CKAD Practice Test 13 — 15 Questions

Question 1

You want to run a command inside a running container to check environment variables. Which command should you use?

Accepted Answer

kubectl exec pod-name -- env. `kubectl exec pod-name -- env` runs the `env` command inside the specified container, which prints all environment variables set in the container's runtime environment. This is the most direct and efficient way to inspect environment variables without entering an interactive shell.

Answer

kubectl logs pod-name

Answer

kubectl describe pod pod-name

Answer

kubectl exec -it pod-name -- /bin/bash

Question 2

You have a Deployment with the following strategy: rollingUpdate: maxSurge: 25%, maxUnavailable: 25%. The Deployment has 4 replicas. During an update, what is the minimum number of pods guaranteed to be available?

Accepted Answer

3. With 4 replicas and a rolling update strategy of maxSurge: 25% and maxUnavailable: 25%, the maximum number of pods that can be unavailable during the update is 25% of 4, which is 1. Therefore, the minimum number of pods guaranteed to be available is 4 - 1 = 3. This is calculated by rounding down the maxUnavailable value (1) and ensuring the desired replica count minus unavailable pods equals the minimum available.

Answer

2

Answer

4

Answer

1

Question 3

A pod has a readiness probe using tcpSocket on port 3306. The application listens on port 3306 but returns errors on database queries. What is the effect of the readiness probe?

Accepted Answer

The pod will be considered ready as long as the TCP port is open, even if the application is not fully functional. A readiness probe with tcpSocket only checks whether the TCP port is open and accepting connections. It does not verify application-level health, such as whether the application can process queries or return valid responses. Since port 3306 is open, the probe succeeds, and the pod is considered ready, even though the application returns errors on database queries.

Answer

The pod will be evicted from the node

Answer

The pod will be marked not ready because the application returns errors

Answer

The container will be restarted due to readiness probe failure

Question 4

Which kubectl command creates a ConfigMap named 'app-config' with key 'color' and value 'blue'?

Accepted Answer

kubectl create configmap app-config --from-literal=color=blue. `kubectl create configmap app-config --from-literal=color=blue` directly creates a ConfigMap with a key-value pair. The `--from-literal` flag specifies a literal key=value string, which is the standard way to inject a single key-value pair into a ConfigMap without referencing an external file.

Answer

kubectl create configmap app-config --from-file=color=blue

Answer

kubectl create configmap app-config --from-env-file=color=blue

Answer

kubectl run configmap app-config --data color=blue

Question 5

An administrator wants to allow ingress traffic to pods with label 'app: database' only from pods with label 'app: api' in the same namespace. Which NetworkPolicy rule is correct?

Accepted Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - podSelector: { matchLabels: { app: api } }. It defines a NetworkPolicy that selects pods with label 'app: database' as the target (podSelector) and allows ingress traffic only from pods with label 'app: api' (ingress.from.podSelector). This matches the requirement exactly: only pods with 'app: api' can send traffic to pods with 'app: database' within the same namespace, as NetworkPolicy podSelector rules are namespace-scoped by default.

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - ipBlock: { cidr: 10.0.0.0/8 }

Answer

podSelector: { matchLabels: { app: api } }
ingress:
- from:
  - podSelector: { matchLabels: { app: database } }

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - namespaceSelector: { matchLabels: { name: default } }

Question 6

You run 'kubectl apply -f pod.yaml' but the pod remains in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 Insufficient cpu'. What is the most likely cause?

Accepted Answer

The pod's CPU request exceeds the available CPU capacity on any node. The error '0/1 nodes are available: 1 Insufficient cpu' indicates that the pod's CPU request (specified in the container spec under `resources.requests.cpu`) exceeds the allocatable CPU capacity on any node in the cluster. The scheduler evaluates CPU requests, not limits, for admission decisions; if no node has enough unallocated CPU to satisfy the request, the pod remains Pending.

Answer

The pod's memory limit is too low

Answer

The container image is not found in the registry

Answer

The node is under disk pressure

Question 7

You run 'kubectl get events' and see an event 'FailedScheduling' for a pod. What is the most common cause?

Accepted Answer

Insufficient node resources to meet the pod's requests. The 'FailedScheduling' event indicates that the Kubernetes scheduler could not find a suitable node to place the pod. The most common cause is insufficient node resources (CPU, memory, or ephemeral storage) to meet the pod's resource requests defined in the pod spec. The scheduler uses the `kube-scheduler` component to evaluate node fit based on predicates like `PodFitsResources`, and if no node satisfies the requested resources, the pod remains in a Pending state with this event.

Answer

The pod's container image pull failed

Answer

The liveness probe failed

Answer

The pod was deleted by a Deployment update

Question 8

A pod is stuck in 'Pending' state. You run 'kubectl describe pod' and see '0/1 nodes are available: 1 Insufficient cpu, 1 Insufficient memory.' What does this mean?

Accepted Answer

The pod's resource requests exceed available resources on any node. The 'Pending' state indicates the pod has been accepted by the Kubernetes API server but cannot be scheduled onto a node. The message '0/1 nodes are available: 1 Insufficient cpu, 1 Insufficient memory' means the scheduler evaluated all nodes and found that none had enough allocatable CPU and memory to satisfy the pod's resource requests. This is a scheduling failure caused by the pod's requests exceeding the available resources on any node.

Answer

The container image is not available

Answer

The liveness probe is failing

Answer

The container is crashing due to an error

Question 9

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine. Which command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. `kubectl port-forward` creates a direct tunnel from a local port to a pod's port, allowing you to access the pod's HTTP endpoint at `localhost:8080` from your local machine. This is the standard method for temporarily exposing a pod's network endpoint without creating a Service or modifying cluster networking.

Answer

kubectl exec -it pod/my-pod -- curl http://localhost:8080

Answer

kubectl proxy --port=8080

Answer

kubectl attach pod/my-pod

Question 10

You need to view the logs of a container named 'sidecar' inside a pod named 'app'. Which command should you use?

Accepted Answer

kubectl logs app -c sidecar. `kubectl logs app -c sidecar` explicitly targets the 'sidecar' container within the 'app' pod. In Kubernetes, when a pod runs multiple containers, you must use the `-c` flag to specify which container's logs to retrieve; otherwise, the command fails or returns ambiguous output.

Answer

kubectl logs app --previous -c sidecar

Answer

kubectl logs app sidecar

Answer

kubectl logs app -c sidecar -p

Question 11

A developer creates a Role and RoleBinding in the namespace 'development' to grant list pods permission to a service account. Which manifest snippet correctly defines the Role?

Accepted Answer

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. Pods belong to the core API group, which is represented by an empty string `""` in the `apiGroups` field. The `list` verb is sufficient to list pods, and the `resources` field correctly specifies `pods`. This Role grants the service account permission to list pods in the `development` namespace.

Answer

rules:
- apiGroups: ["pods"]
  resources: ["pods"]
  verbs: ["get", "list"]

Answer

rules:
- apiGroups: ["apps"]
  resources: ["pods"]
  verbs: ["list"]

Answer

rules:
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["list"]

Question 12

You are using Helm to manage an application. After running 'helm install myapp ./mychart', you notice that the application is running but you need to change a configuration value. Which command should you use to update the release?

Accepted Answer

helm upgrade myapp ./mychart --set key=value. 'helm upgrade' is the correct command to update an existing release with new chart values or a new chart version. Passing '--set key=value' overrides a specific value at upgrade time, and Helm computes a diff against the previous release, applying only the necessary Kubernetes changes. 'helm install' is only for creating new releases.

Answer

helm update myapp ./mychart

Answer

helm install myapp ./mychart --replace

Answer

kubectl edit deployment myapp

Question 13

You create a ServiceAccount 'my-sa' with automountServiceAccountToken: false. A pod that references this ServiceAccount also sets automountServiceAccountToken: true in its spec. Will the service account token be mounted?

Accepted Answer

Yes, because the pod spec setting takes precedence.. The pod spec's `automountServiceAccountToken: true` takes precedence over the ServiceAccount's `automountServiceAccountToken: false`. Kubernetes merges the ServiceAccount and pod-level settings, with the pod-level setting overriding the ServiceAccount's setting. Therefore, the token will be mounted into the pod.

Answer

No, because the ServiceAccount has automountServiceAccountToken: false, which is a hard block.

Answer

It depends on the namespace default settings.

Answer

No, because the ServiceAccount setting overrides the pod setting.

Question 14

A Deployment has been updated with a new image. After running 'kubectl rollout status deployment/myapp', you see that the rollout has stalled. You want to undo the rollout to the previous revision. What command do you run?

Accepted Answer

kubectl rollout undo deployment/myapp. 'kubectl rollout undo deployment/myapp' reverts the Deployment to the previous revision, which is the standard Kubernetes command for rolling back a stalled or failed rollout. This command uses the Deployment's revision history stored in its annotations to restore the prior pod template specification.

Answer

kubectl rollout restart deployment/myapp

Answer

kubectl delete deployment/myapp --cascade=orphan

Answer

kubectl set image deployment/myapp app=old-image

Question 15

An administrator creates a Pod with an ephemeral container using 'kubectl debug my-pod -it --image=busybox --target=my-container'. The ephemeral container shares the same process namespace as the target container. Which flag enables this?

Accepted Answer

--target. The `--target` flag in `kubectl debug` specifies the target container within the Pod for the ephemeral container. When used, the ephemeral container shares the same process namespace as the target container, allowing tools like `ps` to see processes from the target container. This is essential for debugging scenarios where you need to inspect or interact with the target container's processes.

Answer

--container

Answer

--namespace

Answer

--share-process-namespace