About this Certified Kubernetes Administrator (CKA) Containers practice test

The CNCF's Certified Kubernetes Administrator (CKA) exam stands apart as a hands-on battle in a real Unix terminal, where you are tasked with upgrading api-servers, configuring network policies, and restoring unresponsive etcd backups under intense time pressure. Since you can't fake your way through CLI-based tasks, preparing requires a deep, muscle-memory understanding of how cluster resources interact. This practice setup is designed to build that muscle-memory fluency, helping you analyze configuration YAMLs, debug cluster state, and write syntax-perfect kubectl commands with confidence.

Certified Kubernetes Administrator Practice Test sample questions

These starter questions help you launch a containers mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.

1. 1. A pod is stuck in 'Pending' state. Which kubectl command would most quickly reveal the reason?

   • A) kubectl get pod <name>
   • B) kubectl describe pod <name>
   • C) kubectl logs <name>
   • D) kubectl exec -it <name> -- sh

2. 2. Which Kubernetes object is most appropriate for running a database that requires stable network identity and persistent storage?

   • A) Deployment
   • B) ReplicaSet
   • C) StatefulSet
   • D) DaemonSet

3. 3. A cluster administrator needs to ensure that a specific node never has pods scheduled onto it unless a pod explicitly tolerates a taint. Which kubectl command applies this taint?

   • A) kubectl label node <node> key=value
   • B) kubectl taint nodes <node> key=value:NoSchedule
   • C) kubectl annotate node <node> key=value
   • D) kubectl cordon <node>

4. 4. Which command creates a full backup of the etcd data store on a Kubernetes control plane node?

   • A) kubectl backup etcd
   • B) etcdctl snapshot save <file>
   • C) kubectl get etcd --backup
   • D) kubeadm backup etcd

5. 5. What is the purpose of the kube-scheduler component?

   • A) To store cluster state
   • B) To watch for newly created pods with no assigned node and select a suitable node for them
   • C) To run containers on worker nodes
   • D) To expose the Kubernetes API

6. 6. Which component runs on every worker node and is responsible for starting, stopping, and monitoring containers based on the PodSpec?

   • A) kube-scheduler
   • B) kube-proxy
   • C) kubelet
   • D) controller-manager

7. 7. What is the purpose of a DaemonSet in Kubernetes?

   • A) To run a fixed number of replicas anywhere in the cluster
   • B) To ensure a copy of a pod runs on every (or a selected subset of) node in the cluster
   • C) To run a one-time batch job
   • D) To expose a service externally

8. 8. Which command upgrades a kubeadm-managed control plane node to a new Kubernetes minor version?

   • A) kubectl upgrade cluster
   • B) kubeadm upgrade apply
   • C) kubectl apply -f upgrade.yaml
   • D) systemctl restart kubelet

9. 9. What is the purpose of RBAC (Role-Based Access Control) Roles and RoleBindings in Kubernetes?

   • A) To limit CPU and memory usage
   • B) To grant permissions to perform specific actions on resources within a namespace
   • C) To configure networking policies
   • D) To schedule pods on specific nodes

10. 10. How does a ClusterRole differ from a Role in Kubernetes RBAC?

    • A) They are identical
    • B) A Role is namespace-scoped; a ClusterRole applies cluster-wide or across all namespaces
    • C) A ClusterRole only applies to nodes
    • D) A Role can only be used by administrators

11. 11. Which resource automatically adjusts the number of pod replicas for a workload based on observed CPU utilization?

    • A) LimitRange
    • B) ResourceQuota
    • C) Horizontal Pod Autoscaler (HPA)
    • D) PodDisruptionBudget

12. 12. What is the purpose of a PodDisruptionBudget?

    • A) To limit CPU requests for a pod
    • B) To specify the minimum number or percentage of pods that must remain available during voluntary disruptions like node drains
    • C) To restrict which nodes a pod can run on
    • D) To define container resource limits

13. 13. Which Service type exposes a Kubernetes Service on a static port on each node's IP, making it accessible from outside the cluster?

    • A) ClusterIP
    • B) NodePort
    • C) ExternalName
    • D) Headless Service

14. 14. What is the default Service type in Kubernetes if none is specified?

    • A) NodePort
    • B) LoadBalancer
    • C) ClusterIP
    • D) ExternalName

15. 15. Which Kubernetes resource manages external HTTP/HTTPS access to services within a cluster, typically providing routing based on hostname or path?

    • A) Service
    • B) Ingress
    • C) NetworkPolicy
    • D) Endpoint

16. 16. By default, with no NetworkPolicy applied, what is the network traffic behavior between pods in a Kubernetes cluster?

    • A) All traffic is blocked by default
    • B) All pods can communicate with each other, regardless of namespace
    • C) Only pods in the same namespace can communicate
    • D) Traffic is blocked unless explicitly labeled

17. 17. Which component runs on each node and implements Kubernetes Service networking, such as routing traffic to the correct pod?

    • A) kubelet
    • B) kube-proxy
    • C) CoreDNS
    • D) kube-scheduler

18. 18. What does CoreDNS provide in a Kubernetes cluster?

    • A) Load balancing across nodes
    • B) Internal DNS resolution for Services and Pods
    • C) Container image storage
    • D) Persistent volume provisioning

19. 19. What is the relationship between a PersistentVolume (PV) and a PersistentVolumeClaim (PVC)?

    • A) A PVC is a request for storage that binds to a matching PV
    • B) A PV is a request for storage that binds to a PVC
    • C) They are unrelated resources
    • D) A PVC defines the physical storage hardware

20. 20. What does a StorageClass enable in Kubernetes?

    • A) Manual provisioning of persistent volumes only
    • B) Dynamic provisioning of PersistentVolumes on demand, using a defined provisioner
    • C) Node-level disk encryption
    • D) Container image caching

21. 21. What access mode allows a PersistentVolume to be mounted as read-write by a single node at a time?

    • A) ReadOnlyMany
    • B) ReadWriteMany
    • C) ReadWriteOnce
    • D) ReadWriteOncePod

22. 22. A pod's containers keep restarting with status 'CrashLoopBackOff'. Which command shows the logs from the previous crashed container instance?

    • A) kubectl logs <pod>
    • B) kubectl logs <pod> --previous
    • C) kubectl describe pod <pod>
    • D) kubectl get events

23. 23. A pod is stuck in 'ImagePullBackOff' status. What is the most likely cause?

    • A) The node is out of CPU
    • B) The container image name is incorrect, doesn't exist, or credentials to a private registry are missing/invalid
    • C) The pod's PersistentVolumeClaim is unbound
    • D) The Service has no matching Endpoints

24. 24. A worker node shows status 'NotReady'. Which component's health should be checked first on that node?

    • A) kube-apiserver
    • B) kubelet
    • C) etcd
    • D) kube-scheduler

25. 25. Which command shows recent cluster-level events, useful for diagnosing scheduling failures or resource issues?

    • A) kubectl get events
    • B) kubectl top nodes
    • C) kubectl get componentstatuses
    • D) kubectl cluster-info

26. 26. A user reports they cannot reach a Service, even though the pods behind it are running. Which command helps confirm whether the Service has registered the pods as healthy endpoints?

    • A) kubectl get service <name> -o yaml only
    • B) kubectl get endpoints <name>
    • C) kubectl describe node
    • D) kubectl get replicasets

27. 27. Which command displays real-time CPU and memory usage for nodes in the cluster (requires the metrics server to be installed)?

    • A) kubectl get nodes -o wide
    • B) kubectl top nodes
    • C) kubectl describe nodes
    • D) kubectl get metrics

28. 28. A Deployment's pods are failing readiness probes and are never marked Ready, even though the application logs show no errors. What is a likely cause to investigate first?

    • A) The container image is corrupted
    • B) The readiness probe's configured path, port, or timing doesn't match how the application actually responds
    • C) The node has run out of disk space
    • D) The Service has the wrong selector

29. 29. A cluster administrator suspects the kube-apiserver static pod is failing to start on a control plane node set up with kubeadm. Where should they check the container logs first?

    • A) journalctl on the node, or via crictl/docker logs for the static pod container, since it may not appear via kubectl if the API server itself is down
    • B) kubectl logs kube-apiserver -n kube-system only
    • C) /var/log/kubernetes/api.log always exists and is the only source
    • D) There is no way to view static pod logs

30. 30. Two pods on different nodes cannot communicate with each other over their pod IPs, but pods on the same node can. What is a likely root cause?

    • A) The Service has no endpoints
    • B) A misconfigured or failing CNI (Container Network Interface) plugin providing pod-to-pod networking across nodes
    • C) The PersistentVolumeClaim is unbound
    • D) The ConfigMap is missing

Answer key & quick explanations

Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.

1. 1. A pod is stuck in 'Pending' state. Which kubectl command would most quickly reveal the reason?

   B) kubectl describe pod <name>

   kubectl describe pod shows a chronological Events section at the bottom of its output, which typically includes the exact scheduling failure reason (like insufficient resources or an unsatisfied node selector) — that's the fastest way to see why a pod is Pending. kubectl get pod only shows a brief status summary, kubectl logs shows container output (which doesn't exist yet if the pod hasn't been scheduled), and exec requires a running container to shell into.

2. 2. Which Kubernetes object is most appropriate for running a database that requires stable network identity and persistent storage?

   C) StatefulSet

   A StatefulSet gives each pod a stable, predictable network identity (like pod-0, pod-1) and can attach a dedicated PersistentVolumeClaim to each replica, both of which databases typically need. A Deployment and ReplicaSet treat pods as interchangeable with no stable identity, and a DaemonSet is designed to run one pod per node rather than manage a stateful set of replicas.

3. 3. A cluster administrator needs to ensure that a specific node never has pods scheduled onto it unless a pod explicitly tolerates a taint. Which kubectl command applies this taint?

   B) kubectl taint nodes <node> key=value:NoSchedule

   kubectl taint nodes <node> key=value:NoSchedule applies a taint to the node, and only pods with a matching toleration will be scheduled onto it — everything else is repelled. Labeling and annotating just attach metadata without affecting scheduling by themselves, and cordoning marks a node unschedulable for all new pods rather than allowing exceptions for specific tolerations.

4. 4. Which command creates a full backup of the etcd data store on a Kubernetes control plane node?

   B) etcdctl snapshot save <file>

   etcdctl snapshot save <file> creates a point-in-time backup of etcd's data, which holds the entire state of the cluster — this is the standard, Kubernetes-documented way to back up a cluster. There's no built-in kubectl or kubeadm command that performs this backup directly.

5. 5. What is the purpose of the kube-scheduler component?

   B) To watch for newly created pods with no assigned node and select a suitable node for them

   The kube-scheduler watches for pods that have been created but have no node assigned, and selects a suitable node for each based on resource requirements, constraints, and policies. Storing cluster state is etcd's job, running containers is the kubelet/container runtime's job, and exposing the API is the kube-apiserver's job.

6. 6. Which component runs on every worker node and is responsible for starting, stopping, and monitoring containers based on the PodSpec?

   C) kubelet

   The kubelet runs on every worker node and is responsible for making sure the containers described in a pod's spec are actually running and healthy, communicating with the container runtime to start and stop them. kube-scheduler assigns pods to nodes but doesn't run them, kube-proxy handles Service networking, and the controller-manager runs cluster-level control loops rather than managing individual containers.

7. 7. What is the purpose of a DaemonSet in Kubernetes?

   B) To ensure a copy of a pod runs on every (or a selected subset of) node in the cluster

   A DaemonSet ensures that a copy of a pod runs on every node in the cluster (or a selected subset via node selectors/affinity), which is ideal for node-level agents like log collectors or monitoring agents. A fixed replica count anywhere in the cluster describes a Deployment/ReplicaSet instead, a one-time batch job is a Job resource, and exposing something externally is a Service's role.

8. 8. Which command upgrades a kubeadm-managed control plane node to a new Kubernetes minor version?

   B) kubeadm upgrade apply

   kubeadm upgrade apply performs the actual upgrade of a control plane node that was set up with kubeadm, after the kubeadm tool itself has been updated to the target version. There's no such kubectl upgrade or apply-a-YAML mechanism for cluster version upgrades, and restarting kubelet alone doesn't upgrade any component's version.

9. 9. What is the purpose of RBAC (Role-Based Access Control) Roles and RoleBindings in Kubernetes?

   B) To grant permissions to perform specific actions on resources within a namespace

   RBAC Roles define a set of permissions (like get, list, create on specific resource types) within a namespace, and a RoleBinding grants those permissions to specific users, groups, or service accounts. RBAC doesn't limit CPU/memory (that's ResourceQuota/LimitRange), configure networking (NetworkPolicy), or schedule pods (scheduler, taints/affinity).

10. 10. How does a ClusterRole differ from a Role in Kubernetes RBAC?

    B) A Role is namespace-scoped; a ClusterRole applies cluster-wide or across all namespaces

    A Role's permissions apply only within the single namespace it's created in, while a ClusterRole's permissions can be granted cluster-wide (via a ClusterRoleBinding) or reused across multiple namespaces (via RoleBindings referencing it). ClusterRoles aren't limited to nodes, and both Roles and ClusterRoles can be bound to regular users or service accounts, not just administrators.

11. 11. Which resource automatically adjusts the number of pod replicas for a workload based on observed CPU utilization?

    C) Horizontal Pod Autoscaler (HPA)

    The Horizontal Pod Autoscaler automatically adjusts the number of pod replicas for a workload based on observed metrics like CPU utilization, scaling up or down within a configured range. LimitRange and ResourceQuota constrain resource requests/limits rather than replica count, and a PodDisruptionBudget limits voluntary disruptions rather than driving autoscaling.

12. 12. What is the purpose of a PodDisruptionBudget?

    B) To specify the minimum number or percentage of pods that must remain available during voluntary disruptions like node drains

    A PodDisruptionBudget specifies the minimum number (or percentage) of a workload's pods that must stay available during voluntary disruptions, such as node drains or cluster upgrades, so Kubernetes won't evict pods past that threshold at once. It doesn't limit CPU requests, restrict which nodes a pod runs on, or define container resource limits — those are separate mechanisms.

13. 13. Which Service type exposes a Kubernetes Service on a static port on each node's IP, making it accessible from outside the cluster?

    B) NodePort

    A NodePort Service opens the same static port on every node's IP address and forwards traffic from that port to the Service, making it reachable from outside the cluster without a cloud load balancer. ClusterIP is only reachable inside the cluster, ExternalName maps to an external DNS name rather than exposing pods, and a Headless Service skips load-balancing entirely rather than exposing a node port.

14. 14. What is the default Service type in Kubernetes if none is specified?

    C) ClusterIP

    If no type is specified, a Service defaults to ClusterIP, which is only reachable from within the cluster using an internal virtual IP. NodePort and LoadBalancer both need to be explicitly requested to expose the Service externally, and ExternalName is used for a completely different purpose — mapping to an external DNS name.

15. 15. Which Kubernetes resource manages external HTTP/HTTPS access to services within a cluster, typically providing routing based on hostname or path?

    B) Ingress

    Ingress is the resource specifically designed to manage external HTTP/HTTPS access into the cluster, typically routing requests to different backend Services based on hostname or URL path through a single entry point. A Service alone doesn't provide this kind of host/path-based routing, NetworkPolicy controls which traffic is allowed between pods rather than routing external traffic, and an Endpoint just tracks the IPs backing a Service.

16. 16. By default, with no NetworkPolicy applied, what is the network traffic behavior between pods in a Kubernetes cluster?

    B) All pods can communicate with each other, regardless of namespace

    By default, Kubernetes networking is flat and unrestricted — any pod can reach any other pod's IP across the cluster unless a NetworkPolicy is specifically applied to restrict that traffic. Traffic isn't blocked by default, and NetworkPolicies (not labels alone, and not namespace boundaries by default) are what introduce restrictions.

17. 17. Which component runs on each node and implements Kubernetes Service networking, such as routing traffic to the correct pod?

    B) kube-proxy

    kube-proxy runs on every node and maintains the network rules (via iptables, IPVS, or similar) that route traffic sent to a Service's virtual IP to one of the actual backing pods. kubelet manages containers rather than Service routing, CoreDNS provides name resolution rather than traffic routing, and kube-scheduler only decides where pods run.

18. 18. What does CoreDNS provide in a Kubernetes cluster?

    B) Internal DNS resolution for Services and Pods

    CoreDNS is the cluster's internal DNS server, resolving Service and Pod names to their corresponding cluster IP addresses so applications can reach each other by name instead of hardcoded IPs. It doesn't load-balance across nodes, store container images, or provision persistent volumes.

19. 19. What is the relationship between a PersistentVolume (PV) and a PersistentVolumeClaim (PVC)?

    A) A PVC is a request for storage that binds to a matching PV

    A PersistentVolumeClaim is a request for storage made by a user or application, and Kubernetes binds it to a matching PersistentVolume that satisfies the requested size, access mode, and storage class. It's the PVC that requests storage and the PV that represents the actual (or dynamically provisioned) storage resource, not the other way around, and a PVC doesn't describe physical hardware directly.

20. 20. What does a StorageClass enable in Kubernetes?

    B) Dynamic provisioning of PersistentVolumes on demand, using a defined provisioner

    A StorageClass defines a provisioner and parameters that let Kubernetes dynamically create a PersistentVolume on demand whenever a matching PVC is created, removing the need for an administrator to pre-provision storage manually. It has nothing to do with disk encryption specifically or caching container images — those are separate concerns.

21. 21. What access mode allows a PersistentVolume to be mounted as read-write by a single node at a time?

    C) ReadWriteOnce

    ReadWriteOnce (RWO) allows the volume to be mounted as read-write by a single node at a time, which is the most common access mode for block storage like cloud provider disks. ReadOnlyMany and ReadWriteMany allow multiple nodes to mount the volume simultaneously (read-only or read-write respectively), and ReadWriteOncePod is a newer, stricter mode that limits access to a single pod rather than a single node.

22. 22. A pod's containers keep restarting with status 'CrashLoopBackOff'. Which command shows the logs from the previous crashed container instance?

    B) kubectl logs <pod> --previous

    kubectl logs <pod> --previous retrieves the logs from the container's previous run, which is essential when a container has already crashed and restarted, since the current container may not have logged the failure yet. Plain kubectl logs only shows the current (restarted) container's logs, describe shows events and state rather than application log output, and get events won't have the application's own log lines.

23. 23. A pod is stuck in 'ImagePullBackOff' status. What is the most likely cause?

    B) The container image name is incorrect, doesn't exist, or credentials to a private registry are missing/invalid

    ImagePullBackOff almost always means the kubelet couldn't pull the specified container image — often because the image name or tag is misspelled, doesn't exist in the registry, or the cluster lacks valid credentials for a private registry. It isn't related to CPU availability, unbound storage claims, or missing Service endpoints, which produce different symptoms entirely.

24. 24. A worker node shows status 'NotReady'. Which component's health should be checked first on that node?

    B) kubelet

    A node's Ready condition is reported by its kubelet, so if a node shows NotReady, the kubelet on that node (crashed, misconfigured, or unable to reach the control plane) is the first thing to check. kube-apiserver, etcd, and kube-scheduler all run on the control plane and wouldn't directly cause one specific worker node's status to flip to NotReady.

25. 25. Which command shows recent cluster-level events, useful for diagnosing scheduling failures or resource issues?

    A) kubectl get events

    kubectl get events lists recent cluster events — including scheduling failures, image pull problems, and volume mount issues — across the resources it has permission to see, making it a first stop for diagnosing many kinds of problems. kubectl top shows resource usage rather than events, componentstatuses reports basic control-plane health, and cluster-info just prints service endpoint URLs.

26. 26. A user reports they cannot reach a Service, even though the pods behind it are running. Which command helps confirm whether the Service has registered the pods as healthy endpoints?

    B) kubectl get endpoints <name>

    kubectl get endpoints <name> shows exactly which pod IPs the Service has currently registered as healthy backends; if it's empty, the Service's selector isn't matching any Ready pods, which is a very common cause of 'Service unreachable' issues. Viewing only the Service's own YAML won't show which pods are actually backing it, describing a node doesn't reveal Service-to-pod wiring, and ReplicaSets don't show endpoint health either.

27. 27. Which command displays real-time CPU and memory usage for nodes in the cluster (requires the metrics server to be installed)?

    B) kubectl top nodes

    kubectl top nodes reports live CPU and memory usage per node, but it depends on the metrics server being installed and running in the cluster to supply that data. kubectl get nodes -o wide shows node metadata rather than live usage, describe shows configuration and events rather than a live resource dashboard, and there's no built-in 'kubectl get metrics' command.

28. 28. A Deployment's pods are failing readiness probes and are never marked Ready, even though the application logs show no errors. What is a likely cause to investigate first?

    B) The readiness probe's configured path, port, or timing doesn't match how the application actually responds

    When application logs look clean but readiness probes still fail, the most common cause is that the probe itself — its path, port, expected response, or timing (initialDelaySeconds, timeoutSeconds) — doesn't actually match what the running application serves, so Kubernetes marks it NotReady even though the app is fine. A corrupted image or wrong Service selector would usually produce different, more obvious symptoms, and disk space issues would typically show up elsewhere first.

29. 29. A cluster administrator suspects the kube-apiserver static pod is failing to start on a control plane node set up with kubeadm. Where should they check the container logs first?

    A) journalctl on the node, or via crictl/docker logs for the static pod container, since it may not appear via kubectl if the API server itself is down

    Because the kube-apiserver static pod is itself part of the control plane, if it's failing to start, kubectl commands that rely on the API server may not work at all — so logs need to be pulled directly from the node using journalctl (for kubelet) or the container runtime's own log/inspect tools (like crictl logs), rather than through kubectl. Relying solely on kubectl logs assumes the very component that's broken is still reachable, and there's no single fixed log file path guaranteed across all Kubernetes installations.

30. 30. Two pods on different nodes cannot communicate with each other over their pod IPs, but pods on the same node can. What is a likely root cause?

    B) A misconfigured or failing CNI (Container Network Interface) plugin providing pod-to-pod networking across nodes

    Pod-to-pod networking across different nodes is provided by the cluster's CNI plugin, so if same-node communication works but cross-node communication doesn't, a misconfigured, crashed, or incompatible CNI plugin is the most likely root cause. Missing Service endpoints, unbound PVCs, and missing ConfigMaps would cause different, unrelated symptoms rather than breaking raw pod-to-pod IP connectivity specifically.

Curriculum Mapping & Learning Guide

Use this breakdown to identify which skills each question tests and guide post-test review.

Certified Kubernetes Administrator (CKA) Containers units covered

1. Chapter 1: Cluster Architecture & Installation: Upgrading system binaries with kubeadm, taking etcd snapshots, and managing certificates.
2. Chapter 2: Workloads & Scheduling: Running DaemonSets, scaling replicas via HPA, and configuring toleration taints.
3. Chapter 3: Services & Networking: Configuring external access via Ingress resources, managing internal DNS, and creating network policies.
4. Chapter 4: Storage: Creating matching PersistentVolume claims, adjusting storage classes, and assigning system mount modes.
5. Chapter 5: Troubleshooting: Repairing broken node configurations, monitoring container start failures, and diagnosing network connectivity issues.