Study. uk . com
  1. Home
  2. All questions
  3. Configuration

CKA study material: Configuration

95 questions of the 1000 in the CKA — Certified Kubernetes Administrator quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

  1. 85. An existing organisational CA is placed in /etc/kubernetes/pki before kubeadm init runs. What does kubeadm do?
  2. 86. Which directory does kubeadm use for cluster certificates by default?
  3. 87. What are the default certificate lifetimes in a kubeadm cluster? Choose two.
  4. 88. Which key algorithm does kubeadm use by default when generating certificates?
  5. 89. An administrator supplies ca.crt but deliberately withholds ca.key. What does kubeadm do?
  6. 90. Which files are shared between control-plane nodes and so generated once and distributed?
  7. 91. What is the documented size limit for the data held in one ConfigMap?
  8. 92. Which two fields does a ConfigMap carry instead of a spec? Choose two.
  9. 93. An application should not see later edits to its ConfigMap. Which setting enforces that?
  10. 94. A Pod cannot reference a ConfigMap held in another namespace. Which approach still reaches it?
  11. 95. Which statement about a static Pod and ConfigMaps is correct?
  12. 96. Which two statements about how Secrets are stored are correct? Choose two.
  13. 97. Why does the ability to create a Deployment in a namespace effectively grant read access to that namespace's Secrets?
  14. 98. Which mechanisms are built on Secret objects? Choose two.
  15. 99. A Secret is mounted as a volume and one of its keys begins with a dot. What is the effect inside the container?
  16. 100. Since which kubectl version has Kustomize been supported natively?
  17. 101. Which two commands work with a kustomization directory? Choose two.
  18. 102. A Deployment references a ConfigMap built by configMapGenerator. Why does editing the source file trigger a rollout? Choose two.
  19. 103. In configMapGenerator, what is the difference between listing a file under files and under envs?
  20. 104. What does installing a Helm chart create?
  21. 105. helm install returns successfully. What can be concluded about the application?
  22. 106. A chart is installed with both --values and --set supplying the same key. Which wins?
  23. 107. Where does Helm persist the values supplied with --set for a release?
  24. 108. Which command clears values that were previously applied with --set?
  25. 109. In Helm's --set syntax, what does a comma separate?
  26. 110. How does helm upgrade treat a chart whose templates are largely unchanged?
  27. 111. Which two statements about Helm release revisions are correct? Choose two.
  28. 112. Which Helm flag makes the command wait until Pods are ready, PVCs are bound and Services have addresses?
  29. 113. What is the default value of Helm's --timeout flag?
  30. 114. A release is removed with helm uninstall and no record of it remains. Which flag would have kept one?
  31. 115. An engineer is offline and wants to find a chart. Which search still works?
  32. 116. Which directories does Helm reserve inside a chart? Choose two.
  33. 117. Which fields are required in a chart's Chart.yaml? Choose two.
  34. 118. How can a subchart be switched off without editing the parent chart?
  35. 119. Which command downloads a published chart for inspection without installing it?
  36. 120. Which kinds are cluster-scoped and therefore outside any namespace? Choose two.
  37. 121. Which namespace holds the Lease objects that carry node heartbeats?
  38. 122. Which initial namespace is readable by all clients, including unauthenticated ones?
  39. 123. A team wants to run two versions of one application side by side. What does the documentation recommend?
  40. 124. Which command fixes the namespace for all later kubectl commands in the current context?
  41. 125. Why must every namespace name be a valid RFC 1123 DNS label?
  42. 332. Where do the contents of a mounted Secret volume live on the node?
  43. 499. Where does kubeadm keep the cluster-wide kubelet configuration?
  44. 500. A kubelet configuration change must take effect on a node. Which steps apply? Choose two.
  45. 585. A user has read access to Secrets in a namespace through a broad ClusterRole, and you want to take just that one permission away. What does RBAC allow?
  46. 586. A RoleBinding in namespace dev references a ClusterRole that grants read access to Secrets. What can the subject read?
  47. 587. You try to edit a RoleBinding to point at a different Role and the API server rejects it. What is the correct procedure?
  48. 588. A Role grants get and list on pods, but a user running kubectl logs is refused. What does the Role need?
  49. 589. An administrator writes a Role with resourceNames set, hoping to allow creating only a ConfigMap with a particular name. Why does this not work?
  50. 590. A user has list on configmaps restricted by resourceNames to my-config, yet plain kubectl get configmaps is denied. What must they do?
  51. 591. You want a RoleBinding to cover every ServiceAccount in the qa namespace. Which subject expresses that?
  52. 592. Why does the built-in view ClusterRole exclude Secrets?
  53. 593. A developer is granted the edit role in a namespace. Which two capabilities does that actually give them? Choose two.
  54. 594. What does binding the cluster-admin ClusterRole through a RoleBinding, rather than a ClusterRoleBinding, grant?
  55. 595. An operator removes a permission from the system:discovery ClusterRole, and after the next control plane restart the permission is back. What explains this?
  56. 596. A namespace administrator who cannot list Secrets cluster-wide tries to create a ClusterRole granting that permission. What happens?
  57. 597. You want a team lead to be able to grant the admin, edit and view roles in their own namespace without holding those permissions themselves. Which verb makes that possible?
  58. 598. An aggregated ClusterRole has an aggregationRule and rules that an operator wrote by hand. What becomes of those hand-written rules?
  59. 599. You have added a CustomResourceDefinition and want read access to it included in the built-in view role. What is the documented approach?
  60. 600. Why is a rule with resources: ["*"] and verbs: ["*"] considered risky even when it currently grants only what is intended?
  61. 601. A security review asks how Secrets could be read in a cluster with no special hardening. Which two statements are accurate? Choose two.
  62. 602. A Secret manifest sets the key password under both data and stringData. Which value ends up stored?
  63. 603. An application team wants to store a 4 MiB certificate bundle in a single Secret. What stops them?
  64. 604. Which Secret type holds the credentials the kubelet uses to pull images from a private registry?
  65. 605. A Pod references a Secret that does not exist yet. What happens by default?
  66. 606. An operator updates a Secret, and one container picks up the new value while another, mounting the same Secret, does not. What most likely differs?
  67. 607. A Secret contains a key named app.config.value, and a Pod maps every key into environment variables. What happens?
  68. 608. A static Pod manifest on a node references a ConfigMap, and the value never arrives. Why?
  69. 609. A ConfigMap was marked immutable and now needs a changed value. What is required?
  70. 610. A cluster with tens of thousands of Secret-to-Pod mounts is straining its API server. Which change reduces that load?
  71. 611. A Role grants list and watch on secrets in a namespace, intending to cover only the Secrets a controller's Pods use. What does it actually grant?
  72. 612. A workload runs with privileged: true. What can it read regardless of RBAC?
  73. 613. A namespace needs both a ceiling on total CPU consumption and a cap on what any single Pod may request. Which two objects provide these? Choose two.
  74. 614. In what order does the LimitRange admission controller act on a new Pod?
  75. 615. An administrator tightens a LimitRange in a namespace where twenty Pods are already running. What happens to those Pods?
  76. 616. A namespace has a LimitRange whose default CPU limit is 500m. A Pod is submitted with a CPU request of 700m and no limit, and it never schedules. Why?
  77. 617. A namespace has a ResourceQuota covering requests.cpu. A developer submits a Pod with no CPU request or limit at all. What is the likely outcome?
  78. 618. A Deployment is applied successfully into a namespace with a tight ResourceQuota, but only two of its five replicas appear. Where does the explanation show up?
  79. 619. In a ResourceQuota, what does a bare memory entry constrain?
  80. 620. A namespace should be limited to four GPUs of the extended resource nvidia.com/gpu. Which quota entry is valid?
  81. 621. How do the three Pod Security Standards relate to one another?
  82. 622. You want a namespace to reject Pods that break the restricted profile, while also recording near-misses without blocking them. Which two Pod Security modes do you configure? Choose two.
  83. 623. A namespace enforces the restricted Pod Security level. A Deployment whose template violates it is applied. What happens?
  84. 624. A user is added to the Pod Security exemption list by username, but their Deployment's Pods are still rejected. Why?
  85. 625. An engineer sets KUBECONFIG to two file paths separated by a colon on Linux. What does kubectl do?
  86. 832. A projected volume combines a Secret from another namespace with a ConfigMap from the Pod's own. What is the problem?
  87. 844. A namespace has a quota on ephemeral-storage, but a Pod consuming a great deal of scratch space is admitted anyway. What explains it?
  88. 924. You want to know whether the ServiceAccount build-bot in namespace ci may create Pods in namespace prod. Which command answers that?
  89. 948. An engineer has lost their kubeconfig but still has SSH access to a control plane node. Where can a working one be found?
  90. 971. kubectl create secret generic tls-bundle --from-file=/certs/server.pem is run. What key is created?
  91. 972. A ConfigMap is created from a directory containing regular files, a subdirectory and a symlink. What is packaged?
  92. 973. How is a ReplicaSet, served by the apps group, written in kubectl create role --resource?
  93. 974. A Role must allow reading Pods and their status subresource. How are both named to kubectl create role?
  94. 975. How is the ServiceAccount sa-dev in namespace monitoring named as a subject to kubectl create rolebinding?
  95. 976. Why does kubectl create clusterrolebinding accept only --clusterrole and not --role?