CKAD Practice Test 18 — 15 Questions

Question 1

Which Service type is used to expose a Service externally using a cloud provider's load balancer?

Accepted Answer

LoadBalancer. The LoadBalancer service type provisions an external load balancer from the underlying cloud provider (e.g., AWS ELB, GCP TCP/UDP Load Balancer) and assigns a public IP or DNS name to route external traffic to the Service's ClusterIP and NodePort. This is the correct choice because it directly exposes the Service externally via the cloud provider's infrastructure, unlike other types that either expose internally or require manual configuration.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 2

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. The `backoffLimit` field in a Job spec specifies the number of retries before the Job is considered failed. In this YAML, `backoffLimit: 4` means Kubernetes will retry the Job up to 4 times after the initial failure, for a total of 5 attempts (1 initial + 4 retries). The question asks 'how many times will Kubernetes retry the job before considering it failed?', which directly corresponds to the `backoffLimit` value of 4.

Answer

1

Answer

0

Answer

5

Question 3

A developer wants to ensure a container runs as a non-root user with user ID 1000 and group ID 2000. Which SecurityContext fields should be set?

Accepted Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: true. Setting `runAsUser: 1000` and `runAsGroup: 2000` ensures the container's processes run with user ID 1000 and group ID 2000, while `runAsNonRoot: true` enforces that the container cannot run as root (UID 0), providing a security best practice for non-root execution.

Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: false

Answer

runAsUser: 1000, runAsGroup: 2000, allowPrivilegeEscalation: false

Answer

runAsUser: 1000, fsGroup: 2000, runAsNonRoot: true

Question 4

Which of the following Service types exposes a pod on a static port on each node's IP address?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a pod on a static port (in the range 30000-32767) on every node's IP address. When a Service of type NodePort is created, Kubernetes opens that port on all nodes in the cluster, forwarding traffic to the target pods. This allows external access to the pod via any node's IP and the assigned static port.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP

Question 5

Which of the following Ingress controllers is commonly used in Kubernetes?

Accepted Answer

NGINX. NGINX is the most widely adopted Ingress controller in Kubernetes, providing a reverse proxy that routes external HTTP/HTTPS traffic to services based on Ingress resource rules. It is officially maintained by the Kubernetes community and supports advanced features like SSL termination, load balancing, and path-based routing, making it the default choice for many production clusters.

Answer

IIS

Answer

Apache

Answer

Tomcat

Question 6

You need to configure a liveness probe for a container that listens on TCP port 8080. The probe should wait 5 seconds before starting, check every 10 seconds, and timeout after 2 seconds. Which YAML snippet correctly configures this?

Accepted Answer

livenessProbe:
  tcpSocket:
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 2. It uses the `tcpSocket` probe type to check TCP port 8080, which is appropriate for a container that listens on TCP. The fields `initialDelaySeconds: 5`, `periodSeconds: 10`, and `timeoutSeconds: 2` match the required timing parameters exactly as specified in the Kubernetes API.

Answer

livenessProbe:
  exec:
    command:
    - echo
    - ok
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 2

Answer

livenessProbe:
  tcpSocket:
    port: 8080
  initialDelay: 5
  period: 10
  timeout: 2

Answer

livenessProbe:
  httpGet:
    path: /
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 10
  timeoutSeconds: 2

Question 7

You have a pod that needs to mount a Secret as a volume. The Secret has keys 'username' and 'password'. How should the volumes and volumeMounts be configured to mount the secret at /etc/secret with each key as a file?

Accepted Answer

volumes:
- name: secret-vol
  secret:
    secretName: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret. It uses the `secret` volume type with `secretName: my-secret`, which mounts the specified Kubernetes Secret as a volume. When mounted at `/etc/secret`, each key in the Secret (e.g., 'username' and 'password') becomes a file in that directory, with the file name matching the key and the file content being the decoded value of the key. This is the standard method for exposing Secret data as files in a pod.

Answer

volumes:
- name: secret-vol
  hostPath:
    path: /etc/secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  configMap:
    name: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  emptyDir: {}
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Question 8

Which instruction in a Dockerfile sets the default command to run when the container starts, but allows overriding?

Accepted Answer

CMD. The CMD instruction in a Dockerfile defines the default command to execute when a container starts from the image. It can be overridden by providing a command at the end of the `docker run` command, making it the correct choice for a default command that allows user override.

Answer

START

Answer

RUN

Answer

ENTRYPOINT

Question 9

What is the primary purpose of a Kubernetes ServiceAccount?

Accepted Answer

To provide an identity for processes running in a Pod. A Kubernetes ServiceAccount provides an identity for processes running in a Pod, allowing them to authenticate to the Kubernetes API server and to external services. When a Pod is created, it can be assigned a ServiceAccount, and the API server then associates that identity with the Pod's requests. This is distinct from user accounts, which are for human users.

Answer

To grant permissions to users

Answer

To define network policies for Pods

Answer

To store Docker registry credentials

Question 10

You have a ConfigMap created from an env file. Which command creates the ConfigMap from the file 'app.env' containing key=value pairs?

Accepted Answer

kubectl create configmap app-config --from-env-file=app.env. `--from-env-file` is the exact flag used to create a ConfigMap from a file containing key=value pairs in env-file format (e.g., `app.env`). This flag parses each line as a key-value pair and stores them as individual data entries in the ConfigMap, unlike `--from-file` which stores the entire file content under a single key.

Answer

kubectl create configmap app-config --from-file=app.env

Answer

kubectl create configmap app-config --env-file=app.env

Answer

kubectl create configmap app-config --from-literal=app.env

Question 11

Which TWO are valid ways to debug a pod using ephemeral containers?

Accepted Answer

kubectl debug -it --image=busybox -- sh. `kubectl debug -it --image=busybox -- sh` creates an ephemeral container in the target pod and attaches an interactive terminal to it. This is the standard Kubernetes mechanism for debugging a running pod without modifying its original container spec, using the ephemeral container feature (alpha in v1.16, stable in v1.23).

Answer

kubectl run debug --image=busybox -- sh

Answer

kubectl exec -it <pod> -- sh

Answer

kubectl attach to the pod

Question 12

You need to configure a container to shut down gracefully when it receives a SIGTERM signal, with a timeout of 30 seconds before force kill. Which field in the Pod spec should you set?

Accepted Answer

terminationGracePeriodSeconds. The `terminationGracePeriodSeconds` field in a Pod spec defines the duration (in seconds) that Kubernetes waits after sending a SIGTERM signal to the container's main process before forcefully killing it with SIGKILL. Setting this to 30 seconds allows the container to perform graceful shutdown tasks (e.g., closing connections, flushing data) within that window, meeting the requirement.

Answer

activeDeadlineSeconds

Answer

livenessProbe.periodSeconds

Answer

restartPolicy

Question 13

What is the default restart policy for a pod created with 'kubectl run nginx --image=nginx'?

Accepted Answer

Always. The default restart policy for a Pod created with `kubectl run` is `Always`. This is because `kubectl run` generates a deployment-like controller (or a standalone Pod in older versions) that defaults to the `Always` policy, meaning the kubelet will automatically restart the container regardless of its exit code. This ensures the Pod maintains a running state unless explicitly deleted or scaled down.

Answer

OnFailure

Answer

Never

Answer

Restart

Question 14

Which Service type is used to expose a Service on a static port on each node's IP address, allowing external traffic to reach the Service?

Accepted Answer

NodePort. NodePort is the correct Service type because it exposes the Service on a static port (in the range 30000-32767) on each node's IP address. This allows external traffic to reach the Service by sending requests to any node's IP at that port, which then forwards traffic to the appropriate Pods via the ClusterIP and kube-proxy rules.

Answer

ClusterIP

Answer

ExternalName

Answer

LoadBalancer

Question 15

The exhibit shows a Deployment manifest. When applied, the pods are created but show 'CrashLoopBackOff'. What is the most likely cause?

Accepted Answer

The liveness probe targets port 8080, but the container only listens on port 80. The liveness probe is configured to check port 8080, but the container (nginx) only listens on port 80 by default. Since the probe never receives a successful HTTP response, Kubernetes restarts the container repeatedly, causing the CrashLoopBackOff state. The probe must target the same port the application is serving on.

Answer

The selector does not match the pod labels

Answer

The initialDelaySeconds is too short, starting probes before the app is ready

Answer

The container image nginx:1.21 does not exist