5 exercises — CrashLoopBackOff, RBAC, DaemonSets, PersistentVolume access modes, and NetworkPolicies. The vocabulary behind every Kubernetes certification exam.
0 / 18 completed
1 / 18
An exam question says: "A Pod is in CrashLoopBackOff status." What does this mean?
CrashLoopBackOff is one of the most important Pod status messages in Kubernetes and appears frequently in the CKA exam.
It means the container keeps crashing immediately after start. Kubernetes restarts it automatically, but adds backoff delays: 10s, 20s, 40s, 80s... up to 5 minutes between restarts.
Common causes: • Application code error on startup • Missing environment variable or Secret • Incorrect command or entrypoint • Missing PVC or ConfigMap volume
Diagnosis command:kubectl logs <pod-name> --previous (shows logs from the crashed container)
Other important Pod statuses: • Pending — not yet scheduled; check node resources or taints • ImagePullBackOff — cannot pull container image; check registry credentials • OOMKilled — out of memory; increase memory limit • Evicted — node was under pressure, Pod removed
2 / 18
You need to allow a Pod to read Secrets in the payments namespace only. Which Kubernetes resources do you create?
Kubernetes RBAC uses four resources — and the CKA/CKAD exams test this distinction constantly:
Role — grants permissions within a single namespace ClusterRole — grants permissions cluster-wide or to non-namespaced resources (Nodes, PVs) RoleBinding — binds a Role (or ClusterRole) to a subject within a namespace ClusterRoleBinding — binds a ClusterRole to a subject cluster-wide
For namespace-scoped permissions → always Role + RoleBinding. For cluster-wide permissions → ClusterRole + ClusterRoleBinding.
The subject is the ServiceAccount, User, or Group receiving the permissions.
Quick check: A ClusterRole can be used in a RoleBinding to limit a cluster-wide role to a specific namespace. But a Role can never grant cluster-wide permissions.
3 / 18
Complete the Kubernetes concept: "To ensure a Pod always runs on every node in the cluster — useful for monitoring agents like Prometheus Node Exporter — you use a _____."
A DaemonSet ensures that one copy of a Pod runs on every node (or a subset defined by node selectors). When a new node joins the cluster, Kubernetes automatically schedules the DaemonSet Pod on it. When a node is removed, the Pod is garbage collected.
Deployment — runs N replicas, typically on different nodes, but not necessarily one per node StatefulSet — ordered, stable identity Pods for databases and stateful applications ReplicaSet — lower-level than Deployment; manages replicas but has no rolling update strategy
The CKA exam often asks: "how would you ensure a logging agent runs on all nodes?" → DaemonSet.
4 / 18
A question states: "The application writes to a PersistentVolumeClaim (PVC) with accessMode: ReadWriteOnce." What does ReadWriteOnce mean?
Kubernetes PersistentVolume access modes control how volumes can be mounted:
ReadWriteOnce (RWO) — can be mounted read-write by one node at a time. Multiple Pods on the same node can all use it. ReadOnlyMany (ROX) — can be mounted read-only by many nodes simultaneously ReadWriteMany (RWX) — can be mounted read-write by many nodes simultaneously (requires NFS, CephFS, etc.) ReadWriteOncePod (RWOP) — can be mounted read-write by a single Pod only (K8s 1.22+)
Exam trap: RWO allows one node, not one Pod. If you deploy 3 replicas on 3 different nodes and use RWO → two Pods will be Pending because the PVC can only attach to one node.
Supported modes depend on the storage class and underlying storage provider.
5 / 18
The exam asks you to ensure Pods from team A cannot send traffic to Pods from team B. The teams use different namespaces. You need to create a _____.
NetworkPolicy is the Kubernetes resource for pod-level network traffic rules. It's a critical CKA and CKS topic.
Key concepts: • NetworkPolicies are namespaced • By default, Pods are non-isolated — all traffic is allowed • Once any NetworkPolicy selects a Pod, that Pod becomes isolated. Only explicitly allowed traffic passes • NetworkPolicies require a CNI plugin that supports them (Calico, Cilium, Weave-net)
To block team A → team B: Create a NetworkPolicy in team B's namespace. The podSelector selects team B's Pods. The ingress rules do NOT include team A's namespace in the namespaceSelector. That drops all ingress from team A.
ResourceQuota — limits CPU/memory/Pod count within a namespace PodSecurityAdmission — controls Pod security standards (privileged, baseline, restricted) Headless Service (ClusterIP: None) — removes load balancing, doesn't affect network traffic rules
6 / 18
Reviewer: 'The deployment failed with a `ImagePullBackOff` error. It seems like the Docker image isn't available on the registry.'
During a code review of a new deployment to our staging environment, your colleague flags an issue. What is ImagePullBackOff indicating about the deployment?
ImagePullBackOff specifically means that Kubernetes was unable to retrieve the Docker image specified in the Pod's definition. This is often due to a typo in the image name or tag, or a problem with DNS resolution preventing it from reaching the registry. It's distinct from general cluster downtime (which would cause CrashLoopBackOff) or resource constraints.
7 / 18
During a code review of a new deployment to our staging environment, your colleague flags an issue. The deployment log shows the Pod is in `ImagePullBackOff` status. What is ImagePullBackOff indicating about the deployment?
**Option A:** The application is running successfully but experiencing high CPU usage.
**Option B:** The Kubernetes cluster is unable to retrieve the Docker image specified in the Pod's definition from the registry, likely due to a network issue or incorrect image name.
**Option C:** The application is crashing due to an unhandled exception within its code.
**Option D:** The deployment process was interrupted prematurely and requires manual intervention to resume.
ImagePullBackOff is a Kubernetes status indicating that the kubelet (the agent running on each node) failed to pull the container image specified in the Pod's YAML definition. This typically happens because the image name or tag is incorrect, there's a network problem preventing access to the registry (like Docker Hub), or the registry itself is unavailable. It's *not* related to application errors within the container; that would manifest differently.
8 / 18
Reviewer: 'The deployment failed with a `ImagePullBackOff` error. It seems like the Docker image isn't available on the registry.'
During a code review of a new deployment to our staging environment, your colleague flags an issue. What is ImagePullBackOff indicating about the deployment?
ImagePullBackOff specifically means that Kubernetes was unable to retrieve the Docker image specified in the Pod's definition. This is often due to a typo in the image name or tag, or a problem with DNS resolution preventing it from reaching the registry. It's distinct from general cluster downtime (which would cause CrashLoopBackOff) or resource constraints.
9 / 18
During a code review of a new deployment to our staging environment, your colleague flags an issue. The deployment log shows the Pod is in `ImagePullBackOff` status. What is ImagePullBackOff indicating about the deployment?
**Option A:** The application is running successfully but experiencing high CPU usage.
**Option B:** The Kubernetes cluster is unable to retrieve the Docker image specified in the Pod's definition from the registry, likely due to a network issue or incorrect image name.
**Option C:** The application is crashing due to an unhandled exception within its code.
**Option D:** The deployment process was interrupted prematurely and requires manual intervention to resume.
ImagePullBackOff is a Kubernetes status indicating that the kubelet (the agent running on each node) failed to pull the container image specified in the Pod's YAML definition. This typically happens because the image name or tag is incorrect, there's a network problem preventing access to the registry (like Docker Hub), or the registry itself is unavailable. It's *not* related to application errors within the container; that would manifest differently.
10 / 18
Reviewer: 'The deployment failed with a `ImagePullBackOff` error. It seems like the Docker image isn't available on the registry.'
During a code review of a new deployment to our staging environment, your colleague flags an issue. What is ImagePullBackOff indicating about the deployment?
ImagePullBackOff specifically means that Kubernetes was unable to retrieve the Docker image specified in the Pod's definition. This is often due to a typo in the image name or tag, or a problem with DNS resolution preventing it from reaching the registry. It's distinct from general cluster downtime (which would cause CrashLoopBackOff) or resource constraints.
11 / 18
During a code review of a new deployment to our staging environment, your colleague flags an issue. The deployment log shows the Pod is in `ImagePullBackOff` status. What is ImagePullBackOff indicating about the deployment?
**Option A:** The application is running successfully but experiencing high CPU usage.
**Option B:** The Kubernetes cluster is unable to retrieve the Docker image specified in the Pod's definition from the registry, likely due to a network issue or incorrect image name.
**Option C:** The application is crashing due to an unhandled exception within its code.
**Option D:** The deployment process was interrupted prematurely and requires manual intervention to resume.
ImagePullBackOff is a Kubernetes status indicating that the kubelet (the agent running on each node) failed to pull the container image specified in the Pod's YAML definition. This typically happens because the image name or tag is incorrect, there's a network problem preventing access to the registry (like Docker Hub), or the registry itself is unavailable. It's *not* related to application errors within the container; that would manifest differently.
12 / 18
Reviewer: 'The deployment failed with a `ImagePullBackOff` error. It seems like the Docker image isn't available on the registry.'
During a code review of a new deployment to our staging environment, your colleague flags an issue. What is ImagePullBackOff indicating about the deployment?
ImagePullBackOff specifically means that Kubernetes was unable to retrieve the Docker image specified in the Pod's definition. This is often due to a typo in the image name or tag, or a problem with DNS resolution preventing it from reaching the registry. It's distinct from general cluster downtime (which would cause CrashLoopBackOff) or resource constraints.
13 / 18
During a code review of a new deployment to our staging environment, your colleague flags an issue. The deployment log shows the Pod is in `ImagePullBackOff` status. What is ImagePullBackOff indicating about the deployment?
**Option A:** The application is running successfully but experiencing high CPU usage.
**Option B:** The Kubernetes cluster is unable to retrieve the Docker image specified in the Pod's definition from the registry, likely due to a network issue or incorrect image name.
**Option C:** The application is crashing due to an unhandled exception within its code.
**Option D:** The deployment process was interrupted prematurely and requires manual intervention to resume.
ImagePullBackOff is a Kubernetes status indicating that the kubelet (the agent running on each node) failed to pull the container image specified in the Pod's YAML definition. This typically happens because the image name or tag is incorrect, there's a network problem preventing access to the registry (like Docker Hub), or the registry itself is unavailable. It's *not* related to application errors within the container; that would manifest differently.
14 / 18
During a Slack conversation with Alex from DevOps, he mentions that a newly deployed Pod is stuck in the 'Pending' state. He suspects it might be related to resource constraints. What does 'Pending' typically indicate within Kubernetes?
The 'Pending' state in Kubernetes means the scheduler is actively searching for a node with enough available resources (CPU, memory) to run the Pod. It's not an error; it's simply that the current cluster configuration doesn't meet the Pod's requirements. A common misconception is that 'Pending' always implies a failure – it's a normal step in the deployment process until a suitable node is found.
15 / 18
Sarah, a developer, is creating a PR to update her application's image in Kubernetes. She includes the following YAML snippet:
```yaml
apiVersion: apps/v1
definitions:
myImage:
schemaVersion: 1
name: myImage
type: OCI
registry: docker.io
repository: my-team/my-app
tag: latest
```
What role does the `registry` field primarily serve in this definition?
The `registry` field in a Kubernetes Image definition specifies the location of the Docker image. It's typically the URL of the registry where the image is hosted (e.g., Docker Hub or a private registry). This allows Kubernetes to correctly locate and pull the image needed to run the Pod.
16 / 18
You need to ensure that your application's stateful set of pods can reliably access persistent storage. You want to use PersistentVolumes and PersistentVolumeClaims. Which mounting options are most appropriate for ensuring data durability and availability?
For stateful applications requiring durable storage, `ReadWriteOnce` is the ideal choice. It allows only *one* pod in the StatefulSet to access the PersistentVolumeClaim (PVC) simultaneously for both reading and writing. This prevents data corruption or conflicts that could occur if multiple pods tried to modify the same data concurrently.
17 / 18
During a standup meeting, Ben, a senior developer, mentions that he's using Kubernetes labels to organize his deployments. He wants to ensure all pods deployed by his team (Team Alpha) are automatically scaled up when the application experiences increased traffic. Which label strategy is MOST suitable for this scenario?
The `LabelSelector` is the key mechanism for targeting deployments within Kubernetes. By defining a label (e.g., `team=alpha`) and using that label in a Deployment's selector, you can precisely control which Pods are managed by that Deployment – in this case, ensuring all Team Alpha deployments are automatically scaled based on traffic demands.
18 / 18
As a DevOps engineer, you're tasked with isolating traffic between two microservices teams – 'Team A' and 'Team B'—each running in separate namespaces. Which Kubernetes resource would be the most effective solution to enforce this isolation?
`NetworkPolicies` are specifically designed to control network traffic between Kubernetes objects. By defining rules that restrict communication based on namespaces or labels, you can effectively isolate Team A's pods from accessing Team B's pods – preventing unintended cross-namespace traffic and enhancing security.
What will I practice in "Kubernetes & CKA Exam Language — Certification Language Exercises"?
This is a Certification Prep exercise set. It walks through 18 scenario-based multiple-choice questions built around real usage of Certification Prep terminology that IT professionals encounter on the job.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to complete with no account, sign-up, or paywall.
How many questions are in this exercise?
This set contains 18 questions. Each one shows immediate feedback and a detailed explanation after you answer, so you learn the correct usage right away rather than waiting for a final score.
Do I need prior experience to complete this exercise?
No prior experience is required. Each question includes a full explanation covering the reasoning behind the correct answer, so the exercise itself teaches the Certification Prep vocabulary as you go.
Can I retry the exercise if I get questions wrong?
Yes — use the "Try again" button on the results screen to reset your answers and go through all the questions again. There is no limit on attempts.
Is my progress saved?
Your answers and score for the current session are tracked in the browser as you go. No account or login is needed, and there is nothing to install.
What if I don't understand a term used in a question?
Read the explanation shown after you answer each question — it breaks down the correct term in plain English with a real-world example. You can also check the site Glossary for quick definitions.
How is this different from reading a blog article on the topic?
Exercises like this one are interactive drills that test and reinforce specific vocabulary through multiple-choice questions, while blog articles explain concepts in prose. Practising here after reading builds active recall, not just passive recognition.
Where can I find more Certification Prep exercises?
See the Certification Prep exercises hub for the full set of related pages, or browse all exercise categories from the main Exercises index.
Can I use this exercise to prepare for a technical interview?
Yes — Certification Prep vocabulary comes up often in technical discussions and interviews. Pair this exercise with our dedicated Interview Preparation section for role-specific practice.