How to Ace the CKA: Certified Kubernetes Administrator

Question 1 · Cluster Architecture, Installation & Configuration

You need to verify that an RBAC ClusterRole has the correct permissions without applying it to the cluster. Which command allows dry-run inspection?

• kubectl apply -f clusterrole.yaml --dry-run=client to validate syntax
• kubectl auth can-i create deployments as user to test permissions
• kubectl describe clusterrole rolename to see permissions
• RBAC roles must be applied to test them; dry-run is not available

Correct answer: kubectl apply -f clusterrole.yaml --dry-run=client to validate syntax

The --dry-run=client flag validates the manifest without applying it. kubectl auth can-i tests actual permissions but requires the role to exist. kubectl describe shows existing roles. Dry-run is available for validation.

Question 2 · Workloads & Scheduling

You need to deploy a web application with 3 replicas that automatically scales when CPU usage exceeds 80%. Which Kubernetes resources are required?

• A Deployment with 3 replicas and a manual scale procedure
• A Deployment with 3 initial replicas and a HorizontalPodAutoscaler targeting 80% CPU threshold
• A StatefulSet with 3 replicas and built-in auto-scaling via replicas field
• A Service with 3 endpoints and Ingress controller for scaling

Correct answer: A Deployment with 3 initial replicas and a HorizontalPodAutoscaler targeting 80% CPU threshold

HPA (HorizontalPodAutoscaler) automatically adjusts Deployment replicas based on metrics like CPU. The Deployment provides the base template. StatefulSets are for stateful workloads. Services and Ingress manage traffic, not scaling.

Question 3 · Services & Networking

You need to route traffic to a Service based on the hostname in the HTTP request. Which Kubernetes resource should you use?

• A Service with multiple ports
• An Ingress resource with host-based routing rules
• A NetworkPolicy to filter traffic by hostname
• A LoadBalancer service with hostname configuration

Correct answer: An Ingress resource with host-based routing rules

Ingress provides Layer 7 (HTTP) routing based on hostnames, paths, and other HTTP attributes. Services operate at Layer 4 and don't understand HTTP. NetworkPolicy filters network traffic but doesn't understand hostnames. LoadBalancer is Layer 4.

Question 4 · Storage

A StorageClass is created with provisioner: kubernetes.io/aws-ebs and reclaimPolicy: Delete. What happens to the EBS volume when a PVC using this StorageClass is deleted?

• The volume is retained and can be reused by manually creating a new PV
• The volume is automatically deleted from AWS
• The volume is moved to a read-only state but retained
• The volume creation request is denied until manual cleanup occurs

Correct answer: The volume is automatically deleted from AWS

reclaimPolicy: Delete instructs the storage provisioner to automatically delete the underlying storage resource when the PVC is deleted. This is the default behavior for dynamically provisioned volumes. Retain would keep the volume, read-only state isn't a valid reclaim policy, and denial of PVC deletion isn't how reclaimPolicy works.

Question 5 · Troubleshooting

A Node reports a status of NotReady. You need to investigate the cause. Which command should you run first?

• kubectl get nodes to see the node's age
• kubectl describe node <node-name> to check conditions and events
• kubectl logs kubelet to view kubelet logs directly
• kubectl top node <node-name> to check resource usage

Correct answer: kubectl describe node <node-name> to check conditions and events

kubectl describe node provides the Status, Conditions (Ready, MemoryPressure, DiskPressure, PIDPressure), and recent Events that explain why the node is NotReady. kubectl get nodes only shows the status without details, kubectl logs requires node access, and kubectl top only shows resource usage, not status conditions.