CKA practice questions: 10 free samples from the Kubernetes mock exam

10 questions in the style of the Certified Kubernetes Administrator exam, with their answer options. They are 10 of the 173 in the pool the mock draws from; answers and explanations come back when you sit it, and every question is marked against its domain so you can see where you stand.

Sit the full 30-question mock — free, no account

  1. 1. Which component stores all cluster data? Kubernetes Introduction

    1. AAPI Server
    2. BController Manager
    3. Cetcd
    4. DScheduler

  2. 2. A _____ binds a Role to a user or service account. Security & RBAC

    1. 3. What are the three Pod Security Standards levels? Security & RBAC

      1. ANone, Basic, Advanced
      2. BOpen, Moderate, Strict
      3. CPrivileged, Baseline, Restricted
      4. DLow, Medium, High

    2. 4. A service account must read pods in one namespace only, and the permission definition should be reusable elsewhere. What is the cleanest construction? CKA · Cluster architecture, installation and configuration

      1. AA ClusterRole bound with a ClusterRoleBinding
      2. BA RoleBinding referencing a Role in a different namespace
      3. CA Role in every namespace that might need it
      4. DA ClusterRole for reading pods, bound with a RoleBinding in that namespace

    3. 5. Which command answers whether a specific service account may delete deployments in a namespace? CKA · Cluster architecture, installation and configuration

      1. Akubectl auth can-i delete deployments --as=system:serviceaccount:ns:name -n ns
      2. Bkubectl auth reconcile -f role.yaml
      3. Ckubectl get clusterrolebindings -o wide
      4. Dkubectl describe rolebinding -n ns

    4. 6. RBAC rules are purely additive: there is no deny rule. CKA · Cluster architecture, installation and configuration

      1. 7. Which environment variable must be set for etcdctl snapshot commands to work as expected on a modern cluster? CKA · Cluster architecture, installation and configuration

        1. AETCDCTL_API=2
        2. BETCDCTL_API=3
        3. CKUBECONFIG pointing at the etcd manifest
        4. DETCD_UNSUPPORTED_ARCH=1

      2. 8. After restoring an etcd snapshot to a new data directory on a kubeadm control plane, what else must be done? CKA · Cluster architecture, installation and configuration

        1. ARun kubeadm reset and rejoin the node
        2. BDelete and recreate the kube-apiserver deployment
        3. CRestart the kubelet only, which will detect the restore
        4. DPoint the etcd static pod manifest at the new data directory so the pod restarts against it

      3. 9. An etcd snapshot contains the cluster's Secrets as well as its other objects. CKA · Cluster architecture, installation and configuration

        1. 10. A node has a NoSchedule taint. A pod tolerates it. What follows? CKA · Workloads and scheduling

          1. AThe pod will be scheduled there only if no other node is available
          2. BThe pod may be scheduled there, but the taint alone does not attract it
          3. CThe pod will be scheduled there in preference to other nodes
          4. DThe pod is guaranteed to run there

        Check your answers

        The mock marks every answer on submit, explains it and breaks the result down by domain. It draws its questions in the published domain weights, and passes at 70% — The Linux Foundation does not publish the CKA pass mark on the exam page, and the real exam is hands-on. 70% is a convention of this site.

        Start the CKA (Kubernetes v1.35) mock exam

        Not ready yet? The Kubernetes course covers the same domains in short lessons, each with its own questions.

        Exam facts are taken from the official page: training.linuxfoundation.org. Questions here are written for practice and are not from the real exam.