[Oct 27, 2025] CKA Free Exam Questions with Quality Guaranteed [Q22-Q40]

4/5 - (1 vote)

[Oct 27, 2025] CKA Free Exam Questions with Quality Guaranteed

CKA Free Exam Files Downloaded Instantly

Levels of Certification

The CNCF Certified Kubernetes Administrator exam conducts 4 levels of certification covering different areas of Cloud Native Computing. Charges vary by level with the highest level of certification being the only one that is required in order to obtain the CNCF Certified Kubernetes Administrator certification. Subjects to be tested for each level are listed below.
Future changes to the certification levels and pricing are possible.

NO.22 Score: 4%

Task
Set the node named ek8s-node-1 as unavailable and reschedule all the pods running on it.

NO.23 From the pod label name=cpu-utilizer, find pods running high CPU workloads and write the name of the pod consuming most CPU to the file /opt/KUTR00102/KUTR00102.txt (which already exists).

NO.24 A Kubernetes worker node, named wk8s-node-0 is in state NotReady. Investigate why this is the case, and perform any appropriate steps to bring the node to a state, ensuring that any changes are made permanent.
You can ssh to the failed node using:
[student@node-1] $ | ssh Wk8s-node-0
You can assume elevated privileges on the node with the following command:
[student@w8ks-node-0] $ | sudo -i

NO.25 Create a deployment called webapp with image nginx having 5 replicas in it, put the file in /tmp directory with named webapp.yaml

//Create a file using dry run command
kubectl create deploy –image=nginx –dry-run -o yaml >
/tmp/webapp.yaml
// Now, edit file webapp.yaml and update replicas=5
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: webapp
name: webapp
spec:
replicas: 5
selector:
matchLabels:
app: webapp
template:
metadata:
labels:
app: webapp
spec:
containers:
– image: nginx
name: nginx
Note: Search “deployment” in kubernetes.io site , you will get
the page
https://kubernetes.io/docs/concepts/workloads/controllers/deplo
yment/
// Verify the Deployment
kubectl get deploy webapp –show-labels
// Output the YAML file of the deployment webapp
kubectl get deploy webapp -o yaml

//Create a file using dry run command
kubectl create deploy –image=nginx –dry-run -o yaml >
/tmp/webapp.yaml
// Now, edit file webapp.yaml and update replicas=5
apiVersion: apps/v1
kind: Deployment
metadata:
labels:
app: webapp
name: webapp
spec:
replicas: 5
selector:
matchLabels:
app: webapp
template:
metadata:
labels:
Note: Search “deployment” in kubernetes.io site , you will get
the page
https://kubernetes.io/docs/concepts/workloads/controllers/deplo
yment/
// Verify the Deployment
kubectl get deploy webapp –show-labels
// Output the YAML file of the deployment webapp
kubectl get deploy webapp -o yaml

NO.26 You are running a stateful application using a StatefulSet. How do you ensure that the application data is preserved during a rolling update?

NO.27 Create a ETCD backup of kubernetes cluster
Note : You don’t need to memorize command, refer –
https://kubernetes.io/docs/tasks/administer-cluster/configureupgrade-etcd/ during exam

ETCDCTL_API=3 etcdctl –endpoints=[ENDPOINT] –cacert=[CA CERT]
–cert=[ETCD SERVER CERT] –key=[ETCD SERVER KEY] snapshot save
[BACKUP FILE NAME]
In exam, cluster setup is done with kubeadm , this means ETCD
used by the kubernetes cluster is coming from static pod.
kubectl get pod -n kube-system
kubectl describe pod etcd-master -n kube-system
You can locate the information on
endpoint: – advertise-client-urls=https://172.17.0.15:2379
ca certificate: – trusted-cafile=/etc/kubernetes/pki/etcd/ca.crt
server certificate : – certfile=/etc/kubernetes/pki/etcd/server.crt
key: – key-file=/etc/kubernetes/pki/etcd/server.key
To Create backup
export ETCDCTL_API=3
(or)
ETCDCTL_API=3 etcdctl ETCDCTL_API=3 etcdctl —
endpoints=https://172.17.0.15:2379 —
cacert=/etc/kubernetes/pki/etcd/ca.crt —
cert=/etc/kubernetes/pki/etcd/server.crt —
key=/etc/kubernetes/pki/etcd/server.key snapshot save etcdsnapshot.db
//Verify
ETCDCTL_API=3 etcdctl –write-out=table snapshot status
snapshot.db

ETCDCTL_API=3 etcdctl –endpoints=[ENDPOINT] –cacert=[CA CERT]
–cert=[ETCD SERVER CERT] –key=[ETCD SERVER KEY] snapshot save
[BACKUP FILE NAME]
In exam, cluster setup is done with kubeadm , this means ETCD
used by the kubernetes cluster is coming from static pod.
kubectl get pod -n kube-system
kubectl describe pod etcd-master -n kube-system
You can locate the information on
endpoint: – advertise-client-urls=https://172.16.0.18:2379
ca certificate: – trusted-cafile=/etc/kubernetes/pki/etcd/ca.crt
server certificate : – certfile=/etc/kubernetes/pki/etcd/server.crt
key: – key-file=/etc/kubernetes/pki/etcd/server.key
To Create backup
export ETCDCTL_API=3
(or)
ETCDCTL_API=3 etcdctl ETCDCTL_API=3 etcdctl —
endpoints=https://172.17.0.15:2379 —
key=/etc/kubernetes/pki/etcd/server.key snapshot save etcdsnapshot.db
//Verify
ETCDCTL_API=3 etcdctl –write-out=table snapshot status
snapshot.db

NO.28 Create an nginx pod which loads the secret as environment variables

// create a yml file
kubectl run nginx –image=nginx –restart=Never –dry-run -o
yaml > nginx.yml
// add env section below and create
vim nginx.yaml
apiVersion: v1
kind: Pod
metadata:
labels:
run: nginx
name: nginx
spec:
containers:
– image: nginx
name: nginx
envFrom:
– secretRef:
name: my-secret
restartPolicy: Never
kubectl apply -f nginx.yaml
//verify
kubectl exec -it nginx – env

// create a yml file
kubectl run nginx –image=nginx –restart=Never –dry-run -o
yaml > nginx.yml
// add env section below and create
vim nginx.yaml
run: nginx
name: nginx
spec:
containers:
– image: nginx
name: nginx
envFrom:
– secretRef:
name: my-secret
restartPolicy: Never
kubectl apply -f nginx.yaml
//verify
kubectl exec -it nginx – env

NO.29 Create a NetworkPolicy which denies all ingress traffic

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: {}
policyTypes:
– Ingress

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny
spec:
podSelector: ()
policyTypes:
– Ingress

NO.30 Create a Pod nginx and specify both CPU, memory requests and limits together and verify.

kubectl run nginx-request –image=nginx –restart=Always –dryrun -o yaml > nginx-request.yml
// add the resources section and create
apiVersion: v1
kind: Pod
metadata:
labels:
run: nginx
name: nginx
resources:
requests:
memory: “100Mi”
cpu: “0.4”
limits:
memory: “200Mi”
cpu: “7”
restartPolicy: Always
k kubectl apply -f nginx-request.yaml
// Verify
Kubectl top po

kubectl run nginx-request –image=nginx –restart=Always –dryrun -o yaml > nginx-request.yml
// add the resources section and create
apiVersion: v1
kind: Pod
metadata:
labels:
run: nginx
name: nginx-request
spec:
containers:
– image: nginx
name: nginx
resources:
requests:
memory: “100Mi”
cpu: “0.5”
limits:
memory: “200Mi”
cpu: “1”
restartPolicy: Always
k kubectl apply -f nginx-request.yaml
// Verify
Kubectl top po

NO.31 Print all pod name and all image name and write it to a file
name “/opt/pod-details.txt”

NO.32 Score: 4%

Task
Create a pod named kucc8 with a single app container for each of the following images running inside (there may be between 1 and 4 images specified): nginx + redis + memcached .

NO.33 Check the Image version of nginx-dev pod using jsonpath

NO.34 You have a Deployment named ‘redis-deployment’ running a Redis server. You need to configure Redis with a specific configuration file stored in a ConfigMap named ‘redis-config’. The configuration file includes sensitive information like the Redis password. How do you ensure that the sensitive information remains secure while still being accessible to the Redis container?

NO.35 Create an nginx pod and list the pod with different levels of verbosity

NO.36 Score: 7%

Task
Reconfigure the existing deployment front-end and add a port specification named http exposing port 80/tcp of the existing container nginx.
Create a new service named front-end-svc exposing the container port http.
Configure the new service to also expose the individual Pods via a NodePort on the nodes on which they are scheduled.

NO.37 Create a pod with image nginx called nginx and allow traffic on port 80 See the solution below.

NO.38 You have a Deployment named ‘my-app’ running a web application with three replicas. The application is exposed using a ‘LoadBalancer’ service. You want to create a ‘ClusterlP’ service for internal communication within the Kubernetes cluster and route traffic from the ‘LoadBalancer’ service to the ‘ClusterlP’ service.

NO.39 Check the history of deployment

NO.40 Score: 7%

Task
Create a new NetworkPolicy named allow-port-from-namespace in the existing namespace echo. Ensure that the new NetworkPolicy allows Pods in namespace my-app to connect to port 9000 of Pods in namespace echo.
Further ensure that the new NetworkPolicy:
* does not allow access to Pods, which don’t listen on port 9000
* does not allow access from Pods, which are not in namespace my-app

The Certified Kubernetes Administrator (CKA) Program Exam is a certification exam offered by the Linux Foundation. CKA exam is designed to test an individual’s knowledge and skills related to Kubernetes administration, as well as their ability to work with various Kubernetes tools and resources. The CKA exam is a popular certification among IT professionals who are interested in building their knowledge of container orchestration and management.

Q&As with Explanations Verified & Correct Answers: https://www.real4prep.com/CKA-exam.html