McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 103

Question 1020

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service dispatch-svc in fulfillment exists but requests fail and its EndpointSlices list no ready backends. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Use identity-specific can-i checks as part of RBAC rollout tests.
  2. Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests.
  3. Maintain port contracts across workload, Service and probe configuration changes.
  4. Monitor metrics-server availability and required resource requests when enabling autoscaling.

Explanation

Correct Answer

B:

Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment describe service dispatch-svc and kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc. The relevant mechanism is: A Service may exist without usable backends because labels or Pod readiness do not match expected routing.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Here the sustained control must address: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. Choose “Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests”.

C:

This routine guards against another mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The recurring exposure in the current case is: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The matching preventive check is “Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests”.

D:

The suggested review tracks a different technical risk: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. Here the sustained control must address: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. Choose “Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests”.

Question 1021

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Clients can resolve Service invoice-svc in ledger but connections fail; Service targetPort does not match the container's actual listener 8080. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger describe pod invoice-api and inspect image-pull events, tag and imagePullSecrets.
  2. Run kubectl -n observability exec metrics-api -- cat /etc/resolv.conf and query metrics-svc.observability.svc.cluster.local from that Pod.
  3. Run kubectl -n ledger describe pvc invoice-data and kubectl get storageclass fast-block before recreating either resource.
  4. Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching.

Explanation

Correct Answer

D:

Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Validate the result with: Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes. The case facts point instead to: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Implement “Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching” to address that specific condition.

B:

This alternative is a response to another technical cause: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The reported case instead depends on: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The action that directly addresses it is “Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching”.

C:

The proposed action belongs to the mechanism: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. Here the stated fault follows a different mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The corrective choice is “Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching”.

Question 1022

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Clients can resolve Service invoice-svc in ledger but connections fail; Service targetPort does not match the container's actual listener 8080. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  2. A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources.
  3. Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.
  4. A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector.

Explanation

Correct Answer

A:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. This explains the stated condition. The corresponding action is: Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching. The direct acceptance evidence is: Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080.

Incorrect Answers

B:

A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. That explanation applies to a different technical failure. Here the controlling principle is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

C:

The offered statement is true for this other mechanism: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. It does not explain the facts described here, which follow from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

D:

This principle describes a separate cause: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The reported condition is governed by: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The two mechanisms should not be conflated.

Question 1023

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Clients can resolve Service invoice-svc in ledger but connections fail; Service targetPort does not match the container's actual listener 8080. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm the scheduler events clear and the Pod is assigned after capacity or request adjustments.
  2. Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080.
  3. Run kubectl -n ledger get pod invoice-api and inspect matching EndpointSlices after correcting the probe or backend.
  4. Run kubectl -n ledger get pod invoice-api and confirm the image pulls and containers reach Running after the specific failure is corrected.

Explanation

Correct Answer

B:

Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The intended action is: Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching.

Incorrect Answers

A:

The alternative verifies a different condition: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. The current case instead depends on: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Confirm that “Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080”.

C:

This observation would test a different technical dependency: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The current issue is governed by: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Its decisive check is “Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080”.

D:

The alternative verifies a different condition: ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes. The current case instead depends on: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Confirm that “Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080”.

Question 1024

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Clients can resolve Service invoice-svc in ledger but connections fail; Service targetPort does not match the container's actual listener 8080. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Monitor CSI provisioning events and test StorageClass compatibility in advance.
  2. Capture prior-container logs and restart reasons in workload incident runbooks.
  3. Maintain port contracts across workload, Service and probe configuration changes.
  4. Test DNS policy and search domains during application Pod template changes.

Explanation

Correct Answer

C:

Maintain port contracts across workload, Service and probe configuration changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching. The relevant mechanism is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

Incorrect Answers

A:

That safeguard is relevant to: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. The current failure instead follows from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Its prevention measure is “Maintain port contracts across workload, Service and probe configuration changes”.

B:

This routine guards against another mechanism: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. The recurring exposure in the current case is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The matching preventive check is “Maintain port contracts across workload, Service and probe configuration changes”.

D:

That safeguard is relevant to: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The current failure instead follows from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Its prevention measure is “Maintain port contracts across workload, Service and probe configuration changes”.

Question 1025

At Horizon observability, in a disposable simulated environment during a monitored release window: Clients can resolve Service metrics-svc in observability but connections fail; Service targetPort does not match the container's actual listener 3000. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching.
  2. Run kubectl -n observability describe hpa metrics-api and check the metrics API, CPU requests and target Pod selection.
  3. Run kubectl -n observability describe service metrics-svc and kubectl -n observability get endpointslices -l kubernetes.io/service-name=metrics-svc.
  4. Run kubectl get nodes -l workload=restricted and compare with kubectl -n observability describe pod metrics-api before changing node labels.

Explanation

Correct Answer

A:

Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Validate the result with: Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The proposed action belongs to the mechanism: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. Here the stated fault follows a different mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The corrective choice is “Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching”.

C:

The offered action targets: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The case facts point instead to: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Implement “Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching” to address that specific condition.

D:

This alternative is a response to another technical cause: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The reported case instead depends on: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The action that directly addresses it is “Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching”.

Question 1026

At Horizon observability, in a disposable simulated environment during a monitored release window: Clients can resolve Service metrics-svc in observability but connections fail; Service targetPort does not match the container's actual listener 3000. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers.
  2. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  3. A Service may exist without usable backends because labels or Pod readiness do not match expected routing.
  4. The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone.

Explanation

Correct Answer

B:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. This explains the stated condition. The corresponding action is: Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching. The direct acceptance evidence is: Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000.

Incorrect Answers

A:

DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers. That explanation applies to a different technical failure. Here the controlling principle is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

C:

This principle describes a separate cause: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The reported condition is governed by: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The two mechanisms should not be conflated.

D:

The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. That explanation applies to a different technical failure. Here the controlling principle is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

Question 1027

At Horizon observability, in a disposable simulated environment during a monitored release window: Clients can resolve Service metrics-svc in observability but connections fail; Service targetPort does not match the container's actual listener 3000. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in observability.
  2. Verify HPA reports a numeric utilization and responds to a controlled load change within configured bounds.
  3. Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000.
  4. Confirm endpoint addresses appear for healthy selected Pods and test a request through metrics-svc.

Explanation

Correct Answer

C:

Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The intended action is: Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching.

Incorrect Answers

A:

That test belongs to another control with this basis: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. In the current case, the governing reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The direct verification is “Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000”.

B:

This observation would test a different technical dependency: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The current issue is governed by: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Its decisive check is “Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000”.

D:

That test belongs to another control with this basis: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. In the current case, the governing reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The direct verification is “Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000”.

Question 1028

At Horizon observability, in a disposable simulated environment during a monitored release window: Clients can resolve Service metrics-svc in observability but connections fail; Service targetPort does not match the container's actual listener 3000. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Monitor metrics-server availability and required resource requests when enabling autoscaling.
  2. Validate DaemonSet coverage whenever node labels, pools or taints change.
  3. Test probe paths, startup time and port assumptions before rolling out new workloads.
  4. Maintain port contracts across workload, Service and probe configuration changes.

Explanation

Correct Answer

D:

Maintain port contracts across workload, Service and probe configuration changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching. The relevant mechanism is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

Incorrect Answers

A:

This routine guards against another mechanism: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The recurring exposure in the current case is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The matching preventive check is “Maintain port contracts across workload, Service and probe configuration changes”.

B:

The suggested review tracks a different technical risk: DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers. Here the sustained control must address: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Choose “Maintain port contracts across workload, Service and probe configuration changes”.

C:

That safeguard is relevant to: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The current failure instead follows from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Its prevention measure is “Maintain port contracts across workload, Service and probe configuration changes”.

Question 1029

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Clients can resolve Service dispatch-svc in fulfillment but connections fail; Service targetPort does not match the container's actual listener 9000. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment describe pod dispatch-api and inspect readiness failure events and probe configuration.
  2. Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching.
  3. Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod.
  4. Run kubectl get nodes -l workload=restricted and compare with kubectl -n fulfillment describe pod dispatch-api before changing node labels.

Explanation

Correct Answer

B:

Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Validate the result with: Run an in-cluster connection test to Service port 9090 after aligning targetPort with 9000. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. Here the stated fault follows a different mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The corrective choice is “Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching”.

C:

This alternative is a response to another technical cause: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The reported case instead depends on: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The action that directly addresses it is “Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching”.

D:

The proposed action belongs to the mechanism: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. Here the stated fault follows a different mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The corrective choice is “Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching”.

Question 1030

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Clients can resolve Service dispatch-svc in fulfillment but connections fail; Service targetPort does not match the container's actual listener 9000. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector.
  2. A Service may exist without usable backends because labels or Pod readiness do not match expected routing.
  3. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  4. A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints.

Explanation

Correct Answer

C:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment describe service dispatch-svc and compare Service targetPort with Pod listening port before patching. The direct acceptance evidence is: Run an in-cluster connection test to Service port 9090 after aligning targetPort with 9000.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. It does not explain the facts described here, which follow from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.

B:

This principle describes a separate cause: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The reported condition is governed by: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The two mechanisms should not be conflated.

D:

The offered statement is true for this other mechanism: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. It does not explain the facts described here, which follow from: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.