CERTIFIED KUBERNETES ADMINISTRATOR (CKA)
PRACTICE TEST--Questions And Answers With
Rationales/Graded A+/2026 Update/100% Correct
Domain 1: Cluster Architecture, Installation & Configuration (25%)
Q1. Upgrading a Cluster Using kubeadm
You need to upgrade a Kubernetes cluster from v1.28 to v1.29. On the control
plane node, which sequence of commands is correct?
• A. kubeadm upgrade plan → kubeadm upgrade apply v1.29.0 → kubectl
drain → upgrade kubelet → kubectl uncordon
• B. kubeadm upgrade apply v1.29.0 → kubeadm upgrade plan → upgrade
kubelet → kubectl drain
• C. kubectl drain → kubeadm upgrade plan → kubeadm upgrade apply
v1.29.0 → upgrade kubelet → kubectl uncordon
• D. apt-get update → apt-get upgrade kubeadm → kubeadm upgrade apply
v1.29.0
Answer: C
Rationale: The correct workflow for upgrading a control plane node
with kubeadm is: drain the node to safely evict workloads, check the upgrade
plan, apply the upgrade, upgrade the kubelet, then uncordon the node. This
ensures zero-downtime cluster maintenance.
Q2. etcd Backup and Restore
The etcd cluster must be backed up to /backup/etcd.db. Which command
correctly creates this snapshot?
, • A. etcdctl snapshot save /backup/etcd.db
• B. ETCDCTL_API=3 etcdctl snapshot save /backup/etcd.db --
endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=cert.crt --
key=key.key
• C. etcdctl backup save /backup/etcd.db
• D. kubectl snapshot etcd /backup/etcd.db
Answer: B
Rationale: etcdctl commands require ETCDCTL_API=3 and authentication
certificates for secure communication with the etcd server. The snapshot
command must include the correct endpoints and certificate paths to authorize
the operation.
Q3. kubelet Certificate Rotation
A worker node's kubelet certificate is about to expire. What enables automatic
renewal?
• A. Setting RotateKubeletServerCertificate: true in the kubelet config
• B. Manually running kubeadm certs renew on the node
• C. Restarting the kubelet service
• D. Deleting the expired certificate from /var/lib/kubelet/pki
Answer: A
Rationale: The RotateKubeletServerCertificate feature gate and configuration
setting enable the kubelet to request new certificates from the API server
automatically when the current certificate approaches expiration. This eliminates
manual renewal tasks.
Domain 2: Workloads & Scheduling (15%)
PRACTICE TEST--Questions And Answers With
Rationales/Graded A+/2026 Update/100% Correct
Domain 1: Cluster Architecture, Installation & Configuration (25%)
Q1. Upgrading a Cluster Using kubeadm
You need to upgrade a Kubernetes cluster from v1.28 to v1.29. On the control
plane node, which sequence of commands is correct?
• A. kubeadm upgrade plan → kubeadm upgrade apply v1.29.0 → kubectl
drain → upgrade kubelet → kubectl uncordon
• B. kubeadm upgrade apply v1.29.0 → kubeadm upgrade plan → upgrade
kubelet → kubectl drain
• C. kubectl drain → kubeadm upgrade plan → kubeadm upgrade apply
v1.29.0 → upgrade kubelet → kubectl uncordon
• D. apt-get update → apt-get upgrade kubeadm → kubeadm upgrade apply
v1.29.0
Answer: C
Rationale: The correct workflow for upgrading a control plane node
with kubeadm is: drain the node to safely evict workloads, check the upgrade
plan, apply the upgrade, upgrade the kubelet, then uncordon the node. This
ensures zero-downtime cluster maintenance.
Q2. etcd Backup and Restore
The etcd cluster must be backed up to /backup/etcd.db. Which command
correctly creates this snapshot?
, • A. etcdctl snapshot save /backup/etcd.db
• B. ETCDCTL_API=3 etcdctl snapshot save /backup/etcd.db --
endpoints=https://127.0.0.1:2379 --cacert=ca.crt --cert=cert.crt --
key=key.key
• C. etcdctl backup save /backup/etcd.db
• D. kubectl snapshot etcd /backup/etcd.db
Answer: B
Rationale: etcdctl commands require ETCDCTL_API=3 and authentication
certificates for secure communication with the etcd server. The snapshot
command must include the correct endpoints and certificate paths to authorize
the operation.
Q3. kubelet Certificate Rotation
A worker node's kubelet certificate is about to expire. What enables automatic
renewal?
• A. Setting RotateKubeletServerCertificate: true in the kubelet config
• B. Manually running kubeadm certs renew on the node
• C. Restarting the kubelet service
• D. Deleting the expired certificate from /var/lib/kubelet/pki
Answer: A
Rationale: The RotateKubeletServerCertificate feature gate and configuration
setting enable the kubelet to request new certificates from the API server
automatically when the current certificate approaches expiration. This eliminates
manual renewal tasks.
Domain 2: Workloads & Scheduling (15%)
