McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 59

Question 580

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review ingress class ownership and avoid exposing test applications outside intended environments.
  2. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  3. Audit controller capability and exposed service access policies before enabling public ingress.
  4. Review CoreDNS configuration diffs and keep a tested prior version before changes.

Explanation

Correct Answer

D:

Review CoreDNS configuration diffs and keep a tested prior version before changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The relevant mechanism is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Incorrect Answers

A:

That safeguard is relevant to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current failure instead follows from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Its prevention measure is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

B:

This routine guards against another mechanism: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The recurring exposure in the current case is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The matching preventive check is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

C:

The suggested review tracks a different technical risk: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Here the sustained control must address: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Choose “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

Question 581

At Horizon observability, in a disposable simulated environment during a monitored release window: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability create ingress metrics-ingress --class=nginx --rule='metrics.example.test/=metrics-svc:8080' after confirming the Service exists.
  2. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  3. Run kubectl -n observability apply -f ./policies/metrics-api-peer.yaml after verifying podSelector rules match the source identity.
  4. Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs.

Explanation

Correct Answer

B:

Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. This is the appropriate command-line action or first safe diagnostic. The technical reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Validate the result with: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task.

Incorrect Answers

A:

This alternative is a response to another technical cause: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The reported case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The action that directly addresses it is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

C:

The offered action targets: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The case facts point instead to: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Implement “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile” to address that specific condition.

D:

This alternative is a response to another technical cause: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The reported case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The action that directly addresses it is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

Question 582

At Horizon observability, in a disposable simulated environment during a monitored release window: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy.
  2. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  3. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  4. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

Explanation

Correct Answer

C:

CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The direct acceptance evidence is: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis.

Incorrect Answers

A:

CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. That explanation applies to a different technical failure. Here the controlling principle is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

B:

The offered statement is true for this other mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. It does not explain the facts described here, which follow from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

D:

DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. That explanation applies to a different technical failure. Here the controlling principle is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Question 583

At Horizon observability, in a disposable simulated environment during a monitored release window: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations.
  2. Run kubectl -n kube-system rollout status deployment/coredns then test a Service lookup from fulfillment.
  3. Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test.
  4. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.

Explanation

Correct Answer

D:

Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The intended action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which observation best verifies the requested outcome rather than an unrelated state.

Incorrect Answers

A:

That test belongs to another control with this basis: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. In the current case, the governing reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The direct verification is “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

B:

This observation would test a different technical dependency: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The current issue is governed by: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Its decisive check is “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

C:

The alternative verifies a different condition: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The current case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Confirm that “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

Question 584

At Horizon observability, in a disposable simulated environment during a monitored release window: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review CoreDNS configuration diffs and keep a tested prior version before changes.
  2. Audit controller capability and exposed service access policies before enabling public ingress.
  3. Review ingress class ownership and avoid exposing test applications outside intended environments.
  4. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.

Explanation

Correct Answer

A:

Review CoreDNS configuration diffs and keep a tested prior version before changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The relevant mechanism is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift.

Incorrect Answers

B:

The suggested review tracks a different technical risk: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Here the sustained control must address: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Choose “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

C:

That safeguard is relevant to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current failure instead follows from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Its prevention measure is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

D:

This routine guards against another mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The recurring exposure in the current case is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The matching preventive check is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

Question 585

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc -o wide.
  2. Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session.
  3. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  4. Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists.

Explanation

Correct Answer

C:

Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. This is the appropriate command-line action or first safe diagnostic. The technical reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Validate the result with: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task. The choice being evaluated here is: Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc -o wide. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab.

Incorrect Answers

A:

The proposed action belongs to the mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. Here the stated fault follows a different mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The corrective choice is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

B:

The offered action targets: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The case facts point instead to: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Implement “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile” to address that specific condition.

D:

The proposed action belongs to the mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Here the stated fault follows a different mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The corrective choice is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

Question 586

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.
  2. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  3. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  4. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Explanation

Correct Answer

D:

CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The direct acceptance evidence is: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis. The choice being evaluated here is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab.

Incorrect Answers

A:

The offered statement is true for this other mechanism: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. It does not explain the facts described here, which follow from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

B:

This principle describes a separate cause: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The reported condition is governed by: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The two mechanisms should not be conflated.

C:

The Service port is what clients connect to, while targetPort must reach the actual backend listener. That explanation applies to a different technical failure. Here the controlling principle is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Question 587

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.
  2. Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active.
  3. Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations.
  4. Run kubectl -n kube-system rollout status deployment/coredns then test a Service lookup from ledger.

Explanation

Correct Answer

A:

Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The intended action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which observation best verifies the requested outcome rather than an unrelated state. The choice being evaluated here is: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab.

Incorrect Answers

B:

The alternative verifies a different condition: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The current case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Confirm that “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

C:

That test belongs to another control with this basis: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. In the current case, the governing reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The direct verification is “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

D:

This observation would test a different technical dependency: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The current issue is governed by: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Its decisive check is “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

Question 588

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  2. Review CoreDNS configuration diffs and keep a tested prior version before changes.
  3. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  4. Verify peer label governance and avoid permitting all namespace workloads accidentally.

Explanation

Correct Answer

B:

Review CoreDNS configuration diffs and keep a tested prior version before changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The relevant mechanism is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Applied here, the relevant facts are: configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift. The choice being evaluated here is: Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The CoreDNS configuration of the lab.

Incorrect Answers

A:

The suggested review tracks a different technical risk: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Here the sustained control must address: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Choose “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

C:

This routine guards against another mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The recurring exposure in the current case is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The matching preventive check is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

D:

The suggested review tracks a different technical risk: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Here the sustained control must address: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Choose “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

Question 589

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A reviewed CoreDNS ConfigMap change needs a controlled DNS Deployment restart in kube-system; a healthy rollout is required. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  2. Run kubectl -n ledger apply -f ./gateway/invoice-api-route.yaml after confirming parentRefs, hostnames and backendRefs.
  3. Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs.
  4. Run kubectl -n kube-system rollout restart deployment/coredns after the approved change.

Explanation

Correct Answer

D:

Run kubectl -n kube-system rollout restart deployment/coredns after the approved change. This is the appropriate command-line action or first safe diagnostic. The technical reason is: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Validate the result with: Run kubectl -n kube-system rollout status deployment/coredns then test a Service lookup from ledger. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The case facts point instead to: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Implement “Run kubectl -n kube-system rollout restart deployment/coredns after the approved change” to address that specific condition.

B:

This alternative is a response to another technical cause: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The reported case instead depends on: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The action that directly addresses it is “Run kubectl -n kube-system rollout restart deployment/coredns after the approved change”.

C:

The proposed action belongs to the mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Here the stated fault follows a different mechanism: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The corrective choice is “Run kubectl -n kube-system rollout restart deployment/coredns after the approved change”.

Question 590

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A reviewed CoreDNS ConfigMap change needs a controlled DNS Deployment restart in kube-system; a healthy rollout is required. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy.
  2. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  3. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.
  4. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.

Explanation

Correct Answer

A:

CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system rollout restart deployment/coredns after the approved change. The direct acceptance evidence is: Run kubectl -n kube-system rollout status deployment/coredns then test a Service lookup from ledger.

Incorrect Answers

B:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. That explanation applies to a different technical failure. Here the controlling principle is: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy.

C:

The offered statement is true for this other mechanism: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. It does not explain the facts described here, which follow from: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy.

D:

This principle describes a separate cause: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The reported condition is governed by: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The two mechanisms should not be conflated.