CKAD Practice Exam 2 — 20 Questions

Question 1

You run the following command: 'kubectl run nginx --image=nginx --restart=Never'. What Kubernetes resource is created?

Accepted Answer

Pod. The `kubectl run nginx --image=nginx --restart=Never` command creates a Pod directly, because the `--restart=Never` flag sets the restart policy to Never, which instructs Kubernetes to run the container as a standalone Pod rather than wrapping it in a higher-level controller like a Deployment or Job. The `kubectl run` command, when used without a controller flag, defaults to creating a Pod when `--restart=Never` is specified, as per the Kubernetes API behavior.

Answer

CronJob

Answer

Deployment

Answer

Job

Question 2

In a Dockerfile, what is the difference between CMD and ENTRYPOINT?

Accepted Answer

ENTRYPOINT defines the executable and CMD provides default arguments. C is correct because in a Dockerfile, ENTRYPOINT specifies the executable that will always run when the container starts, while CMD provides default arguments that can be overridden. When both are defined, CMD arguments are appended to the ENTRYPOINT command, allowing flexible default behavior that users can modify at runtime via the command line.

Answer

CMD always runs, ENTRYPOINT can be overridden

Answer

There is no difference; they are interchangeable

Answer

CMD is used for shell form, ENTRYPOINT for exec form

Question 3

A pod named 'webapp' is stuck in 'Pending' state. 'kubectl describe pod webapp' shows '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds available node memory. The error message '0/1 nodes are available: 1 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on the node. The scheduler cannot place the pod because no node has enough unallocated memory to satisfy the pod's memory request. This is a scheduling failure, not a runtime issue.

Answer

The node has insufficient CPU

Answer

The container was killed due to out-of-memory

Answer

The container image does not exist

Question 4

You have a Deployment named 'web-app' with 5 replicas. You run 'kubectl set image deployment/web-app app=nginx:1.21'. What is the effect of this command?

Accepted Answer

It updates the image of the container named 'app' to nginx:1.21, triggering a rolling update.. The `kubectl set image` command updates the container image in the Deployment's pod template. This triggers a rolling update, where the Deployment's ReplicaSet creates new pods with the new image and gradually terminates old pods, ensuring zero downtime. The container name 'app' matches the container in the pod spec, so the image is updated to nginx:1.21.

Answer

It scales the Deployment to 0 replicas and then scales back up.

Answer

It immediately terminates all running pods and creates new ones with the new image.

Answer

It creates a new Deployment with the updated image.

Question 5

What is the purpose of a readiness probe?

Accepted Answer

To indicate whether the container is ready to serve traffic. A readiness probe determines whether a container is ready to accept traffic. If the probe fails, the Pod's IP address is removed from the Endpoints of the associated Service, preventing traffic from being routed to an unready container. This is distinct from liveness probes, which restart containers, and startup probes, which indicate successful initialization.

Answer

To restart the container if it becomes unresponsive

Answer

To indicate that the container has started successfully

Answer

To measure the resource usage of the container

Question 6

Which command scales a Deployment named 'web' to 5 replicas?

Accepted Answer

kubectl scale deployment web --replicas=5. The correct command to scale a Deployment to a specific number of replicas is `kubectl scale deployment web --replicas=5`. This command directly modifies the `spec.replicas` field of the Deployment object, instructing the Kubernetes controller manager to adjust the number of running Pods to match the desired count.

Answer

kubectl set replicas deployment web 5

Answer

kubectl resize deployment web --replicas=5

Answer

kubectl autoscale deployment web --replicas=5

Question 7

You have a Kustomize overlay that sets 'replicas: 5' in a patch, but the base Deployment has 'replicas: 3'. What is the final number of replicas after applying 'kubectl apply -k overlay/'?

Accepted Answer

5. In Kustomize, overlays are applied on top of the base, and patches override the base values. Since the overlay explicitly sets 'replicas: 5' via a patch, it replaces the base value of 3. The final Deployment will have 5 replicas, making D correct.

Answer

3

Answer

8

Answer

It depends on the strategy

Question 8

You have a Deployment with replicas: 5 and update strategy type: RollingUpdate with maxSurge: 25% and maxUnavailable: 25%. During a rolling update, what is the maximum number of pods that can be unavailable at any given time?

Accepted Answer

1. With maxUnavailable: 25% on a Deployment of 5 replicas, the maximum number of unavailable pods is 25% of 5 = 1.25, and Kubernetes rounds down for maxUnavailable, resulting in 1. Therefore, at most 1 pod can be unavailable at any given time during the rolling update.

Answer

2

Answer

5

Answer

0

Question 9

You need to create a Pod that runs with a specific non-root user (UID 1000), prevents privilege escalation, and mounts the container's filesystem as read-only. Which securityContext field is NOT required to achieve these requirements?

Accepted Answer

runAsGroup: 1000. (runAsGroup: 1000) is not required because the requirement only specifies a non-root user (UID 1000) and does not mandate a specific group ID. The runAsGroup field sets the primary group for the container's processes, but it is optional; without it, the container will use the default group associated with the user or the container's default group. The other options are necessary: runAsUser: 1000 sets the user, readOnlyRootFilesystem: true makes the filesystem read-only, and allowPrivilegeEscalation: false prevents privilege escalation.

Answer

runAsUser: 1000

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 10

A pod's securityContext has 'allowPrivilegeEscalation: false' and 'capabilities: { drop: ["ALL"] }'. Which statement is true?

Accepted Answer

The container runs with no extra capabilities and cannot gain privileges.. Setting 'allowPrivilegeEscalation: false' prevents processes from gaining more privileges than their parent (e.g., via setuid binaries or kernel exploits), and dropping all capabilities with 'capabilities: { drop: ["ALL"] }' removes every Linux capability from the container's bounding set. Together, these ensure the container runs with no extra capabilities and cannot escalate privileges, even if running as root.

Answer

The container can still gain capabilities via setuid binaries.

Answer

The container runs as root with full privileges.

Answer

The container runs with all Linux capabilities.

Question 11

A pod has a container with envFrom referencing a ConfigMap. The ConfigMap has keys 'APP_DEBUG=true' and 'APP_NAME=myapp'. The pod also has an env entry with name 'APP_DEBUG' set to 'false'. What is the value of APP_DEBUG in the container?

Accepted Answer

false. When a pod has both an `envFrom` referencing a ConfigMap and an explicit `env` entry with the same key, the explicit `env` entry takes precedence. This is because Kubernetes merges environment variables from multiple sources, and individual `env` entries override any values from `envFrom` for the same key. Therefore, `APP_DEBUG` will be set to 'false' as defined in the explicit `env` entry.

Answer

undefined

Answer

Both values are concatenated

Answer

true

Question 12

Which THREE of the following are correct about init containers? (Select THREE.)

Accepted Answer

They run to completion before the main application containers start. Init containers are designed to run sequentially to completion before any of the pod's regular application containers start. This ensures that prerequisites, such as database schema migrations or configuration file generation, are completed before the main application begins execution.

Answer

They cannot have resource limits set

Answer

They run after the main application containers have started

Question 13

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 14

Which of the following is the correct way to scale a Deployment named 'api' to 5 replicas using kubectl?

Accepted Answer

kubectl scale deployment api --replicas=5. `kubectl scale deployment api --replicas=5` is the standard kubectl command to change the replica count of a Deployment. The `scale` subcommand directly modifies the `.spec.replicas` field in the Deployment's manifest, instructing the ReplicaSet controller to adjust the number of Pods to match the desired count.

Answer

kubectl scale deploy api 5

Answer

kubectl update deployment api --replicas=5

Answer

kubectl set replicas deployment api 5

Question 15

Which TWO statements about readiness probes are correct? (Choose two.)

Accepted Answer

Readiness probes run continuously after the container starts. Readiness probes are designed to run continuously throughout the lifecycle of a container, not just during startup. They are periodically executed by the kubelet to determine whether the container is ready to accept traffic, and their success or failure directly controls the pod's inclusion in Service endpoints.

Answer

Readiness probes are only used during initial startup

Answer

Readiness probes can only be of type httpGet

Answer

Readiness probes restart the container if they fail

Question 16

A NetworkPolicy is applied to a namespace with the following rules:
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```
What is the effect on pods in that namespace?

Accepted Answer

All inbound traffic is denied, outbound traffic is allowed. This NetworkPolicy selects all pods in the namespace (podSelector: {}) and specifies only Ingress in policyTypes. By default, if any NetworkPolicy selects a pod, all traffic not explicitly allowed by a rule is denied. Since no ingress rules are defined, all inbound traffic is denied. Outbound traffic is not restricted because Egress is not listed in policyTypes and no egress rules are defined, so it remains allowed by default.

Answer

All traffic is allowed

Answer

Only traffic from specific namespaces is allowed

Answer

All inbound and outbound traffic is denied

Question 17

A Service named `api` in namespace `default` has multiple endpoints. You run `kubectl get endpoints api` and see no IPs. What is the most likely cause?

Accepted Answer

The Service selector does not match any pods. The most likely cause is that the Service's selector does not match any pods. A Service uses its label selector to identify pods and automatically populate its endpoints. If no pods match the selector, the endpoints list will be empty, resulting in no IPs shown by `kubectl get endpoints api`.

Answer

The Service type is ExternalName

Answer

The namespace has a NetworkPolicy blocking traffic

Answer

The Service has a clusterIP of None

Question 18

Which TWO statements about init containers are true? (Select 2)

Accepted Answer

Init containers run sequentially in the order they are defined.. Init containers in a Kubernetes Pod are executed sequentially in the exact order they are defined in the `initContainers` array. Each init container must exit successfully (return code 0) before the next one starts, ensuring a strict dependency chain for initialization tasks.

Answer

Init containers support liveness and readiness probes.

Answer

Init containers share the same filesystem as the application containers by default.

Answer

Init containers have a restart policy of Always.

Question 19

An Ingress has two rules:
- host: app.example.com, path: /api -> service-a:80
- host: api.example.com, path: / -> service-b:80
A request to `app.example.com/api/v1` reaches which service?

Accepted Answer

service-a. Ingress rules match the longest prefix of the request path for the given host. For `app.example.com/api/v1`, the path `/api` is a prefix match (since `/api/v1` starts with `/api`), so it routes to service-a:80. The second rule requires host `api.example.com`, which does not match, so service-b is not considered.

Answer

Both services

Answer

Neither service

Answer

service-b

Question 20

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.