CKAD Practice Test 10 — 10 Questions

Question 1

You need to perform a blue-green deployment using Deployments and Services. What is the most common approach to switch traffic from the old version (blue) to the new version (green)?

Accepted Answer

Change the Service's label selector to point to the green Deployment's pod labels. In a blue-green deployment, the Service acts as the traffic router by using a label selector to match pods. By updating the Service's selector to match the green Deployment's pod labels (e.g., `version: green`), traffic is instantly switched from blue pods to green pods without any downtime, as Kubernetes Services use label selectors to dynamically route traffic to matching pods.

Answer

Update the Deployment's image field in the blue Deployment to the new version

Answer

Delete the blue Deployment and create the green Deployment

Answer

Scale the blue Deployment to 0 and the green Deployment to desired replicas

Question 2

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' message indicates the container was terminated because it exceeded its memory limit. Increasing the memory limit in the container's resource specification allows the container to use more memory, preventing the out-of-memory kill. This directly addresses the root cause without losing the pod's state or affecting other workloads.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 3

Which of the following Service types exposes a pod on a static port on each node's IP address?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a pod on a static port (in the range 30000-32767) on every node's IP address. When a Service of type NodePort is created, Kubernetes opens that port on all nodes in the cluster, forwarding traffic to the target pods. This allows external access to the pod via any node's IP and the assigned static port.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP

Question 4

Which TWO of the following are valid methods to create a Service in Kubernetes? (Select 2)

Accepted Answer

kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates a Service from a YAML manifest. Option B is correct because `kubectl expose deployment my-deploy --port=80` imperatively creates a Service that exposes the deployment's pods. Option E is not considered a standard method for creating a Service in the context of this exam; the commonly taught imperative commands are `kubectl apply -f` and `kubectl expose`. Options C and D are incorrect: `kubectl port-forward` does not create a Service, and `kubectl run` creates a Pod or Deployment, not a Service.

Answer

kubectl port-forward svc/my-svc 8080:80

Answer

kubectl run my-svc --image=nginx --port=80

Answer

kubectl create service clusterip my-svc --tcp=80:80

Question 5

Which TWO of the following are valid ways to consume a ConfigMap in a pod? (Select 2)

Accepted Answer

Mounting the ConfigMap as a volume. Although the question instructs to select two, all three options A, B, and E are actually valid ways to consume a ConfigMap in a pod. Option A is correct because a ConfigMap can be mounted as a volume, making each key a file in the container's filesystem. Option B is correct because `configMapKeyRef` in `env.valueFrom` allows loading a specific key from a ConfigMap as an environment variable. Option E is correct because `envFrom` with `configMapRef` loads all keys from a ConfigMap as environment variables. Options C and D are incorrect: `configMapRef` in `env.valueFrom` is not a valid construct (the correct syntax is `configMapKeyRef`), and `secretKeyRef` is used for Secrets, not ConfigMaps.

Answer

Using configMapRef in env.valueFrom

Answer

Using secretKeyRef in env.valueFrom

Question 6

Which of the following are valid concurrencyPolicy values for a CronJob? (Select all that apply.)

Accepted Answer

Replace. Within a Kubernetes CronJob, the concurrencyPolicy field accepts three valid values: Allow, Forbid, and Replace. Allow permits multiple concurrent executions of the same job. Forbid prevents new executions while a previous one is still running. Replace cancels the currently running job and starts a new one in its place. Options C (Parallel) and E (Serial) are not valid values. Therefore, the correct answers are Replace, Allow, and Forbid.

Answer

Parallel

Answer

Serial

Question 7

Which TWO of the following are valid concurrencyPolicy values for a CronJob?

Accepted Answer

Forbid. In Kubernetes, a CronJob's concurrencyPolicy controls how to handle overlapping job executions. The valid values are Allow (default, allowing concurrent runs) and Forbid (skips new run if previous is still running). Among the options given, the two correct answers are Allow and Forbid. Replace is not a valid concurrencyPolicy value; it is a distractor.

Answer

Parallel

Answer

Serial

Answer

Replace

Question 8

A pod fails to start with a 'CreateContainerConfigError'. Running 'kubectl describe pod my-pod' reveals: 'Error: container has runAsNonRoot and image will run as root'. The pod definition includes 'securityContext.runAsNonRoot: true'. What is the most likely cause?

Accepted Answer

The container image's default user is root (UID 0), conflicting with runAsNonRoot. The error 'container has runAsNonRoot and image will run as root' occurs because the pod's securityContext sets `runAsNonRoot: true`, but the container image's default user is root (UID 0). Kubernetes checks the image's user at container startup; if the image runs as root and the pod enforces non-root, the container fails to start with a CreateContainerConfigError.

Answer

The container does not have the CAP_SYS_ADMIN capability

Answer

The container's filesystem is read-only

Answer

The runAsUser field is missing, so the pod uses a random UID

Question 9

Which kubectl command creates a pod named 'nginx' from the image 'nginx:latest'?

Accepted Answer

kubectl run nginx --image=nginx:latest. `kubectl run nginx --image=nginx:latest` creates a Pod named 'nginx' by default in recent Kubernetes versions (1.18+). Option C is also correct: adding `--restart=Never` explicitly creates a Pod and is a common practice to ensure a Pod is created rather than a Deployment. Option B is wrong because `kubectl apply -f` requires a YAML file. Option D is wrong because `kubectl create pod` is not a valid subcommand; the correct imperative command is `kubectl run`.

Answer

kubectl apply -f pod.yaml

Answer

kubectl create pod nginx --image=nginx:latest

Question 10

A Role named 'pod-reader' in namespace 'ns1' grants get, list, and watch on pods. Which RoleBinding correctly binds this role to a ServiceAccount 'sa1' in the same namespace?

Accepted Answer

roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: ns1. A RoleBinding in the same namespace as the Role and ServiceAccount must specify the Role's kind as 'Role' (not ClusterRole) and include the ServiceAccount's namespace in the subjects list. The roleRef references the 'pod-reader' Role with the correct apiGroup and kind, and the subject specifies the ServiceAccount 'sa1' in namespace 'ns1', which matches the Role's namespace, allowing the binding to grant the permissions.

Answer

roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: User name: sa1

Answer

roleRef: { apiGroup: rbac.authorization.k8s.io, kind: ClusterRole, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: ns1

Answer

roleRef: { apiGroup: rbac.authorization.k8s.io, kind: Role, name: pod-reader } subjects: - kind: ServiceAccount name: sa1 namespace: default