A cluster is running with containerd as the runtime. The security team wants to run a subset of workloads in a gVisor sandbox for additional isolation. What is the correct way to configure this?

Create a RuntimeClass with the handler 'runsc' and set it in the pod spec for the sandboxed workloads

Change the kubelet's --container-runtime-endpoint to point to gVisor

Use a mutating admission webhook to inject the gVisor runtime into all pods

Add a nodeSelector to the sandboxed pods to schedule them on nodes with gVisor installed

Which statement best describes how extension interfaces relate to Kubernetes core components?

They are only used for cloud-specific features and not for on-premises clusters

They are external plugins that communicate with Kubernetes through defined APIs

They are deprecated and will be replaced by built-in functionality

They are part of the Kubernetes core and are compiled into the kubelet

A cluster is being migrated from Docker to containerd. After switching the runtime, the administrator notices that pods are created but cannot reach the network. What is the most likely reason?

The CSI driver is not compatible with containerd

The CNI plugin was configured for Docker's networking and needs to be reconfigured for containerd

The kubelet is still using the Docker socket

An administrator is setting up a new Kubernetes cluster and wants to use a container runtime that is not yet supported by the default kubelet integration. The runtime is CRI-compliant. What is the simplest way to enable Kubernetes to use this runtime?

Recompile the kubelet with the runtime's source code included

Install the runtime as a systemd service and restart the node

Deploy the runtime as a DaemonSet and use a RuntimeClass

Configure the kubelet to use the runtime's CRI socket via the --container-runtime-endpoint flag

Certified Kubernetes Administrator (CKA)

Domain 4Objective 7

Understand Extension Interfaces (CNI, CSI, CRI, Etc.) CKA Practice Questions (Page 3)

Part of the Cluster Architecture, Installation and Configuration domain, which accounts for 25% of the CKA exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–20 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

4concepts

25%of the exam

Questions 11–15

11application · medium
A cluster is running with containerd as the runtime. The security team wants to run a subset of workloads in a gVisor sandbox for additional isolation. What is the correct way to configure this?
Select an answer first
12foundation · easy
Which statement best describes how extension interfaces relate to Kubernetes core components?
Select an answer first
13application · medium
A cluster is being migrated from Docker to containerd. After switching the runtime, the administrator notices that pods are created but cannot reach the network. What is the most likely reason?
Select an answer first
14application · medium
A platform team is evaluating how to extend Kubernetes to support a new hardware accelerator. The accelerator needs to be exposed to pods as a device, and the team wants to avoid modifying the Kubernetes source code. Which extension interface should they use?
Select an answer first
15application · medium
An administrator is setting up a new Kubernetes cluster and wants to use a container runtime that is not yet supported by the default kubelet integration. The runtime is CRI-compliant. What is the simplest way to enable Kubernetes to use this runtime?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKA” is a trademark of its owner, used for identification only.