1. Home
2. All questions
3. Installation

CKA study material: Installation

98 questions of the 1000 in the CKA — Certified Kubernetes Administrator quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 43. What are the stated minimum resources for a kubeadm control-plane machine? Choose two.
2. 44. Which values must be unique across every node in a kubeadm cluster? Choose two.
3. 45. Two cloned virtual machines fail to join a cluster as distinct nodes. Which file would you read to confirm the cause?
4. 46. Why can kubeadm fail to run on a lightweight distribution such as Alpine Linux?
5. 47. Which kubeadm preflight check fails when a node runs an unsupported kernel version?
6. 48. A kubelet refuses to start on a node that has swap enabled. Which configuration change lets it start?
7. 49. After setting failSwapOn to false, workloads still get no swap. What else must change?
8. 50. An administrator runs swapoff -a but swap returns after a reboot. Which two statements explain and fix this? Choose two.
9. 51. kubeadm init stops with an error because it detected more than one container runtime. Which flag resolves this?
10. 52. Which statement about kubeadm and version skew is correct?
11. 53. How do Kubernetes components choose the address they advertise on a multi-homed host?
12. 54. Which flag sets the shared endpoint that every control-plane node in a cluster answers on?
13. 55. Which two statements about --control-plane-endpoint are correct? Choose two.
14. 56. Why does changing a control-plane component's IP address require re-issuing certificates?
15. 57. What does kubeadm init do before it downloads and installs the control-plane components?
16. 58. An administrator wants to run kubeadm init again on a node that already initialised a cluster. What must happen first?
17. 59. Which two steps give a non-root user kubectl access after kubeadm init? Choose two.
18. 60. Which group does the certificate inside kubeadm's super-admin.conf belong to?
19. 61. Why is the bootstrap token printed by kubeadm init treated as a secret?
20. 62. Straight after kubeadm init, the CoreDNS Pods sit in Pending and never start. What is the expected cause?
21. 63. What must be true of the Pod network CIDR chosen for a cluster?
22. 64. Why must a Pod network add-on and its manifests support RBAC in a kubeadm cluster?
23. 65. How many Pod networks may be installed in one cluster?
24. 66. Which admission controller does kubeadm enable by default to limit what labels a kubelet may give itself?
25. 67. What does a successful kubectl drain guarantee before it returns? Choose two.
26. 68. kubectl drain will not complete on a node running DaemonSet Pods. Which flag lets it finish?
27. 69. Maintenance is finished on a drained node but no new Pods are scheduled to it. What was forgotten?
28. 70. A Pod keeps running on a node that has been drained and marked unschedulable. What explains this?
29. 71. Two drains run in parallel against different nodes hosting one StatefulSet. What limits how many Pods go down at once?
30. 72. How many minor versions may a kubeadm cluster move in a single upgrade?
31. 73. What is the documented order for upgrading a kubeadm cluster?
32. 74. Why should application state still be backed up before a kubeadm upgrade?
33. 75. Before upgrading a kubelet across a minor version, what must be done to the node?
34. 76. Why does every container restart after a kubeadm upgrade?
35. 77. An administrator wants to change cluster configuration as part of an upgrade. What does kubeadm support?
36. 78. During an upgrade that replaces the etcd static Pod, in-flight API requests stall. What is suggested to limit the disruption?
37. 79. Which two topologies does kubeadm document for a highly available control plane? Choose two.
38. 80. Why is an odd number of control-plane nodes preferred in a highly available cluster?
39. 81. Which registry must every host in a kubeadm cluster reach, unless the images are supplied another way?
40. 82. Upgrading across a minor version with the community packages requires which extra step?
41. 83. Which two statements about cgroup drivers in a kubeadm cluster are correct? Choose two.
42. 84. Which kernel setting commonly has to be enabled by hand before cluster networking works?
43. 406. kubeadm init hangs waiting for the control plane. Which two causes are most common?
44. 407. Which Pod is expected to be Pending immediately after kubeadm init?
45. 410. Passing an admission-plugin list through --apiserver-extra-args fails with a malformed pair error. Why?
46. 506. An administrator wants to create Node objects by hand rather than letting machines add themselves. Which kubelet setting achieves that?
47. 525. Three control plane nodes each run kube-scheduler, yet only one is making scheduling decisions. What arranges that?
48. 543. A cluster was built with a single control plane node and no --control-plane-endpoint. The team now wants to add two more control plane nodes for high availability. What does kubeadm support?
49. 544. During kubeadm init, which flag sets the single address that every control plane node in the cluster will answer on?
50. 545. An engineer installs a CNI plugin whose manifest assumes 10.244.0.0/16, but Pods never get addresses in that range. What was most likely missed at kubeadm init?
51. 546. A node has both containerd and CRI-O installed, and kubeadm join fails while trying to detect the runtime. Which flag resolves the ambiguity?
52. 547. Immediately after a successful kubeadm init, the CoreDNS Pods sit in Pending. What is the expected explanation?
53. 548. You are choosing a Pod CIDR for a new cluster. Which two statements are correct? Choose two.
54. 549. A new operator asks for a copy of admin.conf from a kubeadm cluster so they can run kubectl. What does that file grant?
55. 550. Which kubeadm-generated kubeconfig holds an identity that skips the authorization layer, RBAC included?
56. 551. A colleague pastes the full kubeadm join command, bootstrap token and all, into a public chat. What is the immediate risk?
57. 552. On a single-machine kubeadm cluster, ordinary workloads stay Pending. Which action lets them run?
58. 553. A kubelet is started with --node-labels=node-role.kubernetes.io/worker= and the node never appears in kubectl get nodes. What happened?
59. 554. How should a restricted label such as node-role.kubernetes.io/worker be applied to a node in a kubeadm cluster?
60. 555. You are decommissioning a worker node cleanly. Which two steps belong to the documented procedure, before the Node object is deleted? Choose two.
61. 556. After running kubeadm reset you plan to reuse the machine as a worker in a different cluster. What does reset leave behind?
62. 557. A kubeadm binary at v1.35 is used to build a new cluster. Which control plane versions may it deploy?
63. 558. With kubeadm at v1.35, how far behind may the kubelet on a host be?
64. 559. You are writing a backup job for a single-control-plane kubeadm cluster. Which directory on that node holds the etcd data?
65. 560. A control plane component exits with an error on a freshly provisioned host that has no default route configured. What is the likely cause?
66. 561. An administrator changes a control plane node's IP address after the cluster is built. What else must be done?
67. 562. kubeadm init prints several preflight WARNING lines and then continues. What does this tell you?
68. 563. You run kubeadm join --control-plane on a second machine without any extra etcd configuration. What happens to etcd?
69. 564. A team plans a highly available cluster with stacked etcd. What is the minimum number of control plane nodes?
70. 565. How many machines does the external etcd topology require, at a minimum, compared with the stacked one?
71. 566. In an external etcd topology, which statement describes the communication pattern?
72. 567. A kubeadm cluster has been running for eleven months and you want to know how much life its certificates have left. Which command reports that?
73. 568. An organisation wants kubeadm to sign cluster certificates with its own existing CA. What is the procedure?
74. 569. Which two kubeadm ClusterConfiguration fields change how long its certificates remain valid? Choose two.
75. 570. kubeadm finds ca.crt in its PKI directory but no ca.key. What does it do?
76. 571. A kubelet refuses to start on a node that has swap enabled. Which setting allows it to start anyway?
77. 572. Nodes cloned from a single virtual machine template fail to join a cluster correctly. Which two attributes must be unique per node? Choose two.
78. 573. Which kubeadm preflight check fails when a node runs a kernel version the project does not support?
79. 574. A cluster running v1.33 needs to reach v1.35. What does kubeadm support?
80. 575. You are upgrading the kubelet on a control plane node across a minor version. Why must that node be drained first?
81. 576. After a kubeadm upgrade, every container on the upgraded nodes has restarted. Why?
82. 577. An administrator wants to change an API server flag while also upgrading the cluster. What does kubeadm upgrade offer?
83. 578. During a kubeadm upgrade that also restarts etcd, in-flight API requests stall. Which mitigation is documented?
84. 579. An etcd cluster has lost quorum and cannot elect a leader. What is the effect on the Kubernetes cluster?
85. 580. You need to defragment an etcd database and verify a snapshot file offline. Which tool is intended for that?
86. 581. What is the effect of running etcdctl snapshot save against a live etcd member?
87. 582. You are restricting an etcd cluster so that only the API servers may talk to it. Which two etcd settings accomplish that? Choose two.
88. 583. You are starting a replacement etcd member after removing a failed one. Which environment variable value is required?
89. 584. A node runs containerd configured with the systemd cgroup driver, but the kubelet was left at its default. What must be changed?
90. 752. An engineer proposes a Pod CIDR that partially overlaps the Service CIDR to save address space. Why is this rejected?
91. 754. You are writing firewall rules for a control plane node. Which two inbound ports are needed by default? Choose two.
92. 755. Which protocols must be permitted for the NodePort range on a worker node?
93. 799. A cluster's API server is reached on port 443 rather than 6443. What does that tell you?
94. 907. kubeadm init hangs after printing that it created the API client and is waiting for the control plane. Which two causes are named? Choose two.
95. 938. Auditing is configured on an API server running as a static Pod, and the records vanish on restart. What was forgotten?
96. 990. The API server logs "x509: certificate has expired" for one node. Which kubeadm mechanism has failed?
97. 991. A node has /var/lib/kubelet on a separate mounted filesystem, and kubeadm reset is run. What must be done afterwards?
98. 992. kubeadm upgrade plan prints "context deadline exceeded" on a cluster with external etcd. What should be done?