McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 42

Question 410

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The Deployment invoice-api in namespace ledger must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state.
  2. Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement.
  3. A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity.
  4. Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Explanation

Correct Answer

D:

Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. This explains the stated condition. The corresponding action is: Run kubectl -n ledger patch deployment invoice-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The direct acceptance evidence is: Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.

Incorrect Answers

A:

This principle describes a separate cause: Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state. The reported condition is governed by: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The two mechanisms should not be conflated.

B:

Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. That explanation applies to a different technical failure. Here the controlling principle is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

C:

The offered statement is true for this other mechanism: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. It does not explain the facts described here, which follow from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Question 411

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The Deployment invoice-api in namespace ledger must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.
  2. Run kubectl -n ledger rollout status deployment/invoice-api and inspect the container image in the Deployment spec.
  3. Run kubectl -n ledger get secret lab-api-key -o jsonpath='{.type}' and confirm the expected Secret exists without displaying the test token.
  4. Run kubectl -n ledger rollout status deployment/invoice-api and inspect the restored image and configuration.

Explanation

Correct Answer

A:

Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The intended action is: Run kubectl -n ledger patch deployment invoice-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.

Incorrect Answers

B:

That test belongs to another control with this basis: Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference. In the current case, the governing reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The direct verification is “Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

C:

This observation would test a different technical dependency: Kubernetes Secrets are API objects intended for sensitive values, but literals in a shell command can leak via shell history and process observation. The current issue is governed by: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its decisive check is “Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

D:

The alternative verifies a different condition: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The current case instead depends on: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Confirm that “Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

Question 412

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The Deployment invoice-api in namespace ledger must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Retain meaningful revisions and perform health checks after every rollback.
  2. Control privileged node labels and review availability before adding hard scheduling constraints.
  3. Track whether consumers use environment variables or mounted files when planning ConfigMap refreshes.
  4. Pin reviewed image tags or digests and retain rollout history for recovery.

Explanation

Correct Answer

B:

Control privileged node labels and review availability before adding hard scheduling constraints. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger patch deployment invoice-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The relevant mechanism is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Incorrect Answers

A:

That safeguard is relevant to: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The current failure instead follows from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its prevention measure is “Control privileged node labels and review availability before adding hard scheduling constraints”.

C:

The suggested review tracks a different technical risk: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. Here the sustained control must address: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Choose “Control privileged node labels and review availability before adding hard scheduling constraints”.

D:

That safeguard is relevant to: Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference. The current failure instead follows from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its prevention measure is “Control privileged node labels and review availability before adding hard scheduling constraints”.

Question 413

At Horizon observability, in a disposable simulated environment during a monitored release window: The Deployment metrics-api in namespace observability must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability rollout restart deployment/metrics-api.
  2. Run kubectl -n observability autoscale deployment metrics-api --cpu-percent=70 --min=3 --max=8 after setting valid CPU requests.
  3. Run kubectl -n observability patch cronjob hourly-rollup --type=merge -p '{"spec":{"suspend":true}}'.
  4. Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.

Explanation

Correct Answer

D:

Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Validate the result with: Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Rollout restart annotates the Pod template so the Deployment controller replaces Pods according to its rollout strategy. The reported case instead depends on: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The action that directly addresses it is “Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'”.

B:

The proposed action belongs to the mechanism: HPA evaluates metrics relative to Pod resource requests; missing metrics or requests can leave desired replicas unknown. Here the stated fault follows a different mechanism: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The corrective choice is “Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'”.

C:

The offered action targets: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. The case facts point instead to: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Implement “Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'” to address that specific condition.

Question 414

At Horizon observability, in a disposable simulated environment during a monitored release window: The Deployment metrics-api in namespace observability must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.
  2. Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference.
  3. Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes.
  4. ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods.

Explanation

Correct Answer

A:

Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. This explains the stated condition. The corresponding action is: Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The direct acceptance evidence is: Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.

Incorrect Answers

B:

The offered statement is true for this other mechanism: Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference. It does not explain the facts described here, which follow from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

C:

This principle describes a separate cause: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. The reported condition is governed by: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The two mechanisms should not be conflated.

D:

ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods. That explanation applies to a different technical failure. Here the controlling principle is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Question 415

At Horizon observability, in a disposable simulated environment during a monitored release window: The Deployment metrics-api in namespace observability must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get deployment invoice-api -o jsonpath='{.spec.strategy.rollingUpdate}' and verify the values.
  2. Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.
  3. Run kubectl -n fulfillment rollout status deployment/dispatch-api and inspect the restored image and configuration.
  4. Run kubectl -n observability describe deployment metrics-api and inspect environment key references without printing secret values.

Explanation

Correct Answer

B:

Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The intended action is: Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.

Incorrect Answers

A:

That test belongs to another control with this basis: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. In the current case, the governing reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The direct verification is “Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

C:

The alternative verifies a different condition: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The current case instead depends on: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Confirm that “Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

D:

That test belongs to another control with this basis: Pod templates can reference Secret keys without copying literal secret values into the Deployment spec. In the current case, the governing reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The direct verification is “Run kubectl -n observability get deployment metrics-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

Question 416

At Horizon observability, in a disposable simulated environment during a monitored release window: The Deployment metrics-api in namespace observability must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Retain meaningful revisions and perform health checks after every rollback.
  2. Assess capacity for surge Pods and measure availability during upgrades.
  3. Control privileged node labels and review availability before adding hard scheduling constraints.
  4. Track HPA metric availability and avoid simultaneous manual scaling policies that fight the controller.

Explanation

Correct Answer

C:

Control privileged node labels and review availability before adding hard scheduling constraints. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability patch deployment metrics-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The relevant mechanism is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Incorrect Answers

A:

This routine guards against another mechanism: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The recurring exposure in the current case is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The matching preventive check is “Control privileged node labels and review availability before adding hard scheduling constraints”.

B:

The suggested review tracks a different technical risk: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. Here the sustained control must address: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Choose “Control privileged node labels and review availability before adding hard scheduling constraints”.

D:

This routine guards against another mechanism: HPA evaluates metrics relative to Pod resource requests; missing metrics or requests can leave desired replicas unknown. The recurring exposure in the current case is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The matching preventive check is “Control privileged node labels and review availability before adding hard scheduling constraints”.

Question 417

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The Deployment dispatch-api in namespace fulfillment must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.
  2. Run kubectl -n fulfillment rollout status deployment/dispatch-api --timeout=120s.
  3. Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"tolerations":[{"key":"special","operator":"Equal","value":"dedicated","effect":"NoSchedule"}]}}}}' after checking existing tolerations.
  4. Run kubectl -n fulfillment rollout restart deployment/dispatch-api.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Validate the result with: Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The offered action targets: A successful API mutation does not guarantee updated Pods are healthy and available; rollout status tracks controller progress. The case facts point instead to: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Implement “Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'” to address that specific condition.

C:

This alternative is a response to another technical cause: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The reported case instead depends on: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The action that directly addresses it is “Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'”.

D:

The proposed action belongs to the mechanism: Rollout restart annotates the Pod template so the Deployment controller replaces Pods according to its rollout strategy. Here the stated fault follows a different mechanism: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The corrective choice is “Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'”.

Question 418

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The Deployment dispatch-api in namespace fulfillment must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity.
  2. Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.
  3. Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state.
  4. Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference.

Explanation

Correct Answer

B:

Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The direct acceptance evidence is: Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. It does not explain the facts described here, which follow from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

C:

Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state. That explanation applies to a different technical failure. Here the controlling principle is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

D:

The offered statement is true for this other mechanism: Updating a Deployment Pod template triggers a controlled rollout; restarting Pods alone will not change the image reference. It does not explain the facts described here, which follow from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Question 419

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The Deployment dispatch-api in namespace fulfillment must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger rollout status deployment/invoice-api and inspect the restored image and configuration.
  2. Run kubectl -n fulfillment get deployment dispatch-api -o yaml and inspect spec.template.spec.tolerations before testing scheduling.
  3. Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements.
  4. Run kubectl -n fulfillment describe deployment dispatch-api and inspect the environment references on newly created Pods.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The intended action is: Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'.

Incorrect Answers

A:

This observation would test a different technical dependency: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The current issue is governed by: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its decisive check is “Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

B:

The alternative verifies a different condition: A toleration allows a Pod past a matching taint but does not ensure placement without node selection and capacity. The current case instead depends on: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Confirm that “Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

D:

This observation would test a different technical dependency: Environment variables are copied into new container processes from ConfigMap values; existing running processes need replacement to pick up changes. The current issue is governed by: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its decisive check is “Run kubectl -n fulfillment get deployment dispatch-api -o jsonpath='{.spec.template.spec.nodeSelector}' and check Pod placements”.

Question 420

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The Deployment dispatch-api in namespace fulfillment must target nodes labeled workload=restricted in a disposable lab. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Record resume ownership and inspect currently active Jobs during planned suspensions.
  2. Retain meaningful revisions and perform health checks after every rollback.
  3. Check disruption budgets and readiness behavior before application restarts.
  4. Control privileged node labels and review availability before adding hard scheduling constraints.

Explanation

Correct Answer

D:

Control privileged node labels and review availability before adding hard scheduling constraints. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"template":{"spec":{"nodeSelector":{"workload":"restricted"}}}}}'. The relevant mechanism is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout.

Incorrect Answers

A:

The suggested review tracks a different technical risk: CronJob suspension prevents new scheduled Jobs but does not terminate existing Jobs already running. Here the sustained control must address: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Choose “Control privileged node labels and review availability before adding hard scheduling constraints”.

B:

That safeguard is relevant to: A Deployment tracks ReplicaSet revisions and rollout undo restores a recorded earlier Pod template. The current failure instead follows from: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. Its prevention measure is “Control privileged node labels and review availability before adding hard scheduling constraints”.

C:

This routine guards against another mechanism: Rollout restart annotates the Pod template so the Deployment controller replaces Pods according to its rollout strategy. The recurring exposure in the current case is: Node selectors constrain scheduling to nodes whose labels match all specified key/value pairs; patching the Pod template triggers a rollout. The matching preventive check is “Control privileged node labels and review availability before adding hard scheduling constraints”.