CKAD Practice Test 25 — 15 Questions

Question 1

A NetworkPolicy with the following spec is applied to a namespace. What is the effect? spec: podSelector: {} policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 10.0.0.0/8 except: - 10.0.1.0/24 egress: - to: - ipBlock: cidr: 0.0.0.0/0

Accepted Answer

Deny all ingress traffic except from 10.0.0.0/8 excluding 10.0.1.0/24; allow all egress. The empty podSelector applies to all pods in the namespace. Ingress allows traffic from 10.0.0.0/8 except 10.0.1.0/24. Egress allows all traffic. No default deny because ingress and egress rules are present.

Answer

Deny all ingress and egress traffic

Answer

Allow all ingress and egress traffic

Answer

Allow ingress from 10.0.1.0/24 only

Question 2

You need to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates the appropriate Service?

Accepted Answer

kubectl expose deployment web --port=80. kubectl expose exposes a resource as a Kubernetes Service. The default type is ClusterIP.

Answer

kubectl create service clusterip web --tcp=80:80

Answer

kubectl apply -f service.yaml

Answer

kubectl run web --image=nginx --port=80

Question 3

Which THREE conditions must be met for a NetworkPolicy to effectively isolate a set of pods?

Accepted Answer

The NetworkPolicy must have a non-empty podSelector that matches the target pods. NetworkPolicy must have a podSelector that selects the target pods, the policyTypes must include Ingress and/or Egress, and the rules must define allowed traffic. By default, if no NetworkPolicy applies, all traffic is allowed.

Answer

The namespace must have a default deny-all NetworkPolicy

Answer

The pods must have the label 'networking/allow-external'

Question 4

Which TWO statements about Kubernetes DNS are correct?

Accepted Answer

A service named 'api' in namespace 'prod' has DNS name 'api.prod.svc.cluster.local'. Pod DNS uses the pod's IP with dots replaced by dashes. Service DNS format is 'service.namespace.svc.cluster.local'. Pods with hostNetwork do not get DNS by default. DNS can be customized via CoreDNS.

Answer

The kube-dns service is responsible for DNS resolution

Answer

Pods with hostNetwork: true automatically get DNS entries

Answer

A pod's DNS name is always 'pod-ip.namespace.pod.cluster.local'

Question 5

Which TWO statements about Ingress are correct?

Accepted Answer

Ingress can route traffic based on the requested hostname. Ingress can route based on host and path, and can terminate TLS. Ingress does not support TCP/UDP directly; it's for HTTP/HTTPS. IngressClass is used to select the Ingress controller. Multiple Ingress resources can coexist.

Answer

An Ingress resource without an IngressClass will not work

Answer

Only one Ingress resource can exist per namespace

Answer

Ingress can handle non-HTTP protocols like TCP

Question 6

Which TWO commands can be used to list the endpoints of a Service named 'my-svc'?

Accepted Answer

kubectl describe svc my-svc. Endpoints can be viewed via 'kubectl get endpoints my-svc' and 'kubectl describe svc my-svc' shows endpoint information.

Answer

kubectl get networkpolicy

Answer

kubectl get pods -l app=my-svc

Question 7

A developer needs to expose a deployment named 'web-app' running in the 'default' namespace on port 8080 internally within the cluster. Which kubectl command creates a ClusterIP service that selects pods with label 'app: web'?

Accepted Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --selector=app=web. The correct command uses 'kubectl expose' with the appropriate flags to create a ClusterIP service targeting port 8080 and selecting pods with label 'app=web'.

Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --type=ClusterIP

Answer

kubectl run web-app --image=nginx --port=8080 --expose

Answer

kubectl create service clusterip web-app --tcp=8080:8080 --selector=app=web

Question 8

Which THREE items are required for Ingress to work correctly in a Kubernetes cluster?

Accepted Answer

At least one rule specifying either host or path. An Ingress resource needs an Ingress controller to process it. Rules define routing. TLS configuration enables HTTPS. IngressClass is optional but recommended. Backend service must be of type ClusterIP.

Answer

A LoadBalancer service for the backend

Answer

A default backend service

Question 9

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

NetworkPolicy uses labels to select pods and namespaces. NetworkPolicy is namespaced, can use podSelector and namespaceSelector, and default is allow all if no policy selects the pod. Empty podSelector selects all pods in the namespace. ipBlock can be used in both ingress and egress rules.

Answer

NetworkPolicy resources are cluster-scoped

Answer

ipBlock can only be used in ingress rules

Question 10

A StatefulSet named 'mysql' is deployed with 3 replicas. The administrator wants each pod to have a stable network identity. Which service configuration is required?

Accepted Answer

A headless service with clusterIP: None and selector matching the StatefulSet. StatefulSets require headless services (clusterIP: None) to provide stable DNS names for each pod (e.g., mysql-0.mysql.default.svc.cluster.local).

Answer

A ClusterIP service named 'mysql'

Answer

A NodePort service named 'mysql'

Answer

An ExternalName service pointing to an external database

Question 11

A user runs: kubectl apply -f job.yaml. The Job spec has backoffLimit: 0. The pod fails immediately. What happens?

Accepted Answer

The Job enters a Failed state. With backoffLimit: 0, the Job is not retried after the first failure, so the Job enters Failed state.

Answer

The Job is retried indefinitely

Answer

The pod is restarted until it succeeds

Answer

A new pod is created automatically

Question 12

A multi-stage build has two stages named 'builder' and 'final'. Which instruction copies artifacts from the builder stage to the final stage?

Accepted Answer

COPY --from=builder /app /app. Option B is correct. 'COPY --from=builder' copies from a previous stage. Option A uses 'ADD', which could work but COPY is preferred for clarity. Option C and D have incorrect syntax.

Answer

FROM builder /app /app

Answer

COPY builder /app /app

Answer

ADD --from=builder /app /app

Question 13

Which TWO fields are required in a CronJob manifest? (Select 2)

Accepted Answer

schedule. Options A and D are required. A CronJob must have 'schedule' (A) and 'jobTemplate' (D). Option B (concurrencyPolicy) is optional and defaults to Allow. Option C (successfulJobsHistoryLimit) is optional. Option E (startingDeadlineSeconds) is optional.

Answer

startingDeadlineSeconds

Answer

successfulJobsHistoryLimit

Answer

concurrencyPolicy

Question 14

You run 'kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml'. What is the output?

Accepted Answer

A Pod manifest with apiVersion: v1. Option A is correct: The command generates a Pod manifest with apiVersion v1, kind Pod. Option B is a Deployment. Option C is a Job. Option D is a Pod but with wrong apiVersion.

Answer

A Pod manifest with apiVersion: v1beta1

Answer

A Job manifest with apiVersion: batch/v1

Answer

A Deployment manifest with apiVersion: apps/v1

Question 15

A CronJob is configured with 'concurrencyPolicy: Forbid'. What happens if the scheduled time arrives while the previous job is still running?

Accepted Answer

The new job is skipped until the next scheduled time. With 'Forbid', if a job is still running, the new scheduled job is skipped (does not run).

Answer

The new job starts immediately, running concurrently

Answer

The running job is terminated and the new job starts

Answer

The CronJob enters an error state