CKAD Practice Test 20 — 15 Questions

Question 1

You want to enforce that all pods in a namespace run with the 'restricted' Pod Security Standard (Pod Security Admission). Which label should you set on the namespace?

Accepted Answer

pod-security.kubernetes.io/enforce=restricted. The `pod-security.kubernetes.io/enforce=restricted` label enforces the 'restricted' Pod Security Standard on the namespace, preventing any pod that violates the restricted policy from being created. This label directly activates Pod Security Admission (PSA) enforcement mode, which blocks non-compliant pods at admission time.

Answer

pod-security.kubernetes.io/warn=restricted

Answer

pod-security.kubernetes.io/enforce=baseline

Answer

pod-security.kubernetes.io/audit=restricted

Question 2

A PodSecurityPolicy (PSP) has been replaced by Pod Security Admission. Which of the following commands applies a baseline pod security standard to the namespace 'dev'?

Accepted Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=baseline. Pod Security Admission uses labels on namespaces to enforce pod security standards. The label `pod-security.kubernetes.io/enforce=baseline` applies the baseline standard, which prevents known privilege escalations while allowing the default minimal pod configuration. This replaces the deprecated PodSecurityPolicy (PSP) with a built-in admission controller.

Answer

kubectl label ns dev pod-security.kubernetes.io/warn=baseline

Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=privileged

Answer

kubectl label ns dev pod-security.kubernetes.io/audit=baseline

Question 3

A developer creates a Deployment with 3 replicas and a Service with `clusterIP: None`. What is the primary use case for this headless Service?

Accepted Answer

To enable direct pod-to-pod communication without load balancing. A headless Service (clusterIP: None) disables the kube-proxy load balancer and DNS round-robin, returning A/AAAA records for all ready pod IPs. This allows client applications to perform direct pod-to-pod communication for stateful workloads like databases or messaging systems that require custom load balancing or leader election.

Answer

To assign a static IP address to the Service

Answer

To automatically create an Ingress resource

Answer

To expose the Service externally via a load balancer

Question 4

You want to deny all incoming traffic to a set of pods except from pods with label 'role: frontend'. Which NetworkPolicy spec should you use?

Accepted Answer

spec: podSelector: matchLabels: app: myapp ingress: - from: - podSelector: matchLabels: role: frontend. It selects pods with label 'app: myapp' and defines an ingress rule that only allows traffic from pods with label 'role: frontend'. By default, NetworkPolicy denies all traffic not explicitly allowed, so this configuration ensures only frontend pods can reach the selected pods.

Answer

spec: podSelector: matchLabels: app: myapp ingress: - from: - namespaceSelector: matchLabels: role: frontend

Answer

spec: podSelector: matchLabels: app: myapp egress: - to: - podSelector: matchLabels: role: frontend

Answer

spec: podSelector: {} ingress: - from: - podSelector: matchLabels: role: frontend

Question 5

When using 'kubectl expose', which flag creates a NodePort service?

Accepted Answer

--type=NodePort. The `--type=NodePort` flag explicitly sets the service type to NodePort when using `kubectl expose`. This creates a service that exposes the application on a static port (30000-32767) on each cluster node, making it accessible externally via `:`. Without this flag, the default service type is ClusterIP, which is only reachable within the cluster.

Answer

--node-port

Answer

--type=ClusterIP

Answer

--port

Question 6

An administrator wants to enforce that all Pods in a namespace run with a read-only root filesystem. Which admission controller should be configured?

Accepted Answer

Pod Security Admission (PSA). Pod Security Admission (PSA) is the correct choice because it enforces Pod Security Standards (PSS) at the namespace level, including the `Restricted` profile which mandates a read-only root filesystem (`readOnlyRootFilesystem: true`). PSA is a built-in admission controller that evaluates pod specifications against predefined security policies and rejects pods that violate them, making it the appropriate tool for this requirement.

Answer

LimitRange

Answer

ResourceQuota

Answer

MutatingAdmissionWebhook

Question 7

A team is deploying a microservice that must be reachable within the cluster via a stable DNS name. They also need to distribute traffic among pods. Which Kubernetes resource provides both service discovery and load balancing?

Accepted Answer

Service. A Service in Kubernetes provides a stable DNS name (via cluster DNS, e.g., CoreDNS) that resolves to the Service's ClusterIP, and it load-balances traffic across the pods selected by its label selector using iptables or IPVS rules. This directly fulfills the requirement for both service discovery and load balancing within the cluster.

Answer

ConfigMap

Answer

Secret

Answer

Ingress

Question 8

Which field in a Deployment's rolling update strategy controls the maximum number of pods that can be created above the desired replicas during a rolling update?

Accepted Answer

maxSurge. In a Deployment's rolling update strategy, `maxSurge` controls the maximum number of pods that can be created above the desired replica count during the update. This allows the system to spin up new pods before terminating old ones, ensuring zero downtime. The value can be an absolute number or a percentage of the desired replicas.

Answer

maxUnavailable

Answer

revisionHistoryLimit

Answer

minReadySeconds

Question 9

A developer wants to create a ConfigMap named 'app-config' with two key-value pairs: 'color=blue' and 'size=large'. Which kubectl command should they use?

Accepted Answer

kubectl create configmap app-config --from-literal=color=blue --from-literal=size=large. `kubectl create configmap` with `--from-literal` allows specifying key-value pairs directly in the command line. Each literal must be provided as a separate `--from-literal=key=value` flag, and this command correctly creates the ConfigMap with the two entries 'color=blue' and 'size=large'.

Answer

kubectl create configmap app-config --from-literal=color,size --value=blue,large

Answer

kubectl create configmap app-config --from-env-file=color=blue,size=large

Answer

kubectl create configmap app-config --from-file=color=blue --from-file=size=large

Question 10

A DevOps engineer needs to set up resource monitoring for pods in a namespace. Which built-in Kubernetes resource provides CPU and memory metrics out-of-the-box?

Accepted Answer

Metrics Server. The Metrics Server is the built-in Kubernetes resource that collects resource metrics (CPU and memory) from the kubelet on each node via the Summary API and exposes them through the metrics.k8s.io API. It provides these metrics out-of-the-box without requiring any additional configuration or external storage, making it the standard solution for horizontal pod autoscaling and kubectl top commands.

Answer

Prometheus

Answer

CoreDNS

Answer

Kubernetes Dashboard

Question 11

A Pod with an init container and a main container is created. The init container runs a script that takes 10 seconds. The main container's startupProbe has initialDelaySeconds: 5. When does the startupProbe begin?

Accepted Answer

After the init container completes, then plus 5 seconds. The startupProbe does not begin until the Pod's containers are actually running. Init containers must complete successfully before any main containers start. Therefore, the startupProbe's initialDelaySeconds of 5 is counted from the moment the main container starts, which is after the init container finishes its 10-second script. The probe begins 5 seconds after the main container starts, not from Pod creation.

Answer

5 seconds after the pod is created

Answer

10 seconds after the pod is created

Answer

Immediately after the pod is created

Question 12

A developer wants to create a Job that runs exactly 3 pods in parallel. Which field should be set in the Job spec?

Accepted Answer

spec.parallelism: 3. `spec.parallelism` in a Kubernetes Job spec defines the desired number of Pods that should run concurrently. Setting `spec.parallelism: 3` tells the Job controller to run exactly 3 Pods in parallel, meeting the requirement of running 3 pods simultaneously.

Answer

spec.ttlSecondsAfterFinished: 3

Answer

spec.backoffLimit: 3

Answer

spec.completions: 3

Question 13

You need to view metrics from a Pod running a web server. Which approach follows Kubernetes best practices?

Accepted Answer

Configure a Prometheus server to scrape the Pod's /metrics endpoint.. Prometheus is the de facto standard for monitoring in Kubernetes, and scraping a Pod's /metrics endpoint is the recommended approach for collecting application-level metrics. This follows the Kubernetes best practice of exposing metrics via an HTTP endpoint that a monitoring system can scrape, rather than relying on ephemeral commands or resource-level metrics.

Answer

Use kubectl top pod to view CPU and memory metrics.

Answer

Exec into the container and run curl to check health.

Answer

Create a ServiceMonitor resource to expose metrics.

Question 14

An ingress resource is created with the following spec. Which request will be routed to the 'green' service?

```yaml
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: blue
            port:
              number: 80
      - path: /api/v1
        pathType: Exact
        backend:
          service:
            name: green
            port:
              number: 80
```

Accepted Answer

http://example.com/api/v1. The request to http://example.com/api/v1 matches the Exact path /api/v1, which routes to the green service. In Kubernetes ingress, Exact pathType requires the request path to be identical to the specified path, and /api/v1 matches exactly.

Answer

http://example.com/api/v1/

Answer

http://example.com/api

Answer

http://example.com/

Question 15

Which TWO of the following are required for Ingress to route HTTP traffic to a backend Service?

Accepted Answer

An Ingress controller deployed in the cluster. An Ingress controller is required because the Ingress resource itself is just a set of routing rules; it does not process traffic. The Ingress controller, typically a pod running a reverse proxy like nginx or Envoy, watches the Ingress API and configures itself to route external HTTP/HTTPS traffic to the appropriate backend Services. Without a running Ingress controller, the Ingress resource has no effect.

Answer

Pod readiness probes

Answer

A Service of type LoadBalancer

Answer

A TLS certificate for HTTPS