10 beginner questions on the CKA curriculum v1.37: storage (access modes, reclaim policy), troubleshooting (container logs, node problems), workloads and scheduling (rollbacks, nodeSelector), cluster architecture (RBAC, kubeadm upgrades) and services and networking (NodePort, Gateway API). The real exam is hands-on; these questions check that you know the right command or field for each task.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A PersistentVolumeClaim requests the access mode ReadWriteOnce. What does this mode allow?

    • A. The volume can be mounted read-write by many nodes at the same time
    • B. The volume can be mounted read-write by a single node ✔ correct
    • C. The volume can be mounted read-only by many nodes
    • D. The volume can be written once and is read-only afterwards

    Answer: B. ReadWriteOnce lets the volume be mounted read-write by a single node (Pods on that node can share it). ReadWriteMany is for many nodes, ReadOnlyMany is read-only, and ReadWriteOncePod limits access to one Pod.

    Source: kubernetes.io/docs/concepts/storage/persistent-volumes/ · Domain: Storage

  2. With the Retain reclaim policy, deleting the PersistentVolumeClaim leaves the PersistentVolume and its data in place, and the volume must be reclaimed manually.

    • A. True ✔ correct
    • B. False

    Answer: A. True. When the claim is deleted, a Retain volume still exists and is marked Released, keeping the previous claimant's data until an administrator cleans it up. The Delete policy removes the volume and its backing storage.

    Source: kubernetes.io/docs/concepts/storage/persistent-volumes/ · Domain: Storage

  3. A Pod named api is in CrashLoopBackOff. An administrator wants to read the logs of the container instance that crashed, not the one that just restarted. Which command shows them?

    • A. kubectl logs api --previous ✔ correct
    • B. kubectl logs api --since=0
    • C. kubectl get events api
    • D. kubectl top pod api

    Answer: A. kubectl logs --previous (-p) prints the logs of the previous instance of the container, which shows why it crashed. kubectl top shows CPU and memory use, not logs.

    Source: kubernetes.io/docs/reference/kubectl/generated/kubectl_logs/ · Domain: Troubleshooting

  4. A worker node in a kubeadm cluster shows NotReady. After SSH to the node, which first check is most useful?

    • A. Run kubeadm init again on the worker node
    • B. Delete every Pod in the kube-system namespace
    • C. Check the kubelet with systemctl status kubelet and journalctl -u kubelet ✔ correct
    • D. Restart the API server on the worker node

    Answer: C. The kubelet runs as a systemd service on each node and reports node status. If it is stopped or failing, the node becomes NotReady, and its journal shows why. kubeadm init creates a new control plane and is wrong here.

    Source: kubernetes.io/docs/tasks/debug/debug-cluster/ · Domain: Troubleshooting

  5. A new image version of the Deployment web is failing. Which command returns the Deployment to its previous revision?

    • A. kubectl rollout restart deployment/web
    • B. kubectl rollout pause deployment/web
    • C. kubectl delete deployment/web --previous
    • D. kubectl rollout undo deployment/web ✔ correct

    Answer: D. kubectl rollout undo rolls back to the previous revision (add --to-revision for a specific one). rollout restart restarts Pods with the same template, and rollout pause only stops further rollout steps.

    Source: kubernetes.io/docs/concepts/workloads/controllers/deployment/ · Domain: Workloads & Scheduling

  6. A Pod must run only on nodes labeled disktype=ssd. Which Pod spec field is the simplest way to do this?

    • A. nodeSelector ✔ correct
    • B. tolerations
    • C. priorityClassName
    • D. hostNetwork

    Answer: A. nodeSelector lists node labels, and the scheduler places the Pod only on nodes that have all of them. Tolerations only allow a Pod onto tainted nodes; they do not force it onto particular nodes.

    Source: kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ · Domain: Workloads & Scheduling

  7. An administrator must allow the user jane to list Pods only in the namespace dev. Which RBAC objects fit best?

    • A. A ClusterRole and a ClusterRoleBinding
    • B. A Role and a RoleBinding in the dev namespace ✔ correct
    • C. A ServiceAccount and a Secret in dev
    • D. A NetworkPolicy in the dev namespace

    Answer: B. A Role grants permissions within one namespace, and a RoleBinding in the same namespace grants that Role to a user. A ClusterRoleBinding would grant the permissions in every namespace, which is more than required.

    Source: kubernetes.io/docs/reference/access-authn-authz/rbac/ · Domain: Cluster Architecture, Installation & Configuration

  8. An administrator upgrades a kubeadm cluster to a new patch release of v1.37 and has already upgraded the kubeadm package on the first control plane node. Which two kubeadm commands are run next on that node? (Select TWO)

    • A. kubeadm upgrade plan ✔ correct
    • B. kubeadm upgrade apply v1.37.x ✔ correct
    • C. kubeadm upgrade node
    • D. kubeadm reset -f
    • E. kubeadm token create --print-join-command

    Answer: A, B. On the first control plane node you check the upgrade with kubeadm upgrade plan and perform it with kubeadm upgrade apply. kubeadm upgrade node is for the other control plane nodes and workers; reset wipes the node.

    Source: kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/ · Domain: Cluster Architecture, Installation & Configuration

  9. A team must reach a Service from outside the cluster on a static port on every node's IP address, without a cloud load balancer. Which Service type should it use?

    • A. ClusterIP
    • B. ExternalName
    • C. NodePort ✔ correct
    • D. Headless (clusterIP: None)

    Answer: C. A NodePort Service opens the same port (by default from 30000 to 32767) on every node and forwards it to the Service. ClusterIP is reachable only inside the cluster, and ExternalName just returns a DNS CNAME.

    Source: kubernetes.io/docs/concepts/services-networking/service/ · Domain: Services & Networking

  10. In the Gateway API, which resource defines HTTP routing rules, such as host names and path matches, that send traffic from a Gateway listener to backend Services?

    • A. GatewayClass
    • B. IngressClass
    • C. EndpointSlice
    • D. HTTPRoute ✔ correct

    Answer: D. An HTTPRoute attaches to a Gateway and holds the HTTP matching rules and backend references. A GatewayClass names the controller that implements Gateways, and the Gateway itself defines the listeners.

    Source: kubernetes.io/docs/concepts/services-networking/gateway/ · Domain: Services & Networking

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CNCF / Linux Foundation exam objectives (CNCF CKA Curriculum v1.37 (exam based on Kubernetes v1.37)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CNCF / Linux Foundation; exam names are trademarks of their owners. Official exam page: training.linuxfoundation.org/certification/certified-kubernetes-admini.

Last modified: Sunday, 25 October 2026, 9:57 PM