1. Home
2. All questions

All 1000 questions — CKA — Certified Kubernetes Administrator

Every question in the free CKA — Certified Kubernetes Administrator study material, one page each: the question, its options, the answer, the reasoning and a public source. Pick one of 9 topics or read them in order.

Challenge yourself → Study as cards

Topics

• Cluster architecture (85)
• Configuration (95)
• Installation (98)
• Networking (147)
• Scheduling (107)
• Services (125)
• Storage (113)
• Troubleshooting (418)
• Workloads (96)

Every question

1. 1. Which control plane component holds the authoritative record of all cluster state that the API server persists?
2. 2. A cluster needs more API server throughput. What is the supported way to add capacity?
3. 3. Which component watches for Pods that have been created but have no node assigned, and picks a node for each?
4. 4. Which factors does kube-scheduler weigh when choosing a node for a Pod? Choose two.
5. 5. Why are the Kubernetes controllers compiled into a single kube-controller-manager binary?
6. 6. Which controller inside kube-controller-manager reacts when a node stops responding?
7. 7. Which controller populates the objects that link a Service to the Pods behind it?
8. 8. A new namespace is created and immediately contains a default ServiceAccount. What put it there?
9. 9. A cluster runs on bare metal in an on-premises data centre. Which control plane component will it not have?
10. 10. Which controllers typically have cloud provider dependencies? Choose two.
11. 11. Which statement describes the kubelet's responsibility on a node?
12. 12. Under what circumstance can nodes run without kube-proxy?
13. 13. How does kube-proxy handle Service traffic when the operating system offers a packet filtering layer?
14. 14. Which container runtimes are named as implementations Kubernetes supports through the CRI? Choose two.
15. 15. In which namespace do the namespaced objects belonging to cluster addons live?
16. 16. Which addon does the documentation treat as effectively mandatory in every cluster?
17. 17. How does an administrator change authorization policy in a cluster running RBAC?
18. 18. Which two objects are namespaced in the RBAC API? Choose two.
19. 19. A team wants to revoke a permission that a broad Role already grants, by adding a second, narrower Role. Why will that not work?
20. 20. Which permission requires a ClusterRole rather than a Role?
21. 21. A RoleBinding in the development namespace references a ClusterRole named secret-reader. Which two statements are correct? Choose two.
22. 22. An administrator edits the roleRef of an existing RoleBinding and the request fails validation. Why?
23. 23. What is the security benefit of making a binding's roleRef immutable?
24. 24. A Role must let a subject read Pods and their logs. Which two entries belong in the rule's resources list? Choose two.
25. 25. Why can resourceNames not restrict a top-level create request?
26. 26. A Role restricts list on configmaps by resourceNames. What must a client include for the request to be authorized?
27. 27. An administrator writes rules into the rules field of an aggregated ClusterRole and they keep disappearing. What explains this?
28. 28. What is the supported way to let the built-in edit role manage a new custom resource?
29. 29. What does installing a CustomResourceDefinition give a cluster?
30. 30. A CustomResourceDefinition is installed but nothing happens when its objects are created. What is missing?
31. 31. Which two statements about the operator pattern are correct? Choose two.
32. 32. Which tasks are given as things an operator can automate? Choose two.
33. 33. Which CNI specification version does the Kubernetes project recommend a plugin be compatible with?
34. 34. What changed about CNI plugin management in Kubernetes 1.24? Choose two.
35. 35. Besides the CNI plugin, what must the container runtime provide for every Pod sandbox?
36. 36. A Pod using hostPort gets no traffic on the node's port. Which CNI configuration setting is likely missing?
37. 37. In what order does the API server process an incoming request?
38. 38. Several authorization modules are configured and none of them has an opinion about a request. What happens?
39. 39. Which HTTP status does the API server return for a request that authorization denies?
40. 40. An RBAC rule sets apiGroups to an empty string. Which API group does that name?
41. 41. A Role grants get on secrets but deliberately omits list. Why does this offer little protection?
42. 42. Which special RBAC verbs guard the RBAC API itself? Choose two.
43. 43. What are the stated minimum resources for a kubeadm control-plane machine? Choose two.
44. 44. Which values must be unique across every node in a kubeadm cluster? Choose two.
45. 45. Two cloned virtual machines fail to join a cluster as distinct nodes. Which file would you read to confirm the cause?
46. 46. Why can kubeadm fail to run on a lightweight distribution such as Alpine Linux?
47. 47. Which kubeadm preflight check fails when a node runs an unsupported kernel version?
48. 48. A kubelet refuses to start on a node that has swap enabled. Which configuration change lets it start?
49. 49. After setting failSwapOn to false, workloads still get no swap. What else must change?
50. 50. An administrator runs swapoff -a but swap returns after a reboot. Which two statements explain and fix this? Choose two.
51. 51. kubeadm init stops with an error because it detected more than one container runtime. Which flag resolves this?
52. 52. Which statement about kubeadm and version skew is correct?
53. 53. How do Kubernetes components choose the address they advertise on a multi-homed host?
54. 54. Which flag sets the shared endpoint that every control-plane node in a cluster answers on?
55. 55. Which two statements about --control-plane-endpoint are correct? Choose two.
56. 56. Why does changing a control-plane component's IP address require re-issuing certificates?
57. 57. What does kubeadm init do before it downloads and installs the control-plane components?
58. 58. An administrator wants to run kubeadm init again on a node that already initialised a cluster. What must happen first?
59. 59. Which two steps give a non-root user kubectl access after kubeadm init? Choose two.
60. 60. Which group does the certificate inside kubeadm's super-admin.conf belong to?
61. 61. Why is the bootstrap token printed by kubeadm init treated as a secret?
62. 62. Straight after kubeadm init, the CoreDNS Pods sit in Pending and never start. What is the expected cause?
63. 63. What must be true of the Pod network CIDR chosen for a cluster?
64. 64. Why must a Pod network add-on and its manifests support RBAC in a kubeadm cluster?
65. 65. How many Pod networks may be installed in one cluster?
66. 66. Which admission controller does kubeadm enable by default to limit what labels a kubelet may give itself?
67. 67. What does a successful kubectl drain guarantee before it returns? Choose two.
68. 68. kubectl drain will not complete on a node running DaemonSet Pods. Which flag lets it finish?
69. 69. Maintenance is finished on a drained node but no new Pods are scheduled to it. What was forgotten?
70. 70. A Pod keeps running on a node that has been drained and marked unschedulable. What explains this?
71. 71. Two drains run in parallel against different nodes hosting one StatefulSet. What limits how many Pods go down at once?
72. 72. How many minor versions may a kubeadm cluster move in a single upgrade?
73. 73. What is the documented order for upgrading a kubeadm cluster?
74. 74. Why should application state still be backed up before a kubeadm upgrade?
75. 75. Before upgrading a kubelet across a minor version, what must be done to the node?
76. 76. Why does every container restart after a kubeadm upgrade?
77. 77. An administrator wants to change cluster configuration as part of an upgrade. What does kubeadm support?
78. 78. During an upgrade that replaces the etcd static Pod, in-flight API requests stall. What is suggested to limit the disruption?
79. 79. Which two topologies does kubeadm document for a highly available control plane? Choose two.
80. 80. Why is an odd number of control-plane nodes preferred in a highly available cluster?
81. 81. Which registry must every host in a kubeadm cluster reach, unless the images are supplied another way?
82. 82. Upgrading across a minor version with the community packages requires which extra step?
83. 83. Which two statements about cgroup drivers in a kubeadm cluster are correct? Choose two.
84. 84. Which kernel setting commonly has to be enabled by hand before cluster networking works?
85. 85. An existing organisational CA is placed in /etc/kubernetes/pki before kubeadm init runs. What does kubeadm do?
86. 86. Which directory does kubeadm use for cluster certificates by default?
87. 87. What are the default certificate lifetimes in a kubeadm cluster? Choose two.
88. 88. Which key algorithm does kubeadm use by default when generating certificates?
89. 89. An administrator supplies ca.crt but deliberately withholds ca.key. What does kubeadm do?
90. 90. Which files are shared between control-plane nodes and so generated once and distributed?
91. 91. What is the documented size limit for the data held in one ConfigMap?
92. 92. Which two fields does a ConfigMap carry instead of a spec? Choose two.
93. 93. An application should not see later edits to its ConfigMap. Which setting enforces that?
94. 94. A Pod cannot reference a ConfigMap held in another namespace. Which approach still reaches it?
95. 95. Which statement about a static Pod and ConfigMaps is correct?
96. 96. Which two statements about how Secrets are stored are correct? Choose two.
97. 97. Why does the ability to create a Deployment in a namespace effectively grant read access to that namespace's Secrets?
98. 98. Which mechanisms are built on Secret objects? Choose two.
99. 99. A Secret is mounted as a volume and one of its keys begins with a dot. What is the effect inside the container?
100. 100. Since which kubectl version has Kustomize been supported natively?
101. 101. Which two commands work with a kustomization directory? Choose two.
102. 102. A Deployment references a ConfigMap built by configMapGenerator. Why does editing the source file trigger a rollout? Choose two.
103. 103. In configMapGenerator, what is the difference between listing a file under files and under envs?
104. 104. What does installing a Helm chart create?
105. 105. helm install returns successfully. What can be concluded about the application?
106. 106. A chart is installed with both --values and --set supplying the same key. Which wins?
107. 107. Where does Helm persist the values supplied with --set for a release?
108. 108. Which command clears values that were previously applied with --set?
109. 109. In Helm's --set syntax, what does a comma separate?
110. 110. How does helm upgrade treat a chart whose templates are largely unchanged?
111. 111. Which two statements about Helm release revisions are correct? Choose two.
112. 112. Which Helm flag makes the command wait until Pods are ready, PVCs are bound and Services have addresses?
113. 113. What is the default value of Helm's --timeout flag?
114. 114. A release is removed with helm uninstall and no record of it remains. Which flag would have kept one?
115. 115. An engineer is offline and wants to find a chart. Which search still works?
116. 116. Which directories does Helm reserve inside a chart? Choose two.
117. 117. Which fields are required in a chart's Chart.yaml? Choose two.
118. 118. How can a subchart be switched off without editing the parent chart?
119. 119. Which command downloads a published chart for inspection without installing it?
120. 120. Which kinds are cluster-scoped and therefore outside any namespace? Choose two.
121. 121. Which namespace holds the Lease objects that carry node heartbeats?
122. 122. Which initial namespace is readable by all clients, including unauthenticated ones?
123. 123. A team wants to run two versions of one application side by side. What does the documentation recommend?
124. 124. Which command fixes the namespace for all later kubectl commands in the current context?
125. 125. Why must every namespace name be a valid RFC 1123 DNS label?
126. 126. Which object does a Deployment manage directly?
127. 127. A Deployment is scaled from three replicas to five. How many new revisions does this create?
128. 128. Which two statements about Deployment revisions are correct? Choose two.
129. 129. What are the default values of maxUnavailable and maxSurge for a Deployment's rolling update? Choose two.
130. 130. An administrator sets both maxUnavailable and maxSurge to 0. What happens?
131. 131. During a rolling update, why can the total Pod count briefly exceed the Deployment's replicas?
132. 132. A Deployment is updated again while a rollout is still in progress. What does the controller do?
133. 133. Which field decides how long the controller waits before reporting that a rollout has stalled?
134. 134. A rollout has exceeded its progress deadline. Which condition does the Deployment carry?
135. 135. An operator wants to make three edits to a Deployment's Pod template but trigger only one rollout. What should they do?
136. 136. Which needs does a StatefulSet meet that a Deployment does not? Choose two.
137. 137. A StatefulSet is scaled from five replicas to two. What happens to the two removed Pods' volumes?
138. 138. Which StatefulSet field gives each Pod its own PersistentVolumeClaim?
139. 139. A StatefulSet named web has three replicas. What are its Pods called?
140. 140. What kind of Service does a StatefulSet use to control its Pods' DNS domain?
141. 141. Which ordering guarantees does a StatefulSet give by default? Choose two.
142. 142. Which setting makes a StatefulSet start and stop its Pods together while keeping their identities?
143. 143. A StatefulSet's Pod template is changed but no Pods are replaced. Which updateStrategy explains this?
144. 144. A StatefulSet with RollingUpdate sets partition to 3. Which Pods are updated?
145. 145. Which two settings make up a StatefulSet's persistentVolumeClaimRetentionPolicy? Choose two.
146. 146. A StatefulSet Pod is replaced after its node fails. What happens to its PersistentVolumeClaim?
147. 147. How does the DaemonSet controller ensure a Pod lands on its intended node?
148. 148. Which tolerations does the DaemonSet controller add to its Pods automatically? Choose two.
149. 149. A node's labels are changed so it no longer matches a DaemonSet's selector. What does the controller do?
150. 150. A DaemonSet is deleted with --cascade=orphan. Which two things happen? Choose two.
151. 151. A Job sets neither completions nor parallelism. What does it run?
152. 152. How is a work-queue Job configured?
153. 153. An operator wants to pause a running Job without deleting it. What should they do?
154. 154. A fixed-completion Job needs two more successes but parallelism is set to ten. How many Pods run?
155. 155. What is the default value of a Job's backoffLimit?
156. 156. How does the Job controller space out retries after repeated Pod failures?
157. 157. A Job sets backoffLimit 5 and activeDeadlineSeconds 100. Three retries have happened when 100 seconds elapse. What occurs?
158. 158. A Job has failed through its backoffLimit. What brings it back?
159. 159. Which two behaviours does a CronJob's concurrencyPolicy of Forbid produce? Choose two.
160. 160. Which concurrencyPolicy kills a still-running Job when the next run is due?
161. 161. What are the default history limits for a CronJob? Choose two.
162. 162. What is a liveness probe for?
163. 163. Which two probe fields control its timing? Choose two.
164. 164. Which is the simplest way to confine a Pod to nodes carrying a particular label?
165. 165. A Pod uses requiredDuringSchedulingIgnoredDuringExecution node affinity and no node matches. What happens?
166. 166. A running Pod's node loses the label its preferred node affinity matched. What does Kubernetes do?
167. 167. What range may the weight of a preferred node affinity rule take?
168. 168. A Pod has two preferred affinity rules, one weighted 1 and one weighted 50, and two nodes each satisfy one. Which node wins?
169. 169. Which command removes a taint that was added with kubectl taint nodes node1 key1=value1:NoSchedule?
170. 170. When does a toleration match a taint? Choose two.
171. 171. Which taint effect keeps new Pods away but leaves Pods already running on the node alone?
172. 172. How does tolerationSeconds affect a toleration for a NoExecute taint? Choose two.
173. 173. A node carries three taints and a Pod tolerates two of them, the untolerated one being NoSchedule. What is the outcome?
174. 174. What does a Pod's resource request actually reserve?
175. 175. A container specifies a memory limit but no memory request, and no default is applied. What request does it get?
176. 176. What does a CPU request of 0.5 mean?
177. 177. How does the runtime treat a container that exceeds its limits? Choose two.
178. 178. How many PriorityClasses may set globalDefault to true?
179. 179. A globalDefault PriorityClass is added to a cluster that already runs many Pods. What changes for them?
180. 180. A PriorityClass is deleted while Pods still reference it. What happens?
181. 181. What does setting preemptionPolicy to Never on a PriorityClass achieve?
182. 182. Which are eviction signals the kubelet compares against thresholds? Choose two.
183. 183. Which filesystem does the nodefs eviction signal describe?
184. 184. What distinguishes a hard eviction threshold from a soft one?
185. 185. What is the default hard eviction threshold for memory.available on a Linux node?
186. 186. Which two statements about soft eviction thresholds are correct? Choose two.
187. 187. Which inputs decide the kubelet's eviction order? Choose two.
188. 188. When is a Pod classified as Guaranteed?
189. 189. A static Pod must survive resource pressure. Why can it not use priorityClassName?
190. 190. In a topology spread constraint, what does topologyKey name?
191. 191. What is the default value of whenUnsatisfiable in a topology spread constraint?
192. 192. Two topology spread constraints use the same topologyKey. When is that allowed?
193. 193. Which two statements about minDomains are correct? Choose two.
194. 194. When does a namespace become subject to resource quota enforcement?
195. 195. A quota is written for an extended resource. Which prefix may its quota items use?
196. 196. A Deployment requesting more than the namespace quota allows is applied. What happens?
197. 197. What is the difference between a ResourceQuota and a LimitRange?
198. 198. What can a LimitRange enforce? Choose two.
199. 199. An object violating a LimitRange is submitted. What does the API server return?
200. 200. A LimitRange is added to a namespace that already runs Pods breaching it. What happens to those Pods?
201. 201. A Service manifest sets port 80 but omits targetPort. Which port on the Pod receives traffic?
202. 202. Why would an administrator use a named targetPort instead of a number?
203. 203. A Service is created with no selector. Which two statements are correct? Choose two.
204. 204. Which Service type is used when none is specified?
205. 205. What does a NodePort Service do? Choose two.
206. 206. What is the default port range for NodePort Services?
207. 207. An administrator sets a nodePort explicitly. Which two responsibilities does that create? Choose two.
208. 208. Where does a LoadBalancer Service report the address the cloud provider assigned?
209. 209. Which Service type performs no proxying and simply resolves to another DNS name?
210. 210. What is true of a Service with clusterIP set to None? Choose two.
211. 211. A Pod cannot find the environment variables for a Service that was created after it started. Why?
212. 212. What form do the environment variables the kubelet injects for a Service named redis-primary take?
213. 213. A Service sets internalTrafficPolicy to Local. What happens to traffic from a Pod on a node with no local endpoints?
214. 214. What is the default value of a Service's internalTrafficPolicy?
215. 215. How many endpoints does an EndpointSlice hold by default?
216. 216. Which objects does kube-proxy treat as the source of truth for routing internal traffic?
217. 217. How is an EndpointSlice associated with its Service? Choose two.
218. 218. After heavy Pod churn, several EndpointSlices for one Service are only partly full. Why?
219. 219. An Ingress object is created but nothing routes traffic. What is most likely missing?
220. 220. Why must an Ingress controller be installed deliberately?
221. 221. An Ingress is submitted with a path that has no pathType. What happens?
222. 222. How do the Exact and Prefix path types differ? Choose two.
223. 223. Why can the same Ingress path behave differently on two clusters using ImplementationSpecific?
224. 224. An Ingress rule specifies no host. What traffic does it cover?
225. 225. What does the ingressClassName field on an Ingress reference?
226. 226. Which are stable API kinds in the Gateway API? Choose two.
227. 227. How is the Gateway API delivered to a cluster?
228. 228. What does a GatewayClass contain?
229. 229. Which capability was only reachable in Ingress through controller-specific annotations but is first-class in Gateway API?
230. 230. What does it mean that the Ingress API is frozen? Choose two.
231. 231. Which ingress controllers does the Kubernetes project itself maintain?
232. 232. An administrator requests a clusterIP outside the configured Service range. What does the API server return?
233. 233. Within which range must an explicitly chosen clusterIP fall?
234. 234. A cluster's Service range is 10.96.0.0/16. Which address do many installers give the DNS Service by convention?
235. 235. A load balancer implementation routes straight to Pods and does not need node ports. Which field turns them off?
236. 236. allocateLoadBalancerNodePorts is set to false on a Service that already has node ports. Which two statements apply? Choose two.
237. 237. Which two statements about loadBalancerClass are correct? Choose two.
238. 238. A Service sets loadBalancerClass but no load balancer is ever provisioned. What is the likely cause?
239. 239. What is the default ipMode reported for a LoadBalancer Service's ingress address?
240. 240. How does trafficDistribution differ from a traffic policy?
241. 241. Which proxy modes are available to kube-proxy on a Linux node? Choose two.
242. 242. How does kube-proxy in iptables mode choose a backend Pod for a new connection?
243. 243. What is the recommended replacement for kube-proxy's deprecated ipvs mode?
244. 244. Which kernel version does kube-proxy's nftables mode require?
245. 245. Why is it recommended to name kube-proxy's mode explicitly in its configuration?
246. 246. Which Service field sends a given client's connections to the same Pod each time?
247. 247. What is the default client-IP session stickiness timeout for a Service?
248. 248. A Service's cluster IP cannot be pinged, though the Service works. Why?
249. 249. A newly created Service has no endpoints and connections to it fail. What should be checked first?
250. 250. Which statements about Service type layering are correct? Choose two.
251. 251. A namespace holds no NetworkPolicy objects. What traffic is permitted to and from its Pods?
252. 252. When does a Pod become isolated for egress?
253. 253. A NetworkPolicy restricts inbound traffic to a set of Pods. What is the effect on their outbound traffic?
254. 254. Two NetworkPolicies select the same Pod with different ingress rules. What traffic is allowed?
255. 255. What must hold for a connection from one Pod to another to be allowed? Choose two.
256. 256. A NetworkPolicy allows an inbound connection. Must a matching rule also permit the reply?
257. 257. A Pod is isolated for ingress by a policy with no matching rule. Which traffic still reaches it?
258. 258. How is a namespace-wide default-deny for ingress written?
259. 259. A NetworkPolicy omits policyTypes but contains egress rules. Which types are set?
260. 260. Which peer selectors may a NetworkPolicy rule use? Choose two.
261. 261. A policy names namespaceSelector and podSelector inside a single from entry. What does it match?
262. 262. A NetworkPolicy is applied successfully but traffic is not restricted at all. What is the likeliest cause?
263. 263. Which protocols does NetworkPolicy cover? Choose two.
264. 264. Which field lets one NetworkPolicy rule cover a range of ports?
265. 265. How does a NetworkPolicy target a namespace by its name?
266. 266. A Pod in the test namespace cannot resolve a Service called data that lives in prod. Which two statements explain it? Choose two.
267. 267. Which component writes each Pod's /etc/resolv.conf?
268. 268. What does the DNS A record for a normal, non-headless Service resolve to?
269. 269. A client resolves a headless Service's DNS name. What comes back?
270. 270. Which record type does cluster DNS create for a Service's named ports?
271. 271. What is a Pod's hostname by default?
272. 272. A Pod sets hostname foo and subdomain bar in namespace my-namespace. What is its FQDN?
273. 273. For DNS to publish records for a Pod's subdomain, what else must exist?
274. 274. Which dnsPolicy is used when a Pod does not set one?
275. 275. What does dnsPolicy Default actually do?
276. 276. A hostNetwork Pod with dnsPolicy ClusterFirst cannot resolve Service names. What should be set?
277. 277. A Pod sets dnsPolicy None. Where must its nameservers come from?
278. 278. Which are among the four networking problems Kubernetes addresses? Choose two.
279. 279. How does Kubernetes avoid making applications coordinate host port numbers?
280. 280. Which components assign the cluster's non-overlapping address ranges? Choose two.
281. 281. Which addresses count toward the network model in a dual-stack cluster?
282. 282. Why is the cluster DNS Service still named kube-dns when CoreDNS implements it?
283. 283. Which kubelet flags configure a container's DNS? Choose two.
284. 284. What does the kubelet's --resolv-conf flag control? Choose two.
285. 285. Where is CoreDNS configured in a standard cluster?
286. 286. Which zones does the default Corefile's kubernetes plugin serve? Choose two.
287. 287. Where does the default Corefile send queries that fall outside the cluster zones?
288. 288. Which record type does cluster DNS use for reverse lookups of Pod and Service addresses?
289. 289. Which control plane ports are correct? Choose two.
290. 290. Which port serves the kubelet API on both control-plane and worker nodes?
291. 291. A load balancer's health check targets a node port and fails. Which kube-proxy port serves health checks?
292. 292. External clients cannot reach a NodePort Service through a firewall. Which range must be open?
293. 293. Which two statements about Kubernetes' default ports are correct? Choose two.
294. 294. Where does a Service's default address family come from?
295. 295. How do PreferDualStack and RequireDualStack differ? Choose two.
296. 296. Which part of a Service's ipFamilies may be changed after creation?
297. 297. On a dual-stack Service, which field is authoritative for the addresses assigned?
298. 298. A Service is created on a dual-stack cluster without setting ipFamilyPolicy. What is it?
299. 299. What does a label selector's comma mean, and what operators are set-based? Choose two.
300. 300. What are the length limits on a label key?
301. 301. What is the relationship between a PersistentVolume and a PersistentVolumeClaim?
302. 302. How may a PersistentVolume be provisioned? Choose two.
303. 303. A PVC requests 5Gi and the only matching PV offers 10Gi. What does the control loop do?
304. 304. How many PVCs may bind to one PersistentVolume?
305. 305. Which reclaim policies exist for a PersistentVolume? Choose two.
306. 306. A PVC bound to a Retain volume is deleted. Which two statements describe the PV? Choose two.
307. 307. An administrator deletes a Retain PersistentVolume object. What happens to the storage behind it?
308. 308. Which reclaim policy is deprecated in favour of dynamic provisioning?
309. 309. A PVC is deleted while a Pod still uses it, and it does not disappear. What is happening?
310. 310. What status does a PVC show while in-use protection holds it?
311. 311. How do the two volumeModes differ? Choose two.
312. 312. What does the ReadWriteOnce access mode actually allow?
313. 313. An NFS server supports many writers but a PV backed by it is read-only. Which two statements explain this? Choose two.
314. 314. An attempt to expand a PVC fails because of a capacity constraint. What can be tried next?
315. 315. Which three fields does a StorageClass carry for dynamic provisioning? Choose two of them.
316. 316. A PVC omits storageClassName in a cluster with a default StorageClass. What happens?
317. 317. Two StorageClasses are both annotated as default. Which does a classless PVC get?
318. 318. What is the default reclaimPolicy of a StorageClass?
319. 319. A cluster uses topology-constrained storage and Pods keep landing where their volume is unreachable. Which setting fixes this?
320. 320. What is the default value of volumeBindingMode?
321. 321. A StorageClass uses WaitForFirstConsumer but a Pod sets nodeName directly. What is the consequence?
322. 322. Which StorageClass field must be true before a PVC can be resized?
323. 323. Which StorageClass field is mandatory?
324. 324. Which two statements about StorageClass provisioners are correct? Choose two.
325. 325. What is true of an emptyDir volume? Choose two.
326. 326. An emptyDir is configured to be backed by RAM. What is the trade-off?
327. 327. Why does the documentation discourage hostPath volumes?
328. 328. How do the hostPath types DirectoryOrCreate and FileOrCreate behave? Choose two.
329. 329. A hostPath volume sets an empty type. What check is performed before mounting?
330. 330. Which is true of a local volume?
331. 331. What makes a local PersistentVolume safer to use than a hostPath volume?
332. 332. Where do the contents of a mounted Secret volume live on the node?
333. 333. What does a projected volume do?
334. 334. How does one volume serve several purposes inside a single Pod?
335. 335. What is true of subPathExpr? Choose two.
336. 336. A downward API volume mounted through subPath stops reflecting a changed field value. Why?
337. 337. Which volumes are local ephemeral storage managed by the kubelet? Choose two.
338. 338. What distinguishes a generic ephemeral volume from a CSI ephemeral volume?
339. 339. Which snapshot object corresponds to a PersistentVolume?
340. 340. What is required for volume snapshots to work? Choose two.
341. 341. Which snapshot API objects are CustomResourceDefinitions rather than core kinds? Choose two.
342. 342. Why does a VolumeSnapshotClass exist separately from a StorageClass?
343. 343. A pre-provisioned VolumeSnapshot stays unbound. What is it waiting for?
344. 344. A PVC must bind to one specific PersistentVolume. What is set? Choose two.
345. 345. Naming a PV from a PVC does not stop another claim binding first. What actually reserves it?
346. 346. Which resource can currently be set or requested on a PersistentVolume?
347. 347. A PersistentVolume has no storageClassName. Which claims can bind to it?
348. 348. What problem did CSI solve for storage vendors?
349. 349. A hostPath PersistentVolume is used in a multi-node cluster and behaves inconsistently. What is the supported alternative?
350. 350. A PVC has been Pending for some time. Which explanations are consistent with that?
351. 351. What is the first command to run against a Pod that is not behaving correctly?
352. 352. A Pod is stuck in Pending. What does that state tell you?
353. 353. Which remedies are suggested for a Pod pending through insufficient resources? Choose two.
354. 354. A Deployment using hostPort cannot schedule beyond a handful of replicas. Why?
355. 355. A Pod is stuck in Waiting. What does that indicate?
356. 356. A Pod stays in Waiting because of the image. What should be checked? Choose two.
357. 357. A Pod has been Terminating for a long time. Which two statements describe the usual cause? Choose two.
358. 358. Which objects should be inspected when diagnosing a Pod stuck in Terminating? Choose two.
359. 359. A Pod runs but ignores the command in its manifest. What is the likeliest explanation?
360. 360. Which flag makes kubectl apply report an unknown field in a manifest?
361. 361. What are the first two steps in debugging a cluster? Choose two.
362. 362. A node's conditions all read Unknown with reason NodeStatusUnknown. What does that mean?
363. 363. Which taints does an unreachable node carry? Choose two.
364. 364. How long does a node stay NotReady before its Pods are evicted?
365. 365. Which field shows most directly when a kubelet last reported in?
366. 366. kubectl describe node shows both Capacity and Allocatable. What is the difference?
367. 367. Which two statements about kubectl logs are correct? Choose two.
368. 368. When may the -c flag be omitted from kubectl logs or kubectl exec?
369. 369. kubectl exec fails on a distroless image with no shell. What is the alternative?
370. 370. Which kubectl debug flag joins the process namespace of a named container?
371. 371. A Pod crashes on startup, so there is nothing to exec into. Which approach helps?
372. 372. What does --share-processes do when copying a Pod for debugging?
373. 373. Which command opens a shell on a node when no Pod on it is usable?
374. 374. What should be done with a Pod created by kubectl debug --copy-to once the investigation is over?
375. 375. Which are valid container states? Choose two.
376. 376. A container shows State Waiting with reason CrashLoopBackOff. Where is the reason it died?
377. 377. Which field in kubectl describe pod most directly signals a crash loop?
378. 378. A container has no readiness probe configured. How is it treated?
379. 379. What does a Pod's Ready condition determine?
380. 380. In an event listing, what do the From, Reason and Message columns tell you? Choose two.
381. 381. Why might a Pod fail to schedule anywhere? Choose two.
382. 382. Why is a node's schedulable headroom smaller than its machine size suggests?
383. 383. Where can a container write a message explaining a fatal event so tools can surface it?
384. 384. Which command reads a container's termination message back?
385. 385. Which check comes first when a Service cannot be reached?
386. 386. Which test distinguishes a DNS fault from a proxying fault for a Service?
387. 387. A Service resolves but returns nothing. Which misconfigurations are likely? Choose two.
388. 388. A Service uses a named targetPort but no traffic arrives. What must be true of the Pods?
389. 389. A Service has no EndpointSlices at all. What does that point to?
390. 390. How is it proved that the application itself is serving, independently of the Service?
391. 391. A Service is defined correctly and has endpoints, yet traffic still fails. Which policy object should be reviewed?
392. 392. How are kube-proxy's logs found on a node? Choose two.
393. 393. Which component rotates container logs and owns the log directory layout?
394. 394. What are the kubelet's default container log rotation settings? Choose two.
395. 395. An engineer cannot find log output from several hours ago with kubectl logs. Why?
396. 396. Which components do not run in containers? Choose two.
397. 397. Why can the API server's logs be read with kubectl logs in a kubeadm cluster?
398. 398. Where are container logs written on a node? Choose two.
399. 399. Why is putting the Pod log directory on a filesystem separate from /var risky?
400. 400. Which are documented patterns for cluster-level logging? Choose two.
401. 401. Which pipeline supplies the data behind kubectl top?
402. 402. kubectl top returns no data at all in a new cluster. What is the likeliest cause?
403. 403. Why is metrics-server unsuitable as a monitoring system of record?
404. 404. How does metrics-server obtain usage figures? Choose two.
405. 405. An HPA must scale on a metric other than CPU or memory. What is required?
406. 406. kubeadm init hangs waiting for the control plane. Which two causes are most common?
407. 407. Which Pod is expected to be Pending immediately after kubeadm init?
408. 408. An x509 error says the certificate is signed by an unknown authority. Where should you look?
409. 409. Kubelet client-certificate rotation has failed on a node. Which recovery steps apply? Choose two.
410. 410. Passing an admission-plugin list through --apiserver-extra-args fails with a malformed pair error. Why?
411. 411. kube-proxy logs a failure to retrieve the node IP and falls back to 127.0.0.1. What happened?
412. 412. Which tool inspects containers directly on a node when the API server cannot help?
413. 413. How can crictl's endpoint be configured? Choose two.
414. 414. Why is it worth setting crictl's endpoint explicitly?
415. 415. Why can crictl show a container that kubectl cannot?
416. 416. In what two ways does a node report its health? Choose two.
417. 417. Which settings govern node heartbeat timing? Choose two.
418. 418. What is the default rate at which the node controller evicts Pods from failed nodes?
419. 419. An entire availability zone goes unhealthy in a 30-node cluster. What does the node controller do?
420. 420. What else does the node controller do besides watching health? Choose two.
421. 421. A kubelet is restarted with new --node-labels but the labels do not appear. Why?
422. 422. Under Node authorization with NodeRestriction, what may a kubelet modify?
423. 423. What is a node's role in Kubernetes, technically speaking?
424. 424. What is the default restartPolicy for a Pod?
425. 425. A container exits with status 0 under restartPolicy Always. What happens?
426. 426. Why must batch work run as a Job rather than a Deployment?
427. 427. A sidecar container keeps restarting even though the Pod's restartPolicy is OnFailure. Why?
428. 428. A container has crash-looped for an hour, then runs successfully for a long stretch and crashes again. What is the restart delay?
429. 429. Which conditions does the kubelet maintain on a Pod? Choose two.
430. 430. A Pod never gets past PodReadyToStartContainers. What does that point to?
431. 431. What signal does the kubelet send first when a Pod is deleted?
432. 432. What is the default terminationGracePeriodSeconds?
433. 433. A Pod is deleted with terminationGracePeriodSeconds set to 0. What happens to its preStop hook?
434. 434. How do init containers behave? Choose two.
435. 435. An init container never starts and the Pod sits in Pending. What does that suggest?
436. 436. A Pod's restartPolicy is Always. How are its init containers treated on failure?
437. 437. A Pod with restartPolicy Never has an init container that exits with an error. What is the outcome?
438. 438. Which fields do regular init containers not support? Choose two.
439. 439. Where is an init container's status reported?
440. 440. A Pod restarts after a node problem. What happens to its init containers?
441. 441. A Pod shows status Init:1/2. What does that mean?
442. 442. How are an init container's logs read?
443. 443. What makes a Pod a static Pod?
444. 444. How does the kubelet treat files in the static Pod directory? Choose two.
445. 445. An administrator copies kube-apiserver.yaml to kube-apiserver.yaml.backup inside the manifests directory. What happens?
446. 446. How does a static Pod become visible to kubectl get pods?
447. 447. A mirror Pod is deleted with kubectl. Which two things happen? Choose two.
448. 448. The API server is down in a kubeadm cluster. How can its container be inspected?
449. 449. How is a Kubernetes component's log verbosity changed?
450. 450. Why is parsing Kubernetes component logs fragile? Choose two.
451. 451. Why is an etcd snapshot the backup that matters most for a cluster?
452. 452. Which command writes an etcd snapshot from a running member?
453. 453. What effect does taking an etcd snapshot have on the member serving it?
454. 454. Why should etcd snapshot files be encrypted?
455. 455. Which environment variable must be set for the etcdctl commands used for snapshots?
456. 456. Which etcdctl operations are deprecated in favour of etcdutl? Choose two.
457. 457. What must happen before restoring etcd in a running cluster?
458. 458. An administrator restores a snapshot into the same data directory as before. What must be done first?
459. 459. A restore uses a new data directory. Which file must be edited so etcd uses it?
460. 460. Several etcd members have failed. Which two statements describe how they are replaced? Choose two.
461. 461. What does scaling out an etcd cluster achieve? Choose two.
462. 462. What etcd cluster size is recommended for production Kubernetes at any supported scale?
463. 463. Which are involuntary disruptions? Choose two.
464. 464. What can a PodDisruptionBudget not protect against?
465. 465. How may a PodDisruptionBudget be expressed? Choose two.
466. 466. kubectl drain appears to hang on a node. What is a likely explanation?
467. 467. Which tool turns node-level faults into Node conditions or Events?
468. 468. Node Problem Detector does not recognise a node's kernel messages. Why?
469. 469. Which command reveals which cluster kubectl is currently talking to?
470. 470. Which flag puts kubectl get events into chronological order?
471. 471. Which command narrows the event stream to warnings?
472. 472. Which command lists Pods ordered by how often they have restarted?
473. 473. Which mechanism filters a listing server-side on an object field?
474. 474. A jsonpath expression must read the key ca.crt from a Secret. What is required?
475. 475. Which command prints the documentation for a manifest's fields?
476. 476. A namespaced query returns nothing for a kind. Which command confirms it is cluster-scoped?
477. 477. What does kubectl api-resources report for each resource type? Choose two.
478. 478. Which command produces a valid manifest skeleton without creating anything?
479. 479. Which kubectl rollout subcommands do what? Choose two.
480. 480. How is a Deployment's Pods replaced without changing its spec?
481. 481. What is the risk of kubectl replace --force compared with kubectl apply?
482. 482. Which command compares a manifest against the live cluster before applying it?
483. 483. How do kubectl cordon and kubectl drain differ? Choose two.
484. 484. Which flag breaks kubectl top pod down by container?
485. 485. How is the whole cluster's state captured into a directory for offline analysis?
486. 486. kubectl cp fails against a container. What is the most likely missing dependency?
487. 487. How are logs pulled through a Deployment rather than a named Pod?
488. 488. What can kubectl port-forward target? Choose two.
489. 489. An engineer runs kubectl port-forward and the terminal appears to hang. What is happening?
490. 490. A colleague cannot reach a port-forwarded application from another machine. Why?
491. 491. Port-forwarding to a Service is used to test load balancing, but every request hits one Pod. Why?
492. 492. Which command opens a shell on a node that cannot be reached over SSH?
493. 493. Where does a node debugging Pod see the node's root filesystem?
494. 494. On a typical Linux node, where do these logs live? Choose two.
495. 495. A node debugging session lacks tcpdump. What explains this?
496. 496. Prometheus cannot scrape a component's /metrics endpoint under RBAC. What is needed?
497. 497. Which additional metrics endpoints does the kubelet serve? Choose two.
498. 498. Which guarantee does a stable metric carry?
499. 499. Where does kubeadm keep the cluster-wide kubelet configuration?
500. 500. A kubelet configuration change must take effect on a node. Which steps apply? Choose two.
501. 501. You are asked to design a disaster-recovery procedure that can rebuild the entire cluster state after every control plane node is lost. Backing up which component captures all of that state?
502. 502. A team is building a bare-metal cluster with no cloud provider integration at all. Which control plane component can simply be left out?
503. 503. A Pod has just been assigned to a node by kube-scheduler. Which statement correctly describes what the scheduler did?
504. 504. A cluster runs a CNI plugin that implements Service routing in its own dataplane. What does that make possible for the node components?
505. 505. You are auditing a cluster and want to distinguish core Kubernetes components from addons. Which two of the following are addons rather than core components? Choose two.
506. 506. An administrator wants to create Node objects by hand rather than letting machines add themselves. Which kubelet setting achieves that?
507. 507. A kubelet is configured with both --register-node=false and --register-with-taints=workload=gpu:NoSchedule. What happens to the taint?
508. 508. An operator edits a node's systemd unit to add a new value to --node-labels and restarts the kubelet, but the label never appears on the Node object. What explains this?
509. 509. A security review requires that a compromised kubelet cannot relabel other machines in the cluster. Which combination enforces that?
510. 510. A machine is rebuilt with different hardware but keeps its old hostname and re-registers under the same Node name. What does Kubernetes assume?
511. 511. You label a node with node-role.kubernetes.io/worker=production. How does Kubernetes interpret the value "production"?
512. 512. A cluster's control plane needs to decide whether a node is still alive. Which two mechanisms does a node use to report that it is? Choose two.
513. 513. A worker node's network link fails and it stops answering the control plane. What does the node controller write to that Node's Ready condition?
514. 514. A node goes unreachable at 10:00 and its Ready condition is set to Unknown immediately. With default settings, when does the node controller first request eviction of its Pods?
515. 515. An operator wants the control plane to notice node failures faster. Which kube-controller-manager flag controls how often each node's state is examined?
516. 516. With the default --node-eviction-rate of 0.1 per second, how quickly can the node controller start draining Pods from failed nodes?
517. 517. A 20-node cluster in a single zone loses network connectivity to most of its nodes, pushing the unhealthy fraction past 0.55. With default settings, what does the node controller do?
518. 518. Every zone in a large multi-zone cluster reports unhealthy at the same moment. How does the node controller behave?
519. 519. You cordon a node that is currently running twelve Pods. What is the immediate effect on those Pods?
520. 520. An operator starts a container directly through the container runtime on a node, outside Kubernetes. How does the scheduler account for the resources it consumes?
521. 521. A Job's Pods appear on nodes shortly after the Job is created. What did the Job controller itself actually do?
522. 522. A namespace contains both a Deployment and a Job, and both controllers create Pods. What stops the Job controller from deleting the Deployment's Pods?
523. 523. How are Kubernetes' built-in controllers deployed in a standard cluster?
524. 524. A monitoring tool needs to detect a node going silent as early as possible. Which field does the control plane itself watch for that purpose?
525. 525. Three control plane nodes each run kube-scheduler, yet only one is making scheduling decisions. What arranges that?
526. 526. You want to find out how many kube-apiserver instances a cluster is running. Which objects reveal that?
527. 527. You delete a ReplicaSet with kubectl and no extra flags. What happens to its Pods and to the ReplicaSet object?
528. 528. During foreground cascading deletion, an object sits in a "deletion in progress" state. Which two things does the API server set on it? Choose two.
529. 529. An owner is being deleted in the foreground, but one of its dependents never delays the deletion at all. What would explain that?
530. 530. A ConfigMap in namespace app-a carries an ownerReference naming a Deployment in namespace app-b. What becomes of the ConfigMap?
531. 531. Objects are disappearing unexpectedly and you suspect malformed owner references. Which Event reason should you filter for?
532. 532. A node is running a cron job that prunes unused containers with the container runtime's own CLI. Why does the Kubernetes documentation warn against this?
533. 533. A node's image filesystem crosses its HighThresholdPercent. Which images does the kubelet delete, and until when?
534. 534. A node is configured with imageMaximumGCAge: 12h, but images that have been unused for a day are still present after a kubelet restart. Why?
535. 535. An administrator wants to stop the kubelet from deleting dead containers on age alone. Which setting and value does that?
536. 536. On a busy node, keeping MaxPerPodContainer dead containers for every Pod would exceed the cluster-wide MaxContainers ceiling. What does the kubelet do?
537. 537. You are hardening a cluster whose nodes sit on an untrusted network. Which statement about node-to-control-plane traffic is correct?
538. 538. By default the API server does not verify a kubelet's serving certificate. Which two operations therefore travel over an unverified connection? Choose two.
539. 539. Which kube-apiserver flag makes the API server validate the certificate a kubelet presents?
540. 540. An operator reaches a Service through the API server proxy and prefixes the name with https: to secure it. What guarantee does that give?
541. 541. A cluster still relies on SSH tunnels for control-plane-to-node traffic. What is the documented replacement?
542. 542. A misbehaving Pod is flooding the API server with requests, yet leader election and the built-in controllers keep working. Which feature accounts for that?
543. 543. A cluster was built with a single control plane node and no --control-plane-endpoint. The team now wants to add two more control plane nodes for high availability. What does kubeadm support?
544. 544. During kubeadm init, which flag sets the single address that every control plane node in the cluster will answer on?
545. 545. An engineer installs a CNI plugin whose manifest assumes 10.244.0.0/16, but Pods never get addresses in that range. What was most likely missed at kubeadm init?
546. 546. A node has both containerd and CRI-O installed, and kubeadm join fails while trying to detect the runtime. Which flag resolves the ambiguity?
547. 547. Immediately after a successful kubeadm init, the CoreDNS Pods sit in Pending. What is the expected explanation?
548. 548. You are choosing a Pod CIDR for a new cluster. Which two statements are correct? Choose two.
549. 549. A new operator asks for a copy of admin.conf from a kubeadm cluster so they can run kubectl. What does that file grant?
550. 550. Which kubeadm-generated kubeconfig holds an identity that skips the authorization layer, RBAC included?
551. 551. A colleague pastes the full kubeadm join command, bootstrap token and all, into a public chat. What is the immediate risk?
552. 552. On a single-machine kubeadm cluster, ordinary workloads stay Pending. Which action lets them run?
553. 553. A kubelet is started with --node-labels=node-role.kubernetes.io/worker= and the node never appears in kubectl get nodes. What happened?
554. 554. How should a restricted label such as node-role.kubernetes.io/worker be applied to a node in a kubeadm cluster?
555. 555. You are decommissioning a worker node cleanly. Which two steps belong to the documented procedure, before the Node object is deleted? Choose two.
556. 556. After running kubeadm reset you plan to reuse the machine as a worker in a different cluster. What does reset leave behind?
557. 557. A kubeadm binary at v1.35 is used to build a new cluster. Which control plane versions may it deploy?
558. 558. With kubeadm at v1.35, how far behind may the kubelet on a host be?
559. 559. You are writing a backup job for a single-control-plane kubeadm cluster. Which directory on that node holds the etcd data?
560. 560. A control plane component exits with an error on a freshly provisioned host that has no default route configured. What is the likely cause?
561. 561. An administrator changes a control plane node's IP address after the cluster is built. What else must be done?
562. 562. kubeadm init prints several preflight WARNING lines and then continues. What does this tell you?
563. 563. You run kubeadm join --control-plane on a second machine without any extra etcd configuration. What happens to etcd?
564. 564. A team plans a highly available cluster with stacked etcd. What is the minimum number of control plane nodes?
565. 565. How many machines does the external etcd topology require, at a minimum, compared with the stacked one?
566. 566. In an external etcd topology, which statement describes the communication pattern?
567. 567. A kubeadm cluster has been running for eleven months and you want to know how much life its certificates have left. Which command reports that?
568. 568. An organisation wants kubeadm to sign cluster certificates with its own existing CA. What is the procedure?
569. 569. Which two kubeadm ClusterConfiguration fields change how long its certificates remain valid? Choose two.
570. 570. kubeadm finds ca.crt in its PKI directory but no ca.key. What does it do?
571. 571. A kubelet refuses to start on a node that has swap enabled. Which setting allows it to start anyway?
572. 572. Nodes cloned from a single virtual machine template fail to join a cluster correctly. Which two attributes must be unique per node? Choose two.
573. 573. Which kubeadm preflight check fails when a node runs a kernel version the project does not support?
574. 574. A cluster running v1.33 needs to reach v1.35. What does kubeadm support?
575. 575. You are upgrading the kubelet on a control plane node across a minor version. Why must that node be drained first?
576. 576. After a kubeadm upgrade, every container on the upgraded nodes has restarted. Why?
577. 577. An administrator wants to change an API server flag while also upgrading the cluster. What does kubeadm upgrade offer?
578. 578. During a kubeadm upgrade that also restarts etcd, in-flight API requests stall. Which mitigation is documented?
579. 579. An etcd cluster has lost quorum and cannot elect a leader. What is the effect on the Kubernetes cluster?
580. 580. You need to defragment an etcd database and verify a snapshot file offline. Which tool is intended for that?
581. 581. What is the effect of running etcdctl snapshot save against a live etcd member?
582. 582. You are restricting an etcd cluster so that only the API servers may talk to it. Which two etcd settings accomplish that? Choose two.
583. 583. You are starting a replacement etcd member after removing a failed one. Which environment variable value is required?
584. 584. A node runs containerd configured with the systemd cgroup driver, but the kubelet was left at its default. What must be changed?
585. 585. A user has read access to Secrets in a namespace through a broad ClusterRole, and you want to take just that one permission away. What does RBAC allow?
586. 586. A RoleBinding in namespace dev references a ClusterRole that grants read access to Secrets. What can the subject read?
587. 587. You try to edit a RoleBinding to point at a different Role and the API server rejects it. What is the correct procedure?
588. 588. A Role grants get and list on pods, but a user running kubectl logs is refused. What does the Role need?
589. 589. An administrator writes a Role with resourceNames set, hoping to allow creating only a ConfigMap with a particular name. Why does this not work?
590. 590. A user has list on configmaps restricted by resourceNames to my-config, yet plain kubectl get configmaps is denied. What must they do?
591. 591. You want a RoleBinding to cover every ServiceAccount in the qa namespace. Which subject expresses that?
592. 592. Why does the built-in view ClusterRole exclude Secrets?
593. 593. A developer is granted the edit role in a namespace. Which two capabilities does that actually give them? Choose two.
594. 594. What does binding the cluster-admin ClusterRole through a RoleBinding, rather than a ClusterRoleBinding, grant?
595. 595. An operator removes a permission from the system:discovery ClusterRole, and after the next control plane restart the permission is back. What explains this?
596. 596. A namespace administrator who cannot list Secrets cluster-wide tries to create a ClusterRole granting that permission. What happens?
597. 597. You want a team lead to be able to grant the admin, edit and view roles in their own namespace without holding those permissions themselves. Which verb makes that possible?
598. 598. An aggregated ClusterRole has an aggregationRule and rules that an operator wrote by hand. What becomes of those hand-written rules?
599. 599. You have added a CustomResourceDefinition and want read access to it included in the built-in view role. What is the documented approach?
600. 600. Why is a rule with resources: ["*"] and verbs: ["*"] considered risky even when it currently grants only what is intended?
601. 601. A security review asks how Secrets could be read in a cluster with no special hardening. Which two statements are accurate? Choose two.
602. 602. A Secret manifest sets the key password under both data and stringData. Which value ends up stored?
603. 603. An application team wants to store a 4 MiB certificate bundle in a single Secret. What stops them?
604. 604. Which Secret type holds the credentials the kubelet uses to pull images from a private registry?
605. 605. A Pod references a Secret that does not exist yet. What happens by default?
606. 606. An operator updates a Secret, and one container picks up the new value while another, mounting the same Secret, does not. What most likely differs?
607. 607. A Secret contains a key named app.config.value, and a Pod maps every key into environment variables. What happens?
608. 608. A static Pod manifest on a node references a ConfigMap, and the value never arrives. Why?
609. 609. A ConfigMap was marked immutable and now needs a changed value. What is required?
610. 610. A cluster with tens of thousands of Secret-to-Pod mounts is straining its API server. Which change reduces that load?
611. 611. A Role grants list and watch on secrets in a namespace, intending to cover only the Secrets a controller's Pods use. What does it actually grant?
612. 612. A workload runs with privileged: true. What can it read regardless of RBAC?
613. 613. A namespace needs both a ceiling on total CPU consumption and a cap on what any single Pod may request. Which two objects provide these? Choose two.
614. 614. In what order does the LimitRange admission controller act on a new Pod?
615. 615. An administrator tightens a LimitRange in a namespace where twenty Pods are already running. What happens to those Pods?
616. 616. A namespace has a LimitRange whose default CPU limit is 500m. A Pod is submitted with a CPU request of 700m and no limit, and it never schedules. Why?
617. 617. A namespace has a ResourceQuota covering requests.cpu. A developer submits a Pod with no CPU request or limit at all. What is the likely outcome?
618. 618. A Deployment is applied successfully into a namespace with a tight ResourceQuota, but only two of its five replicas appear. Where does the explanation show up?
619. 619. In a ResourceQuota, what does a bare memory entry constrain?
620. 620. A namespace should be limited to four GPUs of the extended resource nvidia.com/gpu. Which quota entry is valid?
621. 621. How do the three Pod Security Standards relate to one another?
622. 622. You want a namespace to reject Pods that break the restricted profile, while also recording near-misses without blocking them. Which two Pod Security modes do you configure? Choose two.
623. 623. A namespace enforces the restricted Pod Security level. A Deployment whose template violates it is applied. What happens?
624. 624. A user is added to the Pod Security exemption list by username, but their Deployment's Pods are still rejected. Why?
625. 625. An engineer sets KUBECONFIG to two file paths separated by a colon on Linux. What does kubectl do?
626. 626. An application cannot tolerate two versions running at once, even briefly. Which Deployment strategy type meets that requirement?
627. 627. A Deployment has 10 replicas and leaves maxUnavailable at its default. How many Pods may be unavailable during a rolling update?
628. 628. A Deployment has 10 replicas and leaves maxSurge at its default. How many Pods above the desired count may exist during a rolling update?
629. 629. An engineer sets both maxUnavailable and maxSurge to 0 on a RollingUpdate Deployment. What is wrong with that?
630. 630. A Deployment's rollout stalls, and after ten minutes its Progressing condition turns False. What reason does the condition carry, and what does the controller do next?
631. 631. A Deployment sets minReadySeconds to 900 and progressDeadlineSeconds to 600. What is wrong?
632. 632. A team wants a new Pod to be considered available only after it has stayed ready for thirty seconds without a container crashing. Which field expresses that?
633. 633. How many old ReplicaSets does a Deployment retain by default, and what does keeping them enable?
634. 634. An operator finds eighteen ReplicaSets for a Deployment whose revisionHistoryLimit is 10. What explains the excess?
635. 635. A Deployment has spec.paused set to true. Which statement is correct?
636. 636. A Deployment uses the Recreate strategy. An operator deletes one of its Pods by hand. What happens?
637. 637. Two Deployments in a namespace were written with the same label selector. What is the documented consequence?
638. 638. A StatefulSet named db has replicas scaled from 3 to 1. Which two statements describe what happens? Choose two.
639. 639. A StatefulSet is scaled from 1 to 3, but only web-0 and web-1 ever appear. web-1 is Running but never becomes Ready. Why is web-2 missing?
640. 640. A StatefulSet's Pods have no resolvable DNS names. Which omission would cause that?
641. 641. A StatefulSet with three replicas and a volumeClaimTemplate is deleted, with no retention policy configured. What happens to its PersistentVolumeClaims?
642. 642. You need a StatefulSet's Pods to shut down in an orderly, graceful sequence. What is the documented way to achieve that?
643. 643. A StatefulSet with 5 replicas has updateStrategy.rollingUpdate.partition set to 3 when its template changes. Which Pods are updated?
644. 644. A StatefulSet has updateStrategy.type set to OnDelete and its Pod template is changed. What happens?
645. 645. A StatefulSet should keep its volumes when scaled down but discard them when the whole set is deleted. Which two settings express that? Choose two.
646. 646. How does a DaemonSet Pod come to be running on a particular node?
647. 647. A DaemonSet's Pods fail to schedule on nodes that are already full. Which change makes them able to displace other work?
648. 648. A node becomes unreachable and its ordinary Pods are eventually evicted, yet its DaemonSet Pods stay put. Why?
649. 649. Which DaemonSet Pods get an automatic toleration for the node.kubernetes.io/network-unavailable taint?
650. 650. A Job with default settings has a Pod that keeps failing. How many failures are tolerated before the Job is marked failed?
651. 651. A batch job splits a fixed dataset into numbered shards, and each Pod must know which shard it owns. Which Job setting supports that?
652. 652. A Job pulls items from an external queue until the queue is empty, and there is no fixed number of items. How should it be configured?
653. 653. A Job sets completions to 10 and parallelism to 50, but never more than a handful of Pods run at once near the end. Why?
654. 654. Which Job field asks Kubernetes to clean up the Job and its Pods a fixed time after it finishes?
655. 655. A Job sets parallelism 1, completions 1 and restartPolicy Never. What must its program still tolerate?
656. 656. A CronJob's run occasionally overruns its schedule, and the new run must cancel the old one. Which concurrencyPolicy does that?
657. 657. A CronJob with no startingDeadlineSeconds misses its 02:00 run because the controller was down until 05:00. What happens when the controller returns?
658. 658. A CronJob is left with default history settings. Which two statements are correct? Choose two.
659. 659. A CronJob scheduled for 0 3 * * * fires at an unexpected wall-clock time after the control plane is moved to different hosts. What is the likely cause?
660. 660. A container has a startup probe as well as liveness and readiness probes. When do the liveness and readiness probes first run?
661. 661. A container's readiness probe begins failing. Which two things happen? Choose two.
662. 662. A probe is written with no timing fields set. How long may each check take before it is treated as a failure?
663. 663. An engineer wants a container to be considered healthy only after two consecutive successful checks. On which probe type can successThreshold be set above 1?
664. 664. A team adds a toleration for a GPU node's taint to every Pod in a Deployment, expecting them to land on the GPU nodes. What actually happens?
665. 665. An administrator adds a NoExecute taint to a node that is already running Pods. Which two things happen? Choose two.
666. 666. A node carries the taint tier=gold:NoSchedule. Which toleration matches it?
667. 667. A Pod carries a toleration with an empty key and the operator Exists, and no effect. What does it tolerate?
668. 668. A node has three taints and a Pod tolerates two of them; the untolerated one has effect NoSchedule. What is the outcome for a new Pod?
669. 669. A Pod tolerates a NoExecute taint and sets tolerationSeconds to 3600. The taint is applied at noon and removed at 12:30. What happens to the Pod?
670. 670. A Pod manifest sets spec.nodeName directly to a node carrying a NoExecute taint the Pod does not tolerate. What happens?
671. 671. What is the highest value an administrator may set on a custom PriorityClass?
672. 672. A cluster has no PriorityClass with globalDefault set. What priority does a Pod that names no class receive?
673. 673. An operator creates a PriorityClass with globalDefault: true in a running cluster. What effect does it have on the Pods already there?
674. 674. A data science team wants their long jobs scheduled ahead of others in the queue but never at the cost of evicting running work. Which PriorityClass setting achieves that?
675. 675. A Pod uses a PriorityClass with preemptionPolicy: Never. Can that Pod itself be preempted?
676. 676. A topology spread constraint sets maxSkew to 1 with whenUnsatisfiable: ScheduleAnyway. What does maxSkew mean here?
677. 677. A Pod spec has two topology spread constraints, both with topologyKey kubernetes.io/hostname and whenUnsatisfiable: DoNotSchedule. Why is this rejected?
678. 678. A topology spread constraint sets minDomains to 3 alongside whenUnsatisfiable: ScheduleAnyway. What is the problem?
679. 679. A Pod was scheduled using requiredDuringSchedulingIgnoredDuringExecution node affinity. An administrator later removes the matching label from the node. What happens to the Pod?
680. 680. A node affinity rule lists two entries under nodeSelectorTerms, each with one matchExpressions clause. When does a node satisfy the rule?
681. 681. What is the permitted range for the weight of a preferredDuringSchedulingIgnoredDuringExecution node affinity rule?
682. 682. A Pod sets both a nodeSelector for disk=ssd and a required node affinity for zone in [a, b]. Which nodes are eligible?
683. 683. An inter-pod anti-affinity rule uses topology.kubernetes.io/zone as its topologyKey, but several nodes have no such label. What is the documented consequence?
684. 684. Which two of the following are default hard eviction thresholds on a Linux node? Choose two.
685. 685. What distinguishes a soft eviction threshold from a hard one?
686. 686. A node reports the DiskPressure condition. Which eviction signal could have caused it?
687. 687. How does the kubelet calculate memory.available for eviction purposes?
688. 688. Which pair of steps describes how kube-scheduler chooses a node?
689. 689. Three nodes finish the scoring phase with identical scores. How does kube-scheduler choose between them?
690. 690. A Pod's requirements match no node in the cluster. What does kube-scheduler do?
691. 691. Which two of the following are extension points a scheduling profile can configure with plugins? Choose two.
692. 692. Which sequence does kubectl drain follow?
693. 693. An operator scripts a rolling reboot that drains five nodes at once. What risk does the documentation identify?
694. 694. A service owner writes a PodDisruptionBudget with minAvailable: 2 and expects it to survive a node's power supply failing. What does the budget actually guarantee?
695. 695. A drain hangs because the application's Pods are crash-looping and the PodDisruptionBudget will not allow their eviction. Which setting is recommended to avoid this?
696. 696. An API-initiated eviction differs from deleting a Pod directly. Which two things does it respect? Choose two.
697. 697. Which API version serves the Eviction subresource today?
698. 698. A Pod shows the status SchedulingGated and never reaches the scheduler. What must happen for it to proceed?
699. 699. A controller wants to pull an already-created Pod back out of the scheduling queue by adding a scheduling gate. What does the API allow?
700. 700. A RuntimeClass declares an overhead of 120Mi memory, and a Pod using it requests 256Mi across its containers. How much memory does the scheduler require on the node?
701. 701. A Service of type NodePort is created without naming a nodePort value. Which range does the allocated port come from by default?
702. 702. A Service is changed from ClusterIP to NodePort. Which two statements are then true? Choose two.
703. 703. A Service declares port: 80 and no targetPort. Which container port does traffic reach?
704. 704. A Service of type ExternalName maps db to db.example.com. What does a Pod's DNS lookup of db return?
705. 705. An application reaching an HTTPS backend through an ExternalName Service gets certificate errors. What explains this?
706. 706. An engineer sets externalName to 203.0.113.10 on an ExternalName Service, and nothing resolves. Why?
707. 707. How is a headless Service declared?
708. 708. Which two statements describe a headless Service? Choose two.
709. 709. A headless Service is created without a selector. What constraint applies to its ports?
710. 710. A Service is created without a selector so it can front an external database. Nothing can reach it. What is missing?
711. 711. A hand-written EndpointSlice named my-service-1 exists alongside a selectorless Service named my-service, but the Service still shows no endpoints. What is most likely wrong?
712. 712. At roughly what point does Kubernetes create an additional EndpointSlice for a growing Service?
713. 713. A Service backed by 1500 Pods carries the annotation endpoints.kubernetes.io/over-capacity: truncated. What does that indicate?
714. 714. Which two shortcomings of the Endpoints API led to EndpointSlice replacing it? Choose two.
715. 715. A Service sets trafficDistribution to PreferSameZone. What does this guarantee?
716. 716. A manifest sets trafficDistribution to PreferClose. What is the current guidance?
717. 717. An application needs a client's requests to keep landing on the same Pod. What does a Service offer?
718. 718. A Service declares two ports and the API server rejects it. Which requirement was most likely missed?
719. 719. Which of these is a valid name for a Service port?
720. 720. A LoadBalancer Service has been created but kubectl get svc shows its external address as pending. Where will the address appear once provisioned?
721. 721. How does Kubernetes typically implement a LoadBalancer Service?
722. 722. A Service sets internalTrafficPolicy to Local. A Pod on a node with no ready endpoint for that Service tries to connect. What happens?
723. 723. Why is externalTrafficPolicy: Local often chosen for a LoadBalancer Service?
724. 724. Under externalTrafficPolicy: Cluster, which endpoint do load balancer health checks target?
725. 725. Why does kube-proxy return 503 from /healthz while its node is being deleted?
726. 726. A vendor configures kube-proxy's /healthz as a liveness probe, and kube-proxy restarts continuously while a node is being deleted. Which path should have been used?
727. 727. In iptables proxy mode, how is a backend chosen for a new connection to a Service?
728. 728. An operator is choosing a kube-proxy mode for a new Linux cluster and is considering ipvs. What is the current guidance?
729. 729. Which two capabilities does IPVS proxy mode offer that iptables mode does not? Choose two.
730. 730. A very large cluster in iptables mode sees kube-proxy take a long time to converge after a change. What is the underlying cause?
731. 731. A team wants to expose a PostgreSQL database to clients outside the cluster. Why is an Ingress the wrong tool?
732. 732. An Ingress object has been applied successfully but no traffic is routed and its address stays empty. What should be checked first?
733. 733. An Ingress manifest defines a path with no pathType. What happens?
734. 734. An Ingress has a Prefix path of /foo/bar. Which two request paths match? Choose two.
735. 735. An Ingress has an Exact path of /foo. Which request path matches it?
736. 736. An Ingress declares /foo as a Prefix path and /foo as an Exact path, pointing at different Services. Where does a request for /foo go?
737. 737. An Ingress rule uses the host *.foo.com. Which Host header matches?
738. 738. An Ingress is written with no rules at all. What must it contain to be valid?
739. 739. Two IngressClasses in a cluster are both annotated as the default. What is the consequence?
740. 740. Which two statements about Ingress TLS are correct? Choose two.
741. 741. Which keys must a Secret contain to be used as an Ingress TLS certificate?
742. 742. An Ingress terminates TLS for shop.example.com but its rules only define a default backend with no host. Why does TLS not work?
743. 743. A dual-stack Service serves both IPv4 and IPv6. How many EndpointSlices does it have at a minimum?
744. 744. An endpoint in an EndpointSlice reports serving: true and terminating: true. What is its ready condition?
745. 745. Every endpoint of a Service is terminating at once. What do Service proxies do?
746. 746. In Gateway API, what is the relationship between a Gateway and a GatewayClass?
747. 747. A team needs weighted traffic splitting between two backend versions. What does Gateway API offer that Ingress does not?
748. 748. A Service manifest requests a specific clusterIP that another Service already holds. What does the API server do?
749. 749. A Pod reads a Service's address from the injected environment variables, but the variables are missing. What is the most likely reason?
750. 750. A NodePort Service has three backing Pods on three of a cluster's ten nodes. Which nodes answer on the allocated node port?
751. 751. Three different components allocate the three address ranges in a cluster. Which two pairings are correct? Choose two.
752. 752. An engineer proposes a Pod CIDR that partially overlaps the Service CIDR to save address space. Why is this rejected?
753. 753. A node's interfaces carry several addresses, but Kubernetes only ever uses one of them. Which does it consider?
754. 754. You are writing firewall rules for a control plane node. Which two inbound ports are needed by default? Choose two.
755. 755. Which protocols must be permitted for the NodePort range on a worker node?
756. 756. A namespace contains no NetworkPolicy objects at all. What traffic may its Pods send and receive?
757. 757. A NetworkPolicy selects a Pod, lists an ingress rule, and sets policyTypes to ["Ingress"]. What is the Pod's egress isolation?
758. 758. Two NetworkPolicies select the same Pod and permit different ingress sources. What may reach the Pod?
759. 759. Pod A's namespace has a default-deny egress policy. Pod B's namespace has an ingress policy explicitly allowing A. Can A reach B?
760. 760. A NetworkPolicy allows Pod A to open a connection to Pod B on port 8080. What about the responses B sends back?
761. 761. A Pod is isolated for ingress by a policy that names no peers. The kubelet's liveness probe still succeeds. Why?
762. 762. A from block contains two list entries: one with a namespaceSelector and one with a podSelector. What does it allow?
763. 763. Why does the documentation say ipBlock should name cluster-external addresses?
764. 764. A team wants to allow a namespace broad egress but block one specific external CIDR. What does the NetworkPolicy API support?
765. 765. Which two things can a NetworkPolicy not do? Choose two.
766. 766. An incident responder applies a restrictive NetworkPolicy to cut off a compromised Pod's live connections. What should they expect?
767. 767. A NetworkPolicy is applied successfully but traffic it should block still flows. What is the first thing to check?
768. 768. A Pod resolves the DNS name of a headless Service. What does it get back?
769. 769. A Pod in namespace test cannot resolve the name data, which is a Service in namespace prod. What should the client use?
770. 770. Reading a Pod's /etc/resolv.conf you find options ndots:5. What does the kubelet write it for?
771. 771. For which Service ports does cluster DNS create SRV records?
772. 772. A Pod manifest omits dnsPolicy entirely. Which policy applies?
773. 773. A Pod with hostNetwork: true and dnsPolicy: ClusterFirst cannot resolve any in-cluster Service names. Why?
774. 774. A Pod sets dnsPolicy to None. What must accompany it?
775. 775. How many nameservers may a Pod's dnsConfig list?
776. 776. A Pod uses dnsPolicy ClusterFirst and adds options in its dnsConfig. What happens to the options the policy would have produced?
777. 777. What limits does Kubernetes place on a Pod's DNS search domain list?
778. 778. Which two Pod spec fields shape the DNS name a Pod is given under a headless Service? Choose two.
779. 779. An administrator needs to change how cluster DNS forwards external queries. Where is that configured?
780. 780. In the default Corefile, which two plugins divide the work of answering queries? Choose two.
781. 781. Which CoreDNS plugin exists to catch a configuration in which queries would be forwarded back to CoreDNS itself?
782. 782. A cluster must send queries for internal.example.com to a particular corporate nameserver. How is that expressed in CoreDNS?
783. 783. After editing the CoreDNS ConfigMap, an operator wonders whether to restart the CoreDNS Deployment. What does the default configuration provide?
784. 784. A Service sets ipFamilyPolicy to RequireDualStack and is applied to a single-stack cluster. What happens?
785. 785. Which field determines a dual-stack Service's primary IP family?
786. 786. An engineer looks for the kubelet's --network-plugin and --cni-bin-dir flags on a current release and cannot find them. What changed?
787. 787. A cluster operator is evaluating a CNI plugin that declares compatibility with CNI specification v0.3.1 only. What does the Kubernetes project require?
788. 788. A cluster deploys NodeLocal DNSCache. Which two effects does it have on a Pod's DNS queries? Choose two.
789. 789. What change must applications make to benefit from NodeLocal DNSCache?
790. 790. Cluster DNS has stopped working. Which two checks does the troubleshooting guide begin with? Choose two.
791. 791. How is a default-deny ingress policy for a namespace written?
792. 792. After a default-deny egress policy is applied to a namespace, its Pods can no longer resolve any names. What is missing?
793. 793. A namespace has an allow-all ingress policy. A second policy is added that permits only one source. What can now reach the Pods?
794. 794. A NetworkPolicy rule sets endPort: 32768 but omits port. Why is that invalid?
795. 795. A NetworkPolicy using endPort is applied, but traffic to the middle of the range is still blocked. What should be verified?
796. 796. A NetworkPolicy must permit traffic from the namespace named monitoring, which carries no custom labels. What can the namespaceSelector match on?
797. 797. You need a NetworkPolicy that limits who may reach an nginx Service. What does the policy actually select?
798. 798. Two containers in the same Pod need to talk to each other. Which networking problem is that, in the documentation's terms?
799. 799. A cluster's API server is reached on port 443 rather than 6443. What does that tell you?
800. 800. A NetworkPolicy in namespace web has an ingress rule whose from block contains only a podSelector matching app=api. Which Pods does it admit?
801. 801. A PersistentVolume is bound ReadWriteOnce. Three Pods of the same Deployment land on the same node and all mount the claim. What happens?
802. 802. kubectl shows a PersistentVolume's access mode as RWOP. Which mode is that?
803. 803. A PersistentVolume is declared ReadOnlyMany, yet a Pod writes to it successfully. Why?
804. 804. A team wants ReadWriteOncePod on an NFS-backed PersistentVolume provisioned by an in-tree plugin. What blocks them?
805. 805. A PersistentVolume uses the Retain reclaim policy and its claim is deleted. Which two statements are true? Choose two.
806. 806. A developer deletes a PersistentVolumeClaim created from the default StorageClass, and the data is gone. What explains this?
807. 807. A PersistentVolume shows the phase Released. What does that mean?
808. 808. A Retain-policy PersistentVolume is stuck in Released and a new claim will not bind to it. What must be done?
809. 809. A PersistentVolumeClaim has been deleted but sits in Terminating with the finalizer kubernetes.io/pvc-protection. What is holding it?
810. 810. A PersistentVolume backed by an empty block device is mounted by a Pod for the first time, with volumeMode left unset. What happens?
811. 811. A statically created PersistentVolume has no storageClassName. Which claim can bind to it?
812. 812. An administrator pre-creates a PersistentVolume and writes a claim that omits storageClassName, expecting it to bind. Instead a new volume is provisioned. Why?
813. 813. An edit that raises a PersistentVolumeClaim's storage request is rejected. What is the likely cause?
814. 814. A StorageClass leaves volumeBindingMode unset. When is a volume provisioned for a new claim?
815. 815. In a multi-zone cluster, Pods keep failing to start because their volume is in a different zone. Which StorageClass setting fixes this?
816. 816. Which values may a StorageClass's reclaimPolicy take, and what is the default?
817. 817. A cluster needs dynamic provisioning for NFS, which has no in-tree provisioner. What does a StorageClass allow?
818. 818. A Pod uses an emptyDir volume. Which two events preserve its contents? Choose two.
819. 819. A Pod uses an emptyDir with medium set to Memory and is OOM-killed after writing a large file to it. Why?
820. 820. What is the documented alternative to a hostPath volume where node-local storage is genuinely needed?
821. 821. An admission policy restricts hostPath volumes to a list of approved directories. What else must it require to be effective?
822. 822. Which two statements about local volumes are correct? Choose two.
823. 823. A node holding a local PersistentVolume becomes unhealthy. What happens to the Pod using it?
824. 824. Two containers in a Pod must share one PersistentVolumeClaim but keep their data in separate directories. Which field arranges that?
825. 825. What is the default value of mountPropagation on a volume mount?
826. 826. Which requirement applies to a container using Bidirectional mount propagation?
827. 827. A claim omitting storageClassName stays Pending in a cluster where no StorageClass is annotated as default. Why?
828. 828. Which pairing correctly describes the volume snapshot objects?
829. 829. An operator wants to change a VolumeSnapshotClass's deletionPolicy. What does the API allow?
830. 830. kubectl get volumesnapshots returns "the server doesn't have a resource type". What is missing?
831. 831. Which two volume types are local ephemeral storage managed by the kubelet rather than by a storage driver? Choose two.
832. 832. A projected volume combines a Secret from another namespace with a ConfigMap from the Pod's own. What is the problem?
833. 833. A cluster has CSIStorageCapacity objects but the scheduler still places Pods on nodes with no room. What is likely unset?
834. 834. A Pod requiring a new attached volume stays Pending on an otherwise idle node with plenty of CPU and memory. What limit could explain it?
835. 835. What distinguishes a generic ephemeral volume from an ordinary PersistentVolumeClaim?
836. 836. Before deleting a claim in front of a production database, an operator wants to be sure the data survives. What should they change first?
837. 837. A cluster has two StorageClasses both annotated as default. What state is that?
838. 838. Which two fields on a CSI PersistentVolume must correspond to values the driver itself reports? Choose two.
839. 839. One container mounts a volume with readOnly: true. What does that mean for the other containers in the Pod?
840. 840. A hostPath volume of /mnt is mounted read-only into a container, but a tmpfs mounted at /mnt/data on the host is writable inside. Why?
841. 841. recursiveReadOnly is set to Enabled on a volume mount. Which two conditions must hold? Choose two.
842. 842. Which Pod field sets the group that owns the files in a Pod's mounted volumes?
843. 843. A node's ephemeral storage is filling up. Besides emptyDir volumes, which two things draw on it? Choose two.
844. 844. A namespace has a quota on ephemeral-storage, but a Pod consuming a great deal of scratch space is admitted anyway. What explains it?
845. 845. Where does a CSI driver's report that a volume is unhealthy appear?
846. 846. Which two conditions must hold to clone a PersistentVolumeClaim? Choose two.
847. 847. An existing ReadWriteOnce volume must be moved to ReadWriteOncePod without losing data. What does the documented procedure involve?
848. 848. A PersistentVolume uses the Delete reclaim policy and its claim is removed. What is deleted?
849. 849. An old manifest sets persistentVolumeReclaimPolicy to Recycle. What is the current guidance?
850. 850. A PersistentVolume lists ReadWriteOnce and ReadOnlyMany among its access modes. How is it mounted?
851. 851. A Pod is misbehaving and you have only one command to run first. Which gives the most diagnostic ground in a single step?
852. 852. A Pod has been Pending for ten minutes. What does that state tell you, and where is the reason recorded?
853. 853. A Deployment using hostPort is scaled to 8 replicas on a 5-node cluster, and three Pods stay Pending. Why?
854. 854. A Pod is scheduled but its container stays in Waiting. Which two causes should be checked first? Choose two.
855. 855. A Pod has been Terminating for an hour. Which cluster objects should be inspected?
856. 856. A newly installed validating webhook has left older Pods impossible to delete. What design rule was broken?
857. 857. A Pod runs its image's default entrypoint rather than the command in the manifest, and no error was reported. What is the recommended next step?
858. 858. You compare a local manifest with kubectl get pod -o yaml. Which difference indicates a real problem?
859. 859. Which command lists the EndpointSlices belonging to a Service named web?
860. 860. A Service has no endpoints. What is the most direct way to confirm the cause?
861. 861. A Service has endpoints and its selector is correct, yet connections are refused. Which mismatch should be checked next?
862. 862. A container is in CrashLoopBackOff and kubectl logs shows only a few lines from the newest attempt. Which flag reveals why it died last time?
863. 863. Which two situations call for an ephemeral debug container rather than kubectl exec? Choose two.
864. 864. An application crashes immediately at startup, so there is never a running container to exec into. Which approach does the documentation recommend?
865. 865. A debug copy adds an Ubuntu container beside a distroless application container, but the new container cannot see the application's processes. Which flag was missed?
866. 866. A kubectl debug session is disconnected by a dropped network link. How is it resumed?
867. 867. Inside a Pod created by kubectl debug node/mynode, where is the node's root filesystem?
868. 868. In a node debug session, chroot /host fails with a permissions error. Why?
869. 869. kubectl describe shows Ready: True for a container that is plainly not serving traffic correctly. What does that column actually mean here?
870. 870. In a Pod's event list, one entry comes From default-scheduler and another From kubelet. What does that distinction tell you?
871. 871. A node goes unreachable. kubectl describe pod on one of its Pods shows a toleration for node.kubernetes.io/unreachable with tolerationSeconds 300. What does that govern?
872. 872. On a four-node cluster where each node has one CPU, a Pod requesting 1000m stays Pending on every node. What is the likely explanation?
873. 873. A Service name will not resolve from inside a Pod. Which lookup isolates cluster DNS itself as the problem?
874. 874. A Service manifest written in JSON has "targetPort": "9376". What is wrong?
875. 875. A Service selects app=hostnames but its EndpointSlice shows no endpoints, while the Pods are Running. What should be inspected?
876. 876. You want to separate a broken Service from a broken application. Which test does that?
877. 877. A Service works most of the time but fails intermittently, and its backing Pods show a high RESTARTS count. How are the two connected?
878. 878. A Service resolves, has correct endpoints, and each Pod answers when addressed directly, yet the Service IP does not work. What is the remaining suspect?
879. 879. kube-proxy's logs do not show which endpoints it programmed for a Service. What does the guide suggest?
880. 880. A Pod cannot reach itself through its own Service IP. Which two hairpin-mode values allow that to work? Choose two.
881. 881. The kubelet was started with --hairpin-mode=promiscuous-bridge, but hairpin traffic still fails. Where is the effective mode confirmed?
882. 882. A Service is configured correctly and its Pods are healthy, but only some clients can reach it. What should be ruled out before deep proxy debugging?
883. 883. From which path does the kubelet read a container's termination message by default?
884. 884. A Pod has twelve containers, counting init containers. How much termination message space does each get?
885. 885. A container exits with an error and writes nothing to its termination message file. Which setting would surface the tail of its log instead?
886. 886. How much log output can the FallbackToLogsOnError policy include in a termination message?
887. 887. Where in a Pod's YAML does a container's termination message appear after it exits?
888. 888. A Pod shows the status Init:1/3. What does that mean?
889. 889. Which two Pod statuses indicate that all init containers have finished? Choose two.
890. 890. A StatefulSet Pod has sat in Terminating for hours after its node failed. What does the documentation direct you to?
891. 891. Which two kubelet settings govern container log rotation, and what are their defaults? Choose two.
892. 892. A Pod has written 40 MiB of logs on a node rotating at 10 MiB. How much can kubectl logs return?
893. 893. A Pod is evicted from a node. What becomes of its container logs on that node?
894. 894. You need the kubelet's own logs on a systemd node. Which command reads them?
895. 895. Under which directory does the kubelet have the container runtime write container logs by default?
896. 896. Which two components do not run inside containers on a typical node? Choose two.
897. 897. Kubernetes provides no cluster-level logging of its own. Which two of the following are documented approaches? Choose two.
898. 898. Which workload object suits a node-level logging agent, and why?
899. 899. An application writes its logs to a file rather than stdout, and the cluster has a node-level agent. What does a streaming sidecar achieve?
900. 900. kubectl top node returns "Metrics API not available". What is missing?
901. 901. A team wants an HPA to scale on request rate. What does the Metrics API alone provide?
902. 902. Which component collects per-container resource metrics before the kubelet exposes them?
903. 903. A cluster uses a virtualisation-based container runtime, and kubectl top pod reports nothing for its Pods. What must the runtime provide?
904. 904. Node Problem Detector observes a kernel problem on a node. Which two forms can its report take? Choose two.
905. 905. The API server on a node is unreachable and you need to see what containers the runtime is actually running there. Which tool does that?
906. 906. Which two ways can crictl be told which runtime endpoint to use? Choose two.
907. 907. kubeadm init hangs after printing that it created the API client and is waiting for the control plane. Which two causes are named? Choose two.
908. 908. hostPort does not work in a cluster. Which capability does it depend on?
909. 909. Why do PodDisruptionBudgets take effect during a kubectl drain?
910. 910. A control plane node is drained. What happens to the mirror Pods for its static Pods?
911. 911. A drain refuses to proceed because of a Pod created directly with kubectl run and owned by no controller. Which flag allows it?
912. 912. A drain stops on Pods using emptyDir volumes. What does --delete-emptydir-data acknowledge?
913. 913. An operator adds --disable-eviction to a drain to get past a blocking PodDisruptionBudget. What is the consequence?
914. 914. kubectl drain has returned successfully. What does that signify?
915. 915. Which of these is a valid target for kubectl logs?
916. 916. You need logs from every container of every Pod labelled app=web. Which two flags does that call for? Choose two.
917. 917. kubectl top pod shows nothing for a Pod created thirty seconds ago. What is the likeliest reason?
918. 918. kubectl top pod reports one line for a Pod with three containers. Which flag breaks the usage out per container?
919. 919. kubectl top node shows 30% CPU used, while kubectl describe node reports 90% of CPU requested. Which statement reconciles the two?
920. 920. Which command follows new events for one Pod as they arrive?
921. 921. Where does kubectl explain get the field documentation it prints?
922. 922. kubectl rollout undo deployment/api is run with no other flags. Which revision does it restore?
923. 923. A pipeline runs kubectl rollout status to gate on one particular deployment. A colleague triggers another rollout meanwhile. What happens without extra flags?
924. 924. You want to know whether the ServiceAccount build-bot in namespace ci may create Pods in namespace prod. Which command answers that?
925. 925. A user's kubectl auth can-i --as=... command is refused. What permission are they missing?
926. 926. kubectl cluster-info dump is run with --output-directory. Which two things does it collect? Choose two.
927. 927. kubectl cluster-info dump is run with no namespace flags. Which namespaces does it cover?
928. 928. Which two things can kubectl wait be told to wait for? Choose two.
929. 929. How is a wait for a Pod's Ready condition to become false written?
930. 930. kubectl port-forward is run against a Deployment, and the Pod it selected is deleted during a rollout. What happens?
931. 931. You need kubectl port-forward to accept connections from another machine on port 8888, reaching container port 5000. Which two things are required? Choose two.
932. 932. kubectl cp into a distroless container fails. What is the cause, and what is the documented alternative?
933. 933. An auditor asks whether Kubernetes auditing would record someone reading a Secret file directly from a node's disk. What is the answer?
934. 934. Which audit stage is generated only for long-running requests such as a watch?
935. 935. An audit policy's first rule sets level None for a resource, and a later rule sets RequestResponse for the same resource. What is recorded?
936. 936. Which two statements about enabling API server auditing are correct? Choose two.
937. 937. An audit policy is configured but no audit records appear anywhere. Which flag is most likely missing?
938. 938. Auditing is configured on an API server running as a static Pod, and the records vanish on restart. What was forgotten?
939. 939. What operational cost does enabling API server auditing carry?
940. 940. A component is started with -v=0. What is logged?
941. 941. An operator looks for --log-file on a current Kubernetes component and cannot find it. What is the current behaviour?
942. 942. A component runs in a distroless container with no shell to redirect its output. Which helper handles that?
943. 943. Which two statements about the node log query feature are correct? Choose two.
944. 944. Why is granting get on nodes/proxy more dangerous than it looks?
945. 945. Which option is required on a node log query?
946. 946. A node log query is made for a service whose logs go to a file rather than journald. What does the kubelet do?
947. 947. kubectl version prints a client version but no server version. What does that indicate?
948. 948. An engineer has lost their kubeconfig but still has SSH access to a control plane node. Where can a working one be found?
949. 949. You suspect an expired certificate in a kubeconfig. Which two tools does the guide use to check? Choose two.
950. 950. kubectl returns a Forbidden error naming your username and the resource. Which area should you investigate?
951. 951. A Pod has an application container and a logging sidecar, in that order. kubectl exec is run with no -c. Which container does the command run in?
952. 952. An HPA must scale on a queue depth rather than CPU. Which two APIs can an adapter serve to make that possible? Choose two.
953. 953. Which monitoring platform does Kubernetes recommend?
954. 954. After finishing with a node debug session, what does the documentation remind you to do?
955. 955. Telepresence is used to debug a Service locally. What does the local process get access to?
956. 956. From inside a node debug Pod, which two paths hold logs worth reading? Choose two.
957. 957. A node debug Pod's /host does not show the whole machine's filesystem. What would explain that?
958. 958. Which command shows which container runtime each node is using?
959. 959. A containerd log shows "incompatible CNI versions; config is 1.0.0, plugin supports ...". What is wrong?
960. 960. Pods start normally but cannot be stopped, and the runtime reports "invalid version: the version is empty" from StopPodSandbox. What is missing?
961. 961. A control plane component does not expose /metrics for scraping. Which flag opens it?
962. 962. Besides /metrics, which two endpoints does the kubelet serve? Choose two.
963. 963. A Prometheus ServiceAccount is refused when scraping component metrics on an RBAC cluster. Which rule does its ClusterRole need?
964. 964. kubectl describe pod web is run in a namespace holding web-abc and web-def but no Pod named exactly web. What happens?
965. 965. A colleague insists a Deployment exists, but kubectl get deployments returns nothing. What is the most likely explanation?
966. 966. Two API groups both serve a resource named events, and kubectl get events is ambiguous. How is one addressed unambiguously?
967. 967. kubectl debug behaves differently depending on its target. Which two actions can it take? Choose two.
968. 968. What makes an ephemeral container suitable for investigating a Pod that is misbehaving right now?
969. 969. A deployment script runs kubectl diff before applying. Which exit code means changes are pending?
970. 970. An object was created with plain kubectl create and later applies behave unexpectedly. What was missing?
971. 971. kubectl create secret generic tls-bundle --from-file=/certs/server.pem is run. What key is created?
972. 972. A ConfigMap is created from a directory containing regular files, a subdirectory and a symlink. What is packaged?
973. 973. How is a ReplicaSet, served by the apps group, written in kubectl create role --resource?
974. 974. A Role must allow reading Pods and their status subresource. How are both named to kubectl create role?
975. 975. How is the ServiceAccount sa-dev in namespace monitoring named as a subject to kubectl create rolebinding?
976. 976. Why does kubectl create clusterrolebinding accept only --clusterrole and not --role?
977. 977. How is every container of a DaemonSet updated to one image in a single kubectl set image command?
978. 978. A node is uncordoned after maintenance. What happens to the Pods that were drained off it?
979. 979. A Pod is deleted with default settings. What signal does its main process receive first, and how long before SIGKILL?
980. 980. A container has a preStop hook that takes 45 seconds and terminationGracePeriodSeconds left at its default. What happens?
981. 981. A preStop hook is still running as the termination grace period ends. What does the kubelet do?
982. 982. Which two flags together force-delete a Pod from the API server? Choose two.
983. 983. Why is force-deleting a StatefulSet Pod treated as dangerous?
984. 984. A Pod is terminating gracefully. What happens to its entry in the Service's EndpointSlice?
985. 985. A Pod has two sidecar containers and one main container. Which two statements describe shutdown? Choose two.
986. 986. An application requires its cache container to stop before its API container. What does Kubernetes offer?
987. 987. You need to alert on Pods stuck in a Terminating state for more than five minutes. Which component exposes the metrics for that?
988. 988. How does kube-state-metrics obtain the information it publishes?
989. 989. kubectl reports "x509: certificate signed by unknown authority". Which cause does the kubeadm guide name first?
990. 990. The API server logs "x509: certificate has expired" for one node. Which kubeadm mechanism has failed?
991. 991. A node has /var/lib/kubelet on a separate mounted filesystem, and kubeadm reset is run. What must be done afterwards?
992. 992. kubeadm upgrade plan prints "context deadline exceeded" on a cluster with external etcd. What should be done?
993. 993. Graceful node shutdown appears to do nothing on a node. Which two settings must both be non-zero? Choose two.
994. 994. A node has shutdownGracePeriod 30s and shutdownGracePeriodCriticalPods 10s. How is the window divided?
995. 995. During a graceful node shutdown, why can a Pod tolerating node.kubernetes.io/not-ready:NoSchedule still not start there?
996. 996. A node is powered off abruptly and a StatefulSet Pod stays Terminating while its replacement cannot start. What is holding the replacement?
997. 997. The node.kubernetes.io/out-of-service taint is applied to a node confirmed powered off. Which two things follow? Choose two.
998. 998. What must be verified before applying the out-of-service taint to a node?
999. 999. After how long does Kubernetes force-detach a volume from a node where a Pod deletion has not succeeded and the node is unhealthy?
1000. 1000. A node configures shutdownGracePeriodByPodPriority with bands at 100000, 1000 and 0, but no Pod has a priority in the highest band. What happens at shutdown?