[Full-Version] 2026 New Preparation Guide of Linux Foundation CKA Exam

CKA Practice Exam - 85 Unique Questions

NEW QUESTION # 41
List all persistent volumes sorted by capacity, saving the full kubectl output to /opt/KUCC00102/volume_list.
Use kubectl 's own functionality for sorting the output, and do not manipulate it any further.

Answer:

Explanation:

NEW QUESTION # 42
Score: 4%

Task
Check to see how many nodes are ready (not including nodes tainted NoSchedule ) and write the number to /opt/KUSC00402/kusc00402.txt.

Answer:

Explanation:
Solution:
kubectl describe nodes | grep ready|wc -l
kubectl describe nodes | grep -i taint | grep -i noschedule |wc -l
echo 3 > /opt/KUSC00402/kusc00402.txt
#
kubectl get node | grep -i ready |wc -l
# taints、noSchedule
kubectl describe nodes | grep -i taints | grep -i noschedule |wc -l
#
echo 2 > /opt/KUSC00402/kusc00402.txt

NEW QUESTION # 43
A Kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the case, and perform any appropriate steps to bring the node to a Ready state, ensuring that any changes are made permanent.
You can ssh to the failed node using:
[student@node-1] $ | ssh Wk8s-node-0
You can assume elevated privileges on the node with the following command:
[student@w8ks-node-0] $ | sudo -i

Answer:

Explanation:
See the solution below.
Explanation
solution

NEW QUESTION # 44
You are working with a Kubernetes cluster that has been configured with RBAC. You need to create a deployment for a new application, but you are encountering permission issues. You have verified that your user account belongs to the "developers" group, which should have sufficient permissions to create deployments. However, you are receiving an error message indicating insufficient privileges.
Investigate the potential causes for the permission issue and provide solutions to resolve the problem.

Answer:

Explanation:
See the solution below with Step by Step Explanation.

NEW QUESTION # 45
Create a pod as follows:
Name: mongo
Using Image: mongo
In a new Kubernetes namespace named: my-website

Answer:

Explanation:
solution

NEW QUESTION # 46
You are managing a Kubernetes cluster with a complex deployment scenario. The cluster has multiple namespaces, each with its own set of applications and users. You need to create a robust RBAC system to enforce fine-grained access control.
Current Setup:
Namespace: 'dev', 'staging', 'production'
Users: 'developer', 'qa', 'admin'
Applications: 'appl', 'app2' in 'dev', 'app3' in 'staging', 'app4' in 'production' Requirements:
'developer' should be able to access and manage 'appl' and 'app2' in the 'dev' namespace.
'qa' should be able to access and manage 'app3' in the 'staging' namespace.
'admin' should have full cluster-wide access.
Task:
Create the necessary Role, RoleBinding, and ClusterRole objects to implement this RBAC system.

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Create Roles for 'developer' and 'qa':


2. Create RoleBinding for 'developer' and 'qa':

3. Create ClusterRole for 'admin'.

4. Create ClusterRoleBindin for 'admin'.

We created separate roles (developer-role', 'cp-role') for each user group, limiting their access to specific namespaces and resources. We bound these roles to users using RoleBindings in the respective namespaces. For 'admin', we created a ClusterRole Cadmin-clusterrole') with full access to all resources, and bound it using a ClusterRoleBinding. This setup ensures that each user has appropriate access rights based on their role and responsibilities. ,

NEW QUESTION # 47
You have a Deployment running an application that requires a specific network policy. How can you define a network policy that allows only traffic from Pods belonging to the same namespace as the application and denies all other traffic?

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Network Policy Definition:

2. Explanation: - 'apiVersion: networking.k8s.io/v1 ' : Specifies the API version for NetworkPolicy resources. - 'kind: NetworkPolicy': Specifies that this is a NetworkPolicy resource. - 'metadata.name: allow-same-namespace': Sets the name of the NetworkPolicy. - 'metadata.namespace: Specifies the namespace where the NetworkPolicy is applied. Replace " with the actual namespace where your deployment is running. - 'spec.podSelector: {F: This empty podSelector means the NetworkPolicy applies to all Pods in the namespace. - 'spec.ingress': This section defines the rules for incoming traffic. - 'spec.ingress.from.podSelector: {F: This allows traffic from any Pods within the same namespace. 3. How it works: - This NetworkPolicy allows incoming traffic only from Pods within the same namespace where the Deployment is running. It explicitly denies all other traffic, effectively isolating the application to communication only within its namespace. 4. Implementation: - Apply the YAML using 'kubectl apply -f allow-same-namespace.yaml' 5. Verification: After applying the NetworkPolicy, test the communication between Pods within the same namespace and Pods in other namespaces. You should observe that the NetworkPolicy successfully enforces the defined restrictions.

NEW QUESTION # 48
You have a Deployment running on a Kubernetes cluster with limited resources. How can you adjust the Deployment to use resources more efficiently and prevent resource contention?

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define Resource Requests and Limits:
- Set 'requests' and 'limits' for CPU and memory for the containers in the Deployment.
- This helps in specifying the minimum resources required by the pods and the maximum resources that they can consume.

2. Optimize Container Images: - Use smaller and more efficient container images to reduce the resource footprint of the pods. 3. Use Resource Quotas: - Apply resource quotas at the namespace level to control the resource consumption of the pods within a namespace. 4. Consider Pod Disruption Budgets (PDB): - Implement PDBs to control the maximum number of pods that can be unavailable during a rolling update or pod deletion. - This ensures that the application remains available during resource-intensive events. 5. Utilize Node Affinity and Tolerations: - Configure node affinity and tolerations to schedule pods on specific nodes that have the required resources. 6. Monitor Resource Utilization: - Regularly monitor the resource utilization of the cluster and the pods. - Use tools like 'kubectl top pods', 'kubectl top nodes', and 'kubectl describe nodes' to gather resource utilization data. - Adjust resource requests and limits accordingly based on the monitoring data.

NEW QUESTION # 49
You have a deployment named 'my-app' running a web application that uses an external database service. You need to configure a 'ClusterlP' service to route traffic to the external database service.

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Create the ClusterlP service:
- Create a 'ClusterlP' service that points to the external database service using the 'externalName' field.

2. Apply the service: - Apply the YAML file using 'kubectl apply -f external-db-service.yamr 3. Verify the service: - Check the status of the service using 'kubectl get services external-db-service -n ' 4. Test the service: - From a pod in the same namespace as the service, try to connect to the external database service using the 'external-db-service' service name and port. Note: - Replace with the actual namespace. - Replace 'my-external-db.example.com' with the actual hostname of your external database service. - Ensure that your cluster has access to the external database service.

NEW QUESTION # 50
Score: 7%

Task
Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.
Further ensure that the new NetworkPolicy:
* does not allow access to Pods, which don't listen on port 9000
* does not allow access from Pods, which are not in namespace my-app

Answer:

Explanation:
Solution:
#network.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: internal
spec:
podSelector:
matchLabels: {
}
policyTypes:
- Ingress
ingress:
- from:
- podSelector: {
}
ports:
- protocol: TCP
port: 8080
#spec.podSelector namespace pod
kubectl create -f network.yaml

NEW QUESTION # 51
List all the pods sorted by name

Answer:

Explanation:
See the solution below.
Explanation
kubectl get pods --sort-by=.metadata.name

NEW QUESTION # 52
You have a deployment that uses an init container to perform a specific initialization task before the main application container starts. How can you configure the init container to ensure that it runs successfully before the main container starts, even if the init container fails several times?

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Define the Deployment: Define the deployment with both the init container and main container using a YAML file.

2. Set 'restartPolicy' for the Init Container: Set the 'restartPolicy' for the init container to 'Always'. This ensures that the init container will be restarted if it fails. 3. Set a 'restartPolicy' for the Main Container: Set the 'restartPolicy' for the main container to 'Always' so that the main container is restarted if it fails. 4. Apply the Deployment: Apply the YAML file to your cluster using 'kubectl apply -f my-deployment.yamr. 5. Monitor the Pod: Monitor the pod using 'kubectl get pods -l app=my-app' to check if the init container is running and completing successfully. If the init container repeatedly fails, you will need to troubleshoot the failure. Consider adding more logging to the init container or reducing the number of attempts or increasing the time between attempts to diagnose the root cause.

NEW QUESTION # 53
You must connect to the correct host.
Failure to do so may result in a zero score.
[candidate@base] $ ssh Cka000059
Context
A kubeadm provisioned cluster was migrated to a new machine. It needs configuration changes to run successfully.
Task
Fix a single-node cluster that got broken during machine migration.
First, identify the broken cluster components and investigate what breaks them.
The decommissioned cluster used an external etcd server.
Next, fix the configuration of all broken cluster

Answer:

Explanation:
Task Summary
* SSH into node: cka000059
* Cluster was migrated to a new machine
* It uses an external etcd server
* Identify and fix misconfigured components
* Bring the cluster back to a healthy state
Step-by-Step Solution
Step 1: SSH into the correct host
ssh cka000059
Step 2: Check the cluster status
Run:
kubectl get nodes
If it fails, the kubelet or kube-apiserver is likely broken.
Check kubelet status:
sudo systemctl status kubelet
Also, check pod statuses in the control plane:
sudo crictl ps -a | grep kube
or:
docker ps -a | grep kube
Look especially for failures in kube-apiserver or kube-controller-manager.
Step 3: Inspect the kube-apiserver manifest
Since this is a kubeadm-based cluster, manifests are in:
ls /etc/kubernetes/manifests
Open kube-apiserver.yaml:
bash
CopyEdit
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
Look for the --etcd-servers= flag. If the external etcd endpoint has changed (likely, due to migration), this needs to be fixed.
Example of incorrect configuration:
--etcd-servers=https://192.168.1.100:2379
If the IP has changed, update it to the correct IP or hostname of the external etcd server.
Also ensure the correct client certificate and key paths are still valid:
--etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
--etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
--etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
If the files are missing or the path is wrong due to migration, correct those as well.
Step 4: Save and exit, and let static pod restart
Static pod changes will be picked up automatically by the kubelet (watch for /etc/kubernetes/manifests changes).
Check again:
docker ps | grep kube-apiserver
# or
crictl ps | grep kube-apiserver
Step 5: Confirm API is healthy
Once kube-apiserver is up, try:
kubectl get componentstatuses
kubectl get nodes
If these commands work and return valid statuses, the control plane is functional again.
Step 6: Check controller-manager and scheduler (optional)
If still broken, check the other static pods in /etc/kubernetes/manifests/ and correct paths if necessary.
Also verify that /etc/kubernetes/kubelet.conf and /etc/kubernetes/admin.conf are present and valid.
Command Summary
ssh cka000059
# Check system and kubelet
sudo systemctl status kubelet
docker ps -a | grep kube # or crictl ps -a | grep kube
# Check manifests
ls /etc/kubernetes/manifests
sudo nano /etc/kubernetes/manifests/kube-apiserver.yaml
# Fix --etcd-servers and certificate paths if needed
# Watch pods restart and confirm:
kubectl get nodes
kubectl get componentstatuses

NEW QUESTION # 54
You have a deployment that uses a PersistentVolumeClaim for its storage. The deployment is scaled to 5 replicas. You notice that each pod is using the same volume, leading to data corruption. Explain why this is happening and how you can fix the problem.

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
This problem arises because the access mode of the PersistentVolumeClaim is set to 'ReadWriteMany', and the PVC is shared between all pods. When multiple pods access the same data simultaneously, data corruption can occur due to inconsistent updates. To fix the issue, you need to change the PVC access mode to 'ReadWriteOnce' and create individual PVCs for each pod. Here's how:
1. Update the PVC Access Mode:
- Modify the access mode in the PersistentVolumeClaim YAML file to 'ReadWriteOnce'.

2. Update the Deployment to use Multiple PVCs: - Update the Deployment YAML to use a unique PVC for each pod by specifying the 'persistentVolumeClaim' field in the 'spec.template.spec.containers.volumeMounts' section.

3. Apply the Changes: - Apply the updated PVC and Deployment YAML files using 'kubectl apply -f my-pvc.yaml' and "kubectl apply -f my-deployment.yaml' , respectively. - By setting the PVC access mode to 'ReadWriteOnce', each pod can access the volume exclusively. - The updated Deployment definition ensures that each pod has a unique PersistentVolumeClaim. The 'claimName' field in the volumes' section uses the 'pod.metadata.name' to create a unique name for each PVC. This ensures that each pod has its own dedicated storage, preventing data corruption and ensuring data consistency.]

NEW QUESTION # 55
Create a pod as follows:
Name: non-persistent-redis
container Image: redis
Volume with name: cache-control
Mount path: /data/redis
The pod should launch in the staging namespace and the volume must not be persistent.

Answer:

Explanation:
solution

NEW QUESTION # 56
Score: 4%

Context
You have been asked to create a new ClusterRole for a deployment pipeline and bind it to a specific ServiceAccount scoped to a specific namespace.
Task
Create a new ClusterRole named deployment-clusterrole, which only allows to create the following resource types:
* Deployment
* StatefulSet
* DaemonSet
Create a new ServiceAccount named cicd-token in the existing namespace app-team1.
Bind the new ClusterRole deployment-clusterrole lo the new ServiceAccount cicd-token , limited to the namespace app-team1.

Answer:

Explanation:
Solution:
Task should be complete on node k8s -1 master, 2 worker for this connect use command
[student@node-1] > ssh k8s
kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets kubectl create serviceaccount cicd-token --namespace=app-team1 kubectl create rolebinding deployment-clusterrole --clusterrole=deployment-clusterrole --serviceaccount=default:cicd-token --namespace=app-team1

NEW QUESTION # 57
To protect your firewall and network from single source denial of service (DoS) attacks that can overwhelm its packet buffer and cause legitimate traffic to drop, you can configure:

• A. PBP (Packet Buffer Protection)
• B. PGP (Packet Gateway Protocol)
• C. PBP (Protocol Based Protection)
• D. BGP (Border Gateway Protocol)

Answer: C

NEW QUESTION # 58
Create a job named "hello-job" with the image busybox which echos "Hello I'm running job"

• A. kubectl create job hello-job --image=busybox --dry-run -o yaml
  -- echo "Hello I'm running job" > hello-job.yaml
  kubectl create -f hello-job.yaml
  //Verify Job
  kubectl get job
  kubectl get po
  kubectl logs hello-job-*
• B. kubectl create job hello-job --image=busybox --dry-run -o yaml
  -- echo "Hello I'm running job" > hello-job.yaml
  kubectl create -f hello-job.yaml
  //Verify Job
  kubectl get po
  kubectl logs hello-job-*

Answer: A

NEW QUESTION # 59
Create a pod that echo "hello world" and then exists. Have the pod deleted automatically when it's completed

Answer:

Explanation:
kubectl run busybox --image=busybox -it --rm --restart=Never --
/bin/sh -c 'echo hello world'
kubectl get po # You shouldn't see pod with the name "busybox"

NEW QUESTION # 60
List all persistent volumes sorted by capacity, saving the full kubectl output to
/opt/KUCC00102/volume_list. Use kubectl 's own functionality for sorting the output, and do not manipulate it any further.

Answer:

Explanation:
See the solution below.
Explanation
solution
F:\Work\Data Entry Work\Data Entry\20200827\CKA\2 C.JPG

NEW QUESTION # 61
List pod logs named "frontend" and search for the pattern "started" and write it to a file "/opt/error-logs"

Answer:

Explanation:
See the solution below.
Explanation
Kubectl logs frontend | grep -i "started" > /opt/error-logs

NEW QUESTION # 62
Create a secret mysecret with values user=myuser and password=mypassword

• A. kubectl create secret generic my-secret --fromliteral=username=user --from-literal=password=mypassword
  // Verify
  kubectl get secret --all-namespaces
  kubectl get secret generic my-secret -o yaml
• B. kubectl create secret generic my-secret --fromliteral=username=user --from-literal=password=mypassword
  // Verify
  kubectl get secret generic my-secret -o yaml

Answer: A

NEW QUESTION # 63
Your team is deploying a critical application on Kubernetes and needs to ensure its availability and performance. You are considering implementing a load balancer for the application to distribute traffic across multiple pods. Describe the types of load balancers available in Kubernetes and explain how to implement an external load balancer using a cloud provider's load balancer service.

Answer:

Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Types of Load Balancers in Kubernetes:
- NodePort: A simple load balancer that exposes the service on each node's IP address and a specific port.
- LoadBalancer: Exposes the service on the public IP address of the cloud provider's load balancer.
- Ingress: A higher-level abstraction that allows for more flexible routing and configuration of traffic to services.
2. Implementing an External Load Balancer using a Cloud Provider:
- Create a Kubernetes Service:
- Define a Kubernetes Service that exposes the application on a specific port.
- Configure the service type to 'LoadBalancer'.

- Configure a Cloud Provider Load Balancer: - Access the load balancer management console of your cloud provider (e.g., AWS Elastic Load Balancer, Google Cloud Load Balancing, Azure Load Balancer). - Create a new load balancer and configure it to listen on the desired port (e.g., port 80). - Configure the load balancer to distribute traffic to the Kubernetes service. This might involve specifying the Kubernetes service's IP address or hostname, depending on the cloud provider's setup. - Configure the health check settings to ensure that the load balancer only routes traffic to healthy pods. - Verify Load Balancer Configuration: - Once the cloud provider load balancer is configured, verify that it is working correctly by accessing the load balancer's public IP address and ensuring that the application responds as expected. - You can also use 'kubectl describe service myapp-service' to check the load balancer's status and external IP address. ,

NEW QUESTION # 64
Get IP address of the pod - "nginx-dev"

Answer:

Explanation:
See the solution below.
Explanation
Kubect1 get po -o wide
Using JsonPath
kubect1 get pods -o=jsonpath='{range
items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

NEW QUESTION # 65
......

Latest Questions CKA Guide to Prepare Free Practice Tests: https://www.examstorrent.com/CKA-exam-dumps-torrent.html

Reliable CKA Dumps Questions Available as Web-Based Practice Test Engine: https://drive.google.com/open?id=1IRrGMqi8_BjYbODZJ50hALokBClseNgu