CKAD Exam Simulation 1 — 100 Questions

Question 1

You run 'kubectl rollout undo deployment/app'. What happens?

Accepted Answer

It rolls back the Deployment to the previous revision. The 'kubectl rollout undo' command rolls back a Deployment to the previous revision. By default, it reverts to the immediate prior revision (revision 1 less than current).

Answer

It pauses the rollout

Answer

It shows the rollout history

Answer

It deletes the Deployment

Question 2

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 3

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: db' in namespace 'prod'. Which YAML snippet correctly implements this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress: []. It defines a NetworkPolicy that selects pods with label 'app: db' in namespace 'prod', specifies 'policyTypes: [Ingress]', and sets 'ingress: []'. An empty ingress rule list means no ingress traffic is allowed, effectively denying all ingress to the selected pods. This is the standard Kubernetes pattern for creating a deny-all ingress policy for a specific set of pods.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from: []

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []

Question 4

You need to create a Secret of type 'kubernetes.io/tls' for ingress. Which command is correct?

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. `kubectl create secret tls` is the dedicated command for creating a TLS secret, and it uses the `--cert` and `--key` flags to specify the certificate and private key files respectively. This creates a Secret of type `kubernetes.io/tls`, which is required for Ingress resources to terminate HTTPS traffic.

Answer

kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem

Answer

kubectl create secret tls my-tls --certificate=cert.pem --private-key=key.pem

Answer

kubectl create secret tls my-tls --from-file=tls.crt=cert.pem --from-file=tls.key=key.pem

Question 5

Which TWO statements about Kubernetes DNS are correct?

Accepted Answer

A service named 'api' in namespace 'prod' has DNS name 'api.prod.svc.cluster.local'. Kubernetes DNS assigns a fully qualified domain name (FQDN) to services following the pattern `..svc.cluster.local`. For a service named 'api' in the 'prod' namespace, the DNS name is `api.prod.svc.cluster.local`, enabling cluster-internal service discovery via CoreDNS or kube-dns.

Answer

The kube-dns service is responsible for DNS resolution

Answer

Pods with hostNetwork: true automatically get DNS entries

Answer

A pod's DNS name is always 'pod-ip.namespace.pod.cluster.local'

Question 6

Which command streams logs from a pod in real-time?

Accepted Answer

kubectl logs -f pod-name. `kubectl logs -f` (the `-f` flag stands for 'follow') streams log output from a pod in real-time, similar to `tail -f` on a file. This is the standard Kubernetes command for continuous log monitoring, allowing you to see new log lines as they are written by the container.

Answer

kubectl logs --stream pod-name

Answer

kubectl logs --previous pod-name

Answer

kubectl logs pod-name

Question 7

Which THREE configurations are part of Pod Security Admission's 'restricted' profile? (Select THREE.)

Accepted Answer

runAsNonRoot: true. The 'restricted' profile in Pod Security Admission enforces the most stringent security standards. Option A is correct because `runAsNonRoot: true` is a required field in the restricted profile, ensuring containers cannot run as the root user, which mitigates privilege escalation risks.

Answer

allowPrivilegeEscalation: true

Answer

Privileged containers allowed

Question 8

You have a Deployment named 'frontend' with 3 replicas. You run 'kubectl rollout history deployment/frontend' and see revision 1 and revision 2. You want to rollback to revision 1. What command should you use?

Accepted Answer

kubectl rollout undo deployment/frontend --to-revision=1. The 'kubectl rollout undo' command with the --to-revision flag rolls back to a specific revision. Option A is correct.

Answer

kubectl set image deployment/frontend app=nginx:1.19

Answer

kubectl rollout undo deployment/frontend revision=1

Answer

kubectl rollout history deployment/frontend --revision=1

Question 9

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' message indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container more memory to operate without being killed by the Out-of-Memory (OOM) killer.

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Question 10

Which TWO are valid ways to create a Service in Kubernetes?

Accepted Answer

Using kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates or updates a Service resource defined in a YAML manifest. This is the standard approach for managing Kubernetes resources in a GitOps or infrastructure-as-code workflow, ensuring the cluster state matches the file specification.

Answer

Using kubectl create service clusterip myservice --tcp=80:80

Answer

Using kubectl create deployment mydeploy --image=nginx --expose

Answer

Using kubectl run mypod --image=nginx --expose

Question 11

Which TWO commands can be used to view the logs of a pod that has crashed?

Accepted Answer

kubectl logs --previous. `kubectl logs --previous` retrieves logs from the previous instance of a container in a pod that has crashed and been restarted. This is essential for debugging crash loops, as the current container may have no logs or only post-crash output. The `--previous` flag accesses the terminated container's logs stored by the kubelet.

Answer

kubectl logs <pod> --tail=0 -f

Answer

kubectl logs -c

Answer

kubectl logs <pod>

Question 12

Your Deployment is stuck during rollout, and you want to investigate. Which command pauses the rollout and allows you to check the current state?

Accepted Answer

kubectl rollout pause deployment my-deployment. The correct command to pause a deployment rollout is `kubectl rollout pause deployment my-deployment`. While paused, you can inspect the current state with `kubectl rollout status` or other diagnostic commands. Option A (`kubectl rollout resume`) resumes a paused rollout, not pauses it. Option B (`kubectl rollout status`) shows the rollout state but does not pause it. Option D (`kubectl rollout stop`) is not a valid kubectl command; the correct command to stop a rollout is `kubectl rollout undo`. Therefore, only option C pauses the rollout as required.

Answer

kubectl rollout resume deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl rollout stop deployment my-deployment

Question 13

Which TWO of the following are valid methods to perform a blue-green deployment in Kubernetes?

Accepted Answer

Create a new Deployment for the new version, then update the Service's selector to point to the new pods.. A blue-green deployment requires two separate environments (blue = current, green = new) and a mechanism to switch traffic between them. Option B is valid because it uses a new Deployment for the green version and updates the Service selector to point to the new pods, effectively switching traffic. Option C is also valid: it deploys the new version in a separate namespace and uses a Service to route traffic to the new namespace, achieving the same isolation and switch. Option A is incorrect because it modifies the existing Deployment's image and uses Recreate strategy, which is a single-version update with downtime, not a blue-green switch. Option D is incorrect because `kubectl rollout undo` reverts to a previous revision of the same Deployment, not a parallel green environment. Option E uses the RollingUpdate strategy with extreme surge, which is a rolling update, not a blue-green deployment.

Answer

Use kubectl patch to modify the Deployment's image and rely on the Recreate strategy.

Answer

Use kubectl rollout undo to revert to the previous version.

Answer

Use the RollingUpdate strategy with maxSurge=100% and maxUnavailable=0%.

Question 14

Which THREE components are essential for setting up Horizontal Pod Autoscaling (HPA) based on CPU utilization? (Select three)

Accepted Answer

An HPA resource targeting the Deployment. HPA requires metrics-server to collect CPU metrics, CPU resource requests set on containers so HPA can calculate utilization, and the HPA resource itself targeting the Deployment. Therefore, options C, D, and E are correct.

Answer

A readiness probe on the pod

Answer

A Service of type LoadBalancer

Question 15

Which THREE of the following are valid fields in a LimitRange resource to enforce resource constraints at the container level? (Choose three.)

Accepted Answer

min. The three valid fields in a LimitRange resource that enforce resource constraints at the container level are `min`, `defaultRequest`, and `maxLimitRequestRatio`. `min` sets the minimum resource request or limit per container. `defaultRequest` sets the default resource request if not specified, ensuring a minimum request is applied. `maxLimitRequestRatio` enforces a maximum ratio between limit and request, constraining the relationship. While `default` is a valid field, it sets a default limit rather than enforcing a constraint directly, so it is not among the three asked.

Answer

default

Question 16

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 17

Which THREE are valid reasons to use a StatefulSet instead of a Deployment?

Accepted Answer

Each pod requires a stable, unique network identity.. StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Answer

The application requires rolling updates.

Answer

The application cannot be scaled down.

Question 18

A developer wants to ensure that a container runs as a non-root user and the filesystem is read-only except for a tmpfs volume. Which fields should be set in the container's securityContext?

Accepted Answer

runAsNonRoot: true and readOnlyRootFilesystem: true. `runAsNonRoot: true` enforces that the container cannot run as the root user (UID 0), and `readOnlyRootFilesystem: true` makes the container's filesystem read-only except for volumes explicitly mounted as writable, such as a tmpfs volume. Together, these fields satisfy the requirement of a non-root container with a read-only filesystem except for a tmpfs mount.

Answer

runAsUser: 1000 and readOnlyRootFilesystem: true

Answer

runAsNonRoot: true and privileged: false

Answer

allowPrivilegeEscalation: false and readOnlyRootFilesystem: true

Question 19

You want to view the logs of a pod named 'web-pod' that has two containers: 'nginx' and 'sidecar'. Which command correctly retrieves the logs from the 'nginx' container?

Accepted Answer

kubectl logs web-pod -c nginx. The correct command uses the proper syntax: `kubectl logs -c `. Option B follows this syntax correctly. Option A places the container flag before the pod name, which is invalid. Option C omits the -c flag, which is required when the pod has multiple containers. Option D uses the long form --container, which is valid but the question expects the short form as seen in B. Therefore, B is the best answer.

Answer

kubectl logs -c nginx web-pod

Answer

kubectl logs web-pod nginx

Answer

kubectl logs web-pod --container nginx

Question 20

Which THREE capabilities are commonly dropped in a pod's securityContext to adhere to restricted pod security standards?

Accepted Answer

SYS_ADMIN. (SYS_ADMIN) is correct because the restricted pod security standard (PSS) requires dropping all capabilities via `ALL` and then adding back only those needed. However, `SYS_ADMIN` is a highly privileged capability that grants broad system administration access, such as mounting filesystems and performing privileged syscalls, and is explicitly forbidden in restricted profiles. Dropping it is mandatory to comply with restricted PSS.

Answer

ALL

Answer

CHOWN