CKAD Practice Test 16 — 15 Questions

Question 1

A pod spec has terminationGracePeriodSeconds: 30. The main process ignores SIGTERM. After 30 seconds, what happens?

Accepted Answer

SIGKILL is sent to forcefully terminate the container. When the main process in a container ignores SIGTERM, Kubernetes waits for the duration specified in `terminationGracePeriodSeconds` (30 seconds) and then sends SIGKILL to forcefully terminate the container. This ensures that pods do not hang indefinitely during shutdown, as SIGKILL cannot be ignored by any process.

Answer

The pod remains running indefinitely

Answer

The pod enters a CrashLoopBackOff state

Answer

The pod is rescheduled to another node

Question 2

You create a Role named 'pod-reader' in the 'default' namespace with rules to get, list, and watch pods. A ServiceAccount 'app-sa' in the same namespace needs to be bound to this role. Which YAML snippet correctly creates the RoleBinding?

Accepted Answer

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: app-sa
  apiGroup: ''
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io. It creates a RoleBinding in the 'default' namespace that binds the ServiceAccount 'app-sa' to the Role 'pod-reader' using the correct 'kind: Role' in the roleRef. The RoleBinding must reference a Role (not a ClusterRole) when the Role exists in the same namespace, and the apiGroup for the roleRef must be 'rbac.authorization.k8s.io'.

Answer

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: app-sa
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Answer

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: app-sa
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Answer

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Question 3

Which command lists all the secrets in the current namespace?

Accepted Answer

kubectl get secrets. The correct command to list all secrets in the current namespace is `kubectl get secrets`. This command retrieves and displays all Secret resources in the namespace specified by the current context (or the `--namespace` flag). Secrets are stored in etcd as base64-encoded data and are managed via the Kubernetes API, and `kubectl get` is the standard verb for listing resources.

Answer

kubectl get configmaps

Answer

kubectl describe secrets

Answer

kubectl list secrets

Question 4

A pod is in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 Insufficient cpu'. Which action would resolve this?

Accepted Answer

Reduce the CPU request in the container's resource spec. The pod is in Pending state because no node has enough allocatable CPU to satisfy the container's CPU request. Reducing the CPU request in the container's resource spec lowers the amount of guaranteed CPU the scheduler requires, making it possible to schedule the pod on a node with insufficient CPU capacity. This directly resolves the 'Insufficient cpu' condition shown in 'kubectl describe pod'.

Answer

Increase the CPU limit of the container

Answer

Delete and recreate the pod

Answer

Add more environment variables

Question 5

You are performing a rolling update of a Deployment. You set maxSurge=2 and maxUnavailable=1. The Deployment has 5 replicas. During the update, how many pods can be running simultaneously?

Accepted Answer

7. During a rolling update, maxSurge=2 allows up to 2 extra pods beyond the desired replicas, and maxUnavailable=1 allows at most 1 pod to be unavailable. With a desired count of 5, the maximum running pods is 5 (desired) + 2 (surge) = 7, because the surge pods are created before old ones are terminated, and the unavailable limit does not cap the total running count.

Answer

6

Answer

10

Answer

5

Question 6

You are troubleshooting a service connectivity issue. You have a pod named 'client' and a service named 'server'. You want to check if the service's endpoints are populated. Which command should you run?

Accepted Answer

kubectl get endpoints server. `kubectl get endpoints server` directly retrieves the Endpoints object associated with the service named 'server'. Endpoints are automatically managed by Kubernetes and list the IP addresses and ports of pods that match the service's selector. If the endpoints list is empty, it indicates that no pods are matching the service's selector, which is a common cause of connectivity issues.

Answer

kubectl describe pod client

Answer

kubectl get pods -l app=server

Answer

kubectl get svc server

Question 7

You have a service account 'my-sa' in the default namespace. You want a pod to use this service account and also prevent the pod from mounting the service account token. Which pod spec configuration is correct?

Accepted Answer

spec:
  serviceAccountName: my-sa
  automountServiceAccountToken: false. Setting `automountServiceAccountToken: false` in the pod spec prevents the automatic mounting of the service account token, while `serviceAccountName: my-sa` specifies the desired service account. This satisfies both requirements: using the custom service account and disabling token mounting.

Answer

spec:
  serviceAccountName: my-sa
  automountServiceAccountToken: true

Answer

spec:
  serviceAccount: my-sa
  automountServiceAccountToken: true

Answer

spec:
  serviceAccountName: default
  automountServiceAccountToken: false

Question 8

A CronJob is configured with concurrencyPolicy: Replace and a job execution takes 10 minutes. The schedule is */5 * * * *. Which statement is true about job executions?

Accepted Answer

Every 5 minutes, a new job is created, and if the previous job is still running, it is killed. With `concurrencyPolicy: Replace`, if a new job is triggered by the schedule (every 5 minutes) while the previous job is still running (it takes 10 minutes), the running job is terminated and replaced by the new one. This ensures only one job runs at a time, and the new job starts immediately, even if the previous one hasn't finished.

Answer

Jobs will never overlap because the schedule is too frequent

Answer

The job will be skipped if the previous one hasn't finished

Answer

Jobs will overlap, with up to two jobs running concurrently

Question 9

A pod is running with the default service account. An administrator wants to prevent the pod from automatically mounting the service account token. Which field in the pod spec accomplishes this?

Accepted Answer

automountServiceAccountToken: false. Setting `automountServiceAccountToken: false` in the pod spec explicitly prevents the automatic mounting of the service account token into the pod. By default, Kubernetes mounts a projected service account token into every pod at `/var/run/secrets/kubernetes.io/serviceaccount`; this field overrides that default behavior at the pod level.

Answer

serviceAccountName: ""

Answer

serviceAccountToken: none

Answer

securityContext.readOnlyRootFilesystem: true

Question 10

A pod has a readiness probe configured with httpGet on port 8080. The probe is failing, but the pod is running. What is the immediate effect on the pod?

Accepted Answer

The pod will be removed from the Service's endpoints and will stop receiving traffic. A readiness probe that fails means Kubernetes considers the pod not ready to serve traffic. The pod itself continues running, but the kubelet removes its IP from all matching Service endpoints, so it stops receiving new requests. This is the immediate effect because readiness probes only control traffic routing, not pod lifecycle.

Answer

The pod will be restarted

Answer

The pod will be evicted from the node

Answer

The pod will be deleted

Question 11

A deployment 'api-deploy' has resource limits set but is frequently being OOMKilled. The team suspects the memory limit is too low. Which approach should be taken to confirm this without causing downtime?

Accepted Answer

Increase the memory limit in the deployment spec and apply the change; the rollout will automatically restart pods.. Updating the deployment spec triggers a rolling update, which replaces pods with new ones having the increased memory limit without downtime. This approach leverages Kubernetes' deployment controller to manage the rollout automatically, ensuring service continuity while adjusting resource limits.

Answer

Create a new pod with a higher memory limit and delete the old pods manually.

Answer

Set the memory limit to unlimited by removing the limit section and restart the pod.

Answer

Use 'kubectl set resources' to increase the limit on the running pod dynamically.

Question 12

You need to set environment variables in a pod from a ConfigMap 'app-config' that has keys 'APP_ENV' and 'APP_DEBUG'. Which approach exposes all keys as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with `configMapRef` is the Kubernetes-native way to expose all keys from a ConfigMap as environment variables in a pod. This injects each key-value pair from the ConfigMap 'app-config' as an environment variable, matching the requirement to expose all keys without manual enumeration.

Answer

envFrom:
  - secretRef:
      name: app-config

Answer

env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_ENV
  - name: APP_DEBUG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_DEBUG

Answer

volumeMounts:
  - name: config
    mountPath: /etc/config
volumes:
  - name: config
    configMap:
      name: app-config

Question 13

You have a CronJob that runs a backup every hour. Due to a network issue, some backups take longer than an hour, causing overlapping executions. You want to ensure that if a new job is scheduled while the previous one is still running, the new job is skipped. Which concurrencyPolicy should you set?

Accepted Answer

ConcurrencyPolicy: Forbid. Setting `concurrencyPolicy: Forbid` on a CronJob prevents a new job from being created if the previous job from the same CronJob is still running. This directly addresses the requirement to skip overlapping executions when a backup takes longer than the scheduled interval.

Answer

ConcurrencyPolicy: Skip

Answer

ConcurrencyPolicy: Allow

Answer

ConcurrencyPolicy: Replace

Question 14

A Pod specification includes: securityContext: { seccompProfile: { type: RuntimeDefault } }. What does this configuration do?

Accepted Answer

It applies the container runtime's default seccomp profile. Setting `seccompProfile.type: RuntimeDefault` in the Pod's securityContext instructs the container runtime (e.g., containerd or CRI-O) to apply its own default seccomp profile to the container. This default profile restricts system calls to a safe subset, blocking dangerous or unnecessary syscalls while allowing common ones required for typical application execution. It is the recommended way to enable seccomp without managing a custom profile.

Answer

It disables seccomp for the pod

Answer

It allows all syscalls

Answer

It uses a custom seccomp profile from a file

Question 15

You want to update a Deployment's image from nginx:1.20 to nginx:1.21. Which command will perform a rolling update?

Accepted Answer

kubectl set image deployment/my-deployment nginx=nginx:1.21. `kubectl set image` directly updates the container image of a Deployment, which triggers a rolling update by default. The Deployment controller creates a new ReplicaSet with the updated image and gradually scales it up while scaling down the old ReplicaSet, ensuring zero downtime.

Answer

kubectl create deployment my-deployment --image=nginx:1.21

Answer

kubectl apply -f deployment.yaml

Answer

kubectl edit deployment my-deployment