Linux Foundation CKA Online Practice Questions and Exam Preparation

Linux Foundation CKA Online Questions & Answers

• Question 21:

  SIMULATION

  Get IP address of the pod - "nginx-dev"

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Kubect1 get po -o wide Using JsonPath kubect1 get pods -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

• Question 22:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh Cka000055

  Task

  Verify the cert-manager application which has been deployed to your cluster .

  Using kubectl, create a list of all cert-manager Custom Resource Definitions (CRDs ) and save it to ~/resources.yaml .

  You must use kubectl 's default output format.

  Do not set an output format.

  Failure to do so will result in a reduced score.

  Using kubectl, extract the documentation for the subject specification field of the Certificate Custom Resource and save it to ~/subject.yaml.

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Explanation Task Summary

  You need to: SSH into the correct node: cka000055 Use kubectl to list all cert-manager CRDs, and save that list to ~/resources.yaml Do not use any output format flags like -o yaml Extract the documentation for the spec.subject field of the Certificate custom resource and save it to ~/subject.yaml

  Step-by-Step Instructions Step 1: SSH into the node

  ssh cka000055

  Step 2: List cert-manager CRDs and save to a file

  First, identify all cert-manager CRDs:

  kubectl get crds | grep cert-manager

  Then extract them without specifying an output format:

  kubectl get crds | grep cert-manager | awk '{print $1}' | xargs kubectl get crd > ~/resources.yaml

  This saves the default kubectl get output to the required file without formatting flags.

  Step 3: Get documentation for spec.subject in the Certificate CRD

  Run the following command:

  kubectl explain certificate.spec.subject > ~/subject.yaml

  This extracts the field documentation and saves it to the specified file.

  If you're not sure of the resource, verify it exists:

  kubectl get crd certificates.cert-manager.io

  Command Summary

  ssh cka000055 kubectl get crds | grep cert-manager | awk '{print $1}' | xargs kubectl get crd > ~/resources.yaml kubectl explain certificate.spec.subject > ~/subject.yaml

• Question 23:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000051

  Context

  You manage a WordPress application. Some Pods are not starting because resource requests are too high. Your task is to prepare a Linux system for Kubernetes. Docker is already installed, but you need to configure it for kubeadm.

  Task

  Complete these tasks to prepare the system for Kubernetes:

  Set up cri-dockerd: Install the Debian package: ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb Debian packages are installed using dpkg. Enable and start the cri-docker service.

  Configure these system parameters: Set net.bridge.bridge-nf-call-iptables to 1

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Step 1: SSH into the correct host

  ssh cka000051 Required. Skipping this step results in a zero score.

  Step 2: Install the cri-dockerd Debian package

  sudo dpkg -i ~/cri-dockerd_0.3.9.3-0.ubuntu-jammy_amd64.deb If there are dependency issues, fix them with: sudo apt-get install -f

  Step 3: Enable and start the cri-docker service

  sudo systemctl enable cri-docker.service sudo systemctl start cri-docker.service

  Also enable and start the socket (recommended):

  sudo systemctl enable cri-docker.socket sudo systemctl start cri-docker.socket

  Step 4: Set net.bridge.bridge-nf-call-iptables to 1

  Temporarily:

  sudo sysctl net.bridge.bridge-nf-call-iptables=1

  To make it persistent, add this line to /etc/sysctl.conf or create a config file:

  echo "net.bridge.bridge-nf-call-iptables=1" | sudo tee /etc/sysctl.d/k8s.conf

  sudo sysctl --system

  Verification Commands

  # Check cri-docker status

  sudo systemctl status cri-docker.service

  # Check the system parameter

  sysctl net.bridge.bridge-nf-call-iptables

  You should see:

  net.bridge.bridge-nf-call-iptables = 1

• Question 24:

  SIMULATION

  You must connect to the correct host.

  Failure to do so may result in a zero score.

  [candidate@base] $ ssh cka000056

  Task

  Review and apply the appropriate NetworkPolicy from the provided YAML samples. Ensure that the chosen NetworkPolicy is not overly permissive, but allows communication between the frontend and backend Deployments, which run in the frontend and backend namespaces respectively. First, analyze the frontend and backend Deployments to determine the specific requirements for the NetworkPolicy that needs to be applied. Next, examine the NetworkPolicy YAML samples located in the ~/netpol folder. Failure to comply may result in a reduced score.

  ❗ Do not delete or modify the provided samples. Only apply one of them.

  Finally, apply the NetworkPolicy that enables communication between the frontend and backend Deployments, without being overly permissive.

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  1. SSH into the correct host

  ssh cka000056

  2. Analyze the Deployments

  Check the labels and ports used by the frontend and backend apps: kubectl get deployments -A -o wide

  kubectl describe deployment frontend -n frontend kubectl describe deployment backend -n backend Pay attention to:

  The labels used by the backend pods (e.g., app=backend)

  The ports exposed by backend containers (e.g., port 80 or 8080)

  The namespace separation: frontend ➝ frontend namespace, backend ➝ backend namespace

  3. Review NetworkPolicy samples

  List available files:

  ls ~/netpol

  Inspect each one:

  cat ~/netpol/.yaml

  You're looking for a NetworkPolicy that:

  Is created in the backend namespace

  Allows incoming connections from pods in the frontend namespace

  Has a specific podSelector (not empty, to avoid being overly permissive)

  Limits access to necessary ports only

  4. Apply the correct NetworkPolicy

  Once you've identified the correct YAML file, apply it:

  kubectl apply -f ~/netpol/.yaml

  Example Clues for the Correct File

  It should look something like this (example only):

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata:

  name: allow-frontend-to-backend namespace: backend spec: podSelector: matchLabels: app: backend ingress:

  -from:

  -namespaceSelector:

  matchLabels:

  name: frontend

  ports:

  -protocol: TCP

  -Ingress

• Question 25:

  SIMULATION

  A Kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the case, and perform any appropriate steps to bring the node to a Ready state, ensuring that any changes are made permanent.

  

  You can ssh to the failed node using:

  [student@node-1] $ | ssh Wk8s-node-0

  You can assume elevated privileges on the node with the following command:

  [student@w8ks-node-0] $ | sudo -i

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Solution:

  

  

  

• Question 26:

  SIMULATION

  Print pod name and start time to "/opt/pod-status" file

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  kubect1 get pods -o=jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.podIP}{"\n"}{end}'

• Question 27:

  SIMULATION

  Create a deployment spec file that will:

  Launch 7 replicas of the nginx Image with the label app_runtime_stage=dev deployment name: kual00201

  Save a copy of this spec file to /opt/KUAL00201/spec_deployment.yaml (or /opt/KUAL00201/spec_deployment.json).

  When you are done, clean up (delete) any new Kubernetes API object that you produced during this task.

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Solution:

  

  

• Question 28:

  SIMULATION

  

  Create a pod named kucc8 with a single app container for each of the following images running inside (there may be between 1 and 4 images specified): nginx + redis + memcached.

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Solution:

  

  

• Question 29:

  SIMULATION

  

  Task

  Create a new Ingress resource as follows: Name: echo Namespace : sound-repeater Exposing Service echoserver-service on

  http://example.org/echo using Service port 8080

  The availability of Service

  echoserver-service can be checked

  using the following command, which should return 200 :

  [candidate@cka000024] $ curl -o /de v/null -s -w "%{http_code}\n" http://example.org/echo

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  

  

  

• Question 30:

  SIMULATION

  

  Task Monitor the logs of pod bar and: Extract log lines corresponding to error file-not-found

  Write them to /opt/KUTR00101/bar

  Correct Answer. Check the answer in explanation.
  Check the answer in explanation.

  ---

  Solution: