McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 61

Question 600

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed CoreDNS ConfigMap change needs a controlled DNS Deployment restart in kube-system; a healthy rollout is required. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  2. Manage Service selectors and target ports alongside the Deployment labels and container listening port.
  3. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  4. Test security policies from allowed and denied sources rather than trusting YAML alone.

Explanation

Correct Answer

A:

Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system rollout restart deployment/coredns after the approved change. The relevant mechanism is: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Applied here, the relevant facts are: needs a controlled DNS Deployment restart in kube-system; a healthy rollout is required. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift. The choice being evaluated here is: Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed CoreDNS ConfigMap change n.

Incorrect Answers

B:

That safeguard is relevant to: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The current failure instead follows from: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Its prevention measure is “Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS”.

C:

This routine guards against another mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The recurring exposure in the current case is: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The matching preventive check is “Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS”.

D:

The suggested review tracks a different technical risk: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the sustained control must address: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Choose “Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS”.

Question 601

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs.
  2. Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"ports":[{"port":80,"targetPort":8080}]}}' for the lab's single-port Service.
  3. Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns.
  4. Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs.

Explanation

Correct Answer

C:

Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. This is the appropriate command-line action or first safe diagnostic. The technical reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Validate the result with: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The case facts point instead to: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Implement “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns” to address that specific condition.

B:

This alternative is a response to another technical cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported case instead depends on: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The action that directly addresses it is “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns”.

D:

The offered action targets: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The case facts point instead to: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Implement “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns” to address that specific condition.

Question 602

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  2. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  3. An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.
  4. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

Explanation

Correct Answer

D:

DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The direct acceptance evidence is: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test.

Incorrect Answers

A:

This principle describes a separate cause: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The reported condition is governed by: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The two mechanisms should not be conflated.

B:

The Service port is what clients connect to, while targetPort must reach the actual backend listener. That explanation applies to a different technical failure. Here the controlling principle is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

C:

The offered statement is true for this other mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. It does not explain the facts described here, which follow from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

Question 603

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test.
  2. Compare listed endpoints against the matching ready Pods and expected selector for invoice-svc.
  3. Run an in-Pod nslookup dispatch-svc.fulfillment.svc.cluster.local and confirm name resolution under isolation.
  4. Run an in-Pod nslookup metrics-svc.observability.svc.cluster.local and confirm name resolution under isolation.

Explanation

Correct Answer

A:

Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The intended action is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns.

Incorrect Answers

B:

That test belongs to another control with this basis: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. In the current case, the governing reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The direct verification is “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

C:

This observation would test a different technical dependency: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current issue is governed by: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Its decisive check is “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

D:

The alternative verifies a different condition: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current case instead depends on: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Confirm that “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

Question 604

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  2. Monitor DNS replica readiness, restart trends and upstream resolution errors.
  3. Include DNS as an explicit dependency when designing egress policies for isolated Pods.
  4. Audit controller capability and exposed service access policies before enabling public ingress.

Explanation

Correct Answer

B:

Monitor DNS replica readiness, restart trends and upstream resolution errors. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The relevant mechanism is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

Incorrect Answers

A:

That safeguard is relevant to: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The current failure instead follows from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Its prevention measure is “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

C:

The suggested review tracks a different technical risk: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Here the sustained control must address: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Choose “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

D:

That safeguard is relevant to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current failure instead follows from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Its prevention measure is “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

Question 605

At Horizon observability, in a disposable simulated environment during a monitored release window: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system rollout restart deployment/coredns after the approved change.
  2. Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs.
  3. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  4. Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns.

Explanation

Correct Answer

D:

Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. This is the appropriate command-line action or first safe diagnostic. The technical reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Validate the result with: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task.

Incorrect Answers

A:

This alternative is a response to another technical cause: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The reported case instead depends on: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The action that directly addresses it is “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns”.

B:

The proposed action belongs to the mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Here the stated fault follows a different mechanism: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The corrective choice is “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns”.

C:

The offered action targets: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The case facts point instead to: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Implement “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns” to address that specific condition.

Question 606

At Horizon observability, in a disposable simulated environment during a monitored release window: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.
  2. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  3. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  4. The Service port is what clients connect to, while targetPort must reach the actual backend listener.

Explanation

Correct Answer

A:

DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The direct acceptance evidence is: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis.

Incorrect Answers

B:

The offered statement is true for this other mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. It does not explain the facts described here, which follow from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

C:

This principle describes a separate cause: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The reported condition is governed by: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The two mechanisms should not be conflated.

D:

The Service port is what clients connect to, while targetPort must reach the actual backend listener. That explanation applies to a different technical failure. Here the controlling principle is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

Question 607

At Horizon observability, in a disposable simulated environment during a monitored release window: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations.
  2. Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test.
  3. Run kubectl -n observability describe service metrics-svc and perform a connection test to port 8080.
  4. Run kubectl -n observability get service metrics-svc -o wide and inspect the allocated node port and endpoints.

Explanation

Correct Answer

B:

Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The intended action is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which observation best verifies the requested outcome rather than an unrelated state.

Incorrect Answers

A:

That test belongs to another control with this basis: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. In the current case, the governing reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The direct verification is “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

C:

The alternative verifies a different condition: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The current case instead depends on: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Confirm that “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

D:

That test belongs to another control with this basis: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. In the current case, the governing reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The direct verification is “Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test”.

Question 608

At Horizon observability, in a disposable simulated environment during a monitored release window: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  2. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  3. Monitor DNS replica readiness, restart trends and upstream resolution errors.
  4. Include DNS as an explicit dependency when designing egress policies for isolated Pods.

Explanation

Correct Answer

C:

Monitor DNS replica readiness, restart trends and upstream resolution errors. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The relevant mechanism is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which operational control most directly prevents this failure or configuration drift.

Incorrect Answers

A:

This routine guards against another mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The recurring exposure in the current case is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The matching preventive check is “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

B:

The suggested review tracks a different technical risk: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. Here the sustained control must address: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Choose “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

D:

This routine guards against another mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The recurring exposure in the current case is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The matching preventive check is “Monitor DNS replica readiness, restart trends and upstream resolution errors”.

Question 609

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns.
  2. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-peer.yaml after verifying podSelector rules match the source identity.
  3. Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc -o wide.
  4. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"ports":[{"port":9090,"targetPort":9000}]}}' for the lab's single-port Service.

Explanation

Correct Answer

A:

Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. This is the appropriate command-line action or first safe diagnostic. The technical reason is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Validate the result with: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. Execute changes only in an authorized disposable lab or after normal production change controls. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which command or initial safe diagnostic step best addresses the stated lab task. The choice being evaluated here is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Cluster DNS lookups are intermittent;.

Incorrect Answers

B:

The offered action targets: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The case facts point instead to: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. Implement “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns” to address that specific condition.

C:

This alternative is a response to another technical cause: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The reported case instead depends on: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The action that directly addresses it is “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns”.

D:

The proposed action belongs to the mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the stated fault follows a different mechanism: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The corrective choice is “Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns”.

Question 610

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Cluster DNS lookups are intermittent; inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  2. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.
  3. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  4. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.

Explanation

Correct Answer

B:

DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get deploy coredns; kubectl -n kube-system get pods -l k8s-app=kube-dns. The direct acceptance evidence is: Run kubectl -n kube-system logs deployment/coredns --tail=50 and compare to an in-Pod resolution test. Applied here, the relevant facts are: inspect CoreDNS Deployment availability before changing application Service names. Work only within the stated target and verify before declaring success. The question asks which Kubernetes behavior best explains the required change or diagnosis. The choice being evaluated here is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The case setting is: At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Cluster DNS lookups are intermittent;.

Incorrect Answers

A:

The offered statement is true for this other mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. It does not explain the facts described here, which follow from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

C:

A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. That explanation applies to a different technical failure. Here the controlling principle is: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.

D:

The offered statement is true for this other mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. It does not explain the facts described here, which follow from: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.