S
Certified Kubernetes Administrator (CKA) ACTUAL
PERFORMANCE TASK SIMULATION 2026/2027 | Hands-
On kubectl Tasks | No Multiple Choice | Exam Environment
Simulation | Pass Guaranteed - A+ Graded
Cluster Architecture, Installation & Configuration (4 tasks)
Task 1: Create a new ClusterRole named pod-reader that grants read-only access to pods across
all namespaces. Then bind this ClusterRole to the user jane in the default namespace using a
ClusterRoleBinding named jane-read-pods.
Correct Solution: kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods
then kubectl create clusterrolebinding jane-read-pods --clusterrole=pod-reader --user=jane --
namespace=default
Task 2: You have a kubeadm-managed cluster running Kubernetes v1.28.2. Upgrade the control
plane node to v1.29.0. Ensure the kubelet and kubectl are also upgraded. Use the kubeadm
upgrade command and appropriate package manager commands.
Correct Solution: kubectl drain control-plane-node --ignore-daemonsets then apt-get update &&
apt-get install -y kubeadm=1.29.0-00 then kubeadm upgrade apply v1.29.0 then apt-get install -y
kubelet=1.29.0-00 kubectl=1.29.0-00 then systemctl restart kubelet then kubectl uncordon
control-plane-node
Task 3: Create a snapshot backup of the etcd cluster running at https://127.0.0.1:2379 using the
etcdctl command. Save the snapshot to /var/backups/etcd-snapshot.db. Use the CA cert at
/etc/kubernetes/pki/etcd/ca.crt, client cert at /etc/kubernetes/pki/etcd/server.crt, and key at
/etc/kubernetes/pki/etcd/server.key.
Correct Solution: ETCDCTL_API=3 etcdctl snapshot save /var/backups/etcd-snapshot.db --
endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --
cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
, S
Task 4: Restore the etcd cluster from the snapshot located at /var/backups/etcd-snapshot.db to a
new data directory /var/lib/etcd-backup. Stop the kube-apiserver and etcd before restoring. Use
the same certificates as the backup task.
Correct Solution: systemctl stop kube-apiserver then systemctl stop etcd then ETCDCTL_API=3
etcdctl snapshot restore /var/backups/etcd-snapshot.db --data-dir=/var/lib/etcd-backup then
update etcd service to use new data directory and systemctl start etcd then systemctl start kube-
apiserver
Workloads & Scheduling (5 tasks)
Task 5: Create a Deployment named web-app in namespace production using image nginx:1.25
with 5 replicas. Expose the deployment on port 80. Ensure the deployment has resource requests
of 100m CPU and 128Mi memory, and limits of 500m CPU and 512Mi memory.
Correct Solution: kubectl create deployment web-app --image=nginx:1.25 --replicas=5 --port=80
-n production then kubectl set resources deployment web-app -n production --
requests=cpu=100m,memory=128Mi --limits=cpu=500m,memory=512Mi
Task 6: Create a DaemonSet named node-exporter in namespace monitoring using image
prom/node-exporter:v1.6. Ensure it runs on all nodes including control plane nodes by tolerating
the NoSchedule taint. Mount the host's /proc and /sys directories to the container at /host/proc
and /host/sys respectively.
Correct Solution: Create DaemonSet YAML with tolerations: - key: node-
role.kubernetes.io/control-plane operator: Exists effect: NoSchedule and hostPath volumes for
/proc and /sys, then kubectl apply -f daemonset.yaml -n monitoring
Task 7: A pod named frontend in namespace default is stuck in Pending state. Investigate why
and fix the issue. The pod requests 2 CPU cores but the cluster nodes only have 1 CPU available.
Reduce the CPU request to 500m without deleting the pod.
Correct Solution: kubectl describe pod frontend to identify insufficient CPU, then kubectl edit
pod frontend to change resources.requests.cpu: "2" to resources.requests.cpu: "500m" (or
recreate with corrected spec if immutable)
Task 8: Perform a rolling update of the deployment api-server in namespace default from image
api:v1.0 to api:v2.0. Ensure the update proceeds with max 1 unavailable pod and max surge of 1
new pod. Monitor the rollout status.
Certified Kubernetes Administrator (CKA) ACTUAL
PERFORMANCE TASK SIMULATION 2026/2027 | Hands-
On kubectl Tasks | No Multiple Choice | Exam Environment
Simulation | Pass Guaranteed - A+ Graded
Cluster Architecture, Installation & Configuration (4 tasks)
Task 1: Create a new ClusterRole named pod-reader that grants read-only access to pods across
all namespaces. Then bind this ClusterRole to the user jane in the default namespace using a
ClusterRoleBinding named jane-read-pods.
Correct Solution: kubectl create clusterrole pod-reader --verb=get,list,watch --resource=pods
then kubectl create clusterrolebinding jane-read-pods --clusterrole=pod-reader --user=jane --
namespace=default
Task 2: You have a kubeadm-managed cluster running Kubernetes v1.28.2. Upgrade the control
plane node to v1.29.0. Ensure the kubelet and kubectl are also upgraded. Use the kubeadm
upgrade command and appropriate package manager commands.
Correct Solution: kubectl drain control-plane-node --ignore-daemonsets then apt-get update &&
apt-get install -y kubeadm=1.29.0-00 then kubeadm upgrade apply v1.29.0 then apt-get install -y
kubelet=1.29.0-00 kubectl=1.29.0-00 then systemctl restart kubelet then kubectl uncordon
control-plane-node
Task 3: Create a snapshot backup of the etcd cluster running at https://127.0.0.1:2379 using the
etcdctl command. Save the snapshot to /var/backups/etcd-snapshot.db. Use the CA cert at
/etc/kubernetes/pki/etcd/ca.crt, client cert at /etc/kubernetes/pki/etcd/server.crt, and key at
/etc/kubernetes/pki/etcd/server.key.
Correct Solution: ETCDCTL_API=3 etcdctl snapshot save /var/backups/etcd-snapshot.db --
endpoints=https://127.0.0.1:2379 --cacert=/etc/kubernetes/pki/etcd/ca.crt --
cert=/etc/kubernetes/pki/etcd/server.crt --key=/etc/kubernetes/pki/etcd/server.key
, S
Task 4: Restore the etcd cluster from the snapshot located at /var/backups/etcd-snapshot.db to a
new data directory /var/lib/etcd-backup. Stop the kube-apiserver and etcd before restoring. Use
the same certificates as the backup task.
Correct Solution: systemctl stop kube-apiserver then systemctl stop etcd then ETCDCTL_API=3
etcdctl snapshot restore /var/backups/etcd-snapshot.db --data-dir=/var/lib/etcd-backup then
update etcd service to use new data directory and systemctl start etcd then systemctl start kube-
apiserver
Workloads & Scheduling (5 tasks)
Task 5: Create a Deployment named web-app in namespace production using image nginx:1.25
with 5 replicas. Expose the deployment on port 80. Ensure the deployment has resource requests
of 100m CPU and 128Mi memory, and limits of 500m CPU and 512Mi memory.
Correct Solution: kubectl create deployment web-app --image=nginx:1.25 --replicas=5 --port=80
-n production then kubectl set resources deployment web-app -n production --
requests=cpu=100m,memory=128Mi --limits=cpu=500m,memory=512Mi
Task 6: Create a DaemonSet named node-exporter in namespace monitoring using image
prom/node-exporter:v1.6. Ensure it runs on all nodes including control plane nodes by tolerating
the NoSchedule taint. Mount the host's /proc and /sys directories to the container at /host/proc
and /host/sys respectively.
Correct Solution: Create DaemonSet YAML with tolerations: - key: node-
role.kubernetes.io/control-plane operator: Exists effect: NoSchedule and hostPath volumes for
/proc and /sys, then kubectl apply -f daemonset.yaml -n monitoring
Task 7: A pod named frontend in namespace default is stuck in Pending state. Investigate why
and fix the issue. The pod requests 2 CPU cores but the cluster nodes only have 1 CPU available.
Reduce the CPU request to 500m without deleting the pod.
Correct Solution: kubectl describe pod frontend to identify insufficient CPU, then kubectl edit
pod frontend to change resources.requests.cpu: "2" to resources.requests.cpu: "500m" (or
recreate with corrected spec if immutable)
Task 8: Perform a rolling update of the deployment api-server in namespace default from image
api:v1.0 to api:v2.0. Ensure the update proceeds with max 1 unavailable pod and max surge of 1
new pod. Monitor the rollout status.
