McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 7

Question 60

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service account sync-bot in namespace fulfillment must receive the existing dispatch-api-pod-reader Role. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review rendered diffs and pin bases to reproducible revisions before applying overlays.
  2. Review service-account subjects when workloads or bindings are renamed.
  3. Schedule isolated restore drills, not just successful snapshot creation alerts.
  4. Keep namespace-scoped read policies in version control and avoid wildcard verbs or resources.

Explanation

Correct Answer

B:

Review service-account subjects when workloads or bindings are renamed. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment create rolebinding dispatch-api-reader-binding --role=dispatch-api-pod-reader --serviceaccount=fulfillment:sync-bot. The relevant mechanism is: A RoleBinding associates the service account subject with a Role inside the binding namespace.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Kustomize renders declarative resource transformations before Kubernetes admission and reconciliation. Here the sustained control must address: A RoleBinding associates the service account subject with a Role inside the binding namespace. Choose “Review service-account subjects when workloads or bindings are renamed”.

C:

This routine guards against another mechanism: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The recurring exposure in the current case is: A RoleBinding associates the service account subject with a Role inside the binding namespace. The matching preventive check is “Review service-account subjects when workloads or bindings are renamed”.

D:

The suggested review tracks a different technical risk: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. Here the sustained control must address: A RoleBinding associates the service account subject with a Role inside the binding namespace. Choose “Review service-account subjects when workloads or bindings are renamed”.

Question 61

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability create role metrics-api-pod-reader --verb=get,list,watch --resource=pods.
  2. Run kubectl cordon worker-a.
  3. Run kubectl auth can-i list pods -n fulfillment --as=system:serviceaccount:fulfillment:sync-bot and separately test delete deployments with the same impersonation.
  4. Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes.

Explanation

Correct Answer

D:

Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Validate the result with: Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The case facts point instead to: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Implement “Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes” to address that specific condition.

B:

This alternative is a response to another technical cause: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The reported case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The action that directly addresses it is “Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes”.

C:

The proposed action belongs to the mechanism: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Here the stated fault follows a different mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The corrective choice is “Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes”.

Question 62

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  2. A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints.
  3. Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations.
  4. RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.

Explanation

Correct Answer

A:

Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. This explains the stated condition. The corresponding action is: Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes. The direct acceptance evidence is: Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs.

Incorrect Answers

B:

A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. That explanation applies to a different technical failure. Here the controlling principle is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

C:

The offered statement is true for this other mechanism: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. It does not explain the facts described here, which follow from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

D:

This principle describes a separate cause: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The reported condition is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The two mechanisms should not be conflated.

Question 63

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Verify the snapshot command returns readable metadata and a documented file checksum.
  2. Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs.
  3. Run kubectl -n fulfillment get role dispatch-api-pod-reader -o yaml and confirm only Pod read verbs are present.
  4. Run kubectl -n ledger get role invoice-api-pod-reader -o yaml and confirm only Pod read verbs are present.

Explanation

Correct Answer

B:

Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The intended action is: Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes.

Incorrect Answers

A:

The alternative verifies a different condition: The snapshot-status tool inspects backup metadata without modifying the running etcd member or performing a restore. The current case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Confirm that “Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs”.

C:

This observation would test a different technical dependency: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The current issue is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its decisive check is “Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs”.

D:

The alternative verifies a different condition: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The current case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Confirm that “Run kubectl get clusterrole invoice-api-node-reader -o yaml and inspect resources and verbs”.

Question 64

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Keep namespace-scoped read policies in version control and avoid wildcard verbs or resources.
  2. Record node maintenance ownership and uncordon obligations before opening a window.
  3. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.
  4. Review workload identity ownership and avoid unnecessary credentials on the default service account.

Explanation

Correct Answer

C:

Use narrowly defined ClusterRoles and periodically audit cluster-wide grants. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create clusterrole invoice-api-node-reader --verb=get,list --resource=nodes. The relevant mechanism is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

Incorrect Answers

A:

That safeguard is relevant to: A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. The current failure instead follows from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its prevention measure is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

B:

This routine guards against another mechanism: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The recurring exposure in the current case is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The matching preventive check is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

D:

That safeguard is relevant to: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. The current failure instead follows from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its prevention measure is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

Question 65

At Horizon observability, in a disposable simulated environment during a monitored release window: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes.
  2. Run kubectl create clusterrolebinding metrics-api-node-audit --clusterrole=metrics-api-node-reader --group=platform-auditors.
  3. Run kubectl cordon worker-b.
  4. Run kubectl auth can-i list pods -n observability --as=system:serviceaccount:observability:audit-bot and separately test delete deployments with the same impersonation.

Explanation

Correct Answer

A:

Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Validate the result with: Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The proposed action belongs to the mechanism: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. Here the stated fault follows a different mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The corrective choice is “Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes”.

C:

The offered action targets: Cordon marks a Node unschedulable to new Pods but does not drain running workloads. The case facts point instead to: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Implement “Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes” to address that specific condition.

D:

This alternative is a response to another technical cause: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The reported case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The action that directly addresses it is “Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes”.

Question 66

At Horizon observability, in a disposable simulated environment during a monitored release window: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget.
  2. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  3. Server-side dry-run evaluates admission and resource schema without persisting the CRD when supported by the relevant admission stack.
  4. A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject.

Explanation

Correct Answer

B:

Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. This explains the stated condition. The corresponding action is: Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes. The direct acceptance evidence is: Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs.

Incorrect Answers

A:

A ResourceQuota caps combined admitted requests in a namespace; per-Pod limits alone do not enforce a namespace-wide budget. That explanation applies to a different technical failure. Here the controlling principle is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

C:

This principle describes a separate cause: Server-side dry-run evaluates admission and resource schema without persisting the CRD when supported by the relevant admission stack. The reported condition is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The two mechanisms should not be conflated.

D:

A namespaced Role expresses allowed resource verbs; it has no effect until a RoleBinding associates a subject. That explanation applies to a different technical failure. Here the controlling principle is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

Question 67

At Horizon observability, in a disposable simulated environment during a monitored release window: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get serviceaccount audit-bot and inspect the Deployment's serviceAccountName after binding it.
  2. Run kubectl describe node worker-b and inspect the Taints field for the intended key, value and effect.
  3. Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs.
  4. Run kubectl auth can-i list nodes --as=auditor --as-group=regional-readers using an authorized impersonation-capable admin context.

Explanation

Correct Answer

C:

Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The intended action is: Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes.

Incorrect Answers

A:

That test belongs to another control with this basis: ServiceAccounts provide workload identity; creating one does not automatically grant extra RBAC permissions. In the current case, the governing reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The direct verification is “Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs”.

B:

This observation would test a different technical dependency: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The current issue is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its decisive check is “Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs”.

D:

That test belongs to another control with this basis: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. In the current case, the governing reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The direct verification is “Run kubectl get clusterrole metrics-api-node-reader -o yaml and inspect resources and verbs”.

Question 68

At Horizon observability, in a disposable simulated environment during a monitored release window: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Reserve and govern security-sensitive scheduling labels through controlled change procedures.
  2. Include schedulability restoration in maintenance completion checklists.
  3. Reconcile taints with workload tolerations and document dedicated-node policies.
  4. Use narrowly defined ClusterRoles and periodically audit cluster-wide grants.

Explanation

Correct Answer

D:

Use narrowly defined ClusterRoles and periodically audit cluster-wide grants. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl create clusterrole metrics-api-node-reader --verb=get,list --resource=nodes. The relevant mechanism is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

Incorrect Answers

A:

This routine guards against another mechanism: Node labels are discoverable metadata matched by selectors; a node label alone does not create a workload restriction. The recurring exposure in the current case is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The matching preventive check is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

B:

The suggested review tracks a different technical risk: Uncordon clears the Node's unschedulable status; it does not guarantee any particular Pod will be placed there. Here the sustained control must address: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Choose “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

C:

That safeguard is relevant to: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. The current failure instead follows from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Its prevention measure is “Use narrowly defined ClusterRoles and periodically audit cluster-wide grants”.

Question 69

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run helm rollback dispatch-api 4 --namespace fulfillment after verifying release history and any irreversible data migrations.
  2. Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes.
  3. Run kubectl taint nodes worker-c special=dedicated:NoSchedule-.
  4. Run kubectl auth can-i list pods -n ledger --as=system:serviceaccount:ledger:release-bot and separately test delete deployments with the same impersonation.

Explanation

Correct Answer

B:

Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. Validate the result with: Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: Helm rollback submits resources from a prior release revision but cannot automatically undo external side effects or storage migrations. Here the stated fault follows a different mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The corrective choice is “Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes”.

C:

This alternative is a response to another technical cause: A trailing minus removes the matching taint; adding a new toleration on every Pod would leave unnecessary cluster constraints. The reported case instead depends on: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The action that directly addresses it is “Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes”.

D:

The proposed action belongs to the mechanism: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. Here the stated fault follows a different mechanism: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The corrective choice is “Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes”.

Question 70

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An inventory process requires read access to cluster-scoped Nodes, not write access to workloads. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group.
  2. RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access.
  3. Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.
  4. A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods.

Explanation

Correct Answer

C:

Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. This explains the stated condition. The corresponding action is: Run kubectl create clusterrole dispatch-api-node-reader --verb=get,list --resource=nodes. The direct acceptance evidence is: Run kubectl get clusterrole dispatch-api-node-reader -o yaml and inspect resources and verbs.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A ClusterRoleBinding applies its referenced ClusterRole permission set at cluster scope to the named group. It does not explain the facts described here, which follow from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.

B:

This principle describes a separate cause: RBAC authorization decisions depend on the subject, verb, resource and namespace; an admin's own access does not prove the workload identity's access. The reported condition is governed by: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role. The two mechanisms should not be conflated.

D:

The offered statement is true for this other mechanism: A NoSchedule taint repels Pods without a matching toleration but does not automatically evict already running Pods. It does not explain the facts described here, which follow from: Nodes are cluster-scoped and their access rules belong in a ClusterRole rather than a namespaced Role.