CKAD Practice Exam 2 — 20 Questions

Question 1

Which TWO statements about Kubernetes DNS are correct?

Accepted Answer

A service named 'api' in namespace 'prod' has DNS name 'api.prod.svc.cluster.local'. Kubernetes DNS assigns a fully qualified domain name (FQDN) to services following the pattern `..svc.cluster.local`. For a service named 'api' in the 'prod' namespace, the DNS name is `api.prod.svc.cluster.local`, enabling cluster-internal service discovery via CoreDNS or kube-dns.

Answer

The kube-dns service is responsible for DNS resolution

Answer

Pods with hostNetwork: true automatically get DNS entries

Answer

A pod's DNS name is always 'pod-ip.namespace.pod.cluster.local'

Question 2

A namespace 'test' has a LimitRange that sets default memory request to 256Mi and default memory limit to 512Mi. A pod in that namespace does not specify any resources. What memory request and limit will the pod get?

Accepted Answer

request: 256Mi, limit: 512Mi. When a LimitRange exists in a namespace with default memory request and limit values, any pod that does not specify resource requests or limits will automatically have those defaults injected by the admission controller. This ensures the pod is subject to resource constraints even without explicit specification.

Answer

request: 0, limit: 0 (none)

Answer

request: 512Mi, limit: 256Mi

Answer

request: 256Mi, limit: 256Mi

Question 3

Which command streams logs from a pod in real-time?

Accepted Answer

kubectl logs -f pod-name. `kubectl logs -f` (the `-f` flag stands for 'follow') streams log output from a pod in real-time, similar to `tail -f` on a file. This is the standard Kubernetes command for continuous log monitoring, allowing you to see new log lines as they are written by the container.

Answer

kubectl logs --stream pod-name

Answer

kubectl logs --previous pod-name

Answer

kubectl logs pod-name

Question 4

Which TWO of the following are valid ways to expose application metrics from a Pod in Kubernetes?

Accepted Answer

Expose a /metrics HTTP endpoint and configure Prometheus to scrape it.. Exposing a /metrics HTTP endpoint is the standard pattern for Prometheus-based monitoring. Prometheus uses a pull model, where it periodically scrapes metrics from the /metrics endpoint exposed by the application container. This approach is widely adopted in Kubernetes for application observability.

Answer

Write metrics to stdout and parse them with a log aggregator.

Answer

Use kubectl top to collect metrics and expose them via a Service.

Answer

Create a ServiceMonitor custom resource to push metrics to Prometheus.

Question 5

A developer wants to restrict a Pod's resource usage. Which two API resources can be used to enforce limits at the namespace level? (Choose two.)

Accepted Answer

LimitRange. LimitRange (C) is correct because it allows administrators to set default resource requests and limits, as well as minimum and maximum constraints, for Pods and containers within a namespace. This enforces resource boundaries at the namespace level, ensuring that individual Pods cannot exceed defined limits.

Answer

PodSecurityPolicy

Answer

HorizontalPodAutoscaler

Answer

NetworkPolicy

Question 6

A developer needs to run a one-time batch job to process data. After completion, the pod should be retained for logs inspection. Which Job configuration parameter should be set?

Accepted Answer

Leave ttlSecondsAfterFinished unset. To retain a Job's Pod after completion for log inspection, the `ttlSecondsAfterFinished` field must be left unset (or set to nil). When this field is unset, the Job controller does not automatically delete the Pod, allowing logs to be inspected. Setting it to any non-negative integer would schedule automatic deletion after that many seconds, which contradicts the requirement.

Answer

backoffLimit: 0

Answer

ttlSecondsAfterFinished: -1

Answer

activeDeadlineSeconds: 3600

Question 7

Arrange the steps to create a multi-container Pod with a shared volume.

Accepted Answer

Define Pod YAML with container specs and emptyDir volume, mount volume in each container, apply with kubectl, then test.. Define Pod with containers, add shared emptyDir volume, mount in each container, apply, then test.

Answer

Define Pod YAML with container specs and volume mounts (but no volume definition), apply, then add emptyDir volume definition and re-apply.

Answer

Define Pod YAML with container specs and emptyDir volume, apply, then edit the running Pod to mount the volume in each container.

Answer

Define Pod YAML with container specs, mount volume in each container, then add emptyDir volume definition, then apply.

Question 8

You have a multi-container pod with a main container and a sidecar container that collects logs. The sidecar container should start before the main container and must complete initialization tasks before the main container starts. Which type of container should you use for this purpose?

Accepted Answer

Init container. Init containers run to completion before any regular containers in the pod start, making them ideal for prerequisites like initialization tasks or log setup. In this scenario, the sidecar must complete its initialization before the main container begins, which is exactly the behavior of an init container. Regular sidecar containers run concurrently with the main container, not before it.

Answer

Ephemeral container

Answer

Job

Answer

Regular sidecar container

Question 9

Which of the following is a valid way to expose a Secret as an environment variable in a Pod?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef: .... `secretKeyRef` is the Kubernetes API field used to reference a specific key from a Secret object and expose its value as an environment variable in a Pod. This is defined in the Pod spec under `env[].valueFrom.secretKeyRef`, which requires the `name` of the Secret and the `key` within that Secret.

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef: ...

Answer

env:
  - name: DB_PASSWORD
    value: $(DB_PASSWORD_SECRET)

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      fieldRef: ...

Question 10

You need to ensure that a pod in namespace 'dev' cannot consume more than 256Mi of memory. Which approach should you take?

Accepted Answer

Set 'resources.limits.memory: 256Mi' in the container spec. Setting `resources.limits.memory: 256Mi` in the container spec directly enforces a hard memory limit on that specific container. If the container attempts to exceed this limit, the kernel (via cgroups) will terminate it with an OOM (Out Of Memory) kill. This is the only approach that guarantees the pod cannot consume more than 256Mi of memory.

Answer

Add annotation 'memory-limit: 256Mi' to the pod

Answer

Create a ResourceQuota with 'limits.memory: 256Mi' in the namespace

Answer

Create a LimitRange with 'max: memory: 256Mi' in the namespace

Question 11

Which THREE configurations are part of Pod Security Admission's 'restricted' profile? (Select THREE.)

Accepted Answer

runAsNonRoot: true. The 'restricted' profile in Pod Security Admission enforces the most stringent security standards. Option A is correct because `runAsNonRoot: true` is a required field in the restricted profile, ensuring containers cannot run as the root user, which mitigates privilege escalation risks.

Answer

allowPrivilegeEscalation: true

Answer

Privileged containers allowed

Question 12

An Ingress resource routes traffic to a Service 'web' on port 80. The Service has multiple endpoints but all return 503. What should be checked first?

Accepted Answer

Check the readiness probe of the Pods. A 503 Service Unavailable error from the Ingress indicates the upstream Service is not ready to serve traffic. The most common cause is Pods failing their readiness probes, which removes them from the Service's endpoint list. Checking the readiness probe status directly addresses why the Service has endpoints but returns 503.

Answer

Ensure that the Service type is ClusterIP

Answer

Verify that the Service port matches the Pod's container port

Answer

Check the Ingress controller logs

Question 13

You have a Deployment named 'frontend' with 3 replicas. You run 'kubectl rollout history deployment/frontend' and see revision 1 and revision 2. You want to rollback to revision 1. What command should you use?

Accepted Answer

kubectl rollout undo deployment/frontend --to-revision=1. The 'kubectl rollout undo' command with the --to-revision flag rolls back to a specific revision. Option A is correct.

Answer

kubectl set image deployment/frontend app=nginx:1.19

Answer

kubectl rollout undo deployment/frontend revision=1

Answer

kubectl rollout history deployment/frontend --revision=1

Question 14

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' message indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container more memory to operate without being killed by the Out-of-Memory (OOM) killer.

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Answer

Increase the CPU request for the container

Question 15

A pod is failing to start. The 'kubectl describe pod' output shows: 'container has runAsNonRoot and image will run as root'. The Dockerfile of the container image does not specify a USER directive. Which action will fix the issue?

Accepted Answer

Add 'runAsUser: 1000' to the container's securityContext. The error 'container has runAsNonRoot and image will run as root' indicates the pod's securityContext enforces runAsNonRoot: true, but the container image runs as root (default user). Adding runAsUser: 1000 explicitly sets the container's user to a non-root UID, satisfying the runAsNonRoot constraint and allowing the pod to start.

Answer

Set 'runAsGroup: 1000' in the securityContext

Answer

Add capability 'CAP_SYS_ADMIN' to the container

Answer

Remove the 'runAsNonRoot: true' line from the pod spec

Question 16

An administrator creates a Role and RoleBinding in the 'dev' namespace to allow a ServiceAccount 'sa-dev' to list Pods. Which YAML snippet correctly defines the Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It uses the empty string `""` for `apiGroups`, which represents the core API group where Pods reside, and specifies the `list` verb to allow listing Pods. This matches the requirement to allow the ServiceAccount 'sa-dev' to list Pods in the 'dev' namespace.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["v1"]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["apps/v1"]
  resources: ["pods"]
  verbs: ["get"]

Question 17

Which TWO are valid ways to create a Service in Kubernetes?

Accepted Answer

Using kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates or updates a Service resource defined in a YAML manifest. This is the standard approach for managing Kubernetes resources in a GitOps or infrastructure-as-code workflow, ensuring the cluster state matches the file specification.

Answer

Using kubectl create service clusterip myservice --tcp=80:80

Answer

Using kubectl create deployment mydeploy --image=nginx --expose

Answer

Using kubectl run mypod --image=nginx --expose

Question 18

You have a ConfigMap created from an env file. Which command creates the ConfigMap from the file 'app.env' containing key=value pairs?

Accepted Answer

kubectl create configmap app-config --from-env-file=app.env. `--from-env-file` is the exact flag used to create a ConfigMap from a file containing key=value pairs in env-file format (e.g., `app.env`). This flag parses each line as a key-value pair and stores them as individual data entries in the ConfigMap, unlike `--from-file` which stores the entire file content under a single key.

Answer

kubectl create configmap app-config --from-file=app.env

Answer

kubectl create configmap app-config --env-file=app.env

Answer

kubectl create configmap app-config --from-literal=app.env

Question 19

You run 'kubectl get events' and see an event 'FailedScheduling' for a pod. What is the most common cause?

Accepted Answer

Insufficient node resources to meet the pod's requests. The 'FailedScheduling' event indicates that the Kubernetes scheduler could not find a suitable node to place the pod. The most common cause is insufficient node resources (CPU, memory, or ephemeral storage) to meet the pod's resource requests defined in the pod spec. The scheduler uses the `kube-scheduler` component to evaluate node fit based on predicates like `PodFitsResources`, and if no node satisfies the requested resources, the pod remains in a Pending state with this event.

Answer

The pod's container image pull failed

Answer

The liveness probe failed

Answer

The pod was deleted by a Deployment update

Question 20

Which kubectl command creates a ConfigMap named 'app-config' from a file named 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' by reading the entire contents of the file 'config.properties' and storing it as a single key-value pair, where the key defaults to the filename (config.properties) and the value is the file's content. This is the standard syntax for creating a ConfigMap from a file in Kubernetes.

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --file=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties