McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 115

Question 1140

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab control-plane endpoint stopped responding after a static Pod manifest edit; examine local kubelet and runtime state on the control-plane host. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Gate worker acceptance on CNI readiness and a cross-node connectivity check.
  2. Monitor controller-manager availability and reconcile control-plane leader-election health.
  3. Protect CoreDNS configuration with revision control and staged DNS canary tests.
  4. Back up control-plane manifests and validate risky edits before reloading static Pods.

Explanation

Correct Answer

D:

Back up control-plane manifests and validate risky edits before reloading static Pods. This reduces recurrence of the specific operational failure. It reinforces the action: On the control-plane host, run sudo crictl ps -a and sudo journalctl -u kubelet -n 100 --no-pager to inspect kube-apiserver container failures. The relevant mechanism is: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. Applied here, the relevant facts are: static Pod manifest edit; examine local kubelet and runtime state on the control-plane host. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift. The choice being evaluated here is: Gate worker acceptance on CNI readiness and a cross-node connectivity check. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab control-plane endpoin.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. Here the sustained control must address: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. Choose “Back up control-plane manifests and validate risky edits before reloading static Pods”.

B:

That safeguard is relevant to: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. The current failure instead follows from: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. Its prevention measure is “Back up control-plane manifests and validate risky edits before reloading static Pods”.

C:

This routine guards against another mechanism: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The recurring exposure in the current case is: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. The matching preventive check is “Back up control-plane manifests and validate risky edits before reloading static Pods”.

Question 1141

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger describe pod invoice-api and inspect readiness failure events and probe configuration.
  2. On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health.
  3. On the control-plane host, run sudo crictl ps -a and sudo journalctl -u kubelet -n 100 --no-pager to inspect kube-apiserver container failures.
  4. Run kubectl -n kube-system get pods -l k8s-app=kube-dns and kubectl -n kube-system logs deployment/coredns --tail=80.

Explanation

Correct Answer

B:

On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Validate the result with: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The case facts point instead to: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Implement “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health” to address that specific condition.

C:

The proposed action belongs to the mechanism: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. Here the stated fault follows a different mechanism: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The corrective choice is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

D:

The offered action targets: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The case facts point instead to: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Implement “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health” to address that specific condition.

Question 1142

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking.
  2. Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.
  3. The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.
  4. Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service.

Explanation

Correct Answer

C:

The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. This explains the stated condition. The corresponding action is: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. The direct acceptance evidence is: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved.

Incorrect Answers

A:

This principle describes a separate cause: Kubernetes network connectivity requires a functioning CNI implementation on nodes; core API objects alone do not create functional Pod networking. The reported condition is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The two mechanisms should not be conflated.

B:

Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. That explanation applies to a different technical failure. Here the controlling principle is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

D:

This principle describes a separate cause: Node readiness depends on the kubelet and node conditions; application restarts cannot fix a stopped kubelet service. The reported condition is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The two mechanisms should not be conflated.

Question 1143

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm controller-manager health and that a safely tested Deployment returns to its desired replica count.
  2. Confirm the CRI service is healthy and kubectl get node worker-a returns Ready after supported recovery.
  3. Run kubectl -n ledger get pod invoice-api and inspect matching EndpointSlices after correcting the probe or backend.
  4. Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved.

Explanation

Correct Answer

D:

Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The intended action is: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health.

Incorrect Answers

A:

The alternative verifies a different condition: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. The current case instead depends on: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Confirm that “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

B:

That test belongs to another control with this basis: Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime. In the current case, the governing reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The direct verification is “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

C:

This observation would test a different technical dependency: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The current issue is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Its decisive check is “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

Question 1144

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Monitor etcd quorum, certificates, latency and verified backups before maintenance.
  2. Monitor control-plane scheduler health and validate static Pod manifest changes.
  3. Protect CoreDNS configuration with revision control and staged DNS canary tests.
  4. Back up control-plane manifests and validate risky edits before reloading static Pods.

Explanation

Correct Answer

A:

Monitor etcd quorum, certificates, latency and verified backups before maintenance. This reduces recurrence of the specific operational failure. It reinforces the action: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. The relevant mechanism is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

Incorrect Answers

B:

This routine guards against another mechanism: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The recurring exposure in the current case is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The matching preventive check is “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

C:

The suggested review tracks a different technical risk: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. Here the sustained control must address: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Choose “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

D:

That safeguard is relevant to: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. The current failure instead follows from: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Its prevention measure is “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

Question 1145

At Horizon observability, in a disposable simulated environment during a monitored release window: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability describe pod metrics-api and inspect readiness failure events and probe configuration.
  2. Run kubectl -n observability describe pod metrics-api plus kubectl -n observability logs metrics-api --previous to distinguish startup and runtime faults.
  3. On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health.
  4. On the control-plane host, run sudo crictl ps -a and sudo journalctl -u kubelet -n 100 --no-pager to inspect kube-apiserver container failures.

Explanation

Correct Answer

C:

On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Validate the result with: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task.

Incorrect Answers

A:

This alternative is a response to another technical cause: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The reported case instead depends on: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The action that directly addresses it is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

B:

The proposed action belongs to the mechanism: Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes. Here the stated fault follows a different mechanism: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The corrective choice is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

D:

This alternative is a response to another technical cause: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. The reported case instead depends on: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The action that directly addresses it is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

Question 1146

At Horizon observability, in a disposable simulated environment during a monitored release window: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.
  2. CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error.
  3. A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector.
  4. The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

Explanation

Correct Answer

D:

The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. This explains the stated condition. The corresponding action is: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. The direct acceptance evidence is: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis.

Incorrect Answers

A:

Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. That explanation applies to a different technical failure. Here the controlling principle is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

B:

The offered statement is true for this other mechanism: CrashLoopBackOff is a restart backoff symptom, not a root cause; the preceding container logs often preserve the terminating process error. It does not explain the facts described here, which follow from: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

C:

This principle describes a separate cause: A cluster-wide DNS component failure affects names across workloads and cannot be resolved by changing one Service selector. The reported condition is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The two mechanisms should not be conflated.

Question 1147

At Horizon observability, in a disposable simulated environment during a monitored release window: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved.
  2. Verify node disk pressure clears and relevant Pods become stable after approved cleanup or capacity changes.
  3. Confirm local API server container health and successful kubectl get --raw=/readyz after restoring the valid manifest.
  4. Run kubectl -n observability get pod metrics-api and inspect matching EndpointSlices after correcting the probe or backend.

Explanation

Correct Answer

A:

Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The intended action is: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which observation best verifies the requested outcome rather than an unrelated state.

Incorrect Answers

B:

This observation would test a different technical dependency: DiskPressure is a node condition triggered by storage thresholds; deleting live runtime data blindly can corrupt workloads. The current issue is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Its decisive check is “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

C:

The alternative verifies a different condition: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. The current case instead depends on: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Confirm that “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

D:

That test belongs to another control with this basis: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. In the current case, the governing reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The direct verification is “Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved”.

Question 1148

At Horizon observability, in a disposable simulated environment during a monitored release window: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Monitor control-plane scheduler health and validate static Pod manifest changes.
  2. Monitor etcd quorum, certificates, latency and verified backups before maintenance.
  3. Maintain an inventory of dedicated-node taints and explicitly reviewed workload tolerations.
  4. Govern scheduler labels and include eligible-node checks before promoting hard node selectors.

Explanation

Correct Answer

B:

Monitor etcd quorum, certificates, latency and verified backups before maintenance. This reduces recurrence of the specific operational failure. It reinforces the action: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. The relevant mechanism is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift.

Incorrect Answers

A:

This routine guards against another mechanism: The scheduler assigns unscheduled Pods to nodes; a broken scheduler differs from per-Pod placement constraints. The recurring exposure in the current case is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The matching preventive check is “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

C:

That safeguard is relevant to: A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. The current failure instead follows from: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Its prevention measure is “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

D:

This routine guards against another mechanism: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The recurring exposure in the current case is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The matching preventive check is “Monitor etcd quorum, certificates, latency and verified backups before maintenance”.

Question 1149

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get pods -l component=kube-controller-manager and inspect its logs or local static Pod status.
  2. On worker-c, run sudo systemctl status containerd and sudo journalctl -u containerd -n 80 --no-pager before modifying runtime configuration.
  3. On the control-plane host, run sudo crictl ps -a and sudo journalctl -u kubelet -n 100 --no-pager to inspect kube-apiserver container failures.
  4. On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health.

Explanation

Correct Answer

D:

On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. This is the appropriate command-line action or first safe diagnostic. The technical reason is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Validate the result with: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task. The choice being evaluated here is: Run kubectl -n kube-system get pods -l component=kube-controller-manager and inspect its logs or local static Pod status. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab API server is unstabl.

Incorrect Answers

A:

The proposed action belongs to the mechanism: Controllers reconcile desired resources with observed state; the API server storing a Deployment does not itself create replica Pods. Here the stated fault follows a different mechanism: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The corrective choice is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

B:

The offered action targets: Kubelet relies on a CRI-compatible runtime for container creation; restarting application Pods cannot repair an unavailable runtime. The case facts point instead to: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. Implement “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health” to address that specific condition.

C:

This alternative is a response to another technical cause: Kubeadm control-plane components are commonly static Pods managed by kubelet; kubectl cannot diagnose them if the API server itself is unavailable. The reported case instead depends on: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The action that directly addresses it is “On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health”.

Question 1150

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab API server is unstable and recent logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.
  2. Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution.
  3. A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector.
  4. A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership.

Explanation

Correct Answer

A:

The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. This explains the stated condition. The corresponding action is: On the control-plane host, run sudo ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --cert=/etc/kubernetes/pki/etcd/healthcheck-client.crt --key=/etc/kubernetes/pki/etcd/healthcheck-client.key endpoint health. The direct acceptance evidence is: Confirm an authenticated healthy endpoint response and renewed API server readiness after the actual etcd fault is resolved. Applied here, the relevant facts are: logs suggest etcd timeouts; inspect authenticated etcd endpoint health before recovery. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis. The choice being evaluated here is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The kubeadm lab API server is unstabl.

Incorrect Answers

B:

This principle describes a separate cause: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. The reported condition is governed by: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues. The two mechanisms should not be conflated.

C:

A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. That explanation applies to a different technical failure. Here the controlling principle is: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.

D:

The offered statement is true for this other mechanism: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. It does not explain the facts described here, which follow from: The control plane depends on a healthy etcd key-value store, and TLS-authenticated endpoint checks distinguish store failures from API client issues.