Authentic Best resources for CKA Test Engine Practice Exam
[2025] CKA PDF Questions - Perfect Prospect To Go With TestPDF Practice Exam
NEW QUESTION # 26
Updates to dynamic user group membership are automatic therefore using dynamic user groups instead of static group objects allows you to:
- A. respond to changes in user behavior or potential threats without manual policy changes
- B. respond to changes in user behavior or potential threats without automatic policy changes
- C. respond to changes in user behavior and confirmed threats with manual policy changes
- D. respond to changes in user behavior or potential threats using manual policy changes
Answer: A
NEW QUESTION # 27
View certificate details in /etc/kubernetes/pki
Answer:
Explanation:
// Verify Public Key / Certificate file Openssl x509 -in certificate.crt -noout -text // Verify Private Key Openssl rsa -in "private-key" -check // Verify CSR Openssl req -text -noout -verify
NEW QUESTION # 28
Score: 7%
Task
Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.
Further ensure that the new NetworkPolicy:
* does not allow access to Pods, which don't listen on port 9000
* does not allow access from Pods, which are not in namespace my-app
Answer:
Explanation:
Solution:
#network.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: internal
spec:
podSelector:
matchLabels: {
}
policyTypes:
- Ingress
ingress:
- from:
- podSelector: {
}
ports:
- protocol: TCP
port: 8080
#spec.podSelector namespace pod
kubectl create -f network.yaml
NEW QUESTION # 29
You are tasked with setting up fine-grained access control for a Kubernetes cluster running a microservices application. You need to ensure that developers can only access the resources related to their specific microservices while preventing them from accessing or modifying other services' resources. Define RBAC roles and permissions to achieve this, including details of the resources, verbs, and namespaces involved. Consider the following:
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Specify the YAML configurations for roles, role bindings, and service accounts to enable the required access control, ensuring developers only have access to their respective microservice's resources within their assigned namespaces. Solution (Step by Step) : 1. Define Roles:
2. Create Service Accounts: apiVersion: vl kind: ServiceAccount metadata: name: order-service-sa namespace: order-service-ns -- apiVersion: vl kind: ServiceAccount metadata: name: payment-service-sa namespace: payment-service-ns -- apiVersion: vl kind: ServiceAccount metadata: name: inventory-service-sa namespace: inventory-service-ns 3. Bind Roles to Service Accounts: -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: order-service-dev-binding namespace: order-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: order-service-dev subjects: - kind: ServiceAccount name: order-service-sa namespace: order-service-ns -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: payment-service-dev-binding namespace: payment-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: payment-service-dev subjects: - kind: ServiceAccount name: payment-service-sa namespace: payment-service-ns -- apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: inventory-service-dev-binding namespace: inventory-service-ns roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: inventory-service-dev subjects: - kind: ServiceAccount name: inventory-service-sa namespace: inventory-service-ns 4. Assign Service Accounts to Users: This step requires external authentication mechanisms like OIDC or LDAP. Assuming you have these mechanisms set up, you can associate the service accounts with specific users ('[email protected]' , '[email protected]', and '[email protected]') using the configured authentication provider. Roles: Define the specific permissions for each microservice developer within their respective namespaces. The roles allow developers to access resources like Pods, Deployments, Services, ConfigMaps, and Secrets related to their assigned microservice. Service Accounts: Service accounts are created in each namespace for each microservice, representing the identity of the developer group. Role Bindings: Role bindings connect the defined roles with the service accounts, granting the associated permissions. User Association: This step connects the service accounts with individual developers through external authentication mechanisms, enabling them to utilize the assigned permissions. By following these steps, you ensure that developers can only access and manage resources associated with their respective microservices within their assigned namespaces. This fine-grained access control policy effectively restricts access and prevents developers from interfering with other microservices or resources. ,
NEW QUESTION # 30
You have two Kubernetes clusters, 'cluster 1' and 'cluster2, and you need to establish a connection between the two clusters using a NetworkPolicy. You want to allow all traffic from pods in 'cluster 1' to pods in 'cluster? , and you need to implement this using an Ingress rule. What steps are required to configure this connection?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1 . Create a NetworkPolicy in 'cluster?
- Create a NetworkPolicy in 'cluster? that allows all traffic from pods in 'cluster 1'
- Code:
2. Create an Ingress in 'cluster2: - Create an Ingress in 'cluster? that routes traffic from 'clusterl' to the appropriate services or pods in cluster?. - Code:
3. Apply the Configurations: - Apply the NetworkPolicy and Ingress resources to the respective clusters using 'kubectl apply -f networkpolicy.yaml' and 'kubectl apply -f ingress.yaml'.
NEW QUESTION # 31
An Administrator is configuring Authentication Enforcement and they would like to create an exemption rule to exempt a specific group from authentication. Which authentication enforcement object should they select?
- A. default-no-captive-port
- B. default-browser-challenge
- C. default-authentication-bypass
- D. default-web-form
Answer: A
NEW QUESTION # 32
Create a busybox pod which executes this command sleep 3600 with the service account admin and verify
- A. kubectl run busybox --image=busybox --restart=Always --dry-run
-o yaml -- /bin/sh -c "sleep 3600" > busybox.yml
// Edit busybox.yaml file
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: busybox
name: busybox
spec:
serviceAccountName: admin
containers:
- args:
- /bin/sh
- -c
- sleep 3800
image: busybox
name: busybox
restartPolicy: Always
// verify
K kubectl describe po busybox - B. kubectl run busybox --image=busybox --restart=Always --dry-run
-o yaml -- /bin/sh -c "sleep 3600" > busybox.yml
// Edit busybox.yaml file
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: null
labels:
run: busybox
name: busybox
spec:
serviceAccountName: admin
containers:
- args:
- /bin/sh
- -c
- sleep 3600
image: busybox
name: busybox
restartPolicy: Always
// verify
K kubectl describe po busybox
Answer: B
NEW QUESTION # 33
Score: 7%
Task
Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.
Further ensure that the new NetworkPolicy:
* does not allow access to Pods, which don't listen on port 9000
* does not allow access from Pods, which are not in namespace my-app
Answer:
Explanation:
See the solution below.
Explanation
Solution:
#network.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-port-from-namespace
namespace: internal
spec:
podSelector:
matchLabels: {
}
policyTypes:
- Ingress
ingress:
- from:
- podSelector: {
}
ports:
- protocol: TCP
port: 8080
#spec.podSelector namespace pod
kubectl create -f network.yaml
NEW QUESTION # 34
How can an administrator configure the NGFW to automatically quarantine a device using Global Protect?
- A. by exporting the list of quarantined devices to a pdf or csv file by selecting PDF/CSV at the bottom of the Device Quarantine page and leveraging the appropriate XSOAR playbook.
- B. by adding the device's Host ID to a quarantine list and configure GlobalProtect to prevent users from connecting to the GlobalProtect gateway from a quarantined device.
- C. by using security policies, log forwarding profiles, and log settings.
- D. There is no native auto-quarantine feature so a custom script would need to be leveraged.
Answer: B
NEW QUESTION # 35
Score: 5%
Task
Monitor the logs of pod bar and:
* Extract log lines corresponding to error file-not-found
* Write them to /opt/KUTR00101/bar
Answer:
Explanation:
Solution:
kubectl logs bar | grep 'unable-to-access-website' > /opt/KUTR00101/bar cat /opt/KUTR00101/bar
NEW QUESTION # 36
Create a deployment named "myapp" that having 2 replicas with
nginx image and expose deployment as service named "myservice"
- A. // Create a YAML Template
kubectl create deploy myapp --image=nginx --dry-run -o yaml >
myapp.yaml
//Update replicas=2 in myapp.yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: myapp
name: myapp
spec:
replicas: 2
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- image: nginx
name: nginx
// Create deployment
kubectl create -f myapp.yaml
// Creating YAML template for service
kubectl expose deployment myapp --type=ClusterIP --port=60 --
target-port=60 --name=myservice --dry-run -o yaml >
myservice.yaml
YAML File:
apiVersion: v1
kind: Service
metadata:
labels:
app: myapp
name: myservice
spec:
ports:
- port: 60
protocol: TCP
targetPort: 80
selector:
app: myapp
type: ClusterIP
kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S)
AGE
kubernetes ClusterIP 10.2.0.1 <none> 443/TCP
158d
myservice ClusterIP 10.2.96.175 <none> 80/TCP
40s - B. // Create a YAML Template
kubectl create deploy myapp --image=nginx --dry-run -o yaml >
myapp.yaml
//Update replicas=2 in myapp.yaml file
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: myapp
name: myapp
spec:
replicas: 2
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- image: nginx
name: nginx
// Create deployment
kubectl create -f myapp.yaml
// Creating YAML template for service
kubectl expose deployment myapp --type=ClusterIP --port=80 --
target-port=80 --name=myservice --dry-run -o yaml >
myservice.yaml
YAML File:
apiVersion: v1
kind: Service
metadata:
labels:
app: myapp
name: myservice
spec:
ports:
- port: 80
protocol: TCP
targetPort: 80
selector:
app: myapp
type: ClusterIP
kubectl get svc
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S)
AGE
kubernetes ClusterIP 10.2.0.1 <none> 443/TCP
158d
myservice ClusterIP 10.2.96.175 <none> 80/TCP
40s
Answer: B
NEW QUESTION # 37
Scale the deployment from 5 replicas to 20 replicas and verify
Answer:
Explanation:
kubectl scale deploy webapp --replicas=20 kubectl get deploy webapp kubectl get po -l app=webapp
NEW QUESTION # 38
List the nginx pod with custom columns POD_NAME and POD_STATUS
Answer:
Explanation:
kubectl get po -o=custom-columns="POD_NAME:.metadata.name,
POD_STATUS:.status.containerStatuses[].state"
NEW QUESTION # 39
Scale the deployment webserver to
Answer:
Explanation:
See the solution below.
Explanation
solution
NEW QUESTION # 40
Undo the deployment with the previous version and verify
everything is Ok
Answer:
Explanation:
kubectl rollout undo deploy webapp kubectl rollout status deploy webapp kubectl get pods
NEW QUESTION # 41
You have a Kubernetes cluster with a multi-tenant setup where different teams manage their own applications. You need to enforce a policy where only developers from the "engineering" team can create deployments for applications within the "dev" namespace. How would you implement this using RBAC?
Answer:
Explanation:
See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
Step 1: Create a Role for the "engineering" team
Step 2: Create a RoleBinding to assign the role to the "engineering" team
- The Role defines the permissions for the "engineering" team, allowing them to create deployments in the "dev" namespace. - The RoleBinding associates the "engineering-role" with the user "[email protected]" (representing a developer from the "engineering" team). Step 3: Validate the setup - A developer from the "engineering" team should be able to create deployments in the "dev" namespace. - Other users or teams without the appropriate permissions should be prevented from creating deployments in the "dev" namespace.
NEW QUESTION # 42
Create a Job with an image node which prints node version and
verifies there is a pod created for this job
- A. kubectl create job nodeversion --image=node -- node -v
kubectl get job -w
kubectl get pod
YAML File:
apiVersion: batch/v1
kind: Job
metadata:
labels:
job-name: nodeversion
name: nodeversion
spec:
completions: 1
parallelism: 1
labels:
job-name: nodeversion
spec:
containers:
- command:
- node
- -v
image: node
imagePullPolicy: Always
name: nodeversion
restartPolicy: Never - B. kubectl create job nodeversion --image=node -- node -v
kubectl get job -w
kubectl get pod
YAML File:
apiVersion: batch/v1
kind: Job
metadata:
labels:
job-name: nodeversion
name: nodeversion
spec:
completions: 1
parallelism: 1
selector:
matchLabels:
job-name: nodeversion
template:
metadata:
labels:
job-name: nodeversion
spec:
containers:
- command:
- node
- -v
image: node
imagePullPolicy: Always
name: nodeversion
restartPolicy: Never
Answer: B
NEW QUESTION # 43
List "nginx-dev" and "nginx-prod" pod and delete those pods
- A. kubect1 get pods -o wide
kubectl delete po "nginx-dev" kubectl delete po "nginx-prod" - B. kubect1 get pods -o wide
kubectl delete po "nginx-dev" kubectl delete po "nginx-prod"
Answer: A
NEW QUESTION # 44
Create a daemonset named "Prometheus-monitoring" using image=prom/Prometheus which runs in all the nodes in the cluster. Verify the pod running in all the nodes
- A. vim promo-ds.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: prometheus-monitoring
spec:
selector:
matchLabels:
name: prometheus
template:
metadata:
labels:
name: prometheus
spec:
tolerations:
# remove it if your masters can't run pods
- key: node-role.kubernetes.io/master
effect: NoSchedule
containers:
- name: prometheus-container
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
volumes:
- name: varlog
emptyDir: {}
- name: varlibdockercontainers
emptyDir: {}
kubectl apply -f promo-ds.yaml
NOTE: Deamonset will get scheduled to "default" namespace, to
schedule deamonset in specific namespace, then add
"namespace" field in metadata
//Verify
kubectl get ds
NAME DESIRED CURRENT READY UP-TO-DATE
AVAILABLE NODE SELECTOR AGE
prometheus-monitoring 8 8 0 6
0 <none> 7s
kubectl get no # To get list of nodes in the cluster
// There are 6 nodes in the cluster, so a pod gets scheduled to
each node in the cluster - B. vim promo-ds.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
name: prometheus-monitoring
spec:
selector:
matchLabels:
name: prometheus
template:
metadata:
labels:
name: prometheus
spec:
tolerations:
# remove it if your masters can't run pods
- key: node-role.kubernetes.io/master
effect: NoSchedule
containers:
- name: prometheus-container
image: prom/prometheus
volumeMounts:
- name: varlog
mountPath: /var/log
- name: varlibdockercontainers
mountPath: /var/lib/docker/containers
readOnly: true
volumes:
- name: varlog
emptyDir: {}
- name: varlibdockercontainers
emptyDir: {}
kubectl apply -f promo-ds.yaml
NOTE: Deamonset will get scheduled to "default" namespace, to
schedule deamonset in specific namespace, then add
"namespace" field in metadata
//Verify
kubectl get ds
NAME DESIRED CURRENT READY UP-TO-DATE
AVAILABLE NODE SELECTOR AGE
prometheus-monitoring 6 6 0 6
0 <none> 7s
kubectl get no # To get list of nodes in the cluster
// There are 6 nodes in the cluster, so a pod gets scheduled to
each node in the cluster
Answer: B
NEW QUESTION # 45
Score: 4%
Task
Scale the deployment presentation to 6 pods.
Answer:
Explanation:
Solution:
kubectl get deployment
kubectl scale deployment.apps/presentation --replicas=6
NEW QUESTION # 46
Create a PersistentVolumeClaim of at least 3Gi storage and access mode ReadWriteOnce and verify status is Bound
- A. vim task-pv-claim.yaml
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: task-pv-claim
spec:
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 3Gi
kubectl apply -f task-pv-claim.yaml
//Verify
kubectl get pv
NAME CAPACITY ACCESS
MODES RECLAIM POLICY STATUS CLAIM
STORAGECLASS REASON AGE
task-pv-volume 5Gi RWO
Retain Bound default/task-pv-claim
6m16s
kubectl get pvc
NAME STATUS VOLUME
CAPACITY ACCESS MODES STORAGECLASS AGE
task-pv-claim Bound task-pv-volume
5Gi RWO 6s - B. vim task-pv-claim.yaml
apiVersion: v2
kind: PersistentVolumeClaim
metadata:
name: task-pv-claim
spec:
storageClassName: ""
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 4Gi
kubectl apply -f task-pv-claim.yaml
//Verify
kubectl get pv
NAME CAPACITY ACCESS
MODES RECLAIM POLICY STATUS CLAIM
STORAGECLASS REASON AGE
task-pv-volume 4Gi RWO
Retain Bound default/task-pv-claim
6m16s
kubectl get pvc
NAME STATUS VOLUME
CAPACITY ACCESS MODES STORAGECLASS AGE
task-pv-claim Bound task-pv-volume
5Gi RWO 6s
Answer: A
NEW QUESTION # 47
Check the Image version of nginx-dev pod using jsonpath
Answer:
Explanation:
kubect1 get po nginx-dev -o
jsonpath='{.spec.containers[].image}{"\n"}'
NEW QUESTION # 48
Create a redis pod and mount "redis-config" as "redis.conf"
inside redis container, name the config volume as "redis-volume"
redis-config path - /opt/redis-config
- A. 0
- B. Pending
- C. 1
Answer: B
NEW QUESTION # 49
Score: 13%
Task
A Kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the case, and perform any appropriate steps to bring the node to a Ready state, ensuring that any changes are made permanent.
Answer:
Explanation:
See the solution below.
Explanation
Solution:
sudo -i
systemctl status kubelet
systemctl start kubelet
systemctl enable kubelet
NEW QUESTION # 50
......
The CKA certification is valid for three years, and candidates can renew their certification by retaking the exam or by earning a higher-level certification. Certified Kubernetes Administrator (CKA) Program Exam certification is recognized by industry leaders, including AWS, Google Cloud, and Red Hat. Certified Kubernetes Administrator (CKA) Program Exam certification also provides access to a network of certified professionals and resources, including training, events, and community support. Overall, the CKA certification is an excellent way to demonstrate your expertise in Kubernetes and advance your career in the cloud-native ecosystem.
Best updated resource for CKA Online Practice Exam: https://www.testpdf.com/CKA-exam-braindumps.html
Realistic Practice CKA Certified Kubernetes Administrator (CKA) Program Exam Exam Braindumps: https://drive.google.com/open?id=1teRLP70b9Far_9ImJpmZirwi7G5L6ztl
