McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 119

Question 1180

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service account release-bot in namespace ledger receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Choose realistic initial delays or startup probes based on measured application start behavior.
  2. Use identity-specific can-i checks as part of RBAC rollout tests.
  3. Monitor CSI provisioning events and test StorageClass compatibility in advance.
  4. Govern scheduler labels and include eligible-node checks before promoting hard node selectors.

Explanation

Correct Answer

B:

Use identity-specific can-i checks as part of RBAC rollout tests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl auth can-i list pods -n ledger --as=system:serviceaccount:ledger:release-bot and inspect its RoleBindings. The relevant mechanism is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

Incorrect Answers

A:

That safeguard is relevant to: Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes. The current failure instead follows from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Its prevention measure is “Use identity-specific can-i checks as part of RBAC rollout tests”.

C:

The suggested review tracks a different technical risk: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. Here the sustained control must address: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Choose “Use identity-specific can-i checks as part of RBAC rollout tests”.

D:

That safeguard is relevant to: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The current failure instead follows from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Its prevention measure is “Use identity-specific can-i checks as part of RBAC rollout tests”.

Question 1181

At Horizon observability, in a disposable simulated environment during a monitored release window: Service account audit-bot in namespace observability receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability describe pod metrics-api and inspect readiness failure events and probe configuration.
  2. Run kubectl -n observability get networkpolicy -o yaml and compare podSelector, peers, ports and CNI policy support.
  3. Run kubectl -n observability describe hpa metrics-api and check the metrics API, CPU requests and target Pod selection.
  4. Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings.

Explanation

Correct Answer

D:

Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Validate the result with: Verify list pods is allowed for the authorized service account after a least-privilege binding correction. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: A running container is not necessarily Ready; failing readiness can remove a Pod from ready Service endpoints. The reported case instead depends on: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The action that directly addresses it is “Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings”.

B:

The proposed action belongs to the mechanism: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. Here the stated fault follows a different mechanism: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The corrective choice is “Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings”.

C:

The offered action targets: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The case facts point instead to: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Implement “Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings” to address that specific condition.

Question 1182

At Horizon observability, in a disposable simulated environment during a monitored release window: Service account audit-bot in namespace observability receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.
  2. NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter.
  3. A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency.
  4. ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes.

Explanation

Correct Answer

A:

Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. This explains the stated condition. The corresponding action is: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings. The direct acceptance evidence is: Verify list pods is allowed for the authorized service account after a least-privilege binding correction.

Incorrect Answers

B:

The offered statement is true for this other mechanism: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. It does not explain the facts described here, which follow from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

C:

This principle describes a separate cause: A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. The reported condition is governed by: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The two mechanisms should not be conflated.

D:

ImagePullBackOff indicates failed image retrieval; cluster DNS, credentials, registry availability and image names are distinct potential causes. That explanation applies to a different technical failure. Here the controlling principle is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

Question 1183

At Horizon observability, in a disposable simulated environment during a monitored release window: Service account audit-bot in namespace observability receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Verify both the full Service name and intended short name resolve after DNS configuration correction.
  2. Verify list pods is allowed for the authorized service account after a least-privilege binding correction.
  3. Verify the exact toleration or deliberate taint removal and confirm that the Pod schedules to an eligible node.
  4. Run an in-cluster connection test to Service port 8080 after aligning targetPort with 3000.

Explanation

Correct Answer

B:

Verify list pods is allowed for the authorized service account after a least-privilege binding correction. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The intended action is: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings.

Incorrect Answers

A:

That test belongs to another control with this basis: Cluster DNS search domains and dnsPolicy control short-name resolution; resolving a public hostname is not proof of Kubernetes Service resolution. In the current case, the governing reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The direct verification is “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

C:

The alternative verifies a different condition: A NoSchedule taint excludes Pods lacking a matching toleration even if the Node has free resources. The current case instead depends on: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Confirm that “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

D:

That test belongs to another control with this basis: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. In the current case, the governing reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The direct verification is “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

Question 1184

At Horizon observability, in a disposable simulated environment during a monitored release window: Service account audit-bot in namespace observability receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Add labels, readiness and EndpointSlice checks to Service deployment acceptance tests.
  2. Validate selector and template-label consistency before initial resource creation.
  3. Use identity-specific can-i checks as part of RBAC rollout tests.
  4. Choose realistic initial delays or startup probes based on measured application start behavior.

Explanation

Correct Answer

C:

Use identity-specific can-i checks as part of RBAC rollout tests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and inspect its RoleBindings. The relevant mechanism is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

Incorrect Answers

A:

This routine guards against another mechanism: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The recurring exposure in the current case is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The matching preventive check is “Use identity-specific can-i checks as part of RBAC rollout tests”.

B:

The suggested review tracks a different technical risk: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. Here the sustained control must address: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Choose “Use identity-specific can-i checks as part of RBAC rollout tests”.

D:

This routine guards against another mechanism: Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes. The recurring exposure in the current case is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The matching preventive check is “Use identity-specific can-i checks as part of RBAC rollout tests”.

Question 1185

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service account sync-bot in namespace fulfillment receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings.
  2. Run kubectl -n fulfillment get deployment dispatch-api -o yaml and inspect immutable selector and Pod-template labels before planning controlled replacement.
  3. Run kubectl -n fulfillment describe service dispatch-svc and kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc.
  4. Run kubectl -n fulfillment describe pod dispatch-api and compare last termination reason, memory limit and measured working set.

Explanation

Correct Answer

A:

Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Validate the result with: Verify list pods is allowed for the authorized service account after a least-privilege binding correction. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The offered action targets: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. The case facts point instead to: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Implement “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings” to address that specific condition.

C:

This alternative is a response to another technical cause: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. The reported case instead depends on: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The action that directly addresses it is “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings”.

D:

The proposed action belongs to the mechanism: The container runtime can terminate a container when it exceeds its memory cgroup limit; increasing CPU requests does not repair a memory limit failure. Here the stated fault follows a different mechanism: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The corrective choice is “Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings”.

Question 1186

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service account sync-bot in namespace fulfillment receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes.
  2. Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.
  3. The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there.
  4. A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid.

Explanation

Correct Answer

B:

Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. This explains the stated condition. The corresponding action is: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings. The direct acceptance evidence is: Verify list pods is allowed for the authorized service account after a least-privilege binding correction.

Incorrect Answers

A:

The offered statement is true for this other mechanism: Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes. It does not explain the facts described here, which follow from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

C:

The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. That explanation applies to a different technical failure. Here the controlling principle is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

D:

The offered statement is true for this other mechanism: A suspended CronJob skips creating scheduled Jobs even while its controller and time expression are valid. It does not explain the facts described here, which follow from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

Question 1187

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service account sync-bot in namespace fulfillment receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Confirm the corrected Job has a successful completion count and check its Pod exit status.
  2. Run kubectl -n fulfillment get pvc dispatch-data and confirm Bound with capacity and the intended StorageClass after correction.
  3. Verify list pods is allowed for the authorized service account after a least-privilege binding correction.
  4. Run authorized allowed and denied connectivity probes after creating the precise required policy exception.

Explanation

Correct Answer

C:

Verify list pods is allowed for the authorized service account after a least-privilege binding correction. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The intended action is: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings.

Incorrect Answers

A:

This observation would test a different technical dependency: A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. The current issue is governed by: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Its decisive check is “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

B:

The alternative verifies a different condition: A PVC binds only to compatible available storage or successful dynamic provisioning; absent provisioners, quotas or delayed binding can leave it Pending. The current case instead depends on: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Confirm that “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

D:

This observation would test a different technical dependency: NetworkPolicy allows only explicitly selected paths once Pod ingress or egress isolation applies, and both directions may matter. The current issue is governed by: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Its decisive check is “Verify list pods is allowed for the authorized service account after a least-privilege binding correction”.

Question 1188

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service account sync-bot in namespace fulfillment receives Forbidden when trying to list Pods despite healthy authentication. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Validate selector and template-label consistency before initial resource creation.
  2. Set sensible retry limits and preserve failure logs for batch job diagnostics.
  3. Monitor metrics-server availability and required resource requests when enabling autoscaling.
  4. Use identity-specific can-i checks as part of RBAC rollout tests.

Explanation

Correct Answer

D:

Use identity-specific can-i checks as part of RBAC rollout tests. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and inspect its RoleBindings. The relevant mechanism is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A Deployment selector identifies Pods it owns and is generally immutable after creation; patching Service selectors alone does not repair ownership. Here the sustained control must address: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Choose “Use identity-specific can-i checks as part of RBAC rollout tests”.

B:

That safeguard is relevant to: A Job retries failed Pod executions up to its backoff limit, but increasing retries does not repair an invalid command or missing dependency. The current failure instead follows from: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. Its prevention measure is “Use identity-specific can-i checks as part of RBAC rollout tests”.

C:

This routine guards against another mechanism: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The recurring exposure in the current case is: Authentication establishes identity but authorization still requires permitted verbs, resources and scope in matching RBAC bindings. The matching preventive check is “Use identity-specific can-i checks as part of RBAC rollout tests”.

Question 1189

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: HorizontalPodAutoscaler invoice-api in ledger shows <unknown> CPU utilization and is not scaling despite a live Deployment. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger describe pod invoice-api plus kubectl -n ledger logs invoice-api --previous to distinguish startup and runtime faults.
  2. Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection.
  3. Run kubectl -n ledger describe service invoice-svc and kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc.
  4. Run kubectl -n ledger describe service invoice-svc and compare Service targetPort with Pod listening port before patching.

Explanation

Correct Answer

B:

Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection. This is the appropriate command-line action or first safe diagnostic. The technical reason is: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. Validate the result with: Verify HPA reports a numeric utilization and responds to a controlled load change within configured bounds. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: Liveness failure triggers restarts, while startup and readiness probes serve different lifecycle purposes. The case facts point instead to: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. Implement “Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection” to address that specific condition.

C:

The proposed action belongs to the mechanism: A Service may exist without usable backends because labels or Pod readiness do not match expected routing. Here the stated fault follows a different mechanism: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The corrective choice is “Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection”.

D:

The offered action targets: The Service routes to its configured backend target port; working DNS does not establish that the destination process is listening there. The case facts point instead to: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. Implement “Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection” to address that specific condition.

Question 1190

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: HorizontalPodAutoscaler invoice-api in ledger shows <unknown> CPU utilization and is not scaling despite a live Deployment. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector.
  2. A Service may exist without usable backends because labels or Pod readiness do not match expected routing.
  3. HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions.
  4. Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status.

Explanation

Correct Answer

C:

HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. This explains the stated condition. The corresponding action is: Run kubectl -n ledger describe hpa invoice-api and check the metrics API, CPU requests and target Pod selection. The direct acceptance evidence is: Verify HPA reports a numeric utilization and responds to a controlled load change within configured bounds.

Incorrect Answers

A:

This principle describes a separate cause: A hard nodeSelector must match a Node's actual labels; tolerations or Service routing cannot bypass the unmatched selector. The reported condition is governed by: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The two mechanisms should not be conflated.

B:

A Service may exist without usable backends because labels or Pod readiness do not match expected routing. That explanation applies to a different technical failure. Here the controlling principle is: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions.

D:

This principle describes a separate cause: Node memory pressure can cause evictions and scheduling instability independent of one container's OOMKilled status. The reported condition is governed by: HPA CPU utilization is computed from reported metrics relative to requests; missing metrics or requests can prevent scaling decisions. The two mechanisms should not be conflated.