CKAD Practice Test 2 — 25 Questions

Question 1

Which command scales a Deployment named 'web' to 5 replicas?

Accepted Answer

kubectl scale deployment web --replicas=5. The correct command to scale a Deployment to a specific number of replicas is `kubectl scale deployment web --replicas=5`. This command directly modifies the `spec.replicas` field of the Deployment object, instructing the Kubernetes controller manager to adjust the number of running Pods to match the desired count.

Answer

kubectl set replicas deployment web 5

Answer

kubectl resize deployment web --replicas=5

Answer

kubectl autoscale deployment web --replicas=5

Question 2

You have a Kustomize overlay that sets 'replicas: 5' in a patch, but the base Deployment has 'replicas: 3'. What is the final number of replicas after applying 'kubectl apply -k overlay/'?

Accepted Answer

5. In Kustomize, overlays are applied on top of the base, and patches override the base values. Since the overlay explicitly sets 'replicas: 5' via a patch, it replaces the base value of 3. The final Deployment will have 5 replicas, making D correct.

Answer

3

Answer

8

Answer

It depends on the strategy

Question 3

You have a Deployment with replicas: 5 and update strategy type: RollingUpdate with maxSurge: 25% and maxUnavailable: 25%. During a rolling update, what is the maximum number of pods that can be unavailable at any given time?

Accepted Answer

1. With maxUnavailable: 25% on a Deployment of 5 replicas, the maximum number of unavailable pods is 25% of 5 = 1.25, and Kubernetes rounds down for maxUnavailable, resulting in 1. Therefore, at most 1 pod can be unavailable at any given time during the rolling update.

Answer

2

Answer

5

Answer

0

Question 4

You need to create a Pod that runs with a specific non-root user (UID 1000), prevents privilege escalation, and mounts the container's filesystem as read-only. Which securityContext field is NOT required to achieve these requirements?

Accepted Answer

runAsGroup: 1000. (runAsGroup: 1000) is not required because the requirement only specifies a non-root user (UID 1000) and does not mandate a specific group ID. The runAsGroup field sets the primary group for the container's processes, but it is optional; without it, the container will use the default group associated with the user or the container's default group. The other options are necessary: runAsUser: 1000 sets the user, readOnlyRootFilesystem: true makes the filesystem read-only, and allowPrivilegeEscalation: false prevents privilege escalation.

Answer

runAsUser: 1000

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 5

A pod's securityContext has 'allowPrivilegeEscalation: false' and 'capabilities: { drop: ["ALL"] }'. Which statement is true?

Accepted Answer

The container runs with no extra capabilities and cannot gain privileges.. Setting 'allowPrivilegeEscalation: false' prevents processes from gaining more privileges than their parent (e.g., via setuid binaries or kernel exploits), and dropping all capabilities with 'capabilities: { drop: ["ALL"] }' removes every Linux capability from the container's bounding set. Together, these ensure the container runs with no extra capabilities and cannot escalate privileges, even if running as root.

Answer

The container can still gain capabilities via setuid binaries.

Answer

The container runs as root with full privileges.

Answer

The container runs with all Linux capabilities.

Question 6

A pod has a container with envFrom referencing a ConfigMap. The ConfigMap has keys 'APP_DEBUG=true' and 'APP_NAME=myapp'. The pod also has an env entry with name 'APP_DEBUG' set to 'false'. What is the value of APP_DEBUG in the container?

Accepted Answer

false. When a pod has both an `envFrom` referencing a ConfigMap and an explicit `env` entry with the same key, the explicit `env` entry takes precedence. This is because Kubernetes merges environment variables from multiple sources, and individual `env` entries override any values from `envFrom` for the same key. Therefore, `APP_DEBUG` will be set to 'false' as defined in the explicit `env` entry.

Answer

undefined

Answer

Both values are concatenated

Answer

true

Question 7

Which THREE of the following are correct about init containers? (Select THREE.)

Accepted Answer

They run to completion before the main application containers start. Init containers are designed to run sequentially to completion before any of the pod's regular application containers start. This ensures that prerequisites, such as database schema migrations or configuration file generation, are completed before the main application begins execution.

Answer

They cannot have resource limits set

Answer

They run after the main application containers have started

Question 8

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 9

Which of the following is the correct way to scale a Deployment named 'api' to 5 replicas using kubectl?

Accepted Answer

kubectl scale deployment api --replicas=5. `kubectl scale deployment api --replicas=5` is the standard kubectl command to change the replica count of a Deployment. The `scale` subcommand directly modifies the `.spec.replicas` field in the Deployment's manifest, instructing the ReplicaSet controller to adjust the number of Pods to match the desired count.

Answer

kubectl scale deploy api 5

Answer

kubectl update deployment api --replicas=5

Answer

kubectl set replicas deployment api 5

Question 10

Which TWO statements about readiness probes are correct? (Choose two.)

Accepted Answer

Readiness probes run continuously after the container starts. Readiness probes are designed to run continuously throughout the lifecycle of a container, not just during startup. They are periodically executed by the kubelet to determine whether the container is ready to accept traffic, and their success or failure directly controls the pod's inclusion in Service endpoints.

Answer

Readiness probes are only used during initial startup

Answer

Readiness probes can only be of type httpGet

Answer

Readiness probes restart the container if they fail

Question 11

A NetworkPolicy is applied to a namespace with the following rules:
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```
What is the effect on pods in that namespace?

Accepted Answer

All inbound traffic is denied, outbound traffic is allowed. This NetworkPolicy selects all pods in the namespace (podSelector: {}) and specifies only Ingress in policyTypes. By default, if any NetworkPolicy selects a pod, all traffic not explicitly allowed by a rule is denied. Since no ingress rules are defined, all inbound traffic is denied. Outbound traffic is not restricted because Egress is not listed in policyTypes and no egress rules are defined, so it remains allowed by default.

Answer

All traffic is allowed

Answer

Only traffic from specific namespaces is allowed

Answer

All inbound and outbound traffic is denied

Question 12

A Service named `api` in namespace `default` has multiple endpoints. You run `kubectl get endpoints api` and see no IPs. What is the most likely cause?

Accepted Answer

The Service selector does not match any pods. The most likely cause is that the Service's selector does not match any pods. A Service uses its label selector to identify pods and automatically populate its endpoints. If no pods match the selector, the endpoints list will be empty, resulting in no IPs shown by `kubectl get endpoints api`.

Answer

The Service type is ExternalName

Answer

The namespace has a NetworkPolicy blocking traffic

Answer

The Service has a clusterIP of None

Question 13

Which TWO statements about init containers are true? (Select 2)

Accepted Answer

Init containers run sequentially in the order they are defined.. Init containers in a Kubernetes Pod are executed sequentially in the exact order they are defined in the `initContainers` array. Each init container must exit successfully (return code 0) before the next one starts, ensuring a strict dependency chain for initialization tasks.

Answer

Init containers support liveness and readiness probes.

Answer

Init containers share the same filesystem as the application containers by default.

Answer

Init containers have a restart policy of Always.

Question 14

An Ingress has two rules:
- host: app.example.com, path: /api -> service-a:80
- host: api.example.com, path: / -> service-b:80
A request to `app.example.com/api/v1` reaches which service?

Accepted Answer

service-a. Ingress rules match the longest prefix of the request path for the given host. For `app.example.com/api/v1`, the path `/api` is a prefix match (since `/api/v1` starts with `/api`), so it routes to service-a:80. The second rule requires host `api.example.com`, which does not match, so service-b is not considered.

Answer

Both services

Answer

Neither service

Answer

service-b

Question 15

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.

Question 16

When performing a rolling update of a Deployment, which field in the Deployment spec controls the maximum number of Pods that can be created above the desired replicas during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

Answer

spec.strategy.type

Answer

spec.strategy.rollingUpdate.maxUnavailable

Answer

spec.replicas

Question 17

Which THREE of the following are valid fields for configuring a probe in Kubernetes? (Select 3)

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe configuration (e.g., livenessProbe, readinessProbe, startupProbe). It defines the number of seconds after the container has started before the probe is initiated, allowing the application time to initialize before health checks begin.

Answer

retrySeconds

Answer

intervalSeconds

Question 18

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 19

Which TWO approaches can be used to expose a Secret's value as an environment variable in a pod?

Accepted Answer

env:
  - name: MY_SECRET
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: my-key. The `valueFrom.secretKeyRef` field in a container's `env` definition directly references a specific key from a Kubernetes Secret and injects its value as an environment variable. This is the standard method for exposing a single secret key as an environment variable, as defined in the Kubernetes API.

Answer

volumeMounts:
  - name: secret-volume
    mountPath: /etc/secret

Answer

env:
  - name: MY_SECRET
    value: "$(MY_SECRET)"

Answer

env:
  - name: MY_SECRET
    valueFrom:
      configMapKeyRef:
        name: my-secret
        key: my-key

Question 20

Which TWO statements about NetworkPolicy are correct? (Choose two.)

Accepted Answer

NetworkPolicy uses labels to select pods within a namespace. NetworkPolicy uses label selectors in its `spec.podSelector` field to identify which pods within a namespace the policy applies to. This allows fine-grained control over traffic to and from specific sets of pods based on their labels, without needing to reference pod names or IPs.

Answer

If no NetworkPolicy selects a pod, then that pod is isolated and traffic is denied

Answer

NetworkPolicy is only applicable to Services

Answer

NetworkPolicy is a cluster-scoped resource