Certified Kubernetes Administrator practice questions

Question 1

A platform team is rolling out a centralized logging stack and asks why the documentation says cluster-level logging needs storage and lifecycle independent of nodes. Which rationale does the Logging Architecture page give?

Accepted Answer

In a cluster, logs should have a separate storage and lifecycle independent of nodes, pods, or containers. This concept is called cluster-level logging.

Answer

Cluster-level logging requires that logs be stored on the same physical disk as the apiserver's etcd database to avoid cross-component coordination overhead,

Answer

Cluster-level logging is a deprecated v1alpha1 feature removed before the v1.0 release of Kubernetes and modern clusters cannot retain any log information beyond the.

Answer

Cluster-level logging is a feature exclusive to managed cloud providers and is unavailable to self-hosted Kubernetes clusters under any documented release,

Question 2

A platform team is rolling out manual certificate generation via easyrsa for a new cluster. Which step ordering does the documentation describe before component certificates can be issued?

Accepted Answer

Download, unpack, and initialize the patched version of easyrsa3. Generate a new certificate authority (CA).

Answer

Use kubeadm reset on every node before downloading easyrsa3 to clear any prior CA material.

Answer

Pre-create per-component CAs and skip the cluster-wide CA entirely;

Answer

Skip CA bootstrap and issue component certificates from the public Let's Encrypt CA directly.

Question 3

A platform team is rolling out an architecture where many applications share the same nodes. Which problem does the Cluster Networking documentation flag for that arrangement?

Accepted Answer

Sharing machines requires ensuring that two applications do not try to use the same ports. Coordinating ports across multiple developers is very difficult to do at scale.

Answer

Sharing machines is forbidden by Kubernetes; the project mandates one workload per node and rejects any attempt to colocate applications via admission control.

Answer

Sharing machines is solved entirely by host-side iptables rules without any need for a Kubernetes-managed networking layer or any coordination across teams in the cluster at scale.

Answer

Sharing machines is irrelevant in modern clusters because every Pod runs in its own dedicated VM with no shared kernel surface or network stack at all between workloads.

Question 4

A developer is reviewing a Deployment's owned ReplicaSet and asks what role the ReplicaSet plays. Which statement matches the ReplicaSet documentation?

Accepted Answer

A ReplicaSet's purpose is to maintain a stable set of replica Pods running at any given time and is often used to guarantee the availability of identical Pods.

Answer

A ReplicaSet is a deprecated alias for ReplicationController scheduled for removal in v1.40 and should not be used in modern clusters or referenced from any new manifest.

Answer

A ReplicaSet schedules exactly a single Pod per cluster and does not manage any replica count — for replication you must instead author a Deployment with explicit replica fields.

Answer

A ReplicaSet is purely a UI artifact rendered by the dashboard and has no functional role in maintaining replicas or recovering from Pod failures in production clusters.

Question 5

A platform team is rolling out a snapshot-based backup pipeline and asks how administrators differ from users in the snapshot API. Which mapping does the VolumeSnapshots documentation describe?

Accepted Answer

A VolumeSnapshotContent is a snapshot taken from a volume in the cluster that has been provisioned by an administrator; a VolumeSnapshot is a request for snapshot of a volume by a user.

Answer

VolumeSnapshotContent and VolumeSnapshot are identical APIs; the duplication exists only for backwards compatibility with the v1alpha1 spec from earlier releases.

Answer

VolumeSnapshotContent is a CRD installed by Helm and VolumeSnapshot is a deprecated v1alpha1 alias that no longer functions in any documented Kubernetes release version available.

Answer

VolumeSnapshotContent is a deprecated alias for ConfigMap and VolumeSnapshot is a deprecated alias for Secret; neither has a snapshot-related role in modern clusters.

Question 6

A platform team is rolling out a debug procedure for a StatefulSet on a fresh cluster. Which prerequisite does the Debug a StatefulSet documentation specify?

Accepted Answer

You need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster.

Answer

Debug a StatefulSet requires that the cluster is rebooted before any debug command can be executed,

Answer

Debug a StatefulSet requires that the cluster has no other workloads running on it;

Answer

Debug a StatefulSet requires that kubectl is uninstalled from the developer's workstation,

Question 7

A team is migrating a cloned VM template into a new cluster and several nodes fail to join after kubeadm init. The administrator suspects identity collisions. Which uniqueness requirement does kubeadm explicitly enforce per node?

Accepted Answer

Each node must have a unique hostname, MAC address, and product_uuid for every node, otherwise kubeadm cannot reliably identify cluster members.

Answer

Only the hostname must be unique; MAC addresses and product UUIDs are intentionally allowed to overlap to support VM cloning.

Answer

Nodes must share a single hostname prefix and a deterministic product_uuid range that kubeadm reserves at install time.

Answer

Each node must have a unique CPU model and RAM size to avoid scheduling drift across the cluster.

Question 8

A SRE is rolling out a workload where two Pods on the same node frequently communicate, and asks what benefit the Service Internal Traffic Policy provides for that pattern. Which rationale matches the documentation?

Accepted Answer

Avoiding a round trip via the cluster network can help with reliability, performance (network latency and throughput), or cost.

Answer

Internal traffic policy disables Pod readiness probes for any backend Pod the policy is applied to,

Answer

Internal traffic policy actually increases latency to even out cluster bandwidth usage;

Answer

Internal traffic policy migrates the Pod to a remote node before forwarding traffic,

Question 9

An administrator is rolling out a node-monitoring agent that must run on every node in the cluster. Which workload controller is the right fit?

Accepted Answer

A DaemonSet ensures that all (or some) Nodes run a copy of a Pod; as nodes are added Pods are added, and as nodes are removed those Pods are garbage collected automatically.

Answer

A Deployment with the replica count equal to the current node count, manually updated by a cluster operator every time the cluster auto-scales nodes up or down.

Answer

A Job, because per-node monitoring is a one-shot task that runs to completion at boot and never needs to be re-scheduled or re-run for the lifetime of the node.

Answer

A CronJob, because monitoring agents must be re-scheduled on a fixed Cron expression every minute rather than running continuously alongside the node's other workloads.

Question 10

A developer is rolling out a caching service that needs scratch space but does not need data to survive Pod restarts. Which volume class does the Ephemeral Volumes documentation recommend?

Accepted Answer

Some applications need additional storage but don't care whether that data is stored persistently across restarts. Ephemeral volumes are designed for these use cases.

Answer

PersistentVolume with a Retain reclaim policy is the only documented option for any caching workload, regardless of whether durability is actually required by the application logic.

Answer

Caching workloads must always use a NodeLocal CSI driver and explicitly avoid ephemeral volumes for any reason whatsoever in any cluster regardless of how the application is architected.

Answer

Caching workloads should mount a hostPath volume on every node and rely on host-side garbage collection to clean up data after Pod restarts in clusters of any size or shape.

Question 11

An administrator is rolling out workloads on a node with limited disk and asks how the kubelet handles resource pressure on the node. Which mechanism does the Node-pressure Eviction documentation describe?

Accepted Answer

Node-pressure eviction is the process by which the kubelet proactively terminates pods to reclaim resource on nodes.

Answer

Node-pressure eviction is the process by which the kube-apiserver remotely terminates Pods on nodes that report high CPU usage,

Answer

Node-pressure eviction is exclusively driven by an external admission webhook installed by Helm chart and explicitly does not involve.

Answer

Node-pressure eviction is a deprecated alias for API-initiated eviction and has no separate behavior in modern Kubernetes releases,

Question 12

A developer is asking how external systems should interact with a cluster's Pods, Namespaces, and ConfigMaps. Which statement best describes the role of the Kubernetes API?

Accepted Answer

The Kubernetes API lets you query and manipulate the state of objects in Kubernetes, and the core of the control plane is the API server and the HTTP API that it exposes.

Answer

The Kubernetes API is a deprecated interface that exists only for legacy kubectl versions; new clients should bypass the apiserver and write directly to etcd.

Answer

The Kubernetes API is exposed on every node directly, so external clients should connect to a kubelet rather than to a centralized apiserver.

Answer

The Kubernetes API is consumed only by kubectl; any other client (including controllers and CSI drivers) must use a custom RPC protocol instead.

Question 13

An architect is designing a service-networking layer and wants the API to mirror organizational roles (infrastructure provider, cluster operator, application developer). Which Gateway API design principle matches this need?

Accepted Answer

Role-oriented: Gateway API kinds are modeled after organizational roles that are responsible for managing Kubernetes service networking.

Answer

Application-only: Gateway API is consumable solely by application developers; cluster operators and infrastructure providers do not interact with it.

Answer

Anonymous: Gateway API hides the identity of the requesting role to enforce strict separation between cluster operators and developers.

Answer

Single-tenant: Gateway API allows only one role per cluster and rejects any attempt to share infrastructure between tenants.

Question 14

A developer is reviewing how Pods get assigned to Nodes and asks which control plane component is responsible for that decision. Which statement matches the kube-scheduler documentation?

Accepted Answer

kube-scheduler is the default scheduler and runs in the control plane; it watches for newly created Pods with no Node assigned and finds the best Node for the Pod to run on.

Answer

kube-scheduler is a deprecated alias for the kube-apiserver and only forwards scheduling decisions directly to etcd;

Answer

kube-scheduler is an external SaaS that every cluster must call over the public internet for every Pod placement decision, which is why its endpoint must be configured during cluster bootstrap.

Answer

kube-scheduler is a worker-side daemon that runs as a sidecar inside every workload Pod and self-elects which node it should be scheduled onto by negotiating with the kubelet on each machine.

Question 15

An administrator is rolling out backup tooling for a stateful workload and asks how Kubernetes models a point-in-time copy of a PersistentVolume. Which primitive does the VolumeSnapshots documentation describe?

Accepted Answer

In Kubernetes, a VolumeSnapshot represents a snapshot of a volume on a storage system.

Answer

Kubernetes does not have any snapshot primitive in any API group;

Answer

VolumeSnapshots are a deprecated v1alpha1 API removed before the v1.0 release of Kubernetes,

Answer

VolumeSnapshots are a per-Pod sidecar that runs on every Pod attached to a PersistentVolume and.

Certified Kubernetes Administrator

Sample questions

Sources

Similar exams