CKAD Practice Test 15 — 15 Questions

Question 1

You create a ConfigMap named 'app-config' with the command 'kubectl create configmap app-config --from-literal=key1=value1'. Which of the following correctly mounts this ConfigMap as environment variables in a pod?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with `configMapRef` is the Kubernetes mechanism to expose all key-value pairs from a ConfigMap as environment variables in a pod. This directly mounts the ConfigMap created with `--from-literal=key1=value1` so that `key1` becomes an environment variable with value `value1`.

Answer

env:
  - name: key1
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: key1

Answer

volumes:
  - name: config-volume
    configMap:
      name: app-config
volumeMounts:
  - name: config-volume
    mountPath: /etc/config

Answer

env:
  - name: key1
    valueFrom:
      configMapRef:
        name: app-config

Question 2

Your team manages a microservices application on a Kubernetes cluster. A critical service 'order-service' is deployed with 3 replicas. Lately, customers have reported occasional timeouts when placing orders. You suspect that the service is overloaded during peak hours. You have configured a HorizontalPodAutoscaler (HPA) based on CPU utilization, but the autoscaler does not appear to be scaling up quickly enough. Upon inspection, you notice that the HPA is configured with a target CPU utilization of 80%, and the current CPU usage of the pods is around 70%. However, the pods' memory usage is high and growing. The application is also logging slow database queries. Which action is most likely to improve the responsiveness of the service during peak load?

Accepted Answer

Modify the HPA to also scale based on memory utilization, setting a target average value for memory.. The HPA is configured only for CPU, but the symptom (high memory usage, slow DB queries) indicates memory pressure is the bottleneck. Adding a memory-based metric to the HPA allows it to scale when memory exceeds the target, addressing the root cause of overload during peak hours. The current CPU at 70% is below the 80% threshold, so the HPA won't trigger on CPU alone, but memory scaling can react to the actual resource constraint.

Answer

Reduce the number of replicas to 2 to force the HPA to react more aggressively.

Answer

Increase the CPU target utilization to 90% so the HPA triggers earlier.

Answer

Optimize the database queries to reduce response time.

Question 3

You create a Service with the following manifest. What is the effect? service.yaml: apiVersion: v1 kind: Service metadata: name: ext-svc spec: type: ExternalName externalName: db.example.com

Accepted Answer

The service is a CNAME alias for db.example.com. A Service of type `ExternalName` creates a DNS CNAME record in the cluster's DNS (e.g., CoreDNS) that maps the Service name `ext-svc` to the external DNS name `db.example.com`. When a Pod resolves `ext-svc`, it receives the canonical name `db.example.com` directly, with no proxy, ClusterIP, or pod selection involved.

Answer

The service gets a ClusterIP and forwards to db.example.com

Answer

The service creates a load balancer pointing to db.example.com

Answer

The service selects pods with label app: ext

Question 4

A CronJob has concurrencyPolicy set to 'Forbid'. At the scheduled time, if the previous job is still running, what happens?

Accepted Answer

The new job is skipped (does not run). When a CronJob has `concurrencyPolicy: Forbid`, Kubernetes ensures that if a previous job instance is still running at the next scheduled time, the new job is simply skipped (does not run). This prevents overlapping executions, which is critical for workloads that must not run concurrently, such as database migrations or batch processing that would cause data corruption.

Answer

The new job is delayed until the previous job completes

Answer

Both jobs run concurrently

Answer

The previous job is terminated and the new job starts

Question 5

You apply a ResourceQuota to a namespace that limits memory requests to 2Gi. You then try to create a pod that requests 3Gi memory. What happens?

Accepted Answer

The pod creation fails with an error message indicating the quota would be exceeded.. When a ResourceQuota is applied to a namespace with a memory request limit of 2Gi, any pod creation that would cause the total memory requests in the namespace to exceed that quota is rejected by the Kubernetes API server. The pod creation fails immediately with an error message indicating the quota would be exceeded, because the admission controller validates the request against the quota before allowing the pod to be scheduled.

Answer

The pod is created with a warning, but the request is ignored.

Answer

The pod is created, but the memory request is capped at 2Gi.

Answer

The pod is created, but it will be OOMKilled if it exceeds 2Gi.

Question 6

A developer creates a Deployment with 3 replicas that uses a ConfigMap mounted as a volume. After updating the ConfigMap, the developer expects the pods to pick up the new configuration immediately, but the old configuration is still in use. What is the most likely reason?

Accepted Answer

The kubelet sync interval delays the propagation of ConfigMap changes to pods.. When a ConfigMap is mounted as a volume, updates to the ConfigMap are eventually propagated to the pods, but not instantly. The kubelet periodically syncs mounted ConfigMaps (default interval is 60 seconds), so there is a delay before pods see the new configuration. This is the most likely reason the old configuration is still in use.

Answer

ConfigMap updates are not propagated to mounted volumes.

Answer

The pods must be recreated after a ConfigMap update to see the changes.

Answer

ConfigMaps are immutable and cannot be updated.

Question 7

You have a headless Service for a StatefulSet. The DNS query for the service returns no A records. What is the most likely cause?

Accepted Answer

The Service selector does not match any pod labels. A headless Service (clusterIP: None) relies on DNS A records to return the IP addresses of the Pods selected by its selector. If the selector does not match any Pod labels, the Service has no endpoints, and the DNS lookup returns no A records. This is the most common cause for a headless Service returning empty DNS results.

Answer

The Service has clusterIP set to an IP address

Answer

The Service is of type ExternalName

Answer

The StatefulSet is using a volumeClaimTemplate

Question 8

You need to view the logs of a container that previously crashed and has been restarted. Which flag do you use with 'kubectl logs'?

Accepted Answer

--previous. The `--previous` flag is used with `kubectl logs` to view logs from the previous instance of a container that has crashed and been restarted. This allows you to inspect the logs of the terminated container before the restart, which is essential for debugging crash loops.

Answer

--all-containers

Answer

--tail

Answer

-f

Question 9

Which of the following YAML fields can be used to mount a Secret as a volume in a Pod?

Accepted Answer

volumes. The `volumes` field in a Pod spec allows you to define a volume of type `secret`, which can then be mounted into a container using the `volumeMounts` field. This is the standard Kubernetes mechanism for exposing Secret data as files in the container's filesystem.

Answer

imagePullSecrets

Answer

annotations

Answer

envFrom

Question 10

Which commands list all Helm releases in the current namespace? (Select all that apply)

Accepted Answer

helm list. Both `helm list` and its alias `helm ls` are valid commands to list all Helm releases in the current namespace. `helm get all` retrieves all information about a specific release, and `helm status` shows the status of a single release.

Answer

helm get all

Answer

helm status

Question 11

Which kubectl command streams logs from a pod named 'web-pod' in real-time?

Accepted Answer

kubectl logs -f web-pod. The `-f` flag (short for `--follow`) tells kubectl to stream logs from the pod in real-time, similar to `tail -f` on a file. This is essential for live monitoring of application output as it is generated.

Answer

kubectl logs --since=5m web-pod

Answer

kubectl logs --tail=100 web-pod

Answer

kubectl logs web-pod

Question 12

Which two commands can create a ConfigMap from an environment file? (Select TWO.)

Accepted Answer

kubectl create configmap my-config --from-env-file=app.env. `--from-env-file=app.env` is the dedicated flag for creating a ConfigMap from an environment file, where each line in the file is parsed as a key=value pair. Option C is also correct because `--from-file=app.env` creates a ConfigMap with the file's entire contents stored under the filename as the key, which is a valid method even though it does not parse the file as environment variables.

Answer

kubectl create configmap my-config --from-literal=app.env

Answer

kubectl create configmap my-config --from-file=key1=app.env

Answer

kubectl create configmap my-config --from-env=app.env

Question 13

You want to perform a rolling update of a Deployment. The Deployment has a maxSurge=1 and maxUnavailable=0. How many extra pods can be created above the desired count during the update?

Accepted Answer

1. In a rolling update with `maxSurge=1` and `maxUnavailable=0`, Kubernetes ensures that at most one extra pod can be created above the desired replica count during the update. This is controlled by the `maxSurge` field, which defines the maximum number of pods that can be created over the desired number, and here it is set to 1 (either an absolute number or a percentage, defaulting to 25%). Since `maxUnavailable=0`, no pods can be taken down before new ones are ready, so the surge allows exactly one additional pod to be created temporarily.

Answer

Unlimited

Answer

0

Answer

Desired replicas

Question 14

A NetworkPolicy with the following spec is applied:
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
What does this policy do?

Accepted Answer

Allows incoming traffic from pods labeled 'role: frontend' to all pods. This NetworkPolicy selects all pods (empty podSelector `{}`) and defines an ingress rule that only allows incoming traffic from pods with the label `role: frontend`. By default, Kubernetes NetworkPolicies are additive and deny all traffic that is not explicitly allowed, so this policy permits ingress from frontend pods to all pods while blocking all other inbound traffic.

Answer

Allows all outgoing traffic from pods labeled 'role: frontend'

Answer

Blocks all incoming traffic to pods labeled 'role: frontend'

Answer

Has no effect because policyTypes is missing Egress

Question 15

You want to see a list of all events in the 'default' namespace, sorted by timestamp. Which command should you use?

Accepted Answer

kubectl get events. `kubectl get events` retrieves all events in the current namespace (default) and, by default, sorts them by the `lastTimestamp` field in ascending order, which is the timestamp of the event. This command directly answers the requirement to list events sorted by timestamp without additional flags.

Answer

kubectl describe events

Answer

kubectl get pods

Answer

kubectl logs --all-containers