CKA — Exam Format & Strategy

CKA Exam Domain

All Domains — This page covers exam strategy applicable to every domain.

Exam Format

Before we talk strategy, let’s understand what you’re walking into:

Detail	Info
Duration	2 hours
Questions	15–20 performance-based tasks
Passing Score	66%
Environment	Linux terminal with pre-configured clusters
Retake	1 free retake included
Kubernetes Version	1.31 (as of 2025)
Allowed Resources	kubernetes.io/docs, kubernetes.io/blog, github.com/kubernetes
Proctored	Yes — live proctored via PSI Secure Browser

Key takeaway: This is not a multiple-choice exam. You will be working in a real Kubernetes terminal. Every question requires you to execute commands, create resources, or fix broken clusters.

Question Types

CKA questions generally fall into these categories:

Create / Configure Resources:

• Create Pods, Deployments, Services, ConfigMaps, Secrets
• Set up RBAC (Roles, RoleBindings, ClusterRoles, ClusterRoleBindings)
• Create PersistentVolumes, PersistentVolumeClaims
• Configure NetworkPolicies, Ingress

Cluster Administration:

• Upgrade a cluster using kubeadm
• Back up and restore etcd
• Create static Pods
• Manage node scheduling (cordon, drain, uncordon)

Troubleshooting:

• Fix broken nodes (kubelet not running)
• Diagnose networking issues (Services without endpoints, DNS failures)
• Fix broken control plane components (scheduler, controller-manager)
• Debug application failures

Inspection & Sorting:

• Sort Pods by resource usage
• Find specific information using jsonpath
• Check RBAC permissions with kubectl auth can-i

Time Management — The 3-Pass Strategy

This is the single most important exam strategy. Do NOT work through questions sequentially from first to last. Use the 3-pass approach:

Pass 1: Quick Wins (0–60 minutes)

Go through every question and solve only the easy ones first.

Quick wins include:

• Creating Pods, Deployments, Services with imperative commands
• Simple YAML generation tasks
• Questions worth 4–7% with straightforward requirements
• Tasks you can complete in under 3 minutes

Goal: Collect 40–50% of points with minimal effort.

Pass 2: Medium Difficulty (60–100 minutes)

Go back to questions you skipped and tackle the medium ones:

• Multi-step tasks (create Role + RoleBinding + test)
• Troubleshooting questions with clear symptoms
• Storage questions (PV + PVC + Pod mount)
• Questions worth 7% that need more work

Goal: Bring your total to 70–80%.

Pass 3: Hard Questions (100–120 minutes)

Now tackle the heaviest questions:

• Cluster upgrades with kubeadm
• etcd backup and restore
• Complex RBAC with multiple bindings
• Tricky troubleshooting scenarios

Goal: Squeeze out every remaining point.

Why This Works

Approach	Result
Sequential (Q1 → Q20)	You might get stuck on Q3 and waste 20 minutes, missing 5 easy questions at the end
3-Pass Strategy	You guarantee easy points first, then build on top

Point Allocation

Not all questions are equal. Here’s a typical weight distribution:

Weight	Difficulty	Typical Tasks	Count
4%	Easy	Create a Pod, expose a Service	3–5
7%	Medium	RBAC setup, PV/PVC, NetworkPolicy	8–12
8–13%	Hard	etcd restore, cluster upgrade, multi-step troubleshooting	2–4

Pro tip: A 4% question and a 13% question both count as “one question.” Doing three 4% questions (12% total, ~6 minutes) is better than spending 15 minutes on one 13% question you might get wrong.

Context Switching

Every question specifies which cluster context to use. You’ll see something like:

Context: kubectl config use-context cluster1

ALWAYS switch context before starting a question:

kubectl config use-context cluster1

If you forget this step and execute commands against the wrong cluster, you will:

• Not get any points for the question
• Possibly mess up another question’s cluster

Make it a muscle memory habit: Read the context → switch → then start working.

Verify you’re in the right context:

kubectl config current-context

How to Read Questions

CKA questions are precise. Every word matters.

Before you type a single command, identify:

1. Which cluster context? — Switch to it first
2. Which namespace? — Don’t assume “default”
3. Exact resource names — Use exactly what the question specifies
4. Specific labels, annotations, or ports — Don’t miss them
5. Where to save files — Some questions ask you to write output to a specific path

Example question breakdown:

“In cluster cluster2, create a Deployment named web-app in namespace production with image nginx:1.27, 3 replicas, and a container port of 80.”

Checklist:

• Switch to cluster2
• Namespace: production (create if it doesn’t exist)
• Deployment name: web-app
• Image: nginx:1.27
• Replicas: 3
• Container port: 80

Flag Questions

The exam interface has a flag/bookmark feature. Use it generously.

When to flag:

• Questions you skipped in Pass 1
• Questions where you’re unsure about your answer
• Questions where you want to double-check your verification

Don’t rely on memory — with 15–20 questions and time pressure, you will forget which ones you want to revisit.

Practice Questions

These questions test your exam strategy knowledge. No kubectl required.

Question 1: Time Allocation

You have 20 questions totaling 100%. You’ve completed 12 questions in 50 minutes. The remaining 8 questions include two worth 13% each (cluster upgrade and etcd restore). What should you do next?

Show Answer

Answer: Do NOT jump straight to the 13% questions. First, scan the remaining 8 questions and identify any quick wins (4–7% questions) you might have missed. Complete those first, then tackle the 13% questions last. You have 70 minutes left — plenty of time, but only if you don’t waste it on hard questions while easy points are still available.

Question 2: Context Mistake

You completed 3 questions and realized you forgot to switch context for Question 2. You did the work in the wrong cluster. What should you do?

Show Answer

Answer: Flag Question 2 and move on. When you revisit it later:

1. Switch to the correct context
2. Redo the work in the correct cluster
3. Do NOT try to clean up the wrong cluster — it wastes time and doesn’t affect scoring

The exam is scored by checking that the correct resources exist in the correct cluster. Work done in the wrong cluster is simply ignored.

Question 3: Stuck on a Question

You’ve been working on a troubleshooting question for 8 minutes. You found that the kubelet is stopped but systemctl start kubelet doesn’t seem to keep it running. What should you do?

Show Answer

Answer: Check journalctl -u kubelet for error logs. If the error isn’t immediately obvious, flag the question and move on. You’ve already spent 8 minutes — continuing to trial-and-error could waste another 10 minutes. Come back with fresh eyes in Pass 3. Often, the error becomes obvious when you look at it again.

Question 4: Documentation Lookup

You need to create a NetworkPolicy but can’t remember the exact YAML structure. What’s the fastest way to find it?

Show Answer

Answer: Go to kubernetes.io/docs and search for “NetworkPolicy.” The documentation has complete YAML examples you can copy and modify. Don’t try to write complex YAML from memory — it’s faster and more accurate to copy from the docs.

Direct path: kubernetes.io/docs → Search “network policy” → Concepts → Network Policies → Scroll to examples

Question 5: Verification Strategy

You just created an RBAC setup (Role + RoleBinding) for user “jane” to access Pods. How should you verify before moving on?

Show Answer

Answer: Use kubectl auth can-i to verify:

kubectl auth can-i get pods --as jane -n <namespace>
kubectl auth can-i list pods --as jane -n <namespace>
kubectl auth can-i delete pods --as jane -n <namespace>  # should return "no" if not granted

Don’t just check that the Role and RoleBinding exist — verify they actually work as expected. This takes 10 seconds and catches mistakes.

---

Next: Exam Setup & Speed Tips →