CKAD Practice Exam 3 — 20 Questions

Question 1

A developer wants to deploy a stateless application as a set of identical pods. They need the pods to be distributed across nodes and have stable network identities. Which resource should they use?

Accepted Answer

StatefulSet. StatefulSet is the correct resource because it provides each pod with a stable, unique network identity (e.g., pod-name-0, pod-name-1) that persists across rescheduling. While Deployment manages replicas for stateless applications, it does not assign per-pod stable hostnames. The question explicitly requires 'stable network identities' for identical pods, which is a defining feature of StatefulSet. A Service combined with a Deployment gives a stable endpoint for the set, not per-pod identities.

Answer

Job

Answer

Deployment

Answer

DaemonSet

Question 2

Which command forwards port 8080 on the local machine to port 80 on a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` creates a direct tunnel from a local port to a port on a specific pod. The syntax `kubectl port-forward pod/web-pod 8080:80` forwards local port 8080 to port 80 on the pod named 'web-pod', enabling local access to the pod's service without requiring a Service object.

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Answer

kubectl proxy --port=8080 --target=pod/web-pod:80

Answer

kubectl exec web-pod -- curl http://localhost:8080

Question 3

You need to debug a pod that is not responding. Which command attaches an ephemeral debug container to a running pod named 'web-pod'?

Accepted Answer

kubectl debug -it web-pod --image=busybox --target=web-container. `kubectl debug` with the `--image` flag creates an ephemeral container in the specified pod for interactive debugging. The `-it` flag provides an interactive TTY, and `--target=web-container` attaches the ephemeral container to the same Linux namespace as the target container, allowing direct troubleshooting of the unresponsive pod without modifying its original containers.

Answer

kubectl debug web-pod --copy-to=debug-pod --image=busybox

Answer

kubectl attach web-pod

Answer

kubectl run debug --image=busybox -it

Question 4

A CronJob is configured with concurrencyPolicy: Forbid and schedule: '*/5 * * * *'. The first job takes 7 minutes. What happens when the next scheduled time arrives?

Accepted Answer

The new job is skipped. C is correct because when `concurrencyPolicy: Forbid` is set, the CronJob controller skips creating a new job if the previous job is still running at the next scheduled time. Since the first job takes 7 minutes and the schedule is every 5 minutes, the new job is skipped to prevent overlapping executions.

Answer

The previous job is terminated

Answer

The new job waits until the previous job completes

Answer

A new job is created immediately

Question 5

During a rolling update, you want to ensure that at most 2 pods are unavailable at any time. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable: 2. `spec.strategy.rollingUpdate.maxUnavailable` specifies the maximum number of Pods that can be unavailable during a rolling update. Setting `maxUnavailable: 2` ensures that at most 2 Pods are unavailable at any time, allowing the update to proceed while maintaining the desired availability.

Answer

spec.strategy.type: Recreate

Answer

spec.replicas: 2

Answer

spec.strategy.rollingUpdate.maxSurge: 2

Question 6

You need to debug a running pod that does not have a shell installed. Which kubectl command allows you to start an ephemeral container with a shell?

Accepted Answer

kubectl debug <pod> --image=busybox --stdin --tty. `kubectl debug` is specifically designed to add an ephemeral container to a running pod for troubleshooting purposes, even when the original container lacks a shell. The `--image=busybox` flag provides a lightweight image with common debugging tools, and `--stdin --tty` allocates an interactive terminal, allowing you to run commands like `/bin/sh` inside the ephemeral container without modifying the original pod's containers.

Answer

kubectl create pod debug --image=busybox --attach

Answer

kubectl exec -it <pod> -- /bin/sh

Answer

kubectl run debug --image=busybox --attach

Question 7

A Deployment named 'api' has 6 replicas. You want to perform a rolling update with the following constraints: at most 2 pods can be unavailable during the update, and at most 1 extra pod can be created above the desired 6. Which strategy configurations achieve this? (Choose TWO)

Accepted Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 2. Uses absolute numbers: maxSurge=1 and maxUnavailable=2, directly matching the constraints. Option B uses percentages: 16% of 6 = 0.96 rounded up to 1, and 33% of 6 = 1.98 rounded up to 2, so it also yields maxSurge=1 and maxUnavailable=2. Option C has maxSurge=2, exceeding the surge limit. Option D has maxUnavailable=3, exceeding the unavailable limit. Option E has maxUnavailable=1, which is more restrictive than the allowed maximum of 2; while it technically satisfies the constraint, it is not the intended configuration. Therefore, the correct answers are A and B.

Answer

strategy:
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 2

Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 3

Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 1

Question 8

Which TWO Service types allow external access to pods from outside the Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. NodePort is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the service by targeting any node's IP and that port. This works by opening a high-range port (30000-32767) on all nodes, which forwards traffic to the ClusterIP service and then to the pods.

Answer

Headless

Answer

ClusterIP

Answer

ExternalName

Question 9

Which TWO of the following are true about Kustomize overlays? (Select 2)

Accepted Answer

Overlays are used to customize resources for different environments.. Overlays are used to customize resources for different environments, and they can patch resources defined in bases.

Answer

Overlays can only add labels, not modify existing ones.

Answer

Overlays must be stored in the same directory as the base.

Answer

Overlays can only be used with Helm charts.

Question 10

Which THREE of the following are valid reasons to use an annotation in Kubernetes?

Accepted Answer

To store the name of the CI/CD tool that deployed the resource. Annotations are key-value metadata used for non-identifying information. Option A is incorrect because selection of Pods by a Service is done using labels, not annotations. Option B is correct: annotations can store tooling metadata like CI/CD tool name. Option C is correct: build versions and commit hashes are typical audit information stored in annotations. Option D is incorrect because resource limits are set in the container spec, not in annotations. Option E is correct: annotations are designed for arbitrary non-identifying metadata.

Answer

To enable a Service to select Pods based on the annotation value

Answer

To set resource limits for a container

Question 11

Match each Kubernetes resource to its API group.

Accepted Answer

Pod: v1. Kubernetes resources belong to specific API groups. Pods, Services, ConfigMaps, and PersistentVolumeClaims are in the core group (v1), while Deployments are in apps/v1, and Ingresses are in networking.k8s.io/v1.

Answer

Service: apps/v1

Answer

ConfigMap: networking.k8s.io/v1

Answer

PersistentVolumeClaim: apps/v1

Question 12

You need to perform a canary deployment using a Service and two Deployments (stable and canary). Which TWO resources or configurations are typically used to route a percentage of traffic to the canary? (Select TWO)

Accepted Answer

Service Mesh (e.g., Istio VirtualService). A Service Mesh like Istio uses a VirtualService resource to define traffic routing rules based on weights (e.g., `weight: 90` for stable and `weight: 10` for canary). This allows fine-grained, percentage-based traffic splitting between two different Kubernetes Services or subsets, which is a core requirement for canary deployments.

Answer

A single Service with multiple label selectors

Answer

NetworkPolicy

Answer

HorizontalPodAutoscaler

Question 13

Match each Kubernetes object field to its description.

Accepted Answer

livenessProbe: Indicates if the container is running. If fails, kubelet kills the container and restarts it.. Correct matches: livenessProbe checks container health, readinessProbe checks service readiness, startupProbe checks application startup, and imagePullPolicy controls image pulling. Common confusions involve swapping definitions with restartPolicy.

Answer

imagePullPolicy: Defines the policy for restarting the container after exit.

Answer

restartPolicy: Defines when to pull the container image.

Question 14

Which Service type is used to expose a Service on a static port on each node's IP address, allowing external traffic to reach the Service?

Accepted Answer

NodePort. NodePort is the correct Service type because it exposes the Service on a static port (in the range 30000-32767) on each node's IP address. This allows external traffic to reach the Service by sending requests to any node's IP at that port, which then forwards traffic to the appropriate Pods via the ClusterIP and kube-proxy rules.

Answer

ClusterIP

Answer

ExternalName

Answer

LoadBalancer

Question 15

Which kubectl command creates a Secret from literal username and password values?

Accepted Answer

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` with `--from-literal` is the proper syntax for specifying literal key-value pairs directly in the command. Each literal must be prefixed with `--from-literal=key=value`, and multiple literals can be provided to create a Secret containing both the username and password keys.

Answer

kubectl create secret generic my-secret --literal username=admin password=secret123

Answer

kubectl create secret generic my-secret --from-file=username --from-file=password

Answer

kubectl create secret generic my-secret --from-env-file=creds.txt

Question 16

A NetworkPolicy named 'deny-all' is applied in a namespace. Which YAML snippet correctly implements a default-deny-all ingress policy?

Accepted Answer

spec:
  podSelector: {}
  policyTypes:
  - Ingress. A NetworkPolicy with an empty `podSelector: {}` selects all pods in the namespace, and specifying `policyTypes: [Ingress]` without any `ingress` rules creates a default-deny-all ingress policy, blocking all incoming traffic. Options B and C include `ingress` rules (with empty `from`), which is not the standard approach for a strict deny-all; the canonical method is to omit the `ingress` field entirely when using `policyTypes: [Ingress]`.

Answer

spec:
  podSelector: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Ingress

Question 17

You are using a canary deployment pattern with two Deployments: 'web-stable' (version 1) and 'web-canary' (version 2). Both have the label 'app: web'. The Service 'web-svc' selects pods with 'app: web' and 'version: stable'. How do you route traffic to the canary?

Accepted Answer

Add the label 'version: canary' to the canary Deployment's pod template and update the Service's selector to 'app: web, version in (stable, canary)'.. The Service 'web-svc' currently selects pods with 'app: web' and 'version: stable'. To route traffic to the canary pods (version 2), you need to add the label 'version: canary' to the canary Deployment's pod template so that those pods are created with that label. Then, updating the Service's selector to 'app: web, version in (stable, canary)' allows the Service to match both stable and canary pods, distributing traffic between them according to the Service's default round-robin behavior.

Answer

Use kubectl rollout canary on the stable Deployment.

Answer

Create a new Service with selector 'app: web, version: canary' and use an ingress to split traffic.

Answer

Change the Service selector to 'app: web' only (remove version label).

Question 18

You have a Deployment that must run a legacy application that takes up to 5 minutes to start. You need to ensure the liveness probe does not kill the container prematurely. Which probe configuration should you use?

Accepted Answer

Configure a startup probe with a high failureThreshold and appropriate initialDelaySeconds. A startup probe is specifically designed for slow-starting containers. It runs before the liveness probe and allows the container extra time to initialize without being killed. By setting a high failureThreshold (e.g., 30) and an appropriate initialDelaySeconds, the probe can wait up to 5 minutes for the application to start, after which the liveness probe takes over.

Answer

Use a HTTP GET liveness probe with path /healthz and port 8080

Answer

Set livenessProbe.initialDelaySeconds to 300

Answer

Set livenessProbe.periodSeconds to a high value, like 300

Question 19

You want to create a Deployment that runs 5 replicas of a web application. Which kubectl command should you use?

Accepted Answer

kubectl create deployment webapp --image=nginx --replicas=5. To create a Deployment with 5 replicas using a single imperative command, use `kubectl create deployment webapp --image=nginx --replicas=5`. This command directly creates a Deployment and sets the desired replicas. Option A (`kubectl run`) no longer creates a Deployment by default in current Kubernetes versions (1.18+); it creates a single Pod and does not support the `--replicas` flag. Option B (`kubectl create pod`) does not exist and is incorrect. Option C (`kubectl apply -f deployment.yaml`) would also create a Deployment but requires an existing YAML file and is not a single imperative command.

Answer

kubectl run webapp --image=nginx --replicas=5

Answer

kubectl create pod webapp --image=nginx --replicas=5

Answer

kubectl apply -f deployment.yaml

Question 20

A container image requires running as UID 0 but you need to comply with a 'restricted' Pod Security Admission policy. Which SecurityContext setting allows this while still passing the policy?

Accepted Answer

No SecurityContext setting allows running as UID 0 under the restricted policy.. The 'restricted' Pod Security Admission policy requires that containers run as non-root (runAsNonRoot: true) and prohibits setting runAsUser to 0. Since the image requires UID 0, no SecurityContext setting can override this policy constraint; the only way to comply is to modify the image to run as a non-root user. Therefore, option B is correct.

Answer

Set securityContext: { allowPrivilegeEscalation: true }

Answer

Set securityContext: { runAsNonRoot: true, capabilities: { add: ['SYS_ADMIN'] } }

Answer

Set runAsUser: 0 and runAsNonRoot: false