CKAD Practice Test 24 — 15 Questions

Question 1

Which command lists all Helm releases in the current namespace?

Accepted Answer

helm list. The `helm list` command is the correct way to list all Helm releases in the current namespace. It queries the Helm release storage (typically Secrets in the cluster) and returns the release names, status, chart versions, and other metadata for the namespace set in the current kubeconfig context.

Answer

helm get all

Answer

helm status

Answer

helm show

Question 2

Which TWO parameters can be configured for a probe to control its behavior? (Choose two.)

Accepted Answer

timeoutSeconds. `timeoutSeconds` defines the maximum time a probe waits for a response before considering the probe failed. Option E is correct because `initialDelaySeconds` configures the delay before the probe starts after the container starts, allowing the application to initialize. Both are standard fields in the Kubernetes probe specification (liveness, readiness, startup).

Answer

maxRetries

Answer

backoffSeconds

Answer

retryIntervalSeconds

Question 3

A container needs to run with the NET_ADMIN capability. Which securityContext field should be used?

Accepted Answer

capabilities:
  add: ["NET_ADMIN"]. The `capabilities.add` field in a container's `securityContext` is specifically designed to grant Linux capabilities like `NET_ADMIN` to a container. This allows the container to perform network administration operations (e.g., configuring iptables, changing interface settings) without running as root or giving full privileged access.

Answer

capabilities:
  drop: ["ALL"]

Answer

runAsUser: 0

Answer

readOnlyRootFilesystem: true

Question 4

A Service of type NodePort is created with 'spec.ports[0].nodePort: 30080'. The cluster nodes have IPs 10.0.0.1, 10.0.0.2. Which command can be used to test connectivity to the Service from outside the cluster?

Accepted Answer

curl 10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every cluster node's IP address. From outside the cluster, you can reach the service by targeting any node's IP and the nodePort, so `curl 10.0.0.1:30080` will connect to the service via node 10.0.0.1.

Answer

curl 10.0.0.1:80 --header 'Host: service.namespace.svc.cluster.local'

Answer

curl 10.0.0.1:80

Answer

curl 10.96.0.1:30080

Question 5

Which THREE statements about Ingress are correct? (Choose three.)

Accepted Answer

Ingress can terminate TLS connections.. Ingress can terminate TLS connections by referencing a Secret that contains the TLS certificate and private key. When a TLS section is defined in the Ingress spec, the Ingress controller terminates the HTTPS connection at the edge and forwards plain HTTP traffic to the backend services. This is a core feature for securing ingress traffic in Kubernetes.

Answer

Ingress can route traffic based on source IP.

Answer

Ingress can route traffic based on destination port.

Question 6

Which TWO instructions are commonly used to add files to a Docker image during build? (Select 2)

Accepted Answer

COPY. The COPY instruction is used to copy files and directories from the build context into the Docker image filesystem. It is the preferred method for adding local files because it is explicit and does not perform any automatic extraction or URL fetching, making builds more predictable and secure.

Answer

ENTRYPOINT

Answer

RUN

Answer

CMD

Question 7

A developer wants to mount a ConfigMap as a volume in a Pod so that updates to the ConfigMap are reflected in the Pod without restarting. Which two statements are correct? (Choose two.)

Accepted Answer

Using subPath in the volume mount prevents automatic updates.. When a ConfigMap is mounted using `subPath`, Kubernetes treats the mount as a single file rather than a directory of symlinks. This means the atomic update mechanism (which uses symlinks to swap the directory contents) is bypassed, and updates to the ConfigMap are not reflected in the Pod without a restart or remount.

Answer

Using envFrom to inject ConfigMap data as environment variables will update automatically.

Answer

ConfigMap updates are reflected immediately in the volume mount.

Answer

The Pod must be restarted for any ConfigMap change to take effect.

Question 8

Which THREE are valid ways to expose a canary deployment for testing? (Select three)

Accepted Answer

Create a separate Service for the canary with a different selector and provide its endpoint to testers.. Option A is correct because creating a dedicated Service whose selector matches only the canary pods' labels gives testers a stable, isolated endpoint (ClusterIP/NodePort/LoadBalancer) that routes exclusively to the canary, without touching production traffic. Option B is correct because an Ingress controller such as NGINX supports canary annotations (e.g., nginx.ingress.kubernetes.io/canary: "true", canary-weight, canary-by-header, canary-by-cookie) to split or conditionally route a percentage or specific requests to the canary backend. Option E is correct because a single Service selecting both stable and canary pods via a shared common label will load-balance across all matching endpoints, which is a simple way to expose the canary alongside stable for testing (albeit without fine-grained control). Option C is not valid because a DaemonSet schedules one pod per node for node-level agents, not for canary traffic exposure. Option D is not valid because a NetworkPolicy only filters pod ingress/egress traffic; it restricts rather than exposes the canary and provides no routing mechanism to testers.

Answer

Use a DaemonSet instead of Deployment for canary.

Answer

Use a NetworkPolicy to restrict canary pods from receiving traffic.

Question 9

Which TWO options are valid ways to tag an image when building with Docker?

Accepted Answer

docker tag myapp:1.0 myrepo/myapp:1.0. The `docker tag` command explicitly creates a new tag referencing an existing image, allowing you to assign a new name and tag (e.g., `myrepo/myapp:1.0`) to an already built image (e.g., `myapp:1.0`). This is a standard way to prepare an image for pushing to a registry without rebuilding.

Answer

docker build --name myapp:1.0 .

Answer

docker commit myapp:1.0 myrepo/myapp:1.0

Answer

docker run -t myapp:1.0 myrepo/myapp:1.0

Question 10

A Job must run 10 times in total, with up to 3 pods running simultaneously. Which fields should be set?

Accepted Answer

completions: 10, parallelism: 3. In a Kubernetes Job, `completions: 10` specifies the total number of successful Pod completions required, and `parallelism: 3` limits the number of Pods that can run concurrently. This ensures the Job runs exactly 10 times with up to 3 Pods in parallel, which matches the requirement.

Answer

completions: 10, successfulJobsHistoryLimit: 3

Answer

completions: 10, parallelism: 10

Answer

completions: 3, parallelism: 10

Question 11

Which command creates an Opaque Secret named 'my-secret' with key 'password' and value 'p@ssw0rd'?

Accepted Answer

kubectl create secret generic my-secret --from-literal=password=p@ssw0rd. `kubectl create secret generic` creates an Opaque secret, and the `--from-literal=key=value` syntax correctly assigns the literal value 'p@ssw0rd' to the key 'password'. This produces a secret with the specified key-value pair.

Answer

kubectl create secret tls my-secret --cert=cert.pem --key=key.pem

Answer

kubectl create secret generic my-secret --from-literal=password

Answer

kubectl create secret generic my-secret --from-literal=p@ssw0rd=password

Question 12

Which TWO actions can you perform using 'kubectl describe'? (Select two.)

Accepted Answer

View the conditions and status of a node. `kubectl describe node <node-name>` displays detailed information about a node, including its conditions (e.g., Ready, DiskPressure, MemoryPressure) and status (e.g., capacity, allocatable resources). This command is essential for debugging node-level issues.

Answer

Execute a command inside a container

Answer

View the logs of a container

Answer

View the YAML manifest of a resource

Question 13

A developer wants to restrict a Pod's resource usage. Which two API resources can be used to enforce limits at the namespace level? (Choose two.)

Accepted Answer

LimitRange. LimitRange (C) is correct because it allows administrators to set default resource requests and limits, as well as minimum and maximum constraints, for Pods and containers within a namespace. This enforces resource boundaries at the namespace level, ensuring that individual Pods cannot exceed defined limits.

Answer

PodSecurityPolicy

Answer

HorizontalPodAutoscaler

Answer

NetworkPolicy

Question 14

You create a Service with the following YAML:
```
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: my-app
```
What is the default Service type?

Accepted Answer

ClusterIP. When no `type` field is specified in a Service YAML, Kubernetes defaults to `ClusterIP`. This assigns a stable internal IP address reachable only within the cluster, enabling pod-to-pod communication without external exposure. The `spec.type` field is optional, and `ClusterIP` is the implicit default.

Answer

NodePort

Answer

LoadBalancer

Answer

ExternalName

Question 15

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

A single NetworkPolicy can contain both ingress and egress rules. A single NetworkPolicy resource can define both ingress and egress rules within its spec. The `spec.policyTypes` field explicitly lists which rule types are applied; if both `Ingress` and `Egress` are specified, the policy governs both directions. This allows administrators to enforce bidirectional traffic controls with a single policy object.

Answer

NetworkPolicy is a cluster-scoped resource

Answer

NetworkPolicy can only be applied to pods with a specific annotation