CKAD Practice Test 1 — 10 Questions

Question 1

You have a Service that exposes a Deployment. Some pods are not receiving traffic. 'kubectl get endpoints my-service' shows only 2 out of 3 pod IPs. What is the most likely cause?

Accepted Answer

One pod is not ready (readiness probe failing). The most likely cause is that one pod is not ready because its readiness probe is failing. Services only forward traffic to pods that are in the Ready state, as reflected in the Endpoints object. If a pod fails its readiness probe, it is removed from the list of endpoints, even if it is running and has the correct labels.

Answer

The Deployment has a wrong targetPort

Answer

The Service type is NodePort

Answer

One pod has a different label than the Service selector

Question 2

Which TWO of the following are valid uses of Kubernetes Annotations? (Select two.)

Accepted Answer

Configuring ingress controllers with specific settings like rewrite rules.. Kubernetes annotations are key-value pairs used to attach arbitrary non-identifying metadata to objects, and Ingress controllers commonly use specific annotations (e.g., nginx.ingress.kubernetes.io/rewrite-target) to configure behavior like URL rewriting. This allows operators to customize controller functionality without altering the core resource definition.

Answer

Defining the name of a Kubernetes resource.

Answer

Identifying which pods a Service should route traffic to.

Answer

Enabling service discovery between microservices.

Question 3

When performing a rolling update of a Deployment, which field in the Deployment spec controls the maximum number of Pods that can be created above the desired replicas during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

Answer

spec.strategy.type

Answer

spec.strategy.rollingUpdate.maxUnavailable

Answer

spec.replicas

Question 4

You run 'kubectl rollout undo deployment/app'. What happens?

Accepted Answer

It rolls back the Deployment to the previous revision. The 'kubectl rollout undo' command rolls back a Deployment to the previous revision. By default, it reverts to the immediate prior revision (revision 1 less than current).

Answer

It pauses the rollout

Answer

It shows the rollout history

Answer

It deletes the Deployment

Question 5

A developer creates a Role and RoleBinding in the namespace 'development' to grant list pods permission to a service account. Which manifest snippet correctly defines the Role?

Accepted Answer

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. Pods belong to the core API group, which is represented by an empty string `""` in the `apiGroups` field. The `list` verb is sufficient to list pods, and the `resources` field correctly specifies `pods`. This Role grants the service account permission to list pods in the `development` namespace.

Answer

rules:
- apiGroups: ["pods"]
  resources: ["pods"]
  verbs: ["get", "list"]

Answer

rules:
- apiGroups: ["apps"]
  resources: ["pods"]
  verbs: ["list"]

Answer

rules:
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["list"]

Question 6

You are designing a Pod that must run a diagnostic tool to collect network logs before the main application starts. The diagnostic tool should run to completion, then the main application starts. Which approach should you use?

Accepted Answer

Add the diagnostic tool as an init container in the Pod. Init containers run sequentially before the Pod's main containers start, and they must complete successfully before the main application container begins. This makes them ideal for setup tasks like running a diagnostic tool to collect network logs that must finish before the main application starts.

Answer

Add the diagnostic tool as a sidecar container in the same Pod

Answer

Add the diagnostic tool as a sidecar container with a postStart hook

Answer

Create a separate Job that runs before the Pod

Question 7

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/4 nodes are available: 4 Insufficient memory'. Which action will resolve the issue?

Accepted Answer

Scale down other pods in the cluster to free memory. The pod is stuck in 'Pending' because no node has enough allocatable memory to satisfy its memory request. Scaling down other pods frees memory on existing nodes, allowing the scheduler to place the pod. This directly resolves the 'Insufficient memory' condition without changing the pod's specification or cluster topology.

Answer

Add a nodeSelector to target a specific node

Answer

Increase the memory request in the pod spec

Answer

Scale up the Deployment to create more pod replicas

Question 8

You want to run a command inside a running container to check environment variables. Which command should you use?

Accepted Answer

kubectl exec pod-name -- env. `kubectl exec pod-name -- env` runs the `env` command inside the specified container, which prints all environment variables set in the container's runtime environment. This is the most direct and efficient way to inspect environment variables without entering an interactive shell.

Answer

kubectl logs pod-name

Answer

kubectl describe pod pod-name

Answer

kubectl exec -it pod-name -- /bin/bash

Question 9

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. The `backoffLimit` field in a Job spec specifies the number of retries before the Job is considered failed. In this YAML, `backoffLimit: 4` means Kubernetes will retry the Job up to 4 times after the initial failure, for a total of 5 attempts (1 initial + 4 retries). The question asks 'how many times will Kubernetes retry the job before considering it failed?', which directly corresponds to the `backoffLimit` value of 4.

Answer

1

Answer

0

Answer

5

Question 10

A developer creates a Secret using the command: 'kubectl create secret generic db-secret --from-literal=password=myPass'. Which way to consume this Secret in a pod is CORRECT?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password. `secretKeyRef` under `valueFrom` in an `env` entry is the proper way to inject a single key from a Kubernetes Secret into a container environment variable. The Secret was created with key `password` and value `myPass`, so `secretKeyRef` with `name: db-secret` and `key: password` correctly references that key.

Answer

volumes:
  - name: secret-vol
    secret:
      secretName: db-secret
  containers:
    - volumeMounts:
        - name: secret-vol
          mountPath: /etc/secret

Answer

envFrom:
  - secretRef:
      name: db-secret

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef:
        name: db-secret
        key: password