McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 1

Question 1

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The target namespace ledger is missing, and the team needs an owner label finance before workload creation. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite.
  2. Run sudo etcdutl snapshot status /var/backups/invoice-api.db -w table on a compatible administrative host.
  3. Run kubectl taint nodes worker-a special=dedicated:NoSchedule-.
  4. Run kubectl -n ledger create quota invoice-api-cpu --hard=requests.cpu=4 after checking no conflicting quota exists.

Explanation

Correct Answer

A:

Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Validate the result with: Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

This alternative is a response to another technical cause: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The reported case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The action that directly addresses it is “Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite”.

C:

The proposed action belongs to the mechanism: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. Here the stated fault follows a different mechanism: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The corrective choice is “Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite”.

D:

The offered action targets: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. The case facts point instead to: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Implement “Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite” to address that specific condition.

Question 2

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The target namespace ledger is missing, and the team needs an owner label finance before workload creation. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain.
  2. A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.
  3. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.
  4. Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation.

Explanation

Correct Answer

B:

A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. This explains the stated condition. The corresponding action is: Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite. The direct acceptance evidence is: Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist.

Incorrect Answers

A:

This principle describes a separate cause: Drain cordons the node and requests evictions for eligible Pods; the ignore-daemonsets flag is needed because DaemonSet Pods are not deleted by drain. The reported condition is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The two mechanisms should not be conflated.

C:

The offered statement is true for this other mechanism: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. It does not explain the facts described here, which follow from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

D:

This principle describes a separate cause: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. The reported condition is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The two mechanisms should not be conflated.

Question 3

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The target namespace ledger is missing, and the team needs an owner label finance before workload creation. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run both kubectl auth can-i list pods and kubectl auth can-i delete deployments under the service-account impersonation and compare to the policy.
  2. Run kubectl auth can-i list pods -n ledger --as=system:serviceaccount:ledger:release-bot and expect yes.
  3. Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist.
  4. Run kubectl describe node worker-a and confirm the specific taint is absent.

Explanation

Correct Answer

C:

Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The intended action is: Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite.

Incorrect Answers

A:

The alternative verifies a different condition: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The current case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Confirm that “Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist”.

B:

That test belongs to another control with this basis: A RoleBinding associates the service account subject with a Role inside the binding namespace. In the current case, the governing reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The direct verification is “Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist”.

D:

The alternative verifies a different condition: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. The current case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Confirm that “Run kubectl get namespace ledger --show-labels and confirm the namespace and owner label exist”.

Question 4

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The target namespace ledger is missing, and the team needs an owner label finance before workload creation. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Add explicit allowed-and-denied authorization tests after RBAC changes.
  2. Review workload identity ownership and avoid unnecessary credentials on the default service account.
  3. Reserve and govern security-sensitive scheduling labels through controlled change procedures.
  4. Manage namespace creation and required labels through version-controlled bootstrap manifests.

Explanation

Correct Answer

D:

Manage namespace creation and required labels through version-controlled bootstrap manifests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create namespace ledger and then kubectl label namespace ledger owner=finance --overwrite. The relevant mechanism is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Incorrect Answers

A:

That safeguard is relevant to: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The current failure instead follows from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Its prevention measure is “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

B:

This routine guards against another mechanism: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The recurring exposure in the current case is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The matching preventive check is “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

C:

The suggested review tracks a different technical risk: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Here the sustained control must address: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Choose “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

Question 5

At Horizon observability, in a disposable simulated environment during a monitored release window: The target namespace observability is missing, and the team needs an owner label platform before workload creation. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run helm rollback metrics-api 3 --namespace observability after verifying release history and any irreversible data migrations.
  2. Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite.
  3. Run kubectl apply -k ./overlays/production after inspecting the rendered output with kubectl kustomize ./overlays/production.
  4. Run kubectl label node worker-b workload=restricted --overwrite.

Explanation

Correct Answer

B:

Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Validate the result with: Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. The reported case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The action that directly addresses it is “Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite”.

C:

The offered action targets: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. The case facts point instead to: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Implement “Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite” to address that specific condition.

D:

This alternative is a response to another technical cause: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The reported case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The action that directly addresses it is “Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite”.

Question 6

At Horizon observability, in a disposable simulated environment during a monitored release window: The target namespace observability is missing, and the team needs an owner label platform before workload creation. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A RoleBinding associates the service account subject with a Role inside the binding namespace.
  2. A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints.
  3. A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.
  4. Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction.

Explanation

Correct Answer

C:

A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. This explains the stated condition. The corresponding action is: Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite. The direct acceptance evidence is: Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist.

Incorrect Answers

A:

A RoleBinding associates the service account subject with a Role inside the binding namespace. That explanation applies to a different technical failure. Here the controlling principle is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

B:

The offered statement is true for this other mechanism: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. It does not explain the facts described here, which follow from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

D:

Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. That explanation applies to a different technical failure. Here the controlling principle is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Question 7

At Horizon observability, in a disposable simulated environment during a monitored release window: The target namespace observability is missing, and the team needs an owner label platform before workload creation. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get deployment metrics-api --show-labels and compare the live labels with the overlay.
  2. Verify the snapshot command returns readable metadata and a documented file checksum.
  3. Run kubectl -n observability get deploy metrics-operator plus kubectl get crd metrics.example.test and inspect Ready and Established conditions.
  4. Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist.

Explanation

Correct Answer

D:

Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The intended action is: Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite.

Incorrect Answers

A:

That test belongs to another control with this basis: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. In the current case, the governing reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The direct verification is “Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist”.

B:

This observation would test a different technical dependency: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The current issue is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Its decisive check is “Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist”.

C:

The alternative verifies a different condition: Custom resources are reconciled only when their schemas are registered and the operator controller is healthy. The current case instead depends on: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Confirm that “Run kubectl get namespace observability --show-labels and confirm the namespace and owner label exist”.

Question 8

At Horizon observability, in a disposable simulated environment during a monitored release window: The target namespace observability is missing, and the team needs an owner label platform before workload creation. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Manage namespace creation and required labels through version-controlled bootstrap manifests.
  2. Reserve and govern security-sensitive scheduling labels through controlled change procedures.
  3. Record node maintenance ownership and uncordon obligations before opening a window.
  4. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.

Explanation

Correct Answer

A:

Manage namespace creation and required labels through version-controlled bootstrap manifests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create namespace observability and then kubectl label namespace observability owner=platform --overwrite. The relevant mechanism is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Incorrect Answers

B:

The suggested review tracks a different technical risk: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. Here the sustained control must address: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Choose “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

C:

That safeguard is relevant to: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The current failure instead follows from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Its prevention measure is “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

D:

This routine guards against another mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The recurring exposure in the current case is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The matching preventive check is “Manage namespace creation and required labels through version-controlled bootstrap manifests”.

Question 9

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The target namespace fulfillment is missing, and the team needs an owner label supply before workload creation. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run sudo etcdutl snapshot status /var/backups/dispatch-api.db -w table on a compatible administrative host.
  2. Run kubectl taint nodes worker-c special=dedicated:NoSchedule after confirming it is absent.
  3. Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite.
  4. Run kubectl -n fulfillment create quota dispatch-api-cpu --hard=requests.cpu=8 after checking no conflicting quota exists.

Explanation

Correct Answer

C:

Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Validate the result with: Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. Here the stated fault follows a different mechanism: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The corrective choice is “Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite”.

B:

The offered action targets: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The case facts point instead to: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. Implement “Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite” to address that specific condition.

D:

The proposed action belongs to the mechanism: A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. Here the stated fault follows a different mechanism: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The corrective choice is “Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite”.

Question 10

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The target namespace fulfillment is missing, and the team needs an owner label supply before workload creation. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject.
  2. The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore.
  3. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.
  4. A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

Explanation

Correct Answer

D:

A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. This explains the stated condition. The corresponding action is: Run kubectl create namespace fulfillment and then kubectl label namespace fulfillment owner=supply --overwrite. The direct acceptance evidence is: Run kubectl get namespace fulfillment --show-labels and confirm the namespace and owner label exist.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. It does not explain the facts described here, which follow from: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.

B:

This principle describes a separate cause: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The reported condition is governed by: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors. The two mechanisms should not be conflated.

C:

A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. That explanation applies to a different technical failure. Here the controlling principle is: A Namespace supplies a scope for namespaced resources while its metadata labels support policy and inventory selectors.