cka exam questions Intermediate Practice Exam: Medium Difficulty 2025

You are adding a new control-plane node to an existing kubeadm-managed cluster. After running the join command, the node joins successfully but `kubectl get nodes` shows it as `NotReady`. On the node, `crictl ps` shows no kubelet-managed pods, and `systemctl status kubelet` shows it is running but repeatedly logging "failed to load kubelet config file". Which action is the most appropriate next step?

A cluster uses an external etcd. You need to validate that the API server can still reach etcd after a network change. Which check best verifies etcd connectivity from the control plane with minimal assumptions about tools installed on nodes?

You need to schedule a logging DaemonSet only on nodes labeled `node-role.kubernetes.io/worker=true`, but some worker nodes are tainted `dedicated=infra:NoSchedule` and should still run the logging agent. What DaemonSet settings best meet this requirement?

A Deployment uses a PodDisruptionBudget (PDB) with `minAvailable: 3`. The Deployment has 4 replicas. During a planned node drain, eviction fails for one pod with a message indicating the PDB would be violated. What is the best explanation and resolution strategy?

You expose an internal application via a ClusterIP Service. A debug pod in the same namespace cannot reach the service DNS name (e.g., `curl http://my-svc`). Directly curling a backend pod IP works. Which is the most likely cause?

A NodePort Service works from some external clients but fails intermittently from others. Inside the cluster, the Service works consistently. You notice the Service has `externalTrafficPolicy: Local`. What is the best explanation?

Your cluster uses NetworkPolicies. A backend pod cannot connect to a database pod on TCP 5432 in the same namespace. A NetworkPolicy exists selecting the database pods and only allows ingress from pods with label `role=db-client` on port 5432. The backend pods are labeled `app=backend` only. What is the simplest fix that follows least privilege?

A StatefulSet requires stable storage. You created a PVC with `storageClassName: fast` but it stays in `Pending`. `kubectl describe pvc` shows: "no persistent volumes available for this claim and no storage class is set". There is a StorageClass named `fast-ssd`, and the cluster supports dynamic provisioning. What is the best fix?

A critical pod is stuck in `CrashLoopBackOff`. `kubectl logs` shows the container exits immediately after printing a config parse error. The config is provided via a ConfigMap mounted as a file. You update the ConfigMap, but the pod continues to crash with the old config. What should you do to ensure the pod uses the updated configuration reliably?

A node shows `Ready`, but pods scheduled to it cannot resolve DNS names; they time out querying the cluster DNS service. Other nodes work fine. Pod-to-pod IP connectivity from the failing node works, and the CoreDNS pods are Running. Which is the most likely issue to check first?