CKAD Practice Test 25 — 15 Questions

Question 1

Which of the following is a valid Pod Security Admission standard?

Accepted Answer

Restricted. The Pod Security Admission (PSA) standard defines three levels: Privileged, Baseline, and Restricted. Option C is correct because 'Restricted' is one of the three valid standards, designed to enforce the most restrictive pod security policies.

Answer

Privileged, Default

Answer

Default

Answer

Secure

Question 2

You have a Helm chart that deploys a web application. You want to conditionally include a ConfigMap in the release based on a value 'config.enabled'. Which template syntax correctly implements this?

Accepted Answer

{{- if .Values.config.enabled }}
  (ConfigMap YAML)
{{- end }}. Helm uses Go's text/template engine, where conditionals are written as {{ if ... }} ... {{ end }}. The {{- syntax trims preceding whitespace, which is idiomatic in Helm charts to avoid stray blank lines in rendered YAML. Option B correctly uses this Go template syntax with .Values.config.enabled as the condition.

Answer

{% if .Values.config.enabled %}
  (ConfigMap YAML)
{% endif %}

Answer

{{- when .Values.config.enabled }}
  (ConfigMap YAML)
{{- end }}

Answer

{{#if .Values.config.enabled}}
  (ConfigMap YAML)
{{/if}}

Question 3

What is the DNS name for a Service named 'backend' in the 'default' namespace?

Accepted Answer

backend.default.svc.cluster.local. In Kubernetes, a Service named 'backend' in the 'default' namespace is assigned a DNS name following the pattern `..svc.cluster.local`. This is the standard internal DNS resolution format used by CoreDNS (or kube-dns) for cluster-local services. Option B correctly follows this pattern: `backend.default.svc.cluster.local`.

Answer

backend.default.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.svc.cluster

Question 4

Which TWO are valid ways to create a Service from a deployment named 'frontend'? (Choose two.)

Accepted Answer

Write a YAML manifest with apiVersion: v1, kind: Service, metadata.name, spec.selector matching deployment labels, and run kubectl apply -f manifest.yaml. It describes the standard method of creating a Kubernetes Service by writing a YAML manifest with the correct apiVersion (v1), kind (Service), metadata.name, and spec.selector that matches the labels of the target Pods (e.g., from the 'frontend' deployment). Running 'kubectl apply -f manifest.yaml' then creates the Service, which routes traffic to Pods with matching labels.

Answer

kubectl create service clusterip frontend --tcp=80:80

Answer

kubectl autoscale deployment frontend --min=1 --max=5

Answer

kubectl run frontend --image=nginx --port=80 --expose

Question 5

What is the DNS name for a Service named `svc` in namespace `ns`?

Accepted Answer

svc.ns.svc.cluster.local. B is correct because Kubernetes constructs the DNS name for a Service using the format `..svc.cluster.local`. For a Service named `svc` in namespace `ns`, this becomes `svc.ns.svc.cluster.local`. This allows Pods to resolve the Service by its fully qualified domain name (FQDN) within the cluster, leveraging CoreDNS or kube-dns.

Answer

svc.cluster.local

Answer

svc.svc.cluster.local

Answer

ns.svc.cluster.local

Question 6

Which TWO of the following are valid strategies for updating a Deployment?

Accepted Answer

RollingUpdate. RollingUpdate is the default update strategy in Kubernetes Deployments. It gradually replaces old Pods with new ones, ensuring zero downtime by incrementally scaling down old ReplicaSets and scaling up new ones based on configurable parameters like maxSurge and maxUnavailable.

Answer

Canary

Answer

Ramped

Answer

Blue/Green

Question 7

Which THREE of the following are valid fields in a NetworkPolicy spec?

Accepted Answer

podSelector. `podSelector` is a required field in a NetworkPolicy spec that defines which pods the policy applies to, using standard Kubernetes label selectors. It must be present to target specific pods within a namespace, and if set to an empty selector (e.g., `{}`), it selects all pods in the namespace. The CKAD exam often tests the distinction between top-level spec fields and nested rule fields, so candidates mistakenly select `namespaceSelector` or `ipBlock` as valid spec fields when they are only valid within `ingress` or `egress` rules.

Answer

namespaceSelector

Answer

ipBlock

Question 8

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 9

Which THREE are valid reasons to use a StatefulSet instead of a Deployment?

Accepted Answer

Each pod requires a stable, unique network identity.. StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Answer

The application requires rolling updates.

Answer

The application cannot be scaled down.

Question 10

Which THREE are valid types of probes in Kubernetes?

Accepted Answer

Startup probe. Startup probes are a valid Kubernetes probe type used to determine when a container application has started successfully. They are particularly useful for legacy applications that have slow startup times, as they delay the start of liveness and readiness probes until the startup probe succeeds, preventing premature container restarts.

Answer

Survival probe

Answer

Health probe

Question 11

Which TWO commands can be used to view the rollout history of a Deployment?

Accepted Answer

kubectl describe deployment mydeployment. `kubectl describe deployment mydeployment` includes the rollout history in its output, showing revision numbers and timestamps of changes. Option E is correct because `kubectl rollout history deployment/mydeployment` is the dedicated command to display the rollout history, listing revisions and associated change causes.

Answer

kubectl get deployment mydeployment

Answer

kubectl rollout status deployment/mydeployment

Answer

kubectl logs deployment/mydeployment

Question 12

Which TWO statements about kubectl apply vs kubectl create are correct? (Select two)

Accepted Answer

kubectl apply can update existing resources; kubectl create will error if resource exists. C is correct because `kubectl apply` uses a declarative approach: it creates a resource if it does not exist and updates it if it already exists, merging changes based on the last-applied-configuration annotation. In contrast, `kubectl create` is imperative and will return an error if the resource already exists, as it expects to create a new resource from scratch.

Answer

kubectl create can update existing resources if the --force flag is used

Answer

kubectl apply only works with Deployments

Answer

kubectl create can be used to update resources by providing the full YAML

Question 13

You need to check the resource usage of nodes and pods in your cluster. Which TWO commands should you use? (Choose two)

Accepted Answer

kubectl top nodes. A is correct because `kubectl top nodes` retrieves real-time CPU and memory usage metrics for all nodes in the cluster, sourced from the metrics server (which collects resource usage from kubelets via the Summary API). This command is the standard way to check node-level resource consumption in Kubernetes.

Answer

kubectl logs

Answer

kubectl cluster-info

Answer

kubectl describe pod

Question 14

Which THREE of the following are correct statements about the terminationGracePeriodSeconds field? (Select 3)

Accepted Answer

The default value is 30 seconds. The Kubernetes documentation specifies that the default value for terminationGracePeriodSeconds is 30 seconds. This field is part of the PodSpec and controls the duration between sending SIGTERM to the container and forcefully killing it with SIGKILL. If not set, Kubernetes applies this default to ensure a reasonable window for graceful shutdown.

Answer

The default value is 0 seconds

Answer

It is used to configure the readiness probe timeout

Question 15

Which THREE of the following are valid parameters for a probe?

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe specification that defines the number of seconds to wait before initiating the first probe after the container starts. This allows the application time to initialize before health checks begin, preventing premature failures.

Answer

maxRetries

Answer

backoffSeconds