McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 107

Question 1060

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An app invoice-api in ledger lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Assign ownership for resuming CronJobs and review concurrency policy when maintenance ends.
  2. Govern scheduler labels and include eligible-node checks before promoting hard node selectors.
  3. Capture prior-container logs and restart reasons in workload incident runbooks.
  4. Maintain policy test matrices for required app flows, DNS, telemetry and denied peers.

Explanation

Correct Answer

D:

Maintain policy test matrices for required app flows, DNS, telemetry and denied peers. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. The relevant mechanism is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Incorrect Answers

A:

That safeguard is relevant to: A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid. The current failure instead follows from: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Its prevention measure is “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

B:

This routine guards against another mechanism: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The recurring exposure in the current case is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The matching preventive check is “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

C:

The suggested review tracks a different technical risk: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. Here the sustained control must address: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Choose “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

Question 1061

At Horizon observability, in a disposable simulated environment during a monitored release window: An app metrics-api in observability lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl get nodes -l workload=restricted and compare with kubectl -n observability describe pod metrics-api before changing node labels.
  2. Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support.
  3. Run kubectl -n observability describe pvc metrics-data and kubectl get storageclass balanced-block before recreating either resource.
  4. Run kubectl -n observability describe job hourly-rollup and get logs of its failed Pods before increasing retry limits.

Explanation

Correct Answer

B:

Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. This is the appropriate command-line action or first safe diagnostic. The technical reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Validate the result with: Run authorized allowed and denied connectivity probes after creating the precise required policy exception. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The reported case instead depends on: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The action that directly addresses it is “Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support”.

C:

The offered action targets: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. The case facts point instead to: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Implement “Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support” to address that specific condition.

D:

This alternative is a response to another technical cause: A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. The reported case instead depends on: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The action that directly addresses it is “Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support”.

Question 1062

At Horizon observability, in a disposable simulated environment during a monitored release window: An app metrics-api in observability lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid.
  2. The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone.
  3. NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.
  4. A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency.

Explanation

Correct Answer

C:

NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. This explains the stated condition. The corresponding action is: Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. The direct acceptance evidence is: Run authorized allowed and denied connectivity probes after creating the precise required policy exception.

Incorrect Answers

A:

A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid. That explanation applies to a different technical failure. Here the controlling principle is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

B:

The offered statement is true for this other mechanism: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. It does not explain the facts described here, which follow from: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

D:

A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. That explanation applies to a different technical failure. Here the controlling principle is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Question 1063

At Horizon observability, in a disposable simulated environment during a monitored release window: An app metrics-api in observability lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get pod metrics-api and inspect matching EndpointSlices after correcting the probe or backend.
  2. Verify the exact toleration or deliberate taint removal and confirm that the Pod schedules to an eligible node.
  3. Run kubectl -n observability describe pod metrics-api and verify corrected Pods become Ready without repeated restarts.
  4. Run authorized allowed and denied connectivity probes after creating the precise required policy exception.

Explanation

Correct Answer

D:

Run authorized allowed and denied connectivity probes after creating the precise required policy exception. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The intended action is: Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support.

Incorrect Answers

A:

That test belongs to another control with this basis: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. In the current case, the governing reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The direct verification is “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

B:

This observation would test a different technical dependency: A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. The current issue is governed by: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Its decisive check is “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

C:

The alternative verifies a different condition: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. The current case instead depends on: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Confirm that “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

Question 1064

At Horizon observability, in a disposable simulated environment during a monitored release window: An app metrics-api in observability lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain policy test matrices for required app flows, DNS, telemetry and denied peers.
  2. Validate selector and template-label consistency before initial resource creation.
  3. Gate worker acceptance on CNI readiness and a cross-node connectivity check.
  4. Monitor CSI provisioning events and test StorageClass compatibility in advance.

Explanation

Correct Answer

A:

Maintain policy test matrices for required app flows, DNS, telemetry and denied peers. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. The relevant mechanism is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Incorrect Answers

B:

The suggested review tracks a different technical risk: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. Here the sustained control must address: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Choose “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

C:

That safeguard is relevant to: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The current failure instead follows from: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Its prevention measure is “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

D:

This routine guards against another mechanism: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. The recurring exposure in the current case is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The matching preventive check is “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

Question 1065

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An app dispatch-api in fulfillment lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment describe pvc dispatch-data and kubectl get storageclass standard-block before recreating either resource.
  2. Run kubectl -n fulfillment describe hpa dispatch-api and check the metrics API, CPU requests and target Pod selection.
  3. Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support.
  4. Run kubectl -n fulfillment exec dispatch-api -- cat /etc/resolv.conf and query dispatch-svc.fulfillment.svc.cluster.local from that Pod.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. This is the appropriate command-line action or first safe diagnostic. The technical reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Validate the result with: Run authorized allowed and denied connectivity probes after creating the precise required policy exception. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. Here the stated fault follows a different mechanism: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The corrective choice is “Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support”.

B:

The offered action targets: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The case facts point instead to: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Implement “Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support” to address that specific condition.

D:

The proposed action belongs to the mechanism: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. Here the stated fault follows a different mechanism: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The corrective choice is “Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support”.

Question 1066

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An app dispatch-api in fulfillment lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error.
  2. HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions.
  3. A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency.
  4. NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Explanation

Correct Answer

D:

NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. The direct acceptance evidence is: Run authorized allowed and denied connectivity probes after creating the precise required policy exception.

Incorrect Answers

A:

The offered statement is true for this other mechanism: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. It does not explain the facts described here, which follow from: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

B:

This principle describes a separate cause: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The reported condition is governed by: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The two mechanisms should not be conflated.

C:

A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. That explanation applies to a different technical failure. Here the controlling principle is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Question 1067

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An app dispatch-api in fulfillment lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run authorized allowed and denied connectivity probes after creating the precise required policy exception.
  2. Confirm the scheduler events clear and the Pod is assigned after capacity or request adjustments.
  3. Run kubectl -n fulfillment get cronjob nightly-sync -o yaml and verify suspend is false; observe a scheduled Job in the next eligible window.
  4. Run kubectl -n fulfillment describe pod dispatch-api and verify corrected Pods become Ready without repeated restarts.

Explanation

Correct Answer

A:

Run authorized allowed and denied connectivity probes after creating the precise required policy exception. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The intended action is: Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support.

Incorrect Answers

B:

The alternative verifies a different condition: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. The current case instead depends on: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Confirm that “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

C:

That test belongs to another control with this basis: A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid. In the current case, the governing reason is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The direct verification is “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

D:

This observation would test a different technical dependency: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. The current issue is governed by: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Its decisive check is “Run authorized allowed and denied connectivity probes after creating the precise required policy exception”.

Question 1068

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An app dispatch-api in fulfillment lost connectivity after default-deny policies were installed; the target Pod is otherwise Ready. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test probe paths, startup time and port assumptions before rolling out new workloads.
  2. Maintain policy test matrices for required app flows, DNS, telemetry and denied peers.
  3. Set sensible retry limits and preserve failure logs for batch job diagnostics.
  4. Maintain port contracts across workload, Service and probe configuration changes.

Explanation

Correct Answer

B:

Maintain policy test matrices for required app flows, DNS, telemetry and denied peers. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support. The relevant mechanism is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. Here the sustained control must address: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Choose “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

C:

This routine guards against another mechanism: A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. The recurring exposure in the current case is: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The matching preventive check is “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

D:

The suggested review tracks a different technical risk: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. Here the sustained control must address: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Choose “Maintain policy test matrices for required app flows, DNS, telemetry and denied peers”.

Question 1069

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods on new worker worker-a cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80.
  2. Run kubectl -n kube-system get pods -l component=kube-scheduler and inspect scheduler static Pod logs where available.
  3. Run kubectl -n kube-system get pods -l component=kube-controller-manager and inspect its logs or local static Pod status.
  4. Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a.

Explanation

Correct Answer

D:

Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Validate the result with: Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The case facts point instead to: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Implement “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a” to address that specific condition.

B:

This alternative is a response to another technical cause: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The reported case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The action that directly addresses it is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a”.

C:

The proposed action belongs to the mechanism: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. Here the stated fault follows a different mechanism: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The corrective choice is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a”.

Question 1070

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods on new worker worker-a cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  2. Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods.
  3. Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status.
  4. Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime.

Explanation

Correct Answer

A:

Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a. The direct acceptance evidence is: Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node.

Incorrect Answers

B:

Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

C:

The offered statement is true for this other mechanism: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. It does not explain the facts described here, which follow from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

D:

This principle describes a separate cause: Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime. The reported condition is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The two mechanisms should not be conflated.