CKAD Exam Simulation 1 — 100 Questions

Question 1

You are designing a Pod that must run a diagnostic tool to collect network logs before the main application starts. The diagnostic tool should run to completion, then the main application starts. Which approach should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add the diagnostic tool as an init container in the Pod. Init containers run sequentially before the Pod's main containers start, and they must complete successfully before the main application container begins. This makes them ideal for setup tasks like running a diagnostic tool to collect network logs that must finish before the main application starts.

Answer

Add the diagnostic tool as a sidecar container in the same Pod

Answer

Add the diagnostic tool as a sidecar container with a postStart hook

Answer

Create a separate Job that runs before the Pod

Question 2

A Pod named `my-pod` in namespace `ns1` tries to resolve `svc-a.ns2.svc.cluster.local`. The DNS query fails. The Service `svc-a` exists in namespace `ns2`. What is the most likely cause?

Accepted Answer

The DNS add-on (e.g., CoreDNS) is not deployed or is misconfigured. The DNS query for `svc-a.ns2.svc.cluster.local` fails despite the Service existing, which points to a cluster-wide DNS resolution issue. CoreDNS is the default DNS add-on in Kubernetes that translates service names to IP addresses; if it is not deployed or misconfigured, all DNS queries (including cross-namespace ones) will fail. The fact that the Service exists and the Pod is in a different namespace does not inherently prevent resolution—CoreDNS handles cross-namespace lookups by default.

Answer

The Service `svc-a` does not have any endpoints

Answer

The Pod cannot resolve names from other namespaces

Answer

The Service type is NodePort

Question 3

Which FOUR of the following are valid probe handlers in Kubernetes?

Accepted Answer

exec. In Kubernetes, the kubelet supports exactly four probe handler mechanisms for liveness, readiness, and startup probes. Option A (exec) is correct because it runs a command inside the container and uses the exit code to determine success. Option B (gRPC) is correct because Kubernetes supports gRPC health checking (GA since v1.24) via the gRPC Health Checking Protocol. Option C (httpGet) is correct because it performs an HTTP GET request against the container's IP and port, treating 200-399 status codes as success. Option D (tcpSocket) is correct because it attempts a TCP connection to the specified port, succeeding if the connection is established. Option E (udpSocket) is not a valid handler, as Kubernetes does not provide a UDP-based probe type; probes use exec, httpGet, tcpSocket, or gRPC only.

Answer

udpSocket

Question 4

Which THREE are valid patterns for multi-container Pods?

Accepted Answer

Ambassador. (Ambassador) is correct because the Ambassador pattern uses a proxy container that mediates network traffic between the main application container and external services, allowing the main container to connect to localhost while the ambassador handles protocol translation or service discovery. This is a valid multi-container Pod design pattern in Kubernetes, commonly implemented with tools like Envoy or a custom sidecar proxy.

Answer

Init

Answer

Replicator

Question 5

A ClusterRole named 'pod-reader' allows get, list, and watch on pods. A RoleBinding 'read-pods' in namespace 'default' binds this ClusterRole to user 'jane'. Which statement is true?

Accepted Answer

User 'jane' can read pods only in the 'default' namespace. A RoleBinding in a specific namespace binds a ClusterRole to a subject only within that namespace. Since the RoleBinding 'read-pods' is in the 'default' namespace, user 'jane' receives the permissions defined in the 'pod-reader' ClusterRole (get, list, watch on pods) only within the 'default' namespace, not across all namespaces.

Answer

User 'jane' can read pods in all namespaces because ClusterRole is cluster-scoped

Answer

The RoleBinding must be changed to a ClusterRoleBinding for it to work

Answer

User 'jane' can read pods and also delete them because ClusterRole gives full access

Question 6

A developer needs to view the logs of a pod named 'web-app-84b7f6f5b6-abcde' that crashed and has been restarted. Which kubectl command should they use to see the logs from the previous (crashed) instance?

Accepted Answer

kubectl logs --previous web-app-84b7f6f5b6-abcde. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has been restarted. This is essential for debugging a crashed pod, as the current container's logs only reflect the new instance after the restart.

Answer

kubectl logs web-app-84b7f6f5b6-abcde

Answer

kubectl logs --all-containers web-app-84b7f6f5b6-abcde

Answer

kubectl logs -f web-app-84b7f6f5b6-abcde

Question 7

An Ingress resource has the following spec. What is the effect?

spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Accepted Answer

Ingress terminates TLS using the secret and routes to the service.. The Ingress spec defines TLS termination at the ingress controller using the secret `myapp-tls` for the host `myapp.example.com`. The `tls` block configures the ingress to decrypt HTTPS traffic using the certificate and key stored in that secret, and then forward the decrypted HTTP traffic to the backend service `myapp` on port 80. This is the standard behavior for securing traffic with TLS in Kubernetes Ingress.

Answer

Ingress uses the secret for client authentication.

Answer

Ingress redirects HTTP to HTTPS automatically.

Answer

Ingress passes the TLS connection through to the service.

Question 8

A developer wants to view the resource usage of all containers in a specific pod. Which command should they use?

Accepted Answer

kubectl top pod --containers. `kubectl top pod --containers` displays per-container CPU and memory metrics for a specific pod, which is exactly what the developer needs to view resource usage of all containers within that pod. The `--containers` flag is essential to break down the pod-level metrics into individual container-level metrics.

Answer

kubectl top pods --all-namespaces

Answer

kubectl top pods

Answer

kubectl top pod <pod>

Question 9

Which Dockerfile instruction is used to specify the base image for a container image?

Accepted Answer

FROM. The FROM instruction initializes a new build stage and sets the base image for subsequent instructions. It must be the first non-comment instruction in a Dockerfile, pulling a specified image from a registry (e.g., Docker Hub) to provide the filesystem and runtime environment for the container.

Answer

COPY

Answer

CMD

Answer

RUN

Question 10

You need to access a database pod 'db-pod' on port 5432 from your local machine. Which command forwards local port 15432 to the pod's port 5432?

Accepted Answer

kubectl port-forward pod/db-pod 15432:5432. `kubectl port-forward` creates a direct tunnel from a local port to a port on a specific pod. The syntax `kubectl port-forward pod/db-pod 15432:5432` forwards local port 15432 to the pod's port 5432, allowing you to access the database as if it were running locally.

Answer

kubectl proxy --port=15432 db-pod:5432

Answer

kubectl expose pod db-pod --port=15432 --target-port=5432

Answer

kubectl port-forward db-pod 5432:15432

Question 11

A developer reports that a container in a pod is not responding correctly. You need to get an interactive shell in the container to investigate. Which command should you run?

Accepted Answer

kubectl exec -it -- /bin/bash. `kubectl exec -it -- /bin/bash` attaches an interactive terminal to a running container within an existing pod, allowing direct shell access for debugging. The `-it` flags enable interactive mode with a TTY, and `/bin/bash` starts a shell if available in the container image. This is the standard method for troubleshooting a container that is already deployed and running.

Answer

kubectl run -it --rm debug --image=busybox

Answer

kubectl exec <pod> -- /bin/bash

Answer

kubectl debug -it --image=busybox --target=

Question 12

Which field in the container spec controls the time Kubernetes waits after sending SIGTERM before sending SIGKILL during pod shutdown?

Accepted Answer

terminationGracePeriodSeconds. `terminationGracePeriodSeconds` is the field in the Pod spec that defines the duration Kubernetes waits after sending SIGTERM to the main process in each container before forcefully sending SIGKILL. This grace period allows the application to perform clean shutdown tasks, such as closing connections or flushing data. The default value is 30 seconds if not specified.

Answer

timeoutSeconds

Answer

periodSeconds

Answer

activeDeadlineSeconds

Question 13

You want to see all events in the default namespace sorted by timestamp. Which command should you use?

Accepted Answer

kubectl get events. `kubectl get events` retrieves all events in the current namespace (default) and displays them in a table sorted by the `LAST SEEN` timestamp by default. Events are Kubernetes API objects that record actions and state changes (e.g., pod scheduling, container restarts), making this command the standard way to observe cluster activity in a namespace.

Answer

kubectl logs --all-containers

Answer

kubectl top events

Answer

kubectl describe pods

Question 14

You have a pod that takes 2 minutes to start its application. You want to avoid the liveness probe from killing the pod during startup, but still have it active afterward. Which probe should you add to the pod spec?

Accepted Answer

Add a startup probe with a failureThreshold high enough to cover the startup time. A startup probe is designed specifically for slow-starting containers. It runs before the liveness probe and, if it fails, the container is killed. By setting a high failureThreshold (e.g., 12 with a 10-second period gives 120 seconds), you allow the application up to 2 minutes to start without the liveness probe interfering. Once the startup probe succeeds, the liveness probe takes over normally.

Answer

Increase the timeoutSeconds on the liveness probe

Answer

Set periodSeconds on the liveness probe to 120

Answer

Set initialDelaySeconds on the liveness probe to 120

Question 15

Which command exposes a deployment named 'web' as a ClusterIP service on port 80?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a ClusterIP service by default, which exposes the deployment on port 80 within the cluster. The `expose` command automatically selects the deployment's pod labels and creates a service that maps port 80 to the target port (defaulting to the same port).

Answer

kubectl create service clusterip web --port=80

Answer

kubectl run web --expose --port=80

Answer

kubectl expose deployment web --port=80 --type=NodePort

Question 16

Which of the following is true about Istio as a service mesh?

Accepted Answer

It injects a sidecar proxy into each pod. Istio is a service mesh that deploys an Envoy sidecar proxy alongside each application pod. This sidecar intercepts all inbound and outbound traffic, enabling advanced traffic management, observability, and security features without modifying application code. The sidecar injection is typically done automatically via a mutating webhook admission controller.

Answer

It replaces kube-proxy for service routing

Answer

It only works with HTTP traffic

Answer

It requires all services to be of type LoadBalancer

Question 17

A user runs 'kubectl get endpoints my-service' and sees no endpoints listed. The service has a selector 'app: my-app'. Pods with that label exist and are running. What is the most likely cause?

Accepted Answer

The pods are not ready (readiness probe failing). In Kubernetes, a Service creates Endpoints only for pods that match its selector and are ready. Because the pods are labeled app: my-app and match the selector, the missing endpoints indicate the pods are not passing their readiness probes.

Answer

The service selector does not match the pod labels

Answer

The pods are not assigned an IP address

Answer

The service name is incorrect

Question 18

You need to forward a local port to port 8080 on a pod named 'my-pod' in the 'default' namespace. Which kubectl command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. The `kubectl port-forward` command requires the resource type (pod/) and the correct port mapping syntax. The question specifies forwarding a local port to port 8080 on the pod, so the local port is 8080 and the pod port is 8080, making `8080:8080` the correct mapping. The full command `kubectl port-forward pod/my-pod 8080:8080` establishes a tunnel from localhost:8080 to the pod's port 8080.

Answer

kubectl port-forward pod/my-pod 8080:80

Answer

kubectl forward pod/my-pod 8080:8080

Answer

kubectl port-forward my-pod 8080

Question 19

You need to perform a canary deployment where 10% of traffic goes to the new version. You have a Deployment 'app-v1' with 9 replicas and 'app-v2' with 1 replica. What must be true for the Service to distribute traffic roughly 90/10?

Accepted Answer

The Service selector must include a label that both Deployments share, e.g., 'app: myapp'. A Kubernetes Service distributes traffic across all Pods matching its label selector. For a canary deployment with 90/10 traffic split, both Deployments must share a common label (e.g., 'app: myapp') so the Service selects all 10 Pods (9 from v1, 1 from v2), achieving roughly 90% traffic to v1 and 10% to v2 based on replica count. The Service uses round-robin or random load balancing by default, so the ratio of replicas directly determines traffic distribution.

Answer

The Service must have 'sessionAffinity: ClientIP' to ensure sticky sessions

Answer

The Service must not have any selectors, and endpoints must be manually managed

Answer

The Service selector must include only 'version: v2'

Question 20

Which of the following commands creates a deployment named 'webapp' that runs the image 'nginx:1.25' with 3 replicas?

Accepted Answer

kubectl create deployment webapp --image=nginx:1.25 --replicas=3. The correct command to create a Deployment named 'webapp' with the nginx:1.25 image and 3 replicas is 'kubectl create deployment webapp --image=nginx:1.25 --replicas=3'. Option B uses 'kubectl run', which creates a Pod, not a Deployment, and does not support the --replicas flag in modern Kubernetes. Option C is missing the --replicas flag, so it creates a Deployment with only the default of 1 replica. Option D uses 'kubectl expose', which creates a Service, not a Deployment.

Answer

kubectl run webapp --image=nginx:1.25 --replicas=3

Answer

kubectl create deployment webapp --image=nginx:1.25

Answer

kubectl expose deployment webapp --port=80