CKAD Practice Test 17 — 15 Questions

Question 1

A developer wants to enforce that containers in a namespace cannot run as privileged. Which Pod Security Standard profile should they apply to the namespace?

Accepted Answer

baseline. (baseline) is correct because the baseline Pod Security Standard (PSS) profile enforces the minimum restrictions necessary to prevent known privilege escalations, including the prohibition of privileged containers (i.e., `privileged: true` in the security context). This profile is designed to be applied to namespaces where most workloads run, blocking the most common security issues without breaking typical applications. The restricted profile would also block privileged containers but imposes additional constraints (e.g., dropping all capabilities, read-only root filesystem) that are not required by the question's specific goal.

Answer

privileged

Answer

restricted

Answer

custom

Question 2

A Helm chart has the following template snippet: '{{ .Values.replicaCount }}'. You want to set replicaCount to 5 during installation. Which command should you use?

Accepted Answer

helm install my-release mychart --set replicaCount=5. The `--set` flag in Helm allows you to directly override a single value in a chart's `values.yaml` file from the command line. This is the standard way to set `replicaCount` to 5 during installation without modifying the chart or using a separate values file.

Answer

helm install my-release mychart --name replicaCount=5

Answer

helm install my-release mychart --values replicaCount=5

Answer

helm install my-release mychart --set-string replicaCount=5

Question 3

You run 'kubectl run debug-pod --image=busybox -it --restart=Never -- sh' but the pod starts and immediately exits. You want to keep the container running to execute commands later. What flag should you add?

Accepted Answer

-- sleep infinity. Adding `-- sleep infinity` to the `kubectl run` command overrides the default entrypoint (`sh`) with a command that runs `sleep infinity`, which keeps the container alive indefinitely. Without this, the interactive shell (`sh`) exits immediately when it has no input, causing the pod to terminate. The `--` separator passes the command to the container image's entrypoint, ensuring the process runs in the foreground and does not exit.

Answer

--stdin=true

Answer

--command

Answer

--attach

Question 4

You have a CronJob that runs every 5 minutes. The job sometimes takes longer than 5 minutes to complete. You want to ensure that while a job is running, the next scheduled job is skipped (not started). Which concurrencyPolicy should you use?

Accepted Answer

Forbid. The `Forbid` concurrencyPolicy ensures that if a previous job instance is still running when the next scheduled time arrives, the new job is simply skipped (not created). This prevents overlapping executions, which is exactly what you need when a CronJob's duration can exceed its schedule interval.

Answer

Skip

Answer

Allow

Answer

Replace

Question 5

A developer is writing a Dockerfile and wants to ensure that the container runs a Python script named 'app.py' as its main process. Which instruction should be used?

Accepted Answer

ENTRYPOINT ["python", "app.py"]. ENTRYPOINT defines the executable that runs as the main process in the container. When combined with CMD (or used alone in exec form), it ensures that 'python app.py' is the primary process with PID 1, which is essential for proper signal handling and container lifecycle management.

Answer

EXPOSE 8080

Answer

CMD ["python", "app.py"]

Answer

RUN ["python", "app.py"]

Question 6

A user wants to create a Kubernetes Secret for storing Docker registry credentials (username and password). Which type of Secret should they use?

Accepted Answer

kubernetes.io/dockerconfigjson. `kubernetes.io/dockerconfigjson` is the dedicated Secret type for storing Docker registry credentials in the format expected by `docker login`. It automatically encodes the username and password into a `.dockerconfigjson` field, which is used by Kubernetes to pull images from private registries. This type is required when referencing a `imagePullSecret` in a Pod spec.

Answer

kubernetes.io/tls

Answer

Opaque

Answer

kubernetes.io/basic-auth

Question 7

You want to undo a rollout to the previous revision. Which command should you use?

Accepted Answer

kubectl rollout undo deployment/myapp. `kubectl rollout undo deployment/myapp` reverts the deployment to the previous revision by default, using the rollout history stored in the deployment's ReplicaSet annotations. This command directly triggers a new rollout that matches the pod template of the prior revision, effectively undoing the last change.

Answer

kubectl delete deployment/myapp --cascade=orphan

Answer

kubectl set image deployment/myapp app=myapp:previous

Answer

kubectl rollout history deployment/myapp --revision=2

Question 8

Which kubectl command can you use to stream the logs from a pod in real-time?

Accepted Answer

kubectl logs -f. The `-f` flag (short for `--follow`) in `kubectl logs` streams the log output in real-time, similar to `tail -f` on a Linux system. This allows you to observe new log entries as they are written by the pod's containers, which is essential for debugging live issues or monitoring application behavior.

Answer

kubectl logs --previous

Answer

kubectl logs

Answer

kubectl logs --tail=10

Question 9

You deploy a pod with the following specification:

apiVersion: v1
kind: Pod
metadata:
  name: probe-pod
spec:
  containers:
  - name: app
    image: nginx
    livenessProbe:
      httpGet:
        path: /healthz
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 10
      failureThreshold: 3

The application listens on port 80, not 8080. What will happen to the pod?

Accepted Answer

The container will be restarted repeatedly due to liveness probe failure. The liveness probe is configured to perform an HTTP GET request on port 8080, but the application (nginx) listens on port 80. Since the probe will never receive a successful HTTP response (it will get a connection refused or timeout), it will fail. With a failureThreshold of 3, after three consecutive failures the kubelet will consider the container unhealthy and restart it. This cycle repeats indefinitely, causing the container to be restarted repeatedly.

Answer

The pod will be terminated and not restarted

Answer

The pod will start and run normally

Answer

The pod will be stuck in 'Pending' state

Question 10

You want to debug a pod that has no shell or debugging tools installed. Which feature allows you to temporarily add a sidecar container with debugging tools to a running pod?

Accepted Answer

kubectl debug -it my-pod --image=busybox --target=my-container. `kubectl debug` allows you to create an ephemeral container (sidecar) in a running pod, using a specified image (e.g., busybox) that includes debugging tools, without requiring the original container to have a shell or tools. This feature leverages the Ephemeral Containers alpha feature (enabled by default in Kubernetes 1.23+) to inject a temporary container into an existing pod for debugging purposes.

Answer

kubectl exec -it my-pod -- /bin/bash

Answer

kubectl cp /tmp/debug-tool my-pod:/tmp/

Answer

kubectl port-forward my-pod 8080:80

Question 11

A pod uses a Secret 'db-secret' with keys 'username' and 'password'. Which environment variable definition correctly exposes the 'password' as an env var named 'DB_PASSWORD'?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password. It uses `valueFrom.secretKeyRef` to reference the specific key `password` from the Secret `db-secret`, mapping it to the environment variable `DB_PASSWORD`. This is the standard Kubernetes method to expose a single key from a Secret as an environment variable with a custom name.

Answer

env:
  - name: DB_PASSWORD
    value: "password"

Answer

envFrom:
  - secretRef:
      name: db-secret

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef:
        name: db-secret
        key: password

Question 12

You are using Kustomize. Your kustomization.yaml file specifies a base and an overlay. You run: kubectl apply -k overlays/production. What happens?

Accepted Answer

It applies the merged result of base and overlay.. When you run `kubectl apply -k overlays/production`, Kustomize reads the `kustomization.yaml` in the specified directory, which references a base and an overlay. It then performs a strategic merge patch of the overlay's customizations (e.g., patches, namePrefix, commonLabels) onto the base resources, producing a single set of manifests that are applied to the cluster. This is the core purpose of Kustomize: to compose and customize resources without templating.

Answer

It errors because -k expects a directory with kustomization.yaml.

Answer

It applies the base resources only.

Answer

It applies the overlay resources only.

Question 13

Which of the following is a correct Kustomize kustomization.yaml configuration for setting an image tag to 'v2'?

Accepted Answer

images:
- name: my-app
  newTag: v2. In Kustomize, the `images` field in `kustomization.yaml` uses the `newTag` key to override the tag of an existing container image. This allows you to change the image tag to 'v2' without modifying the original YAML manifests, aligning with Kustomize's declarative patching approach.

Answer

images:
- name: my-app
  newName: v2

Answer

patches:
- target:
    kind: Deployment
  patch: |-
    - op: replace
      path: /spec/template/spec/containers/0/image
      value: my-app:v2

Answer

imageTag:
- name: my-app
  tag: v2

Question 14

What is the purpose of a ResourceQuota in Kubernetes?

Accepted Answer

To limit the total amount of resources (CPU, memory, etc.) that can be consumed by all pods in a namespace.. A ResourceQuota is a Kubernetes object that enforces aggregate resource consumption limits on a per-namespace basis. It constrains the total CPU, memory, and other resource requests and limits across all pods in that namespace, preventing any single namespace from exhausting cluster resources. Option B correctly identifies this namespace-level resource cap.

Answer

To set default resource limits for containers that do not specify them.

Answer

To limit the number of nodes in a cluster.

Answer

To limit the number of replicas in a Deployment.

Question 15

Which command creates a Secret named 'db-secret' with two keys, 'username' and 'password', from literal values?

Accepted Answer

kubectl create secret generic db-secret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` is the correct command syntax for creating a generic (opaque) Secret from literal key-value pairs. The `--from-literal` flag allows you to specify each key and its value directly on the command line, making it the appropriate choice for this task.

Answer

kubectl create secret db-secret --from-literal=username=admin --from-literal=password=secret123

Answer

kubectl create secret generic db-secret --from-file=username=admin --from-file=password=secret123

Answer

kubectl create secret generic db-secret --literal=username=admin --literal=password=secret123