CKAD Practice Test 19 — 15 Questions

Question 1

What is the primary purpose of an Init Container in a Pod?

Accepted Answer

Perform initialization tasks such as waiting for a database to be ready. Init containers run to completion before the main application containers start, making them ideal for blocking or delaying the main container until prerequisites like a database readiness check succeed. They execute sequentially and can use different container images, allowing setup tasks without bloating the main app image or requiring special permissions.

Answer

Run a sidecar proxy alongside the main container

Answer

Provide a health check endpoint for the main container

Answer

Collect logs and metrics from the main container

Question 2

A developer creates a Secret named 'db-secret' with key 'password'. They want to expose the password as an environment variable DB_PASSWORD in a Pod. Which of the following is the correct way to achieve this?

Accepted Answer

Set env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password. It uses the `valueFrom.secretKeyRef` field to reference a specific key (`password`) from the Secret named `db-secret` and expose it as the environment variable `DB_PASSWORD`. This is the standard Kubernetes syntax for injecting a single Secret key into a Pod's environment variable.

Answer

Set env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name: db-secret key: password

Answer

Use envFrom: - secretRef: name: db-secret

Answer

Set env: - name: DB_PASSWORD secretRef: name: db-secret key: password

Question 3

A Deployment has a rolling update strategy with maxSurge: 1 and maxUnavailable: 0. The Deployment has 4 replicas. During a rollout, what is the maximum number of pods that can exist at any point?

Accepted Answer

5. With maxSurge: 1 and maxUnavailable: 0, the Deployment controller ensures that during a rolling update, at most one additional pod (beyond the desired 4 replicas) is created before terminating old pods. Since no pods can be unavailable, the maximum number of pods at any point is 4 (desired) + 1 (surge) = 5.

Answer

6

Answer

8

Answer

4

Question 4

Which probe type is used to indicate that a container is ready to serve traffic and should be added to Service endpoints?

Accepted Answer

Readiness probe. A Readiness probe determines whether a container is ready to accept traffic. If the probe fails, the container is removed from all Service endpoints, ensuring only healthy pods receive requests. This is the correct probe for indicating readiness to serve traffic.

Answer

Liveness probe

Answer

Startup probe

Answer

Both liveness and readiness probes

Question 5

A pod in namespace 'app' needs to resolve the DNS name 'db-service.data.svc.cluster.local'. What is the likely namespace of the 'db-service' Service?

Accepted Answer

data. The DNS name 'db-service.data.svc.cluster.local' follows the Kubernetes DNS specification for Services, which has the format ..svc.cluster.local. The second component (after the first dot) is the namespace. Here, 'data' is the namespace of the Service, so the correct answer is B.

Answer

app

Answer

svc

Answer

default

Question 6

You run 'kubectl get pods -o wide' and see that a pod's NODE column shows 'node-1'. You want to see more details about that node's resource usage. Which command should you use?

Accepted Answer

kubectl top node node-1. `kubectl top node node-1` directly displays real-time resource usage (CPU and memory) for the specified node, which is exactly what you need when you want to see more details about a node's resource consumption after identifying the node from `kubectl get pods -o wide`.

Answer

kubectl top pods --all-namespaces

Answer

kubectl describe node node-1

Answer

kubectl top pod node-1

Question 7

A CronJob must run a task every day at midnight, but if the previous job is still running, the new job should be skipped. Which concurrencyPolicy should be set?

Accepted Answer

Forbid. B is correct because the `Forbid` concurrency policy ensures that if a previous job instance is still running when the next scheduled trigger fires, the new job is simply skipped. This matches the requirement to avoid overlapping executions without terminating the running job.

Answer

Skip

Answer

Allow

Answer

Replace

Question 8

Arrange the steps to create a Kubernetes Deployment with a rolling update strategy.

Accepted Answer

1. Define the Deployment in YAML, 2. Apply the YAML using kubectl apply, 3. Modify the YAML for the update, 4. Re-apply the modified YAML using kubectl apply. First, define the Deployment in YAML. Then apply it. After an update, modify the YAML and re-apply; kubectl performs rolling update automatically.

Answer

1. Define the Deployment in YAML, 2. Modify the YAML for the update, 3. Apply the YAML using kubectl apply

Answer

1. Define the Deployment in YAML, 2. Apply the YAML using kubectl apply, 3. Delete the existing Pods manually, 4. Re-apply the modified YAML using kubectl apply

Answer

1. Apply an empty or placeholder YAML, 2. Define the Deployment in YAML, 3. Modify the YAML for the update, 4. Re-apply the YAML using kubectl apply

Question 9

What is the purpose of the 'values.yaml' file in a Helm chart?

Accepted Answer

It contains default configuration values for the chart.. The `values.yaml` file in a Helm chart provides default configuration values that can be overridden at install or upgrade time using the `--values` or `--set` flags. These values are injected into the chart's templates via Go template syntax, enabling parameterized deployments without modifying the chart itself.

Answer

It stores the release history.

Answer

It defines the Kubernetes resources to be created.

Answer

It lists dependencies of the chart.

Question 10

You have a Deployment with 3 replicas. You create a Service with 'clusterIP: None'. What is the effect on pod DNS?

Accepted Answer

DNS returns the IPs of all matching pods.. When a Service is created with `clusterIP: None`, it becomes a headless Service. For a headless Service, DNS is configured to return the IP addresses of all matching pods (the endpoints) rather than a single virtual IP. This allows client applications to discover and connect to individual pods directly, which is essential for stateful workloads like databases.

Answer

Each pod gets its own DNS record in the form ...svc.cluster.local

Answer

The Service name does not resolve to any IP; DNS fails.

Answer

The Service name resolves to a single virtual IP that load balances across pods.

Question 11

Which TWO of the following are valid ways to expose a Deployment named 'web' as a Service?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a Service that automatically selects Pods based on the labels defined in the Deployment's pod template. This command generates a ClusterIP Service that maps port 80 on the Service to the target port (defaulting to the same port) on the selected Pods, providing a stable network endpoint for the Deployment's replicas.

Answer

kubectl port-forward deployment/web 8080:80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80

Question 12

Order the steps to expose a Kubernetes Deployment as a ClusterIP Service.

Accepted Answer

Step 1: Ensure Deployment exists and is running. Step 2: Create a ClusterIP Service YAML manifest. Step 3: Apply the Service manifest using kubectl apply. Step 4: Verify the Service endpoints are populated. Step 5: Test DNS resolution of the Service name from a pod.. A Service requires a running Deployment. Define and apply the Service, then verify endpoints and test DNS resolution.

Answer

Step 1: Create a ClusterIP Service YAML manifest. Step 2: Apply the Service manifest. Step 3: Ensure Deployment exists and is running. Step 4: Test DNS resolution. Step 5: Verify endpoints.

Answer

Step 1: Ensure Deployment exists and is running. Step 2: Test DNS resolution. Step 3: Create the Service YAML. Step 4: Apply the Service. Step 5: Verify endpoints.

Answer

Step 1: Apply the Service manifest. Step 2: Create the Service YAML. Step 3: Ensure Deployment exists. Step 4: Verify endpoints. Step 5: Test DNS.

Question 13

You have a Deployment with the following strategy: type: Recreate. What happens when you update the pod template?

Accepted Answer

Old pods are terminated first, then new pods are created. The Recreate strategy in a Kubernetes Deployment first terminates all existing Pods before creating new ones. When the pod template is updated, the Deployment controller scales down the ReplicaSet to 0 replicas, waits for all Pods to terminate, then scales up the new ReplicaSet to the desired number of replicas. This ensures zero overlap between old and new Pods, which is useful for workloads that cannot run concurrently.

Answer

New pods are created first, then old pods are terminated

Answer

Pods are updated in-place without termination

Answer

The update is rejected because Recreate is not a valid strategy

Question 14

You have a headless service 'db' in namespace 'data'. Pods in that namespace can resolve 'db.data.svc.cluster.local'. What is the effect of a headless service on DNS resolution?

Accepted Answer

It returns a round-robin list of pod IPs. A headless service (with `clusterIP: None`) does not have a ClusterIP, so DNS queries for the service name return the IP addresses of all ready pods backing the service, rather than a single virtual IP. This enables client-side load balancing via DNS round-robin, as the DNS resolver returns multiple A records that the client can cycle through. Option C correctly describes this behavior.

Answer

It does not create any DNS record

Answer

It returns the IP of the first pod

Answer

It returns the ClusterIP of the service

Question 15

You need to debug a Service that is not routing traffic to its endpoints. Which command shows the current endpoints of a Service?

Accepted Answer

kubectl get endpoints my-service. `kubectl get endpoints my-service` directly retrieves the Endpoints object associated with the Service, which lists the IP addresses and ports of the Pods that are currently receiving traffic. This is the most precise way to verify whether the Service has any active endpoints, as the Endpoints object is updated by the kube-controller-manager based on Pod readiness and label selectors.

Answer

kubectl describe service my-service

Answer

kubectl get svc my-service -o wide

Answer

kubectl get pods -l app=my-app