CKAD Practice Exam 3 — 20 Questions

Question 1

Which TWO are valid ways to create a Service in Kubernetes?

Accepted Answer

Using kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates or updates a Service resource defined in a YAML manifest. This is the standard approach for managing Kubernetes resources in a GitOps or infrastructure-as-code workflow, ensuring the cluster state matches the file specification.

Answer

Using kubectl create service clusterip myservice --tcp=80:80

Answer

Using kubectl create deployment mydeploy --image=nginx --expose

Answer

Using kubectl run mypod --image=nginx --expose

Question 2

You have a ConfigMap created from an env file. Which command creates the ConfigMap from the file 'app.env' containing key=value pairs?

Accepted Answer

kubectl create configmap app-config --from-env-file=app.env. `--from-env-file` is the exact flag used to create a ConfigMap from a file containing key=value pairs in env-file format (e.g., `app.env`). This flag parses each line as a key-value pair and stores them as individual data entries in the ConfigMap, unlike `--from-file` which stores the entire file content under a single key.

Answer

kubectl create configmap app-config --from-file=app.env

Answer

kubectl create configmap app-config --env-file=app.env

Answer

kubectl create configmap app-config --from-literal=app.env

Question 3

You run 'kubectl get events' and see an event 'FailedScheduling' for a pod. What is the most common cause?

Accepted Answer

Insufficient node resources to meet the pod's requests. The 'FailedScheduling' event indicates that the Kubernetes scheduler could not find a suitable node to place the pod. The most common cause is insufficient node resources (CPU, memory, or ephemeral storage) to meet the pod's resource requests defined in the pod spec. The scheduler uses the `kube-scheduler` component to evaluate node fit based on predicates like `PodFitsResources`, and if no node satisfies the requested resources, the pod remains in a Pending state with this event.

Answer

The pod's container image pull failed

Answer

The liveness probe failed

Answer

The pod was deleted by a Deployment update

Question 4

Which kubectl command creates a ConfigMap named 'app-config' from a file named 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' by reading the entire contents of the file 'config.properties' and storing it as a single key-value pair, where the key defaults to the filename (config.properties) and the value is the file's content. This is the standard syntax for creating a ConfigMap from a file in Kubernetes.

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --file=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 5

A Pod is running in a namespace with a ResourceQuota that sets 'limits.memory: 2Gi'. The pod's container spec has 'resources.limits.memory: 1Gi' and 'resources.requests.memory: 512Mi'. The pod is in 'Running' state but consumes 1.5Gi of memory. What happens?

Accepted Answer

The container will be OOMKilled because it exceeds its own memory limit of 1Gi. The container has a hard memory limit of 1Gi set in its resources.limits.memory. When the container's memory usage exceeds this limit (1.5Gi > 1Gi), the Linux kernel's OOM killer terminates the container process. The namespace ResourceQuota of 2Gi is not violated because the pod's limit (1Gi) is within the quota, so the kubelet does not evict the pod.

Answer

The pod will be evicted by the kubelet due to namespace quota violation

Answer

The container will continue running because the namespace quota allows up to 2Gi

Answer

The pod will be throttled by the kernel to stay within 1Gi

Question 6

You have a Deployment with strategy type: Recreate. You update the container image. What behavior will occur during the update?

Accepted Answer

Old pods are terminated, then new pods are created.. With the Recreate strategy, the Deployment controller first scales down all existing pods to zero, ensuring they are fully terminated, and then creates new pods with the updated container image. This behavior guarantees that only one version of the application runs at any time, avoiding concurrent old and new pod execution.

Answer

The update is performed in-place without pod termination.

Answer

New pods are created before old ones are terminated.

Answer

The deployment is paused automatically.

Question 7

Which TWO commands can be used to view the logs of a pod that has crashed?

Accepted Answer

kubectl logs --previous. `kubectl logs --previous` retrieves logs from the previous instance of a container in a pod that has crashed and been restarted. This is essential for debugging crash loops, as the current container may have no logs or only post-crash output. The `--previous` flag accesses the terminated container's logs stored by the kubelet.

Answer

kubectl logs <pod> --tail=0 -f

Answer

kubectl logs -c

Answer

kubectl logs <pod>

Question 8

A Secret of type kubernetes.io/tls requires two data keys. What are they?

Accepted Answer

tls.crt and tls.key. Kubernetes requires that a Secret of type `kubernetes.io/tls` contain exactly two data keys: `tls.crt` for the TLS certificate and `tls.key` for the private key. This is mandated by the Kubernetes API specification for TLS secrets, which are used to secure ingress and other TLS-terminated endpoints.

Answer

ca.crt and tls.key

Answer

certificate and key

Answer

cert.crt and cert.key

Question 9

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 10

An Ingress resource is defined as:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
What must exist in the cluster for TLS termination to work?

Accepted Answer

A Secret named tls-secret of type kubernetes.io/tls in the same namespace. C is correct because TLS termination requires the actual TLS certificate and key to be stored in a Kubernetes Secret of type `kubernetes.io/tls`. The Ingress controller reads this Secret to terminate HTTPS connections, decrypting traffic before forwarding it to the backend service. Without this Secret, the Ingress controller cannot present a valid certificate to clients.

Answer

An IngressClass annotation specifying the ingress controller

Answer

A ServiceAccount named tls-secret

Answer

A ConfigMap named tls-secret with certificate data

Question 11

Which TWO of the following are valid ways to consume a Secret named 'db-secret' in a Pod? (Choose two.)

Accepted Answer

As environment variables using envFrom with secretRef. `envFrom` with `secretRef` allows a Pod to consume all key-value pairs from a Secret named 'db-secret' as environment variables. This is a standard Kubernetes feature for injecting Secret data into containers without needing to specify each key individually.

Answer

As environment variables using env with valueFrom.configMapKeyRef

Answer

As a command-line argument using $(DB_PASSWORD)

Answer

As an imagePullSecrets entry

Question 12

You want to create a Deployment that runs 5 replicas of a web application. Which kubectl command should you use?

Accepted Answer

kubectl create deployment webapp --image=nginx --replicas=5. To create a Deployment with 5 replicas using a single imperative command, use `kubectl create deployment webapp --image=nginx --replicas=5`. This command directly creates a Deployment and sets the desired replicas. Option A (`kubectl run`) no longer creates a Deployment by default in current Kubernetes versions (1.18+); it creates a single Pod and does not support the `--replicas` flag. Option B (`kubectl create pod`) does not exist and is incorrect. Option C (`kubectl apply -f deployment.yaml`) would also create a Deployment but requires an existing YAML file and is not a single imperative command.

Answer

kubectl run webapp --image=nginx --replicas=5

Answer

kubectl create pod webapp --image=nginx --replicas=5

Answer

kubectl apply -f deployment.yaml

Question 13

An ingress resource is created with the following spec. Which request will be routed to the 'green' service?

```yaml
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: blue
            port:
              number: 80
      - path: /api/v1
        pathType: Exact
        backend:
          service:
            name: green
            port:
              number: 80
```

Accepted Answer

http://example.com/api/v1. The request to http://example.com/api/v1 matches the Exact path /api/v1, which routes to the green service. In Kubernetes ingress, Exact pathType requires the request path to be identical to the specified path, and /api/v1 matches exactly.

Answer

http://example.com/api/v1/

Answer

http://example.com/api

Answer

http://example.com/

Question 14

In a Deployment, what is the purpose of the 'maxUnavailable' field in the rolling update strategy?

Accepted Answer

The maximum number of pods that can be unavailable during the update.. In a Deployment's rolling update strategy, the 'maxUnavailable' field specifies the maximum number of Pods that can be unavailable during the update process. This ensures that the Deployment maintains a certain level of availability by controlling how many Pods can be taken down at any given time, relative to the desired replica count. It is defined as either an absolute number or a percentage of the desired Pods, and it works alongside 'maxSurge' to manage the update's pace and safety.

Answer

The maximum number of pods that can be terminated at once.

Answer

The maximum time allowed for the rollout to complete.

Answer

The maximum number of pods that can be created above the desired replicas.

Question 15

Which THREE are valid ways to expose a canary deployment for testing? (Select three)

Accepted Answer

Create a separate Service for the canary with a different selector and provide its endpoint to testers.. Canary deployments can be exposed for testing by: (A) creating a separate Service with a different selector so the canary has its own endpoint for testers; (B) using an Ingress with traffic splitting annotations (e.g., nginx.ingress.kubernetes.io/canary) to route a percentage of traffic to the canary; (E) using a single Service that selects both stable and canary pods based on a common label, which sends traffic proportionally if using a deployment strategy with multiple replicas. Options C (DaemonSet) and D (NetworkPolicy) are incorrect because they do not expose the canary for testing.

Answer

Use a DaemonSet instead of Deployment for canary.

Answer

Use a NetworkPolicy to restrict canary pods from receiving traffic.

Question 16

You need to view the logs of a container named 'sidecar' inside a pod named 'app'. Which command should you use?

Accepted Answer

kubectl logs app -c sidecar. `kubectl logs app -c sidecar` explicitly targets the 'sidecar' container within the 'app' pod. In Kubernetes, when a pod runs multiple containers, you must use the `-c` flag to specify which container's logs to retrieve; otherwise, the command fails or returns ambiguous output.

Answer

kubectl logs app --previous -c sidecar

Answer

kubectl logs app sidecar

Answer

kubectl logs app -c sidecar -p

Question 17

Order the steps to update a Kubernetes Secret and ensure a Pod uses the new secret.

Accepted Answer

Step 1: Update the Secret. Step 2: Determine if the Secret is mounted as a volume or set as an environment variable. Step 3a: If volume mount, no further action needed (Pod picks up changes automatically). Step 3b: If environment variable, restart the Pod (e.g., delete and recreate or rollout restart).. Update secret, then if mounted as volume, Pod picks it up automatically; if env, need restart.

Answer

Step 1: Restart the Pod. Step 2: Update the Secret.

Answer

Step 1: Update the Secret. Step 2: Restart the Pod in all cases.

Answer

Step 1: Update the Secret. Step 2: Update the Pod's environment variable definition to reference the new Secret version.

Question 18

Your Deployment is stuck during rollout, and you want to investigate. Which command pauses the rollout and allows you to check the current state?

Accepted Answer

kubectl rollout pause deployment my-deployment. The correct command to pause a deployment rollout is `kubectl rollout pause deployment my-deployment`. While paused, you can inspect the current state with `kubectl rollout status` or other diagnostic commands. Option A (`kubectl rollout resume`) resumes a paused rollout, not pauses it. Option B (`kubectl rollout status`) shows the rollout state but does not pause it. Option D (`kubectl rollout stop`) is not a valid kubectl command; the correct command to stop a rollout is `kubectl rollout undo`. Therefore, only option C pauses the rollout as required.

Answer

kubectl rollout resume deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl rollout stop deployment my-deployment

Question 19

Which TWO of the following are valid methods to perform a blue-green deployment in Kubernetes?

Accepted Answer

Create a new Deployment for the new version, then update the Service's selector to point to the new pods.. A blue-green deployment requires two separate environments (blue = current, green = new) and a mechanism to switch traffic between them. Option B is valid because it uses a new Deployment for the green version and updates the Service selector to point to the new pods, effectively switching traffic. Option C is also valid: it deploys the new version in a separate namespace and uses a Service to route traffic to the new namespace, achieving the same isolation and switch. Option A is incorrect because it modifies the existing Deployment's image and uses Recreate strategy, which is a single-version update with downtime, not a blue-green switch. Option D is incorrect because `kubectl rollout undo` reverts to a previous revision of the same Deployment, not a parallel green environment. Option E uses the RollingUpdate strategy with extreme surge, which is a rolling update, not a blue-green deployment.

Answer

Use kubectl patch to modify the Deployment's image and rely on the Recreate strategy.

Answer

Use kubectl rollout undo to revert to the previous version.

Answer

Use the RollingUpdate strategy with maxSurge=100% and maxUnavailable=0%.

Question 20

Which THREE components are essential for setting up Horizontal Pod Autoscaling (HPA) based on CPU utilization? (Select three)

Accepted Answer

An HPA resource targeting the Deployment. HPA requires metrics-server to collect CPU metrics, CPU resource requests set on containers so HPA can calculate utilization, and the HPA resource itself targeting the Deployment. Therefore, options C, D, and E are correct.

Answer

A readiness probe on the pod

Answer

A Service of type LoadBalancer