CKAD Practice Test 3 — 25 Questions

Question 1

Match each Kubernetes resource to its API group.

Accepted Answer

Pod: v1. Kubernetes resources belong to specific API groups. Pods, Services, ConfigMaps, and PersistentVolumeClaims are in the core group (v1), while Deployments are in apps/v1, and Ingresses are in networking.k8s.io/v1.

Answer

Service: apps/v1

Answer

ConfigMap: networking.k8s.io/v1

Answer

PersistentVolumeClaim: apps/v1

Question 2

You need to perform a canary deployment using a Service and two Deployments (stable and canary). Which TWO resources or configurations are typically used to route a percentage of traffic to the canary? (Select TWO)

Accepted Answer

Service Mesh (e.g., Istio VirtualService). A Service Mesh like Istio uses a VirtualService resource to define traffic routing rules based on weights (e.g., `weight: 90` for stable and `weight: 10` for canary). This allows fine-grained, percentage-based traffic splitting between two different Kubernetes Services or subsets, which is a core requirement for canary deployments.

Answer

A single Service with multiple label selectors

Answer

NetworkPolicy

Answer

HorizontalPodAutoscaler

Question 3

Match each Kubernetes object field to its description.

Accepted Answer

livenessProbe: Indicates if the container is running. If fails, kubelet kills the container and restarts it.. Correct matches: livenessProbe checks container health, readinessProbe checks service readiness, startupProbe checks application startup, and imagePullPolicy controls image pulling. Common confusions involve swapping definitions with restartPolicy.

Answer

imagePullPolicy: Defines the policy for restarting the container after exit.

Answer

restartPolicy: Defines when to pull the container image.

Question 4

Which Service type is used to expose a Service on a static port on each node's IP address, allowing external traffic to reach the Service?

Accepted Answer

NodePort. NodePort is the correct Service type because it exposes the Service on a static port (in the range 30000-32767) on each node's IP address. This allows external traffic to reach the Service by sending requests to any node's IP at that port, which then forwards traffic to the appropriate Pods via the ClusterIP and kube-proxy rules.

Answer

ClusterIP

Answer

ExternalName

Answer

LoadBalancer

Question 5

Which kubectl command creates a Secret from literal username and password values?

Accepted Answer

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` with `--from-literal` is the proper syntax for specifying literal key-value pairs directly in the command. Each literal must be prefixed with `--from-literal=key=value`, and multiple literals can be provided to create a Secret containing both the username and password keys.

Answer

kubectl create secret generic my-secret --literal username=admin password=secret123

Answer

kubectl create secret generic my-secret --from-file=username --from-file=password

Answer

kubectl create secret generic my-secret --from-env-file=creds.txt

Question 6

A NetworkPolicy named 'deny-all' is applied in a namespace. Which YAML snippet correctly implements a default-deny-all ingress policy?

Accepted Answer

spec:
  podSelector: {}
  policyTypes:
  - Ingress. A NetworkPolicy with an empty `podSelector: {}` selects all pods in the namespace, and specifying `policyTypes: [Ingress]` without any `ingress` rules creates a default-deny-all ingress policy, blocking all incoming traffic. Options B and C include `ingress` rules (with empty `from`), which is not the standard approach for a strict deny-all; the canonical method is to omit the `ingress` field entirely when using `policyTypes: [Ingress]`.

Answer

spec:
  podSelector: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Ingress

Question 7

You are using a canary deployment pattern with two Deployments: 'web-stable' (version 1) and 'web-canary' (version 2). Both have the label 'app: web'. The Service 'web-svc' selects pods with 'app: web' and 'version: stable'. How do you route traffic to the canary?

Accepted Answer

Add the label 'version: canary' to the canary Deployment's pod template and update the Service's selector to 'app: web, version in (stable, canary)'.. The Service 'web-svc' currently selects pods with 'app: web' and 'version: stable'. To route traffic to the canary pods (version 2), you need to add the label 'version: canary' to the canary Deployment's pod template so that those pods are created with that label. Then, updating the Service's selector to 'app: web, version in (stable, canary)' allows the Service to match both stable and canary pods, distributing traffic between them according to the Service's default round-robin behavior.

Answer

Use kubectl rollout canary on the stable Deployment.

Answer

Create a new Service with selector 'app: web, version: canary' and use an ingress to split traffic.

Answer

Change the Service selector to 'app: web' only (remove version label).

Question 8

You have a Deployment that must run a legacy application that takes up to 5 minutes to start. You need to ensure the liveness probe does not kill the container prematurely. Which probe configuration should you use?

Accepted Answer

Configure a startup probe with a high failureThreshold and appropriate initialDelaySeconds. A startup probe is specifically designed for slow-starting containers. It runs before the liveness probe and allows the container extra time to initialize without being killed. By setting a high failureThreshold (e.g., 30) and an appropriate initialDelaySeconds, the probe can wait up to 5 minutes for the application to start, after which the liveness probe takes over.

Answer

Use a HTTP GET liveness probe with path /healthz and port 8080

Answer

Set livenessProbe.initialDelaySeconds to 300

Answer

Set livenessProbe.periodSeconds to a high value, like 300

Question 9

You want to create a Deployment that runs 5 replicas of a web application. Which kubectl command should you use?

Accepted Answer

kubectl create deployment webapp --image=nginx --replicas=5. To create a Deployment with 5 replicas using a single imperative command, use `kubectl create deployment webapp --image=nginx --replicas=5`. This command directly creates a Deployment and sets the desired replicas. Option A (`kubectl run`) no longer creates a Deployment by default in current Kubernetes versions (1.18+); it creates a single Pod and does not support the `--replicas` flag. Option B (`kubectl create pod`) does not exist and is incorrect. Option C (`kubectl apply -f deployment.yaml`) would also create a Deployment but requires an existing YAML file and is not a single imperative command.

Answer

kubectl run webapp --image=nginx --replicas=5

Answer

kubectl create pod webapp --image=nginx --replicas=5

Answer

kubectl apply -f deployment.yaml

Question 10

A container image requires running as UID 0 but you need to comply with a 'restricted' Pod Security Admission policy. Which SecurityContext setting allows this while still passing the policy?

Accepted Answer

No SecurityContext setting allows running as UID 0 under the restricted policy.. The 'restricted' Pod Security Admission policy requires that containers run as non-root (runAsNonRoot: true) and prohibits setting runAsUser to 0. Since the image requires UID 0, no SecurityContext setting can override this policy constraint; the only way to comply is to modify the image to run as a non-root user. Therefore, option B is correct.

Answer

Set securityContext: { allowPrivilegeEscalation: true }

Answer

Set securityContext: { runAsNonRoot: true, capabilities: { add: ['SYS_ADMIN'] } }

Answer

Set runAsUser: 0 and runAsNonRoot: false

Question 11

A developer wants to containerize a Node.js application. The Dockerfile should first copy only package.json and package-lock.json, run npm install, then copy the rest of the source code. Which Dockerfile best achieves this?

Accepted Answer

COPY package*.json /app/
RUN npm install
COPY . /app/. It first copies only package.json and package-lock.json (using a wildcard pattern), runs `npm install` to leverage Docker's layer caching, and then copies the rest of the source code. This ensures that subsequent builds only re-run `npm install` when the dependency files change, not on every source code modification, which is a best practice for efficient Docker builds.

Answer

COPY . /app
RUN npm install

Answer

ADD package*.json /app/
RUN npm install
ADD . /app/

Answer

ADD . /app
RUN npm install

Question 12

Which TWO commands can be used to create a Secret from a file? (Select 2)

Accepted Answer

kubectl create secret generic mysecret --from-file=key=file.txt. Both options A and E are valid commands to create a Secret from a file. Option A uses `--from-file` to read file contents and store them under a specified key. Option E uses `--from-env-file` to parse a file with key=value pairs and create a Secret for environment variables. Option C is incorrect for this question because `kubectl apply -f secret.yaml` applies a YAML manifest that defines a Secret, but it does not create a Secret directly from a file's contents in the same way as the `kubectl create secret` commands. The question asks for two commands that create a Secret from a file, and both A and E meet that criterion.

Answer

kubectl create configmap mysecret --from-file=file.txt

Answer

kubectl apply -f secret.yaml where secret.yaml contains data fields

Answer

kubectl create secret tls mysecret --cert=file.txt

Question 13

A pod needs to run as a non-root user with UID 1000. Which SecurityContext field should be set?

Accepted Answer

runAsUser: 1000. The `runAsUser` field in the PodSecurityContext or container SecurityContext sets the user ID (UID) under which the container's main process runs. Setting `runAsUser: 1000` ensures the container runs as a non-root user with UID 1000, meeting the requirement. This field directly controls the effective UID of the process, overriding the default root (UID 0).

Answer

runAsGroup: 1000

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Question 14

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff with an OOMKilled message, which indicates the container is being terminated by the Linux kernel's Out-Of-Memory (OOM) killer because it has exceeded its memory limit. Increasing the memory limit in the pod's container resource specification allows the container to use more memory without being killed, directly addressing the root cause.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 15

You have a Deployment named 'api' with 3 replicas. You need to ensure that new pods are not added to the Service's endpoints until the application is ready to serve traffic. Which probe configuration should you add to the pod spec?

Accepted Answer

Readiness probe. A Readiness probe is the correct choice because it controls whether a pod is added to a Service's endpoints. Kubernetes will only mark a pod as Ready when the probe succeeds, and only Ready pods receive traffic from the Service. This ensures new pods are not added until the application is ready to serve traffic.

Answer

No probe is needed; pods are automatically added when running

Answer

Startup probe

Answer

Liveness probe

Question 16

You have a Deployment running a web server that takes 30 seconds to initialize. You want to ensure that the load balancer does not send traffic to the pod until it is ready. Which probe should you configure?

Accepted Answer

Readiness probe. A Readiness probe is the correct choice because it determines whether a Pod is ready to serve traffic. In this scenario, the web server takes 30 seconds to initialize, so a Readiness probe (e.g., an HTTP GET on the application's health endpoint) will prevent the Service (and thus the load balancer) from sending requests until the probe succeeds, ensuring zero traffic is routed to an uninitialized Pod.

Answer

Resource limit

Answer

Startup probe

Answer

Liveness probe

Question 17

You have a Deployment with multiple replicas. You want to expose it via a Service that has a stable IP address and is accessible from outside the cluster on a static port on each node. Which Service type should you use?

Accepted Answer

NodePort. A NodePort Service type exposes the application on a static port (in the range 30000-32767) on every node's IP address, making it accessible from outside the cluster. This satisfies the requirement for a stable IP (the node's IP) and a static port on each node, while also providing a stable ClusterIP for internal use.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 18

Which of the following is the correct way to set an environment variable 'APP_COLOR' from a ConfigMap key 'color'?

Accepted Answer

env:
  - name: APP_COLOR
    valueFrom:
      configMapKeyRef:
        name: my-config
        key: color. It uses the `configMapKeyRef` field under `valueFrom` in the `env` array to inject a specific key from a ConfigMap as an environment variable. This is the standard Kubernetes syntax for referencing a single key from a ConfigMap, where `name` specifies the ConfigMap object and `key` specifies the key within that ConfigMap whose value will be assigned to the environment variable `APP_COLOR`.

Answer

env:
  - name: APP_COLOR
    valueFrom:
      configMapRef:
        name: my-config
        key: color

Answer

envFrom:
  - configMapKeyRef:
      name: my-config
      key: color

Answer

env:
  - name: APP_COLOR
    value: "configMap.color"

Question 19

You are using a canary deployment strategy with Deployments and Services. You have a stable version (v1) and a canary version (v2). Both Deployments have the label 'app: myapp'. The Service selector is 'app: myapp'. How can you route a small percentage of traffic to the canary?

Accepted Answer

Set the canary Deployment replicas to 1 and the stable to 9, and keep the Service selector as 'app: myapp'. The Service selector 'app: myapp' matches both Deployments, and by setting the canary to 1 replica and the stable to 9, the Service's round-robin load balancing (by default) distributes roughly 10% of traffic to the canary Pods and 90% to the stable Pods. This is a simple, native Kubernetes canary pattern that requires no additional components like Ingress controllers.

Answer

Set both Deployments to 10 replicas and use an Ingress with a canary weight annotation (e.g., canary-weight: '10')

Answer

Set the canary Deployment replicas to 1 and the stable to 9, and update the Service selector to include version: v2

Answer

Set the canary Deployment replicas to 10 and the stable to 1

Question 20

A developer creates a Dockerfile with the following content:
FROM alpine:3.18
COPY app.sh /app.sh
RUN chmod +x /app.sh
CMD ["/app.sh"]
They want to override the command to run '/app.sh --debug' when deploying the container in Kubernetes. Which of the following pod spec fields should they use?

Accepted Answer

spec.containers[].args. In Kubernetes, the `args` field overrides the CMD instruction from the Docker image. The Dockerfile's `CMD ["/app.sh"]` is replaced by `args: ["--debug"]`, which is appended to the ENTRYPOINT (defaulting to `/bin/sh -c` if not set, but here the ENTRYPOINT is `/app.sh` from the image's implicit ENTRYPOINT? Actually, the image has no explicit ENTRYPOINT, so the default is `/app.sh` from CMD? Wait — the Dockerfile has no ENTRYPOINT, so the container's entrypoint is the default `/bin/sh -c`? No, in Kubernetes, if no `command` is set, the image's ENTRYPOINT is used; if no ENTRYPOINT, then the image's CMD is used as the command. Here, the image has CMD `["/app.sh"]` and no ENTRYPOINT, so the container's command is `/app.sh`. Setting `args: ["--debug"]` will append `--debug` to that command, resulting in `/app.sh --debug`.

Answer

spec.containers[].entrypoint

Answer

spec.containers[].command

Answer

spec.command