1. Home
2. All questions
3. Troubleshooting

CKA study material: Troubleshooting

418 questions of the 1000 in the CKA — Certified Kubernetes Administrator quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 162. What is a liveness probe for?
2. 177. How does the runtime treat a container that exceeds its limits? Choose two.
3. 196. A Deployment requesting more than the namespace quota allows is applied. What happens?
4. 199. An object violating a LimitRange is submitted. What does the API server return?
5. 238. A Service sets loadBalancerClass but no load balancer is ever provisioned. What is the likely cause?
6. 248. A Service's cluster IP cannot be pinged, though the Service works. Why?
7. 249. A newly created Service has no endpoints and connections to it fail. What should be checked first?
8. 262. A NetworkPolicy is applied successfully but traffic is not restricted at all. What is the likeliest cause?
9. 276. A hostNetwork Pod with dnsPolicy ClusterFirst cannot resolve Service names. What should be set?
10. 288. Which record type does cluster DNS use for reverse lookups of Pod and Service addresses?
11. 291. A load balancer's health check targets a node port and fails. Which kube-proxy port serves health checks?
12. 336. A downward API volume mounted through subPath stops reflecting a changed field value. Why?
13. 350. A PVC has been Pending for some time. Which explanations are consistent with that?
14. 351. What is the first command to run against a Pod that is not behaving correctly?
15. 352. A Pod is stuck in Pending. What does that state tell you?
16. 353. Which remedies are suggested for a Pod pending through insufficient resources? Choose two.
17. 354. A Deployment using hostPort cannot schedule beyond a handful of replicas. Why?
18. 355. A Pod is stuck in Waiting. What does that indicate?
19. 356. A Pod stays in Waiting because of the image. What should be checked? Choose two.
20. 357. A Pod has been Terminating for a long time. Which two statements describe the usual cause? Choose two.
21. 358. Which objects should be inspected when diagnosing a Pod stuck in Terminating? Choose two.
22. 359. A Pod runs but ignores the command in its manifest. What is the likeliest explanation?
23. 360. Which flag makes kubectl apply report an unknown field in a manifest?
24. 361. What are the first two steps in debugging a cluster? Choose two.
25. 362. A node's conditions all read Unknown with reason NodeStatusUnknown. What does that mean?
26. 363. Which taints does an unreachable node carry? Choose two.
27. 364. How long does a node stay NotReady before its Pods are evicted?
28. 365. Which field shows most directly when a kubelet last reported in?
29. 366. kubectl describe node shows both Capacity and Allocatable. What is the difference?
30. 367. Which two statements about kubectl logs are correct? Choose two.
31. 368. When may the -c flag be omitted from kubectl logs or kubectl exec?
32. 369. kubectl exec fails on a distroless image with no shell. What is the alternative?
33. 370. Which kubectl debug flag joins the process namespace of a named container?
34. 371. A Pod crashes on startup, so there is nothing to exec into. Which approach helps?
35. 372. What does --share-processes do when copying a Pod for debugging?
36. 373. Which command opens a shell on a node when no Pod on it is usable?
37. 374. What should be done with a Pod created by kubectl debug --copy-to once the investigation is over?
38. 375. Which are valid container states? Choose two.
39. 376. A container shows State Waiting with reason CrashLoopBackOff. Where is the reason it died?
40. 377. Which field in kubectl describe pod most directly signals a crash loop?
41. 378. A container has no readiness probe configured. How is it treated?
42. 379. What does a Pod's Ready condition determine?
43. 380. In an event listing, what do the From, Reason and Message columns tell you? Choose two.
44. 381. Why might a Pod fail to schedule anywhere? Choose two.
45. 382. Why is a node's schedulable headroom smaller than its machine size suggests?
46. 383. Where can a container write a message explaining a fatal event so tools can surface it?
47. 384. Which command reads a container's termination message back?
48. 385. Which check comes first when a Service cannot be reached?
49. 386. Which test distinguishes a DNS fault from a proxying fault for a Service?
50. 387. A Service resolves but returns nothing. Which misconfigurations are likely? Choose two.
51. 388. A Service uses a named targetPort but no traffic arrives. What must be true of the Pods?
52. 389. A Service has no EndpointSlices at all. What does that point to?
53. 390. How is it proved that the application itself is serving, independently of the Service?
54. 391. A Service is defined correctly and has endpoints, yet traffic still fails. Which policy object should be reviewed?
55. 392. How are kube-proxy's logs found on a node? Choose two.
56. 393. Which component rotates container logs and owns the log directory layout?
57. 394. What are the kubelet's default container log rotation settings? Choose two.
58. 395. An engineer cannot find log output from several hours ago with kubectl logs. Why?
59. 396. Which components do not run in containers? Choose two.
60. 397. Why can the API server's logs be read with kubectl logs in a kubeadm cluster?
61. 398. Where are container logs written on a node? Choose two.
62. 399. Why is putting the Pod log directory on a filesystem separate from /var risky?
63. 400. Which are documented patterns for cluster-level logging? Choose two.
64. 401. Which pipeline supplies the data behind kubectl top?
65. 402. kubectl top returns no data at all in a new cluster. What is the likeliest cause?
66. 403. Why is metrics-server unsuitable as a monitoring system of record?
67. 404. How does metrics-server obtain usage figures? Choose two.
68. 405. An HPA must scale on a metric other than CPU or memory. What is required?
69. 406. kubeadm init hangs waiting for the control plane. Which two causes are most common?
70. 407. Which Pod is expected to be Pending immediately after kubeadm init?
71. 408. An x509 error says the certificate is signed by an unknown authority. Where should you look?
72. 409. Kubelet client-certificate rotation has failed on a node. Which recovery steps apply? Choose two.
73. 410. Passing an admission-plugin list through --apiserver-extra-args fails with a malformed pair error. Why?
74. 411. kube-proxy logs a failure to retrieve the node IP and falls back to 127.0.0.1. What happened?
75. 412. Which tool inspects containers directly on a node when the API server cannot help?
76. 413. How can crictl's endpoint be configured? Choose two.
77. 414. Why is it worth setting crictl's endpoint explicitly?
78. 415. Why can crictl show a container that kubectl cannot?
79. 416. In what two ways does a node report its health? Choose two.
80. 417. Which settings govern node heartbeat timing? Choose two.
81. 418. What is the default rate at which the node controller evicts Pods from failed nodes?
82. 419. An entire availability zone goes unhealthy in a 30-node cluster. What does the node controller do?
83. 420. What else does the node controller do besides watching health? Choose two.
84. 421. A kubelet is restarted with new --node-labels but the labels do not appear. Why?
85. 422. Under Node authorization with NodeRestriction, what may a kubelet modify?
86. 423. What is a node's role in Kubernetes, technically speaking?
87. 424. What is the default restartPolicy for a Pod?
88. 425. A container exits with status 0 under restartPolicy Always. What happens?
89. 426. Why must batch work run as a Job rather than a Deployment?
90. 427. A sidecar container keeps restarting even though the Pod's restartPolicy is OnFailure. Why?
91. 428. A container has crash-looped for an hour, then runs successfully for a long stretch and crashes again. What is the restart delay?
92. 429. Which conditions does the kubelet maintain on a Pod? Choose two.
93. 430. A Pod never gets past PodReadyToStartContainers. What does that point to?
94. 431. What signal does the kubelet send first when a Pod is deleted?
95. 432. What is the default terminationGracePeriodSeconds?
96. 433. A Pod is deleted with terminationGracePeriodSeconds set to 0. What happens to its preStop hook?
97. 434. How do init containers behave? Choose two.
98. 435. An init container never starts and the Pod sits in Pending. What does that suggest?
99. 436. A Pod's restartPolicy is Always. How are its init containers treated on failure?
100. 437. A Pod with restartPolicy Never has an init container that exits with an error. What is the outcome?
101. 438. Which fields do regular init containers not support? Choose two.
102. 439. Where is an init container's status reported?
103. 440. A Pod restarts after a node problem. What happens to its init containers?
104. 441. A Pod shows status Init:1/2. What does that mean?
105. 442. How are an init container's logs read?
106. 443. What makes a Pod a static Pod?
107. 444. How does the kubelet treat files in the static Pod directory? Choose two.
108. 445. An administrator copies kube-apiserver.yaml to kube-apiserver.yaml.backup inside the manifests directory. What happens?
109. 446. How does a static Pod become visible to kubectl get pods?
110. 447. A mirror Pod is deleted with kubectl. Which two things happen? Choose two.
111. 448. The API server is down in a kubeadm cluster. How can its container be inspected?
112. 449. How is a Kubernetes component's log verbosity changed?
113. 450. Why is parsing Kubernetes component logs fragile? Choose two.
114. 451. Why is an etcd snapshot the backup that matters most for a cluster?
115. 452. Which command writes an etcd snapshot from a running member?
116. 453. What effect does taking an etcd snapshot have on the member serving it?
117. 454. Why should etcd snapshot files be encrypted?
118. 455. Which environment variable must be set for the etcdctl commands used for snapshots?
119. 456. Which etcdctl operations are deprecated in favour of etcdutl? Choose two.
120. 457. What must happen before restoring etcd in a running cluster?
121. 458. An administrator restores a snapshot into the same data directory as before. What must be done first?
122. 459. A restore uses a new data directory. Which file must be edited so etcd uses it?
123. 460. Several etcd members have failed. Which two statements describe how they are replaced? Choose two.
124. 461. What does scaling out an etcd cluster achieve? Choose two.
125. 462. What etcd cluster size is recommended for production Kubernetes at any supported scale?
126. 463. Which are involuntary disruptions? Choose two.
127. 464. What can a PodDisruptionBudget not protect against?
128. 465. How may a PodDisruptionBudget be expressed? Choose two.
129. 466. kubectl drain appears to hang on a node. What is a likely explanation?
130. 467. Which tool turns node-level faults into Node conditions or Events?
131. 468. Node Problem Detector does not recognise a node's kernel messages. Why?
132. 469. Which command reveals which cluster kubectl is currently talking to?
133. 470. Which flag puts kubectl get events into chronological order?
134. 471. Which command narrows the event stream to warnings?
135. 472. Which command lists Pods ordered by how often they have restarted?
136. 473. Which mechanism filters a listing server-side on an object field?
137. 474. A jsonpath expression must read the key ca.crt from a Secret. What is required?
138. 475. Which command prints the documentation for a manifest's fields?
139. 476. A namespaced query returns nothing for a kind. Which command confirms it is cluster-scoped?
140. 477. What does kubectl api-resources report for each resource type? Choose two.
141. 478. Which command produces a valid manifest skeleton without creating anything?
142. 479. Which kubectl rollout subcommands do what? Choose two.
143. 480. How is a Deployment's Pods replaced without changing its spec?
144. 481. What is the risk of kubectl replace --force compared with kubectl apply?
145. 482. Which command compares a manifest against the live cluster before applying it?
146. 483. How do kubectl cordon and kubectl drain differ? Choose two.
147. 484. Which flag breaks kubectl top pod down by container?
148. 485. How is the whole cluster's state captured into a directory for offline analysis?
149. 486. kubectl cp fails against a container. What is the most likely missing dependency?
150. 487. How are logs pulled through a Deployment rather than a named Pod?
151. 488. What can kubectl port-forward target? Choose two.
152. 489. An engineer runs kubectl port-forward and the terminal appears to hang. What is happening?
153. 490. A colleague cannot reach a port-forwarded application from another machine. Why?
154. 491. Port-forwarding to a Service is used to test load balancing, but every request hits one Pod. Why?
155. 492. Which command opens a shell on a node that cannot be reached over SSH?
156. 493. Where does a node debugging Pod see the node's root filesystem?
157. 494. On a typical Linux node, where do these logs live? Choose two.
158. 495. A node debugging session lacks tcpdump. What explains this?
159. 496. Prometheus cannot scrape a component's /metrics endpoint under RBAC. What is needed?
160. 497. Which additional metrics endpoints does the kubelet serve? Choose two.
161. 498. Which guarantee does a stable metric carry?
162. 499. Where does kubeadm keep the cluster-wide kubelet configuration?
163. 500. A kubelet configuration change must take effect on a node. Which steps apply? Choose two.
164. 508. An operator edits a node's systemd unit to add a new value to --node-labels and restarts the kubelet, but the label never appears on the Node object. What explains this?
165. 513. A worker node's network link fails and it stops answering the control plane. What does the node controller write to that Node's Ready condition?
166. 518. Every zone in a large multi-zone cluster reports unhealthy at the same moment. How does the node controller behave?
167. 530. A ConfigMap in namespace app-a carries an ownerReference naming a Deployment in namespace app-b. What becomes of the ConfigMap?
168. 531. Objects are disappearing unexpectedly and you suspect malformed owner references. Which Event reason should you filter for?
169. 532. A node is running a cron job that prunes unused containers with the container runtime's own CLI. Why does the Kubernetes documentation warn against this?
170. 534. A node is configured with imageMaximumGCAge: 12h, but images that have been unused for a day are still present after a kubelet restart. Why?
171. 542. A misbehaving Pod is flooding the API server with requests, yet leader election and the built-in controllers keep working. Which feature accounts for that?
172. 547. Immediately after a successful kubeadm init, the CoreDNS Pods sit in Pending. What is the expected explanation?
173. 553. A kubelet is started with --node-labels=node-role.kubernetes.io/worker= and the node never appears in kubectl get nodes. What happened?
174. 559. You are writing a backup job for a single-control-plane kubeadm cluster. Which directory on that node holds the etcd data?
175. 560. A control plane component exits with an error on a freshly provisioned host that has no default route configured. What is the likely cause?
176. 567. A kubeadm cluster has been running for eleven months and you want to know how much life its certificates have left. Which command reports that?
177. 571. A kubelet refuses to start on a node that has swap enabled. Which setting allows it to start anyway?
178. 572. Nodes cloned from a single virtual machine template fail to join a cluster correctly. Which two attributes must be unique per node? Choose two.
179. 578. During a kubeadm upgrade that also restarts etcd, in-flight API requests stall. Which mitigation is documented?
180. 579. An etcd cluster has lost quorum and cannot elect a leader. What is the effect on the Kubernetes cluster?
181. 580. You need to defragment an etcd database and verify a snapshot file offline. Which tool is intended for that?
182. 583. You are starting a replacement etcd member after removing a failed one. Which environment variable value is required?
183. 584. A node runs containerd configured with the systemd cgroup driver, but the kubelet was left at its default. What must be changed?
184. 588. A Role grants get and list on pods, but a user running kubectl logs is refused. What does the Role need?
185. 590. A user has list on configmaps restricted by resourceNames to my-config, yet plain kubectl get configmaps is denied. What must they do?
186. 595. An operator removes a permission from the system:discovery ClusterRole, and after the next control plane restart the permission is back. What explains this?
187. 602. A Secret manifest sets the key password under both data and stringData. Which value ends up stored?
188. 605. A Pod references a Secret that does not exist yet. What happens by default?
189. 606. An operator updates a Secret, and one container picks up the new value while another, mounting the same Secret, does not. What most likely differs?
190. 607. A Secret contains a key named app.config.value, and a Pod maps every key into environment variables. What happens?
191. 608. A static Pod manifest on a node references a ConfigMap, and the value never arrives. Why?
192. 616. A namespace has a LimitRange whose default CPU limit is 500m. A Pod is submitted with a CPU request of 700m and no limit, and it never schedules. Why?
193. 617. A namespace has a ResourceQuota covering requests.cpu. A developer submits a Pod with no CPU request or limit at all. What is the likely outcome?
194. 618. A Deployment is applied successfully into a namespace with a tight ResourceQuota, but only two of its five replicas appear. Where does the explanation show up?
195. 623. A namespace enforces the restricted Pod Security level. A Deployment whose template violates it is applied. What happens?
196. 625. An engineer sets KUBECONFIG to two file paths separated by a colon on Linux. What does kubectl do?
197. 629. An engineer sets both maxUnavailable and maxSurge to 0 on a RollingUpdate Deployment. What is wrong with that?
198. 630. A Deployment's rollout stalls, and after ten minutes its Progressing condition turns False. What reason does the condition carry, and what does the controller do next?
199. 634. An operator finds eighteen ReplicaSets for a Deployment whose revisionHistoryLimit is 10. What explains the excess?
200. 637. Two Deployments in a namespace were written with the same label selector. What is the documented consequence?
201. 639. A StatefulSet is scaled from 1 to 3, but only web-0 and web-1 ever appear. web-1 is Running but never becomes Ready. Why is web-2 missing?
202. 650. A Job with default settings has a Pod that keeps failing. How many failures are tolerated before the Job is marked failed?
203. 653. A Job sets completions to 10 and parallelism to 50, but never more than a handful of Pods run at once near the end. Why?
204. 657. A CronJob with no startingDeadlineSeconds misses its 02:00 run because the controller was down until 05:00. What happens when the controller returns?
205. 659. A CronJob scheduled for 0 3 * * * fires at an unexpected wall-clock time after the control plane is moved to different hosts. What is the likely cause?
206. 668. A node has three taints and a Pod tolerates two of them; the untolerated one has effect NoSchedule. What is the outcome for a new Pod?
207. 677. A Pod spec has two topology spread constraints, both with topologyKey kubernetes.io/hostname and whenUnsatisfiable: DoNotSchedule. Why is this rejected?
208. 682. A Pod sets both a nodeSelector for disk=ssd and a required node affinity for zone in [a, b]. Which nodes are eligible?
209. 683. An inter-pod anti-affinity rule uses topology.kubernetes.io/zone as its topologyKey, but several nodes have no such label. What is the documented consequence?
210. 684. Which two of the following are default hard eviction thresholds on a Linux node? Choose two.
211. 686. A node reports the DiskPressure condition. Which eviction signal could have caused it?
212. 690. A Pod's requirements match no node in the cluster. What does kube-scheduler do?
213. 693. An operator scripts a rolling reboot that drains five nodes at once. What risk does the documentation identify?
214. 695. A drain hangs because the application's Pods are crash-looping and the PodDisruptionBudget will not allow their eviction. Which setting is recommended to avoid this?
215. 698. A Pod shows the status SchedulingGated and never reaches the scheduler. What must happen for it to proceed?
216. 705. An application reaching an HTTPS backend through an ExternalName Service gets certificate errors. What explains this?
217. 706. An engineer sets externalName to 203.0.113.10 on an ExternalName Service, and nothing resolves. Why?
218. 710. A Service is created without a selector so it can front an external database. Nothing can reach it. What is missing?
219. 711. A hand-written EndpointSlice named my-service-1 exists alongside a selectorless Service named my-service, but the Service still shows no endpoints. What is most likely wrong?
220. 713. A Service backed by 1500 Pods carries the annotation endpoints.kubernetes.io/over-capacity: truncated. What does that indicate?
221. 718. A Service declares two ports and the API server rejects it. Which requirement was most likely missed?
222. 720. A LoadBalancer Service has been created but kubectl get svc shows its external address as pending. Where will the address appear once provisioned?
223. 722. A Service sets internalTrafficPolicy to Local. A Pod on a node with no ready endpoint for that Service tries to connect. What happens?
224. 724. Under externalTrafficPolicy: Cluster, which endpoint do load balancer health checks target?
225. 726. A vendor configures kube-proxy's /healthz as a liveness probe, and kube-proxy restarts continuously while a node is being deleted. Which path should have been used?
226. 730. A very large cluster in iptables mode sees kube-proxy take a long time to converge after a change. What is the underlying cause?
227. 732. An Ingress object has been applied successfully but no traffic is routed and its address stays empty. What should be checked first?
228. 739. Two IngressClasses in a cluster are both annotated as the default. What is the consequence?
229. 742. An Ingress terminates TLS for shop.example.com but its rules only define a default backend with no host. Why does TLS not work?
230. 745. Every endpoint of a Service is terminating at once. What do Service proxies do?
231. 748. A Service manifest requests a specific clusterIP that another Service already holds. What does the API server do?
232. 749. A Pod reads a Service's address from the injected environment variables, but the variables are missing. What is the most likely reason?
233. 757. A NetworkPolicy selects a Pod, lists an ingress rule, and sets policyTypes to ["Ingress"]. What is the Pod's egress isolation?
234. 759. Pod A's namespace has a default-deny egress policy. Pod B's namespace has an ingress policy explicitly allowing A. Can A reach B?
235. 761. A Pod is isolated for ingress by a policy that names no peers. The kubelet's liveness probe still succeeds. Why?
236. 762. A from block contains two list entries: one with a namespaceSelector and one with a podSelector. What does it allow?
237. 766. An incident responder applies a restrictive NetworkPolicy to cut off a compromised Pod's live connections. What should they expect?
238. 767. A NetworkPolicy is applied successfully but traffic it should block still flows. What is the first thing to check?
239. 769. A Pod in namespace test cannot resolve the name data, which is a Service in namespace prod. What should the client use?
240. 770. Reading a Pod's /etc/resolv.conf you find options ndots:5. What does the kubelet write it for?
241. 772. A Pod manifest omits dnsPolicy entirely. Which policy applies?
242. 773. A Pod with hostNetwork: true and dnsPolicy: ClusterFirst cannot resolve any in-cluster Service names. Why?
243. 777. What limits does Kubernetes place on a Pod's DNS search domain list?
244. 781. Which CoreDNS plugin exists to catch a configuration in which queries would be forwarded back to CoreDNS itself?
245. 786. An engineer looks for the kubelet's --network-plugin and --cni-bin-dir flags on a current release and cannot find them. What changed?
246. 790. Cluster DNS has stopped working. Which two checks does the troubleshooting guide begin with? Choose two.
247. 792. After a default-deny egress policy is applied to a namespace, its Pods can no longer resolve any names. What is missing?
248. 795. A NetworkPolicy using endPort is applied, but traffic to the middle of the range is still blocked. What should be verified?
249. 800. A NetworkPolicy in namespace web has an ingress rule whose from block contains only a podSelector matching app=api. Which Pods does it admit?
250. 803. A PersistentVolume is declared ReadOnlyMany, yet a Pod writes to it successfully. Why?
251. 806. A developer deletes a PersistentVolumeClaim created from the default StorageClass, and the data is gone. What explains this?
252. 807. A PersistentVolume shows the phase Released. What does that mean?
253. 808. A Retain-policy PersistentVolume is stuck in Released and a new claim will not bind to it. What must be done?
254. 809. A PersistentVolumeClaim has been deleted but sits in Terminating with the finalizer kubernetes.io/pvc-protection. What is holding it?
255. 811. A statically created PersistentVolume has no storageClassName. Which claim can bind to it?
256. 812. An administrator pre-creates a PersistentVolume and writes a claim that omits storageClassName, expecting it to bind. Instead a new volume is provisioned. Why?
257. 813. An edit that raises a PersistentVolumeClaim's storage request is rejected. What is the likely cause?
258. 815. In a multi-zone cluster, Pods keep failing to start because their volume is in a different zone. Which StorageClass setting fixes this?
259. 819. A Pod uses an emptyDir with medium set to Memory and is OOM-killed after writing a large file to it. Why?
260. 823. A node holding a local PersistentVolume becomes unhealthy. What happens to the Pod using it?
261. 827. A claim omitting storageClassName stays Pending in a cluster where no StorageClass is annotated as default. Why?
262. 830. kubectl get volumesnapshots returns "the server doesn't have a resource type". What is missing?
263. 834. A Pod requiring a new attached volume stays Pending on an otherwise idle node with plenty of CPU and memory. What limit could explain it?
264. 837. A cluster has two StorageClasses both annotated as default. What state is that?
265. 840. A hostPath volume of /mnt is mounted read-only into a container, but a tmpfs mounted at /mnt/data on the host is writable inside. Why?
266. 843. A node's ephemeral storage is filling up. Besides emptyDir volumes, which two things draw on it? Choose two.
267. 844. A namespace has a quota on ephemeral-storage, but a Pod consuming a great deal of scratch space is admitted anyway. What explains it?
268. 845. Where does a CSI driver's report that a volume is unhealthy appear?
269. 851. A Pod is misbehaving and you have only one command to run first. Which gives the most diagnostic ground in a single step?
270. 852. A Pod has been Pending for ten minutes. What does that state tell you, and where is the reason recorded?
271. 853. A Deployment using hostPort is scaled to 8 replicas on a 5-node cluster, and three Pods stay Pending. Why?
272. 854. A Pod is scheduled but its container stays in Waiting. Which two causes should be checked first? Choose two.
273. 855. A Pod has been Terminating for an hour. Which cluster objects should be inspected?
274. 856. A newly installed validating webhook has left older Pods impossible to delete. What design rule was broken?
275. 857. A Pod runs its image's default entrypoint rather than the command in the manifest, and no error was reported. What is the recommended next step?
276. 858. You compare a local manifest with kubectl get pod -o yaml. Which difference indicates a real problem?
277. 859. Which command lists the EndpointSlices belonging to a Service named web?
278. 860. A Service has no endpoints. What is the most direct way to confirm the cause?
279. 861. A Service has endpoints and its selector is correct, yet connections are refused. Which mismatch should be checked next?
280. 862. A container is in CrashLoopBackOff and kubectl logs shows only a few lines from the newest attempt. Which flag reveals why it died last time?
281. 863. Which two situations call for an ephemeral debug container rather than kubectl exec? Choose two.
282. 864. An application crashes immediately at startup, so there is never a running container to exec into. Which approach does the documentation recommend?
283. 865. A debug copy adds an Ubuntu container beside a distroless application container, but the new container cannot see the application's processes. Which flag was missed?
284. 866. A kubectl debug session is disconnected by a dropped network link. How is it resumed?
285. 867. Inside a Pod created by kubectl debug node/mynode, where is the node's root filesystem?
286. 868. In a node debug session, chroot /host fails with a permissions error. Why?
287. 869. kubectl describe shows Ready: True for a container that is plainly not serving traffic correctly. What does that column actually mean here?
288. 870. In a Pod's event list, one entry comes From default-scheduler and another From kubelet. What does that distinction tell you?
289. 871. A node goes unreachable. kubectl describe pod on one of its Pods shows a toleration for node.kubernetes.io/unreachable with tolerationSeconds 300. What does that govern?
290. 872. On a four-node cluster where each node has one CPU, a Pod requesting 1000m stays Pending on every node. What is the likely explanation?
291. 873. A Service name will not resolve from inside a Pod. Which lookup isolates cluster DNS itself as the problem?
292. 874. A Service manifest written in JSON has "targetPort": "9376". What is wrong?
293. 875. A Service selects app=hostnames but its EndpointSlice shows no endpoints, while the Pods are Running. What should be inspected?
294. 876. You want to separate a broken Service from a broken application. Which test does that?
295. 877. A Service works most of the time but fails intermittently, and its backing Pods show a high RESTARTS count. How are the two connected?
296. 878. A Service resolves, has correct endpoints, and each Pod answers when addressed directly, yet the Service IP does not work. What is the remaining suspect?
297. 879. kube-proxy's logs do not show which endpoints it programmed for a Service. What does the guide suggest?
298. 880. A Pod cannot reach itself through its own Service IP. Which two hairpin-mode values allow that to work? Choose two.
299. 881. The kubelet was started with --hairpin-mode=promiscuous-bridge, but hairpin traffic still fails. Where is the effective mode confirmed?
300. 882. A Service is configured correctly and its Pods are healthy, but only some clients can reach it. What should be ruled out before deep proxy debugging?
301. 883. From which path does the kubelet read a container's termination message by default?
302. 884. A Pod has twelve containers, counting init containers. How much termination message space does each get?
303. 885. A container exits with an error and writes nothing to its termination message file. Which setting would surface the tail of its log instead?
304. 886. How much log output can the FallbackToLogsOnError policy include in a termination message?
305. 887. Where in a Pod's YAML does a container's termination message appear after it exits?
306. 888. A Pod shows the status Init:1/3. What does that mean?
307. 889. Which two Pod statuses indicate that all init containers have finished? Choose two.
308. 890. A StatefulSet Pod has sat in Terminating for hours after its node failed. What does the documentation direct you to?
309. 891. Which two kubelet settings govern container log rotation, and what are their defaults? Choose two.
310. 892. A Pod has written 40 MiB of logs on a node rotating at 10 MiB. How much can kubectl logs return?
311. 893. A Pod is evicted from a node. What becomes of its container logs on that node?
312. 894. You need the kubelet's own logs on a systemd node. Which command reads them?
313. 895. Under which directory does the kubelet have the container runtime write container logs by default?
314. 896. Which two components do not run inside containers on a typical node? Choose two.
315. 897. Kubernetes provides no cluster-level logging of its own. Which two of the following are documented approaches? Choose two.
316. 898. Which workload object suits a node-level logging agent, and why?
317. 899. An application writes its logs to a file rather than stdout, and the cluster has a node-level agent. What does a streaming sidecar achieve?
318. 900. kubectl top node returns "Metrics API not available". What is missing?
319. 901. A team wants an HPA to scale on request rate. What does the Metrics API alone provide?
320. 902. Which component collects per-container resource metrics before the kubelet exposes them?
321. 903. A cluster uses a virtualisation-based container runtime, and kubectl top pod reports nothing for its Pods. What must the runtime provide?
322. 904. Node Problem Detector observes a kernel problem on a node. Which two forms can its report take? Choose two.
323. 905. The API server on a node is unreachable and you need to see what containers the runtime is actually running there. Which tool does that?
324. 906. Which two ways can crictl be told which runtime endpoint to use? Choose two.
325. 907. kubeadm init hangs after printing that it created the API client and is waiting for the control plane. Which two causes are named? Choose two.
326. 908. hostPort does not work in a cluster. Which capability does it depend on?
327. 909. Why do PodDisruptionBudgets take effect during a kubectl drain?
328. 910. A control plane node is drained. What happens to the mirror Pods for its static Pods?
329. 911. A drain refuses to proceed because of a Pod created directly with kubectl run and owned by no controller. Which flag allows it?
330. 912. A drain stops on Pods using emptyDir volumes. What does --delete-emptydir-data acknowledge?
331. 913. An operator adds --disable-eviction to a drain to get past a blocking PodDisruptionBudget. What is the consequence?
332. 914. kubectl drain has returned successfully. What does that signify?
333. 915. Which of these is a valid target for kubectl logs?
334. 916. You need logs from every container of every Pod labelled app=web. Which two flags does that call for? Choose two.
335. 917. kubectl top pod shows nothing for a Pod created thirty seconds ago. What is the likeliest reason?
336. 918. kubectl top pod reports one line for a Pod with three containers. Which flag breaks the usage out per container?
337. 919. kubectl top node shows 30% CPU used, while kubectl describe node reports 90% of CPU requested. Which statement reconciles the two?
338. 920. Which command follows new events for one Pod as they arrive?
339. 921. Where does kubectl explain get the field documentation it prints?
340. 922. kubectl rollout undo deployment/api is run with no other flags. Which revision does it restore?
341. 923. A pipeline runs kubectl rollout status to gate on one particular deployment. A colleague triggers another rollout meanwhile. What happens without extra flags?
342. 924. You want to know whether the ServiceAccount build-bot in namespace ci may create Pods in namespace prod. Which command answers that?
343. 925. A user's kubectl auth can-i --as=... command is refused. What permission are they missing?
344. 926. kubectl cluster-info dump is run with --output-directory. Which two things does it collect? Choose two.
345. 927. kubectl cluster-info dump is run with no namespace flags. Which namespaces does it cover?
346. 928. Which two things can kubectl wait be told to wait for? Choose two.
347. 929. How is a wait for a Pod's Ready condition to become false written?
348. 930. kubectl port-forward is run against a Deployment, and the Pod it selected is deleted during a rollout. What happens?
349. 931. You need kubectl port-forward to accept connections from another machine on port 8888, reaching container port 5000. Which two things are required? Choose two.
350. 932. kubectl cp into a distroless container fails. What is the cause, and what is the documented alternative?
351. 933. An auditor asks whether Kubernetes auditing would record someone reading a Secret file directly from a node's disk. What is the answer?
352. 934. Which audit stage is generated only for long-running requests such as a watch?
353. 935. An audit policy's first rule sets level None for a resource, and a later rule sets RequestResponse for the same resource. What is recorded?
354. 936. Which two statements about enabling API server auditing are correct? Choose two.
355. 937. An audit policy is configured but no audit records appear anywhere. Which flag is most likely missing?
356. 938. Auditing is configured on an API server running as a static Pod, and the records vanish on restart. What was forgotten?
357. 939. What operational cost does enabling API server auditing carry?
358. 940. A component is started with -v=0. What is logged?
359. 941. An operator looks for --log-file on a current Kubernetes component and cannot find it. What is the current behaviour?
360. 942. A component runs in a distroless container with no shell to redirect its output. Which helper handles that?
361. 943. Which two statements about the node log query feature are correct? Choose two.
362. 944. Why is granting get on nodes/proxy more dangerous than it looks?
363. 945. Which option is required on a node log query?
364. 946. A node log query is made for a service whose logs go to a file rather than journald. What does the kubelet do?
365. 947. kubectl version prints a client version but no server version. What does that indicate?
366. 948. An engineer has lost their kubeconfig but still has SSH access to a control plane node. Where can a working one be found?
367. 949. You suspect an expired certificate in a kubeconfig. Which two tools does the guide use to check? Choose two.
368. 950. kubectl returns a Forbidden error naming your username and the resource. Which area should you investigate?
369. 951. A Pod has an application container and a logging sidecar, in that order. kubectl exec is run with no -c. Which container does the command run in?
370. 952. An HPA must scale on a queue depth rather than CPU. Which two APIs can an adapter serve to make that possible? Choose two.
371. 953. Which monitoring platform does Kubernetes recommend?
372. 954. After finishing with a node debug session, what does the documentation remind you to do?
373. 955. Telepresence is used to debug a Service locally. What does the local process get access to?
374. 956. From inside a node debug Pod, which two paths hold logs worth reading? Choose two.
375. 957. A node debug Pod's /host does not show the whole machine's filesystem. What would explain that?
376. 958. Which command shows which container runtime each node is using?
377. 959. A containerd log shows "incompatible CNI versions; config is 1.0.0, plugin supports ...". What is wrong?
378. 960. Pods start normally but cannot be stopped, and the runtime reports "invalid version: the version is empty" from StopPodSandbox. What is missing?
379. 961. A control plane component does not expose /metrics for scraping. Which flag opens it?
380. 962. Besides /metrics, which two endpoints does the kubelet serve? Choose two.
381. 963. A Prometheus ServiceAccount is refused when scraping component metrics on an RBAC cluster. Which rule does its ClusterRole need?
382. 964. kubectl describe pod web is run in a namespace holding web-abc and web-def but no Pod named exactly web. What happens?
383. 965. A colleague insists a Deployment exists, but kubectl get deployments returns nothing. What is the most likely explanation?
384. 966. Two API groups both serve a resource named events, and kubectl get events is ambiguous. How is one addressed unambiguously?
385. 967. kubectl debug behaves differently depending on its target. Which two actions can it take? Choose two.
386. 968. What makes an ephemeral container suitable for investigating a Pod that is misbehaving right now?
387. 969. A deployment script runs kubectl diff before applying. Which exit code means changes are pending?
388. 970. An object was created with plain kubectl create and later applies behave unexpectedly. What was missing?
389. 971. kubectl create secret generic tls-bundle --from-file=/certs/server.pem is run. What key is created?
390. 972. A ConfigMap is created from a directory containing regular files, a subdirectory and a symlink. What is packaged?
391. 973. How is a ReplicaSet, served by the apps group, written in kubectl create role --resource?
392. 974. A Role must allow reading Pods and their status subresource. How are both named to kubectl create role?
393. 975. How is the ServiceAccount sa-dev in namespace monitoring named as a subject to kubectl create rolebinding?
394. 976. Why does kubectl create clusterrolebinding accept only --clusterrole and not --role?
395. 977. How is every container of a DaemonSet updated to one image in a single kubectl set image command?
396. 978. A node is uncordoned after maintenance. What happens to the Pods that were drained off it?
397. 979. A Pod is deleted with default settings. What signal does its main process receive first, and how long before SIGKILL?
398. 980. A container has a preStop hook that takes 45 seconds and terminationGracePeriodSeconds left at its default. What happens?
399. 981. A preStop hook is still running as the termination grace period ends. What does the kubelet do?
400. 982. Which two flags together force-delete a Pod from the API server? Choose two.
401. 983. Why is force-deleting a StatefulSet Pod treated as dangerous?
402. 984. A Pod is terminating gracefully. What happens to its entry in the Service's EndpointSlice?
403. 985. A Pod has two sidecar containers and one main container. Which two statements describe shutdown? Choose two.
404. 986. An application requires its cache container to stop before its API container. What does Kubernetes offer?
405. 987. You need to alert on Pods stuck in a Terminating state for more than five minutes. Which component exposes the metrics for that?
406. 988. How does kube-state-metrics obtain the information it publishes?
407. 989. kubectl reports "x509: certificate signed by unknown authority". Which cause does the kubeadm guide name first?
408. 990. The API server logs "x509: certificate has expired" for one node. Which kubeadm mechanism has failed?
409. 991. A node has /var/lib/kubelet on a separate mounted filesystem, and kubeadm reset is run. What must be done afterwards?
410. 992. kubeadm upgrade plan prints "context deadline exceeded" on a cluster with external etcd. What should be done?
411. 993. Graceful node shutdown appears to do nothing on a node. Which two settings must both be non-zero? Choose two.
412. 994. A node has shutdownGracePeriod 30s and shutdownGracePeriodCriticalPods 10s. How is the window divided?
413. 995. During a graceful node shutdown, why can a Pod tolerating node.kubernetes.io/not-ready:NoSchedule still not start there?
414. 996. A node is powered off abruptly and a StatefulSet Pod stays Terminating while its replacement cannot start. What is holding the replacement?
415. 997. The node.kubernetes.io/out-of-service taint is applied to a node confirmed powered off. Which two things follow? Choose two.
416. 998. What must be verified before applying the out-of-service taint to a node?
417. 999. After how long does Kubernetes force-detach a volume from a node where a Pod deletion has not succeeded and the node is unhealthy?
418. 1000. A node configures shutdownGracePeriodByPodPriority with bands at 100000, 1000 and 0, but no Pod has a priority in the highest band. What happens at shutdown?