plane node, kubeadm upgrade apply performs the control plane upgrade and also runs the necessary preflight checks for the target version. The kubelet and kubectl packages must be upgraded separately afterwards, and node upgrades use kubeadm upgrade node.

Question 2Cluster Architecture, Installation & Configuration

Which component in a kubeadm cluster stores the cluster-wide certificate authority and is used by kubeadm to sign new certificates?

  1. /etc/kubernetes/admin.conf
  2. /etc/kubernetes/pki/ca.crt and ca.key Correct answer.
  3. /var/lib/kubelet/config.yaml
  4. /etc/cni/net.d/10-flannel.conflist

Explanation

The cluster CA certificate and key in /etc/kubernetes/pki are used by kubeadm to sign all control plane and kubelet client certificates. The key must be protected because anyone holding it can mint trusted certificates for the cluster.

Question 3Cluster Architecture, Installation & Configuration

An administrator needs to add a new worker node to an existing kubeadm cluster. Which command generates the token and prints the join command for that node?

  1. kubeadm join --discovery-token
  2. kubeadm config upload from-flags
  3. kubeadm token create --print-join-command Correct answer.
  4. kubeadm certs renew all

Explanation

kubeadm token create --print-join-command creates a bootstrap token and outputs a complete kubeadm join command including the CA certificate hash. The token is short-lived by default, so the join command must be used promptly or the token regenerated.

Question 4Cluster Architecture, Installation & Configuration

Which command displays the certificate expiration dates for the certificates managed by kubeadm on a control plane node?

  1. kubeadm certs renew all
  2. kubectl get certificates -n kube-system
  3. kubeadm certs check-expiration Correct answer.
  4. openssl verify /etc/kubernetes/pki

Explanation

kubeadm certs check-expiration lists each managed certificate with its residual validity and expiration date. It is the standard way to audit certificate expiry before planning a renewal or upgrade.

Question 5Cluster Architecture, Installation & Configuration

A user must be granted read-only access to pods in a single namespace. Which pair of objects is required?

  1. A ServiceAccount and a Secret
  2. A ClusterRole and a ClusterRoleBinding
  3. A NetworkPolicy and a PodDisruptionBudget
  4. A Role and a RoleBinding in that namespace Correct answer.

Explanation

A Role defines permissions scoped to a namespace, and a RoleBinding grants those permissions to a subject within that namespace. Cluster-scoped bindings would grant access across all namespaces, which exceeds the requirement.

Question 6Cluster Architecture, Installation & Configuration

Which command creates a new bootstrap token in a kubeadm cluster in the format required for node joining?

  1. kubeadm token create Correct answer.
  2. kubeadm token list --create
  3. kubeadm init phase token
  4. kubectl create secret generic bootstrap-token

Explanation

kubeadm token create generates a bootstrap token and stores it as a Secret in kube-system. The token follows the [a-z0-9]{6}.[a-z0-9]{16} format that kubeadm join expects.

Question 7Cluster Architecture, Installation & Configuration

An administrator wants to upgrade only the kubelet and kubectl binaries on a worker node that is already running a supported version. Which action is required on the node after installing the new packages?

  1. Run kubeadm upgrade apply on the worker node
  2. Re-run kubeadm join with a new token
  3. Run kubeadm upgrade node and restart the kubelet Correct answer.
  4. Delete and recreate the Node object

Explanation

Worker nodes upgrade their kubelet configuration with kubeadm upgrade node, then the kubelet service is restarted to pick up the new binary. The control plane upgrade apply step is only performed on the first control plane node.

Question 8Cluster Architecture, Installation & Configuration

Which object must exist for the kube-scheduler to place pods onto a node that has been tainted with node-role.kubernetes.io/control-plane:NoSchedule?

  1. A pod tolerating that taint Correct answer.
  2. A pod with a PriorityClass
  3. A pod with hostNetwork enabled
  4. A pod with nodeName set to the control plane node

Explanation

Taints repel pods unless the pod declares a matching toleration. Setting nodeName bypasses the scheduler but does not remove the taint effect for scheduling decisions, and hostNetwork or PriorityClass do not affect taint tolerance.

Question 9Cluster Architecture, Installation & Configuration

A cluster uses RBAC. A developer needs to be able to create and delete deployments but must not be able to read Secrets. Which rule best expresses this?

  1. A ClusterRole granting '*' on '*'
  2. A ClusterRoleBinding to the built-in cluster-admin role
  3. A Role granting get, list, create, delete on deployments.apps only Correct answer.
  4. A Role granting get on secrets and create on deployments

Explanation

RBAC is additive, so permissions should be limited to the verbs and resources actually needed. Granting only deployment verbs in the target namespace avoids granting Secret read access.

Question 10Cluster Architecture, Installation & Configuration

After running kubeadm init, an administrator notices that the kubelet on the new control plane node is not starting. Which step is most likely missing?

  1. Installing a CNI plugin before kubeadm init
  2. Configuring the kubelet cgroup driver to match the container runtime Correct answer.
  3. Creating a bootstrap token
  4. Setting the node's hostname to localhost

Explanation

kubeadm preflight checks warn when the kubelet cgroup driver differs from the container runtime's driver, and a mismatch prevents the kubelet from managing pods correctly. The driver is set in the kubelet config or via the KubeletConfiguration passed to kubeadm.

Question 11Cluster Architecture, Installation & Configuration

An administrator must back up the etcd data of a cluster managed by kubeadm. Which command produces a consistent snapshot using the default certificates?

  1. kubectl get etcd -n kube-system -o yaml > /backup/etcd.db
  2. cp -r /var/lib/etcd /backup/etcd.db
  3. ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key snapshot save /backup/etcd.db Correct answer.
  4. etcdctl snapshot status /backup/etcd.db

Explanation

A consistent etcd backup is taken with etcdctl snapshot save against the etcd endpoint, authenticated with the etcd CA and client certificate pair. Copying the data directory while etcd is running can produce an inconsistent backup.

Question 12Cluster Architecture, Installation & Configuration

A kubeadm cluster was initialized with a custom pod subnet of 10.244.0.0/16. Which configuration must be passed to kubeadm init so that the control plane components use that range?

  1. --service-cidr=10.244.0.0/16
  2. --apiserver-advertise-address=10.244.0.1
  3. --feature-gates=PodCIDR=true
  4. --pod-network-cidr=10.244.0.0/16 Correct answer.

Explanation

The --pod-network-cidr flag sets the pod IP range that the controller manager uses for node CIDR allocation and must match the CNI plugin configuration. The service CIDR is a separate range and must not overlap the pod range.

Question 13Cluster Architecture, Installation & Configuration

A namespace has a ResourceQuota limiting pods to 10. A deployment with replicas: 15 is applied. What happens?

  1. The deployment is rejected entirely and no pods are created
  2. The quota is automatically increased to match the deployment
  3. All 15 pods are created and the quota is ignored for controllers
  4. The ReplicaSet creates 10 pods and the remaining 5 fail admission until quota is freed Correct answer.

Explanation

ResourceQuota is enforced at admission time, so the ReplicaSet controller can create pods only while the quota allows it. The remaining replicas stay pending as failed creations until capacity in the quota is released.

Question 14Cluster Architecture, Installation & Configuration

Which command shows the API resources available in a cluster along with whether each is namespaced?

  1. kubectl get all --all-namespaces
  2. kubectl explain pods
  3. kubectl api-resources Correct answer.
  4. kubectl cluster-info

Explanation

kubectl api-resources lists resource names, short names, API groups, and whether each resource is namespaced. It is useful for discovering the correct resource name and scope before writing manifests or RBAC rules.

Question 15Cluster Architecture, Installation & Configuration

An administrator wants to prevent a namespace from exceeding 4 CPU total across all pods. Which object should be created?

  1. A PodDisruptionBudget with minAvailable: 4
  2. A LimitRange with default cpu: "4"
  3. A HorizontalPodAutoscaler with maxReplicas: 4
  4. A ResourceQuota with requests.cpu: "4" Correct answer.

Explanation

ResourceQuota caps the aggregate resource requests or limits of all pods in a namespace. LimitRange sets per-container defaults and bounds, and HPA scales replicas rather than capping CPU.

Question 16Cluster Architecture, Installation & Configuration

A cluster administrator needs to upgrade the control plane of a highly available kubeadm cluster with three control plane nodes. After upgrading the first node, what is the correct next step?

  1. Run kubeadm init --control-plane-endpoint again
  2. Run kubeadm reset on the remaining nodes and re-join them
  3. Run kubeadm upgrade apply on all remaining nodes simultaneously
  4. Run kubeadm upgrade node on each remaining control plane node one at a time Correct answer.

Explanation

Additional control plane nodes are upgraded with kubeadm upgrade node, one at a time to preserve quorum. Upgrading them simultaneously risks losing etcd quorum if a node fails during the process.

Question 17Cluster Architecture, Installation & Configuration

Which file does the kubelet use by default on a kubeadm node to know which API server to contact and which credentials to present?

  1. /etc/kubernetes/controller-manager.conf
  2. /root/.kube/config
  3. /etc/kubernetes/admin.conf
  4. /etc/kubernetes/kubelet.conf Correct answer.

Explanation

The kubelet reads /etc/kubernetes/kubelet.conf, which contains the API server endpoint and client certificate for the system:node identity. The other kubeconfigs belong to control plane components or the admin user.

Question 18Cluster Architecture, Installation & Configuration

An administrator needs to change the cluster's DNS domain from cluster.local to a custom domain on an existing kubeadm cluster. Which approach is correct?

  1. Change the service CIDR and restart the API server
  2. Delete and recreate all Services
  3. Update clusterDNS and the DNS domain in the kubelet and control plane configuration, then restart the components Correct answer.
  4. Edit the CoreDNS ConfigMap only

Explanation

The DNS domain is a cluster-wide setting referenced by the kubelet, the API server, and CoreDNS, so it must be changed consistently in the component configuration and the DNS addon. Editing only CoreDNS leaves the kubelet searching the old domain.

Question 19Cluster Architecture, Installation & Configuration

Which command lists the roles bound to a specific user in a namespace using kubectl?

  1. kubectl auth can-i --list
  2. kubectl get rolebindings -n <namespace> -o wide Correct answer.
  3. kubectl get roles -n <namespace>
  4. kubectl get clusterrolebindings

Explanation

kubectl get rolebindings with -o wide shows the subjects, including users, that each RoleBinding grants permissions to within the namespace. To check effective permissions for a specific user, kubectl auth can-i --as can also be used.

Question 20Cluster Architecture, Installation & Configuration

A node is marked with the taint node.kubernetes.io/unschedulable:NoSchedule after being cordoned. What is the effect on existing pods?

  1. Existing pods are rescheduled to other nodes
  2. The node is deleted from the cluster
  3. Existing pods keep running and new pods are not scheduled there Correct answer.
  4. Existing pods are evicted immediately

Explanation

Cordoning a node adds the unschedulable taint, which prevents new pods from being scheduled but leaves running pods in place. Draining is the separate operation that evicts existing pods.

Question 21Cluster Architecture, Installation & Configuration

Which kubeadm command generates a new certificate key so that a new control plane node can join an existing cluster?

  1. kubeadm token create --print-join-command
  2. kubeadm certs renew all
  3. kubeadm init phase upload-certs --upload-certs Correct answer.
  4. kubeadm join --control-plane

Explanation

kubeadm init phase upload-certs --upload-certs uploads the control plane certificates to a Secret and prints the certificate key. That key is then passed to kubeadm join --control-plane on the new node.

Question 22Cluster Architecture, Installation & Configuration

An administrator restores an etcd snapshot taken from a kubeadm cluster into a new data directory. Which additional step is required before the API server can use the restored data?

  1. Point the etcd static pod manifest's data-dir and related flags at the restored directory Correct answer.
  2. Recreate all ServiceAccounts
  3. Delete the kube-apiserver static pod manifest
  4. Re-run kubeadm init with the snapshot path

Explanation

After etcdctl snapshot restore, the etcd static pod must be configured to use the restored data directory, typically by editing the etcd manifest in /etc/kubernetes/manifests. The API server then reads the restored state once etcd starts with that directory.

Question 23Cluster Architecture, Installation & Configuration

A cluster administrator wants to enforce that all pods in a namespace define resource requests, rejecting those that do not. Which combination achieves this?

  1. A LimitRange with default requests plus a ResourceQuota requiring requests.cpu and requests.memory Correct answer.
  2. A NetworkPolicy allowing only pods with requests
  3. A PriorityClass with a high value
  4. A PodDisruptionBudget with minAvailable set

Explanation

A LimitRange can supply default requests so pods are admitted with values, while a ResourceQuota that requires requests.cpu and requests.memory rejects pods lacking them. Together they enforce that every admitted pod carries resource requests.

Question 24Cluster Architecture, Installation & Configuration

A user reports that kubectl auth can-i create pods returns yes in namespace dev but the API server rejects the request with forbidden. Which explanation is most consistent?

  1. The kubelet is intercepting the request
  2. The user is authenticating with a different identity than the one being checked Correct answer.
  3. The RoleBinding grants the verb but the Role lacks the resource
  4. The API server is running in a different namespace

Explanation

kubectl auth can-i evaluates permissions for the identity in the current kubeconfig, which may differ from the identity the user believes they are using. Checking with --as or verifying the kubeconfig context usually reveals the mismatch.

Question 25Cluster Architecture, Installation & Configuration

An administrator needs to rotate the cluster CA on a kubeadm cluster without downtime. Which statement describes the supported approach?

  1. Rotating the CA is not possible and the cluster must be rebuilt
  2. kubeadm supports CA rotation through staged certificate renewal with a new CA key pair and distribution of the new CA to all nodes Correct answer.
  3. Deleting ca.key forces kubeadm to regenerate all certificates
  4. kubeadm certs renew all replaces the CA automatically

Explanation

kubeadm provides a documented CA rotation procedure that stages a new CA, distributes the new CA certificate to nodes and kubeconfigs, and then switches signing to the new key. It is performed in phases to avoid invalidating existing trust immediately.

Question 26Cluster Architecture, Installation & Configuration

A cluster administrator needs to install a specific Kubernetes release and wants kubeadm to pull control plane images that match exactly that version. Which kubeadm command prepares these images before running kubeadm init?

  1. kubeadm init --dry-run --kubernetes-version v1.29.3
  2. kubeadm token create --print-join-command
  3. kubeadm upgrade plan --etcd-upgrade=false
  4. kubeadm config images pull --kubernetes-version v1.29.3 Correct answer.

Explanation

kubeadm config images pull downloads the control plane images for the version given by --kubernetes-version, so they are already cached locally when kubeadm init runs. This is the documented way to prefetch images in air-gapped or bandwidth-limited environments. kubeadm init would create the cluster, not merely fetch images.

Question 27Cluster Architecture, Installation & Configuration

An administrator wants to inspect the default configuration kubeadm would use for a new cluster before customizing it. Which command outputs that configuration to standard output?

  1. kubeadm init phase upload-config
  2. kubeadm config view
  3. kubeadm config print init-defaults Correct answer.
  4. kubeadm config migrate

Explanation

kubeadm config print init-defaults writes the default ClusterConfiguration and InitConfiguration to standard output, which can be redirected to a file and edited. The customized file is then passed with --config during kubeadm init. Other config subcommands operate on existing cluster state or convert between API versions.

Question 28Cluster Architecture, Installation & Configuration

A user must be granted permission to view nodes across the whole cluster but nothing else. Which built-in ClusterRole binding approach grants exactly this?

  1. Bind the built-in system:node-reader ClusterRole to the user via a ClusterRoleBinding Correct answer.
  2. Create a Role in the default namespace granting get/list nodes
  3. Bind the built-in system:node ClusterRole to the user
  4. Bind the built-in view ClusterRole to the user in the kube-system namespace

Explanation

Nodes are cluster-scoped resources, so a ClusterRoleBinding is required; a namespaced RoleBinding cannot grant access to them. The built-in system:node-reader ClusterRole provides read access to node objects. system:node is intended for kubelets and carries far broader permissions.

Question 29Cluster Architecture, Installation & Configuration

Which kubeadm command verifies that the current cluster certificates have not expired and reports their residual validity?

  1. kubeadm init phase certs all
  2. kubeadm alpha certs renew
  3. kubeadm certs check-expiration Correct answer.
  4. kubeadm certs renew all

Explanation

kubeadm certs check-expiration lists the control plane certificates, their expiry dates, and whether they can be renewed automatically. It is a read-only inspection command. Renewal is performed separately with kubeadm certs renew.

Question 30Cluster Architecture, Installation & Configuration

An administrator must make the API server's audit log record request bodies for Secrets but not for other resources. Which audit policy construct achieves this?

  1. Add an audit rule with level RequestResponse and a omitStages field
  2. Add an audit rule with level Metadata for all resources
  3. Set the audit-webhook-batch-max-size flag on the API server
  4. Add an audit rule with level RequestResponse and a resource selector for secrets Correct answer.

Explanation

Audit policy rules are evaluated in order, and a rule with level RequestResponse logs the request and response bodies. Scoping that rule with a resource selector for secrets limits body logging to Secret requests. Rules for other resources can then use Metadata to avoid capturing bodies.

Question 31Cluster Architecture, Installation & Configuration

A kubeadm control plane node must be replaced. Before running kubeadm join --control-plane on the new node, which artifact from the existing cluster is required?

  1. The certificate key used by the upload-certs phase Correct answer.
  2. A copy of the etcd data directory from a control plane node
  3. The kubelet kubeconfig file from a worker node
  4. The bootstrap token secret stored in the kube-system namespace

Explanation

Joining a new control plane node requires the cluster CA certificates to be uploaded as secrets, which are encrypted with a certificate key. That key is generated during kubeadm init --upload-certs or with kubeadm init phase upload-certs, and must be supplied to kubeadm join. Without it the new node cannot decrypt the shared certificates.

Question 32Cluster Architecture, Installation & Configuration

An administrator needs to give a ServiceAccount in namespace reporting permission to read pods in that same namespace only. Which pair of objects is required?

  1. A Role in default plus a RoleBinding in reporting
  2. A ClusterRole plus a ClusterRoleBinding
  3. A Role in reporting plus a RoleBinding in reporting Correct answer.
  4. A ClusterRole in reporting plus a RoleBinding in reporting

Explanation

Namespaced access is granted by a Role that defines the rules and a RoleBinding that attaches those rules to the subject within the namespace. Both objects live in reporting, so the permission applies only there. ClusterRoles are cluster-scoped and are not created inside a namespace.

Question 33Cluster Architecture, Installation & Configuration

A node must run only workloads that tolerate a specific taint. Which kubelet-visible mechanism ensures pods without the matching toleration are not admitted to that node?

  1. A nodeSelector on each pod
  2. A PodDisruptionBudget on the node
  3. A taint on the node combined with matching tolerations on the intended pods Correct answer.
  4. An admission webhook that rewrites pod names

Explanation

Taints on a node repel pods that lack a matching toleration, and the scheduler only places tolerant pods there. Taints and tolerations therefore reserve a node for specific workloads. nodeSelector only attracts pods to a node and does not exclude others.

Question 34Cluster Architecture, Installation & Configuration

An administrator wants the kube-apiserver to accept a custom authorization mode in addition to RBAC. Which API server flag configures this?

  1. --authorization-webhook-config-file
  2. --anonymous-auth=false
  3. --enable-admission-plugins=NodeRestriction
  4. --authorization-mode=Node,RBAC Correct answer.

Explanation

The --authorization-mode flag lists the authorization modules the API server evaluates in order. Adding a mode such as Node or Webhook alongside RBAC configures combined authorization. The order matters because the first module that allows or denies a request decides the outcome.

Question 35Cluster Architecture, Installation & Configuration

A cluster administrator must ensure that every namespace automatically receives a default CPU request limit when pods omit one. Which object accomplishes this?

  1. A PodSecurityAdmission label on the namespace
  2. A NetworkPolicy with a default deny rule
  3. A LimitRange with a default request in the namespace Correct answer.
  4. A ResourceQuota with a max limit on CPU

Explanation

A LimitRange can define default and defaultRequest values that the API server injects into containers that omit them. This gives every pod in the namespace a baseline CPU request. A ResourceQuota only enforces aggregate caps and does not supply defaults.

Question 36Cluster Architecture, Installation & Configuration

An administrator needs to confirm which API server endpoint and CA the kubelet on a node uses. Which file should be inspected on that node?

  1. /etc/kubernetes/bootstrap-kubelet.conf
  2. /etc/kubernetes/admin.conf
  3. /var/lib/kubelet/config.yaml
  4. /etc/kubernetes/kubelet.conf Correct answer.

Explanation

On a kubeadm node, /etc/kubernetes/kubelet.conf is the kubeconfig the kubelet uses, and it contains the server URL, the client certificate, and the CA data. This file is written by kubeadm and consumed by the kubelet service. admin.conf is an administrator credential and is not used by the kubelet.

Question 37Cluster Architecture, Installation & Configuration

A cluster must be upgraded from one minor version to the next using kubeadm. What is the required order of operations?

  1. Upgrade the CNI plugin, then kubeadm, then the control plane
  2. Upgrade kubelets on all nodes, then the control plane, then kubeadm
  3. Upgrade etcd first, then kubeadm, then kubelets on workers only
  4. Upgrade kubeadm on the control plane, run kubeadm upgrade apply, then upgrade kubelets and kube-proxy Correct answer.

Explanation

kubeadm upgrades are performed one minor version at a time: first upgrade the kubeadm binary, then run kubeadm upgrade apply on a control plane node, then upgrade kubelets and kube-proxy on each node. The control plane must be upgraded before the kubelets. Draining nodes before kubelet upgrades is also required.

Question 38Cluster Architecture, Installation & Configuration

An administrator must verify that the etcd cluster backing a kubeadm control plane has healthy members and no leader election problems. Which command is appropriate?

  1. etcdctl member remove
  2. etcdctl endpoint health --cluster Correct answer.
  3. etcdctl snapshot save /backup.db
  4. etcdctl defrag --data-dir /var/lib/etcd

Explanation

etcdctl endpoint health --cluster queries each member and reports whether it can serve requests and communicate with the cluster. It is the standard quick check for member health and leader availability. Snapshot and defrag commands perform maintenance rather than diagnostics.

Question 39Cluster Architecture, Installation & Configuration

A cluster administrator wants a namespace to reject any pod whose container image comes from an untrusted registry. Which mechanism enforces this at admission time?

  1. A NetworkPolicy restricting egress to the registry
  2. A ResourceQuota limiting the number of pods
  3. A PodDisruptionBudget on the namespace
  4. A ValidatingAdmissionPolicy or validating webhook that inspects image fields Correct answer.

Explanation

Image source enforcement requires evaluating pod specs at admission time, which is done by a validating admission webhook or a ValidatingAdmissionPolicy with a CEL expression. These can inspect container image fields and reject non-conforming pods. NetworkPolicies and quotas operate on traffic and counts, not image provenance.

Question 40Cluster Architecture, Installation & Configuration

An administrator needs to add a second DNS name to the API server certificate of an existing kubeadm cluster. Which approach is supported?

  1. Add the name to the kubelet configuration and restart the kubelet
  2. Regenerate the certificate by editing the ClusterConfiguration certSANs and running kubeadm init phase certs apiserver Correct answer.
  3. Edit the serving certificate file directly with openssl
  4. Delete the apiserver.crt file and restart the API server

Explanation

The supported path is to add the name to certSANs in the kubeadm ClusterConfiguration stored in the kube-system kubeadm-config ConfigMap, then regenerate the API server certificate with kubeadm init phase certs apiserver. The API server must then be restarted to load the new certificate. Manual edits to certificate files are not supported.

Question 41Cluster Architecture, Installation & Configuration

Which command displays the kubeadm-generated join command for an existing cluster, including a new bootstrap token?

  1. kubeadm config print join-defaults
  2. kubeadm token create --print-join-command Correct answer.
  3. kubeadm join --discovery-token-unsafe-skip-ca-verification
  4. kubeadm token list

Explanation

kubeadm token create --print-join-command creates a fresh bootstrap token and prints a complete kubeadm join command that embeds it. This is the standard way to obtain a ready-to-use join string. kubeadm token list only shows existing tokens without producing a join command.

Question 42Cluster Architecture, Installation & Configuration

A user is bound to a ClusterRole that allows get on pods, but kubectl commands still fail with a forbidden error. Which diagnostic step best isolates the cause?

  1. kubectl rollout status deployment
  2. kubectl auth can-i get pods --as=<user> --namespace=<ns> Correct answer.
  3. kubectl get clusterrolebinding -o wide
  4. kubectl describe node

Explanation

kubectl auth can-i with --as performs a SubjectAccessReview for the impersonated user, showing whether the API server authorizes the action. If it returns no, the binding or rule is wrong; if it returns yes but the request still fails, the cause lies elsewhere such as admission or a different resource name. This isolates authorization from other failures.

Question 43Cluster Architecture, Installation & Configuration

An administrator must confirm the version of the running control plane components rather than the client binary. Which command reports server versions?

  1. kubectl version --client
  2. kubectl version --output=yaml Correct answer.
  3. kubectl api-versions
  4. kubectl cluster-info

Explanation

kubectl version --output=yaml includes both client and server version information, and the server section reports the API server's version. Plain kubectl version also shows both, but the YAML output makes the server block explicit. api-versions lists group versions, not the component release.

Question 44Cluster Architecture, Installation & Configuration

A cluster administrator wants to prevent workloads from being scheduled onto control plane nodes while still allowing DaemonSets such as the CNI to run there. Which configuration achieves this?

  1. Apply a NoSchedule taint with a matching toleration on DaemonSets Correct answer.
  2. Cordon the control plane nodes
  3. Remove the node-role.kubernetes.io/control-plane label
  4. Set unschedulable: true in the node spec

Explanation

Control plane nodes carry the node-role.kubernetes.io/control-plane:NoSchedule taint, which repels ordinary pods. DaemonSets that include a matching toleration are still admitted, so infrastructure components keep running while general workloads are excluded. This is the standard kubeadm behavior.

Question 45Cluster Architecture, Installation & Configuration

An etcd snapshot from a kubeadm cluster must be restored into a new data directory on the same host. Which step is required after running etcdctl snapshot restore?

  1. Delete the kube-apiserver static pod manifest
  2. Regenerate the API server serving certificate
  3. Point the etcd static pod manifest at the restore output directory and restart the etcd pod Correct answer.
  4. Re-run kubeadm init to recreate the etcd data

Explanation

etcdctl snapshot restore writes a new data directory with a new member identity. The etcd static pod manifest must then be updated so its data-dir volume points at that directory, and the etcd pod is restarted. This makes the restored data the member's active store.

Question 46Cluster Architecture, Installation & Configuration

An administrator must ensure that a kubeadm cluster's certificates are renewed automatically before they expire. Which statement is accurate?

  1. Certificates are valid for ten years and never need renewal
  2. Control plane certificates must be renewed manually with kubeadm certs renew before expiry Correct answer.
  3. Renewal happens only when the cluster is upgraded to a new major version
  4. kubeadm renews certificates automatically on every kubelet restart

Explanation

kubeadm-issued control plane certificates default to one year of validity and are not renewed automatically. Administrators must run kubeadm certs renew, or perform a kubeadm upgrade, before they expire. kubeadm certs check-expiration helps track remaining validity.

Question 47Cluster Architecture, Installation & Configuration

A user needs to be able to create pods in namespace staging but must not be able to read the contents of Secrets there. Which RBAC rule set satisfies this?

  1. A Role granting create on pods and get on secrets
  2. A ClusterRole granting create on pods cluster-wide
  3. A Role granting create on pods and no rule for secrets Correct answer.
  4. A Role granting create on pods and list on secrets

Explanation

RBAC is additive and deny-by-default, so granting create on pods without any rule for secrets leaves Secret access unauthorized. The user can create pods but cannot read Secret contents. Adding any secret verb would violate the requirement.

Question 48Cluster Architecture, Installation & Configuration

An administrator wants to inspect the kubeadm ClusterConfiguration currently stored in the cluster. Where is it kept?

  1. In the kube-proxy DaemonSet spec
  2. In the kubelet-config ConfigMap in the default namespace
  3. In the kubeadm-config ConfigMap in the kube-system namespace Correct answer.
  4. In the /etc/kubernetes/manifests directory on each node

Explanation

kubeadm stores the cluster-wide ClusterConfiguration in the kubeadm-config ConfigMap in kube-system. Later kubeadm operations such as upgrades read this object to determine cluster settings. Administrators can inspect or edit it there.

Question 49Cluster Architecture, Installation & Configuration

A cluster administrator needs to add a new worker node whose kubelet version matches the control plane. Which kubeadm operation on the new node completes the join?

  1. kubeadm reset then kubeadm init on the new host
  2. kubeadm join with the discovery token and API server endpoint Correct answer.
  3. kubeadm upgrade node on the new host
  4. kubeadm init --join

Explanation

A new worker joins by running kubeadm join with a bootstrap token and the API server endpoint, which performs TLS bootstrapping and writes the kubelet configuration. The kubelet version on the new node must not exceed the control plane version. kubeadm init would attempt to create a separate control plane.

Question 50Cluster Architecture, Installation & Configuration

An administrator must ensure that a set of pods continues to run on a node even when the node is drained for maintenance. Which mechanism keeps those pods on the node during drain?

  1. An anti-affinity rule between the pods
  2. A PodDisruptionBudget with minAvailable set to zero
  3. A nodeSelector that matches the node label
  4. A DaemonSet whose pods tolerate the node's taints Correct answer.

Explanation

kubectl drain evicts pods unless they are managed by a DaemonSet or carry the appropriate tolerations and are otherwise exempt. DaemonSet pods that tolerate the node's taints remain running during maintenance. This is why infrastructure components survive drains.