McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 108

Question 1070

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods on new worker worker-a cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  2. Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods.
  3. Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status.
  4. Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime.

Explanation

Correct Answer

A:

Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a. The direct acceptance evidence is: Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node.

Incorrect Answers

B:

Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

C:

The offered statement is true for this other mechanism: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. It does not explain the facts described here, which follow from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

D:

This principle describes a separate cause: Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime. The reported condition is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The two mechanisms should not be conflated.

Question 1071

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods on new worker worker-a cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Verify the exact toleration or deliberate taint removal and confirm that the Pod schedules to an eligible node.
  2. Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node.
  3. Run kubectl -n ledger get pod invoice-api and inspect matching EndpointSlices after correcting the probe or backend.
  4. Confirm controller-manager health and that a safely tested Deployment returns to its desired replica count.

Explanation

Correct Answer

B:

Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The intended action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a.

Incorrect Answers

A:

The alternative verifies a different condition: A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. The current case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Confirm that “Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node”.

C:

This observation would test a different technical dependency: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The current issue is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its decisive check is “Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node”.

D:

The alternative verifies a different condition: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. The current case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Confirm that “Confirm the expected CNI Pod is Ready on worker-a and test Pod-to-Pod connectivity from that node”.

Question 1072

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods on new worker worker-a cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test probe paths, startup time and port assumptions before rolling out new workloads.
  2. Protect CoreDNS configuration with revision control and staged DNS canary tests.
  3. Gate worker acceptance on CNI readiness and a cross-node connectivity check.
  4. Baseline memory requests and track node allocatable resources and eviction signals.

Explanation

Correct Answer

C:

Gate worker acceptance on CNI readiness and a cross-node connectivity check. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-a. The relevant mechanism is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

Incorrect Answers

A:

That safeguard is relevant to: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The current failure instead follows from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its prevention measure is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

B:

This routine guards against another mechanism: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The recurring exposure in the current case is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The matching preventive check is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

D:

That safeguard is relevant to: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. The current failure instead follows from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its prevention measure is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

Question 1073

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods on new worker worker-b cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b.
  2. Run kubectl -n kube-system get pods -l component=kube-controller-manager and inspect its logs or local static Pod status.
  3. Run kubectl -n observability describe pod metrics-api and inspect readiness failure events and probe configuration.
  4. Run kubectl -n observability describe pod metrics-api and compare CPU requests with kubectl describe node worker-b allocatable resources.

Explanation

Correct Answer

A:

Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Validate the result with: Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The proposed action belongs to the mechanism: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. Here the stated fault follows a different mechanism: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The corrective choice is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b”.

C:

The offered action targets: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The case facts point instead to: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Implement “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b” to address that specific condition.

D:

This alternative is a response to another technical cause: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. The reported case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The action that directly addresses it is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b”.

Question 1074

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods on new worker worker-b cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status.
  2. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  3. The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints.
  4. Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service.

Explanation

Correct Answer

B:

Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b. The direct acceptance evidence is: Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node.

Incorrect Answers

A:

Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

C:

This principle describes a separate cause: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The reported condition is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The two mechanisms should not be conflated.

D:

Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service. That explanation applies to a different technical failure. Here the controlling principle is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

Question 1075

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods on new worker worker-b cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Verify the node returns to Ready without MemoryPressure and Pod eviction rates stabilize after capacity planning.
  2. Verify node disk pressure clears and relevant Pods become stable after approved cleanup or capacity changes.
  3. Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node.
  4. Confirm the scheduler events clear and the Pod is assigned after capacity or request adjustments.

Explanation

Correct Answer

C:

Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The intended action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b.

Incorrect Answers

A:

That test belongs to another control with this basis: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. In the current case, the governing reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The direct verification is “Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node”.

B:

This observation would test a different technical dependency: DiskPressure is a node condition triggered by storage thresholds; deleting live runtime data blindly can corrupt workloads. The current issue is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its decisive check is “Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node”.

D:

That test belongs to another control with this basis: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. In the current case, the governing reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The direct verification is “Confirm the expected CNI Pod is Ready on worker-b and test Pod-to-Pod connectivity from that node”.

Question 1076

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods on new worker worker-b cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Validate DaemonSet coverage whenever node labels, pools or taints change.
  2. Maintain policy test matrices for required app flows, DNS, telemetry and denied peers.
  3. Monitor control-plane scheduler health and validate static Pod manifest changes.
  4. Gate worker acceptance on CNI readiness and a cross-node connectivity check.

Explanation

Correct Answer

D:

Gate worker acceptance on CNI readiness and a cross-node connectivity check. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-b. The relevant mechanism is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

Incorrect Answers

A:

This routine guards against another mechanism: DaemonSets schedule according to node selection and toleration rules; unavailable node agents can break networking or logging on selected workers. The recurring exposure in the current case is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The matching preventive check is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

B:

The suggested review tracks a different technical risk: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Here the sustained control must address: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Choose “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

C:

That safeguard is relevant to: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The current failure instead follows from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its prevention measure is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

Question 1077

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods on new worker worker-c cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl describe node worker-c and on the host inspect df -h and kubelet eviction messages.
  2. Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c.
  3. Run kubectl describe node worker-c and kubectl top node worker-c where metrics are available before altering Pod requests.
  4. Run kubectl -n kube-system get pods -l component=kube-scheduler and inspect scheduler static Pod logs where available.

Explanation

Correct Answer

B:

Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Validate the result with: Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: DiskPressure is a node condition triggered by storage thresholds; deleting live runtime data blindly can corrupt workloads. Here the stated fault follows a different mechanism: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The corrective choice is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c”.

C:

This alternative is a response to another technical cause: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. The reported case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The action that directly addresses it is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c”.

D:

The proposed action belongs to the mechanism: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. Here the stated fault follows a different mechanism: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The corrective choice is “Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c”.

Question 1078

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods on new worker worker-c cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone.
  2. Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service.
  3. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  4. A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.

Explanation

Correct Answer

C:

Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c. The direct acceptance evidence is: Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node.

Incorrect Answers

A:

The offered statement is true for this other mechanism: The scheduler places Pods by requested resources and constraints, not the current shell's observed free CPU alone. It does not explain the facts described here, which follow from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

B:

This principle describes a separate cause: Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service. The reported condition is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The two mechanisms should not be conflated.

D:

The offered statement is true for this other mechanism: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. It does not explain the facts described here, which follow from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

Question 1079

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods on new worker worker-c cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in fulfillment.
  2. Confirm CoreDNS replicas are Ready and a test Pod can resolve a known Service in ledger.
  3. Confirm controller-manager health and that a safely tested Deployment returns to its desired replica count.
  4. Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node.

Explanation

Correct Answer

D:

Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The intended action is: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c.

Incorrect Answers

A:

This observation would test a different technical dependency: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The current issue is governed by: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its decisive check is “Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node”.

B:

The alternative verifies a different condition: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The current case instead depends on: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Confirm that “Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node”.

C:

That test belongs to another control with this basis: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. In the current case, the governing reason is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The direct verification is “Confirm the expected CNI Pod is Ready on worker-c and test Pod-to-Pod connectivity from that node”.

Question 1080

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods on new worker worker-c cannot communicate while the CNI node agent DaemonSet in kube-system lacks a Ready Pod there. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Gate worker acceptance on CNI readiness and a cross-node connectivity check.
  2. Maintain policy test matrices for required app flows, DNS, telemetry and denied peers.
  3. Monitor kubelet health and coordinate OS upgrades with supported runtime versions.
  4. Maintain an inventory of dedicated-node taints and explicitly reviewed workload tolerations.

Explanation

Correct Answer

A:

Gate worker acceptance on CNI readiness and a cross-node connectivity check. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get daemonsets and kubectl -n kube-system get pods -o wide to identify CNI plugin coverage on worker-c. The relevant mechanism is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.

Incorrect Answers

B:

That safeguard is relevant to: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The current failure instead follows from: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Its prevention measure is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

C:

This routine guards against another mechanism: Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service. The recurring exposure in the current case is: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The matching preventive check is “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.

D:

The suggested review tracks a different technical risk: A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. Here the sustained control must address: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Choose “Gate worker acceptance on CNI readiness and a cross-node connectivity check”.