CKAD Practice Exam 3 — 20 Questions

Question 1

When performing a rolling update of a Deployment, which field in the Deployment spec controls the maximum number of Pods that can be created above the desired replicas during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

Answer

spec.strategy.type

Answer

spec.strategy.rollingUpdate.maxUnavailable

Answer

spec.replicas

Question 2

Which THREE of the following are valid fields for configuring a probe in Kubernetes? (Select 3)

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe configuration (e.g., livenessProbe, readinessProbe, startupProbe). It defines the number of seconds after the container has started before the probe is initiated, allowing the application time to initialize before health checks begin.

Answer

retrySeconds

Answer

intervalSeconds

Question 3

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 4

Which TWO approaches can be used to expose a Secret's value as an environment variable in a pod?

Accepted Answer

env:
  - name: MY_SECRET
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: my-key. The `valueFrom.secretKeyRef` field in a container's `env` definition directly references a specific key from a Kubernetes Secret and injects its value as an environment variable. This is the standard method for exposing a single secret key as an environment variable, as defined in the Kubernetes API.

Answer

volumeMounts:
  - name: secret-volume
    mountPath: /etc/secret

Answer

env:
  - name: MY_SECRET
    value: "$(MY_SECRET)"

Answer

env:
  - name: MY_SECRET
    valueFrom:
      configMapKeyRef:
        name: my-secret
        key: my-key

Question 5

Which TWO statements about NetworkPolicy are correct? (Choose two.)

Accepted Answer

NetworkPolicy uses labels to select pods within a namespace. NetworkPolicy uses label selectors in its `spec.podSelector` field to identify which pods within a namespace the policy applies to. This allows fine-grained control over traffic to and from specific sets of pods based on their labels, without needing to reference pod names or IPs.

Answer

If no NetworkPolicy selects a pod, then that pod is isolated and traffic is denied

Answer

NetworkPolicy is only applicable to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 6

You have a Deployment with 'replicas: 3' and the HPA is configured with 'targetCPUUtilizationPercentage: 80'. The current CPU usage is at 60% across all pods, but the HPA has scaled up to 5 replicas. What is the most likely reason?

Accepted Answer

The CPU request in the Deployment's resource spec might be set lower than expected, causing the HPA to perceive higher utilization.. The HPA calculates CPU utilization as the average CPU usage across all pods divided by the CPU request of each pod. If the Deployment's container resource requests are set to a value that is lower than expected (e.g., 0.5 CPU instead of 1.0 CPU), then the same absolute CPU usage results in a higher utilization percentage. With 3 pods at 60% actual usage but a low CPU request, the utilization relative to the request could exceed the 80% target, triggering scale-up to 5 replicas. Therefore, option A is the most likely reason: a mismatch in the CPU request on the Deployment's resource spec causes the HPA to perceive higher utilization.

Answer

The HPA has a behavior policy that scales up aggressively

Answer

The HPA is using the 'averageUtilization' target type on a custom metric, not CPU

Answer

The HPA is reading the total CPU usage instead of average

Question 7

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Accepted Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretKeyRef:
      name: my-secret
      key: key. `secretKeyRef` is the standard Kubernetes API field for referencing a specific key from a Secret object and injecting its value as an environment variable. Option E is correct because `envFrom` with `secretRef` allows you to load all key-value pairs from a Secret as environment variables into the pod, which is a valid and common pattern.

Answer

env:
- name: SECRET_KEY
  valueFrom:
    configMapKeyRef:
      name: my-secret
      key: key

Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretEnvRef:
      name: my-secret
      key: key

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 8

Which THREE of the following are valid parameters for configuring probes? (Select 3)

Accepted Answer

timeoutSeconds. In Kubernetes, probe configuration parameters are defined in the container spec within a Pod. `timeoutSeconds` is a valid parameter that specifies the number of seconds after which the probe times out, defaulting to 1 second if not set. It is used in liveness, readiness, and startup probes to control how long kubelet waits for a probe response before considering it failed.

Answer

retryIntervalSeconds

Answer

cooldownSeconds

Question 9

You have just applied a new Deployment configuration using 'kubectl apply -f deployment.yaml'. You want to see the latest revision number of the rollout. Which command should you run?

Accepted Answer

kubectl rollout history deployment/myapp. 'kubectl rollout history deployment/<name>' shows revision history with revision numbers. The latest revision is shown as the most recent.

Answer

kubectl rollout status deployment/myapp

Answer

kubectl get deployment myapp -o yaml

Answer

kubectl describe deployment myapp

Question 10

To prevent a container from running as root, which field should be set in the securityContext?

Accepted Answer

runAsNonRoot: true. The `runAsNonRoot: true` field in the securityContext explicitly prevents the container from running as the root user (UID 0). When set, Kubernetes will refuse to start the container if the image is configured to run as root, enforcing a non-root execution policy at the pod or container level. This is the direct and intended mechanism for ensuring the container does not run with root privileges.

Answer

runAsUser: 1000

Answer

allowPrivilegeEscalation: false

Answer

readOnlyRootFilesystem: true

Question 11

Which Dockerfile instruction sets a command that can be overridden when running the container?

Accepted Answer

CMD. The CMD instruction provides default arguments for the container's entrypoint, which can be overridden by supplying command-line arguments when running the container with `docker run`. This makes CMD the correct choice for a command that is intended to be overridden at runtime.

Answer

RUN

Answer

EXPOSE

Answer

ENTRYPOINT

Question 12

A pod has a startup probe with failureThreshold: 30 and periodSeconds: 10. The application takes up to 5 minutes to start. What should be changed to ensure the startup probe does not kill the container prematurely?

Accepted Answer

Increase failureThreshold to 40. Increasing failureThreshold to 40 (from 30) with periodSeconds: 10 gives a total timeout of 40 × 10 = 400 seconds (6 minutes 40 seconds), which exceeds the 5-minute startup time. Setting initialDelaySeconds (Option D) would also delay the first probe execution, but best practices recommend adjusting the probe's failure threshold and interval instead of using an initial delay for startup probes, as the purpose of a startup probe is to start probing immediately and replace the need for an initial delay.

Answer

Change periodSeconds to 5

Answer

Change timeoutSeconds to 30

Answer

Set initialDelaySeconds to 300

Question 13

You have a Pod with two containers: a main application and a sidecar that handles logging. The sidecar needs access to the same log files as the main application. Which volume type allows both containers to share files?

Accepted Answer

emptyDir. An `emptyDir` volume is created when a Pod is assigned to a node and exists as long as the Pod runs, allowing both containers in the same Pod to mount and share the same directory. This is the simplest and most appropriate volume type for sharing ephemeral data, such as log files, between a main application and a sidecar container within the same Pod.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

configMap

Question 14

A Pod spec includes 'securityContext' with 'runAsUser: 1000' and 'runAsGroup: 3000'. The container process inside the pod is expected to write to a mounted volume. Which securityContext field should be set to ensure the volume's group ownership is 3000?

Accepted Answer

fsGroup: 3000. The `fsGroup` field in the Pod's `securityContext` specifies the group ID (GID) that Kubernetes should assign to any volume mounted into the Pod. When `fsGroup: 3000` is set, Kubernetes recursively changes the ownership of the volume's files and directories to group ID 3000, and any new files created by the container process will inherit that group ownership. This ensures the container process, which runs with `runAsGroup: 3000`, can write to the volume without permission errors.

Answer

supplementalGroups: [3000]

Answer

fsGroup: 1000

Answer

runAsGroup: 3000

Question 15

You have a ConfigMap named 'app-config' with key 'database.url'. Which environment variable definition correctly injects this value into a pod using a configMapKeyRef?

Accepted Answer

- name: DATABASE_URL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: database.url. It properly defines an environment variable with a name and uses `valueFrom.configMapKeyRef` to reference the specific key 'database.url' from the ConfigMap 'app-config'. The `name` field is required in the env entry to specify the environment variable name. Option D is incorrect because it omits the `name` field, making the definition incomplete.

Answer

envFrom:
- configMapRef:
    name: app-config

Answer

- name: DATABASE_URL
  valueFrom:
    secretKeyRef:
      name: app-config
      key: database.url

Answer

- valueFrom:
    configMapKeyRef:
      name: app-config
      key: database.url

Question 16

You have a Deployment with a liveness probe that fails intermittently, causing the pod to restart. You want to reduce the sensitivity of the probe so that it only restarts after 3 consecutive failures. Which probe parameter should you adjust?

Accepted Answer

failureThreshold. The `failureThreshold` parameter defines the number of consecutive probe failures required before Kubernetes considers the probe to have failed and triggers the configured action (e.g., restarting the container). By default, this value is 3, but if it is set lower (e.g., 1), a single failure causes a restart. Increasing `failureThreshold` to 3 (or higher) ensures that the liveness probe only restarts the pod after three consecutive failures, thereby reducing sensitivity to transient issues.

Answer

initialDelaySeconds

Answer

periodSeconds

Answer

successThreshold

Question 17

You have a pod with two containers: one runs a web server, and the other is a sidecar that logs the web server's output to a central logging system. Which pattern does this represent?

Accepted Answer

Sidecar pattern. The sidecar pattern involves deploying a helper container alongside the main application container within the same pod. In this scenario, the sidecar container consumes the web server's logs (e.g., by tailing a shared volume or reading stdout/stderr) and forwards them to a central logging system, such as Elasticsearch or Fluentd. This pattern is a core Kubernetes design principle for extending or enhancing the main container without modifying its code.

Answer

Decorator pattern

Answer

Ambassador pattern

Answer

Adapter pattern

Question 18

You need to debug a pod that is running but not serving traffic. You want to add a temporary container with networking tools to the pod. Which command should you use?

Accepted Answer

kubectl debug mypod --image=busybox -it. `kubectl debug` allows you to add an ephemeral container (a temporary container with networking tools) to an existing running pod without restarting it. This is the only command that directly injects a new container into the pod's network namespace, enabling debugging of network issues while the original container continues running.

Answer

kubectl run debug --image=busybox -it --restart=Never -- /bin/sh

Answer

kubectl attach mypod

Answer

kubectl exec -it mypod -- /bin/sh

Question 19

You are tasked with running a batch job that processes 100 items in parallel, using a Kubernetes Job. The Job should ensure that all items are processed even if some pods fail, and the total number of pod failures should be limited to 3. Which Job configuration is correct?

Accepted Answer

Set spec.parallelism: 100, spec.completions: 100, spec.backoffLimit: 3. Setting `spec.parallelism: 100` allows 100 pods to run concurrently, `spec.completions: 100` ensures all 100 items are processed (each pod handles one item), and `spec.backoffLimit: 3` limits the total number of pod failures to 3 before the Job is marked as failed. This configuration guarantees that even if some pods fail, the Job will retry them up to the specified backoff limit, ensuring all items are processed.

Answer

Set spec.parallelism: 1, spec.completions: 100, spec.backoffLimit: 3

Answer

Set spec.parallelism: 100, spec.completions: 1, spec.backoffLimit: 3

Answer

Set spec.parallelism: 100, spec.completions: 100, spec.activeDeadlineSeconds: 300

Question 20

You need to debug a pod that has no running containers because it is in a CrashLoopBackOff state. You want to start an ephemeral container with debugging tools in the same namespace. Which command accomplishes this?

Accepted Answer

kubectl debug -it pod-name --image=busybox --target=container-name. `kubectl debug` allows you to start an ephemeral container in an existing pod that is in a CrashLoopBackOff state. The `--target` flag attaches the ephemeral container to the same Linux namespace as the specified container, enabling debugging without restarting the pod. This is the only command that works when the pod has no running containers and `kubectl exec` fails.

Answer

kubectl run debug --image=busybox -it --restart=Never

Answer

kubectl attach pod-name

Answer

kubectl exec -it pod-name -- /bin/sh