CERTIFIED KUBERNETES ADMINISTRATOR
(CKA) MIDTERM EXAM--QUESTIONS AND
ANSWERS WITH RATIONALES/GRADED
A+/2026 UPDATE/100%
CKA Midterm Exam: Questions 1–60
Domain 1: Cluster Architecture, Installation & Configuration (Questions 1-12)
Q1. kubeadm Initialization
You need to initialize a control plane node with a specific pod network
CIDR 10.244.0.0/16 and an API server advertise address of 192.168.1.100. Which
command is correct?
A. kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-
address=192.168.1.100
B. kubeadm init --network-cidr=10.244.0.0/16 --advertise-address=192.168.1.100
C. kubeadm init --pod-cidr=10.244.0.0/16 --api-server=192.168.1.100
D. kubeadm init --cidr=10.244.0.0/16 --bind-address=192.168.1.100
Answer: A
Rationale: The kubeadm init command requires --pod-network-cidr to specify the
CIDR for pod networking (used by CNI plugins like Flannel, Calico). --apiserver-
advertise-address sets the IP address the API server advertises to other cluster
members.
,Q2. Certificate Renewal with kubeadm
Your cluster certificates expire in 30 days. Which command renews all certificates
immediately without downtime?
A. kubeadm certs renew all
B. kubeadm alpha certs renew all
C. kubeadm upgrade renew-certs
D. kubeadm certs regenerate
Answer: A
Rationale: kubeadm certs renew all renews all certificates managed by kubeadm.
After renewal, the API server and other control plane components must be
restarted (or the pods will automatically pick up the new certificates when they
restart). The command does not require cluster downtime.
Q3. Control Plane High Availability
You are building a 3-node control plane cluster with kubeadm. After initializing the
first node, how do you join additional control plane nodes?
A. kubeadm join with the --control-plane flag
B. kubeadm init --join-control-plane
C. kubeadm control-plane join
D. kubectl join --control-plane
Answer: A
Rationale: After initializing the first control plane node, use kubeadm join with
the --control-plane flag on additional nodes, along with the certificate key from
the first node. This adds them as etcd members and control plane components.
Q4. etcd Member Removal
An etcd member node is permanently offline. How do you remove it from the etcd
cluster?
, A. etcdctl member remove <member-id>
B. kubeadm reset etcd
C. kubectl delete etcd member
D. etcdctl cluster remove <node-name>
Answer: A
Rationale: Use etcdctl member list to identify the member ID, then etcdctl
member remove <member-id> to remove it. This maintains cluster health by
removing a failed member from the quorum calculation.
Q5. kubelet Configuration File Location
Where is the kubelet configuration file typically located on a node bootstrapped
with kubeadm?
A. /var/lib/kubelet/config.yaml
B. /etc/kubernetes/kubelet.conf
C. /etc/systemd/system/kubelet.conf
D. /var/lib/kubelet/kubeadm-flags.env
Answer: A
Rationale: kubeadm writes the kubelet configuration
to /var/lib/kubelet/config.yaml. The /etc/kubernetes/kubelet.conf file contains
the kubeconfig for the kubelet to authenticate to the API server.
Q6. Cluster Upgrade Order
You have a 4-node cluster (1 control plane, 3 workers). What is the correct order
for upgrading from v1.28 to v1.29?
A. Upgrade control plane → upgrade workers → upgrade kubelet on control plane
B. Upgrade kubelet on control plane → upgrade control plane → upgrade workers
C. Drain control plane → upgrade kubeadm/kubelet/kubectl → kubeadm upgrade
(CKA) MIDTERM EXAM--QUESTIONS AND
ANSWERS WITH RATIONALES/GRADED
A+/2026 UPDATE/100%
CKA Midterm Exam: Questions 1–60
Domain 1: Cluster Architecture, Installation & Configuration (Questions 1-12)
Q1. kubeadm Initialization
You need to initialize a control plane node with a specific pod network
CIDR 10.244.0.0/16 and an API server advertise address of 192.168.1.100. Which
command is correct?
A. kubeadm init --pod-network-cidr=10.244.0.0/16 --apiserver-advertise-
address=192.168.1.100
B. kubeadm init --network-cidr=10.244.0.0/16 --advertise-address=192.168.1.100
C. kubeadm init --pod-cidr=10.244.0.0/16 --api-server=192.168.1.100
D. kubeadm init --cidr=10.244.0.0/16 --bind-address=192.168.1.100
Answer: A
Rationale: The kubeadm init command requires --pod-network-cidr to specify the
CIDR for pod networking (used by CNI plugins like Flannel, Calico). --apiserver-
advertise-address sets the IP address the API server advertises to other cluster
members.
,Q2. Certificate Renewal with kubeadm
Your cluster certificates expire in 30 days. Which command renews all certificates
immediately without downtime?
A. kubeadm certs renew all
B. kubeadm alpha certs renew all
C. kubeadm upgrade renew-certs
D. kubeadm certs regenerate
Answer: A
Rationale: kubeadm certs renew all renews all certificates managed by kubeadm.
After renewal, the API server and other control plane components must be
restarted (or the pods will automatically pick up the new certificates when they
restart). The command does not require cluster downtime.
Q3. Control Plane High Availability
You are building a 3-node control plane cluster with kubeadm. After initializing the
first node, how do you join additional control plane nodes?
A. kubeadm join with the --control-plane flag
B. kubeadm init --join-control-plane
C. kubeadm control-plane join
D. kubectl join --control-plane
Answer: A
Rationale: After initializing the first control plane node, use kubeadm join with
the --control-plane flag on additional nodes, along with the certificate key from
the first node. This adds them as etcd members and control plane components.
Q4. etcd Member Removal
An etcd member node is permanently offline. How do you remove it from the etcd
cluster?
, A. etcdctl member remove <member-id>
B. kubeadm reset etcd
C. kubectl delete etcd member
D. etcdctl cluster remove <node-name>
Answer: A
Rationale: Use etcdctl member list to identify the member ID, then etcdctl
member remove <member-id> to remove it. This maintains cluster health by
removing a failed member from the quorum calculation.
Q5. kubelet Configuration File Location
Where is the kubelet configuration file typically located on a node bootstrapped
with kubeadm?
A. /var/lib/kubelet/config.yaml
B. /etc/kubernetes/kubelet.conf
C. /etc/systemd/system/kubelet.conf
D. /var/lib/kubelet/kubeadm-flags.env
Answer: A
Rationale: kubeadm writes the kubelet configuration
to /var/lib/kubelet/config.yaml. The /etc/kubernetes/kubelet.conf file contains
the kubeconfig for the kubelet to authenticate to the API server.
Q6. Cluster Upgrade Order
You have a 4-node cluster (1 control plane, 3 workers). What is the correct order
for upgrading from v1.28 to v1.29?
A. Upgrade control plane → upgrade workers → upgrade kubelet on control plane
B. Upgrade kubelet on control plane → upgrade control plane → upgrade workers
C. Drain control plane → upgrade kubeadm/kubelet/kubectl → kubeadm upgrade
