McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 105

Question 1040

At Horizon observability, in a disposable simulated environment during a monitored release window: Pod metrics-api in namespace observability resolves external names but cannot resolve local Service metrics-svc; check Pod DNS policy and Service FQDN. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain port contracts across workload, Service and probe configuration changes.
  2. Validate DaemonSet coverage whenever node labels, pools or taints change.
  3. Test DNS policy and search domains during application Pod template changes.
  4. Validate selector and template-label consistency before initial resource creation.

Explanation

Correct Answer

C:

Test DNS policy and search domains during application Pod template changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability exec metrics-api -- cat /etc/resolv.conf and query metrics-svc.observability.svc.cluster.local from that Pod. The relevant mechanism is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.

Incorrect Answers

A:

This routine guards against another mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The recurring exposure in the current case is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The matching preventive check is “Test DNS policy and search domains during application Pod template changes”.

B:

The suggested review tracks a different technical risk: DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers. Here the sustained control must address: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Choose “Test DNS policy and search domains during application Pod template changes”.

D:

This routine guards against another mechanism: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. The recurring exposure in the current case is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The matching preventive check is “Test DNS policy and search domains during application Pod template changes”.

Question 1041

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pod dispatch-api in namespace fulfillment resolves external names but cannot resolve local Service dispatch-svc; check Pod DNS policy and Service FQDN. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod.
  2. Run kubectl -n fulfillment describe hpa dispatch-api and check the metrics API, CPU requests and target Pod selection.
  3. Run kubectl -n fulfillment get deployment dispatch-api -o yaml and inspect immutable selector and Pod-template labels before planning controlled replacement.
  4. Run kubectl -n observability describe service metrics-svc and compare Service targetPort with Pod listening port before patching.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Validate the result with: Verify both the full Service name and intended short name resolve after DNS configuration correction. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The offered action targets: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The case facts point instead to: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Implement “Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod” to address that specific condition.

C:

This alternative is a response to another technical cause: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. The reported case instead depends on: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The action that directly addresses it is “Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod”.

D:

The proposed action belongs to the mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Here the stated fault follows a different mechanism: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The corrective choice is “Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod”.

Question 1042

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pod dispatch-api in namespace fulfillment resolves external names but cannot resolve local Service dispatch-svc; check Pod DNS policy and Service FQDN. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A Service may exist without usable backends because labels or Pod readiness do not match expected routing.
  2. Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.
  3. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  4. DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers.

Explanation

Correct Answer

B:

Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod. The direct acceptance evidence is: Verify both the full Service name and intended short name resolve after DNS configuration correction.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. It does not explain the facts described here, which follow from: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.

C:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. That explanation applies to a different technical failure. Here the controlling principle is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.

D:

The offered statement is true for this other mechanism: DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers. It does not explain the facts described here, which follow from: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.

Question 1043

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pod dispatch-api in namespace fulfillment resolves external names but cannot resolve local Service dispatch-svc; check Pod DNS policy and Service FQDN. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run an in-cluster connection test to Service port 80 after aligning targetPort with 8080.
  2. Run kubectl -n fulfillment get pod dispatch-api -o wide after an approved matching label or selector correction and confirm a suitable node.
  3. Verify both the full Service name and intended short name resolve after DNS configuration correction.
  4. Verify HPA reports a numeric utilization and responds to a controlled load change within configured bounds.

Explanation

Correct Answer

C:

Verify both the full Service name and intended short name resolve after DNS configuration correction. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The intended action is: Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod.

Incorrect Answers

A:

This observation would test a different technical dependency: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The current issue is governed by: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Its decisive check is “Verify both the full Service name and intended short name resolve after DNS configuration correction”.

B:

The alternative verifies a different condition: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The current case instead depends on: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Confirm that “Verify both the full Service name and intended short name resolve after DNS configuration correction”.

D:

This observation would test a different technical dependency: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The current issue is governed by: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Its decisive check is “Verify both the full Service name and intended short name resolve after DNS configuration correction”.

Question 1044

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pod dispatch-api in namespace fulfillment resolves external names but cannot resolve local Service dispatch-svc; check Pod DNS policy and Service FQDN. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain port contracts across workload, Service and probe configuration changes.
  2. Monitor CSI provisioning events and test StorageClass compatibility in advance.
  3. Monitor peak memory with appropriate safety margins and evaluate application leaks rather than unlimited resource increases.
  4. Test DNS policy and search domains during application Pod template changes.

Explanation

Correct Answer

D:

Test DNS policy and search domains during application Pod template changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod. The relevant mechanism is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.

Incorrect Answers

A:

The suggested review tracks a different technical risk: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Here the sustained control must address: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Choose “Test DNS policy and search domains during application Pod template changes”.

B:

That safeguard is relevant to: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. The current failure instead follows from: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Its prevention measure is “Test DNS policy and search domains during application Pod template changes”.

C:

This routine guards against another mechanism: The container runtime can terminate a container when it exceeds its memory cgroup limit; increasing CPU requests does not repair a memory limit failure. The recurring exposure in the current case is: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The matching preventive check is “Test DNS policy and search domains during application Pod template changes”.

Question 1045

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching.
  2. Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80.
  3. Run kubectl -n ledger exec invoice-api -- cat /etc/resolv.conf and query invoice-svc.ledger.svc.cluster.local from that Pod.
  4. Run kubectl -n kube-system get pods -l component=kube-scheduler and inspect scheduler static Pod logs where available.

Explanation

Correct Answer

B:

Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Validate the result with: Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The case facts point instead to: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Implement “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80” to address that specific condition.

C:

The proposed action belongs to the mechanism: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Here the stated fault follows a different mechanism: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The corrective choice is “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80”.

D:

The offered action targets: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The case facts point instead to: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Implement “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80” to address that specific condition.

Question 1046

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods.
  2. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  3. A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.
  4. ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes.

Explanation

Correct Answer

C:

A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80. The direct acceptance evidence is: Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger.

Incorrect Answers

A:

This principle describes a separate cause: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. The reported condition is governed by: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The two mechanisms should not be conflated.

B:

Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. That explanation applies to a different technical failure. Here the controlling principle is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

D:

This principle describes a separate cause: ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes. The reported condition is governed by: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The two mechanisms should not be conflated.

Question 1047

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm the scheduler component is healthy and a new test Pod obtains spec.nodeName after repair.
  2. Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node.
  3. Confirm controller-manager health and that a safely tested Deployment returns to its desired replica count.
  4. Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger.

Explanation

Correct Answer

D:

Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The intended action is: Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80.

Incorrect Answers

A:

The alternative verifies a different condition: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The current case instead depends on: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Confirm that “Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger”.

B:

That test belongs to another control with this basis: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. In the current case, the governing reason is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The direct verification is “Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger”.

C:

This observation would test a different technical dependency: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. The current issue is governed by: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Its decisive check is “Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger”.

Question 1048

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Protect CoreDNS configuration with revision control and staged DNS canary tests.
  2. Maintain port contracts across workload, Service and probe configuration changes.
  3. Monitor control-plane scheduler health and validate static Pod manifest changes.
  4. Validate selector and template-label consistency before initial resource creation.

Explanation

Correct Answer

A:

Protect CoreDNS configuration with revision control and staged DNS canary tests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80. The relevant mechanism is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

Incorrect Answers

B:

This routine guards against another mechanism: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The recurring exposure in the current case is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The matching preventive check is “Protect CoreDNS configuration with revision control and staged DNS canary tests”.

C:

The suggested review tracks a different technical risk: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. Here the sustained control must address: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Choose “Protect CoreDNS configuration with revision control and staged DNS canary tests”.

D:

That safeguard is relevant to: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. The current failure instead follows from: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Its prevention measure is “Protect CoreDNS configuration with revision control and staged DNS canary tests”.

Question 1049

At Horizon observability, in a disposable simulated environment during a monitored release window: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c.
  2. Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a.
  3. Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80.
  4. Run kubectl -n observability describe pod metrics-api and inspect readiness failure events and probe configuration.

Explanation

Correct Answer

C:

Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Validate the result with: Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in observability. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The reported case instead depends on: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The action that directly addresses it is “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80”.

B:

The proposed action belongs to the mechanism: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Here the stated fault follows a different mechanism: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The corrective choice is “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80”.

D:

This alternative is a response to another technical cause: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The reported case instead depends on: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The action that directly addresses it is “Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80”.

Question 1050

At Horizon observability, in a disposable simulated environment during a monitored release window: DNS resolution fails across namespaces and CoreDNS Pods in kube-system are restarting; investigate DNS component health rather than rewriting every Service. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  2. ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes.
  3. The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints.
  4. A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

Explanation

Correct Answer

D:

A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80. The direct acceptance evidence is: Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in observability.

Incorrect Answers

A:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. That explanation applies to a different technical failure. Here the controlling principle is: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

B:

The offered statement is true for this other mechanism: ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes. It does not explain the facts described here, which follow from: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

C:

This principle describes a separate cause: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The reported condition is governed by: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The two mechanisms should not be conflated.