CKAD Practice Test 5 — 25 Questions

Question 1

You are a platform engineer managing a production Kubernetes cluster. A team deploys a stateful application called 'inventory-service' with 3 replicas using a StatefulSet. Each pod writes logs to a persistent volume via a PersistentVolumeClaim. Recently, the team reports that the application becomes unresponsive after running for a few hours. You notice that the pods are still running (READY 1/1) but the application does not respond to HTTP requests. You exec into one pod and find that the disk is 100% full. The PVC is backed by a cloud disk (e.g., AWS EBS). You check the pod's resource limits and see that memory and CPU are not exhausted. The container logs are not rotated. Which course of action should you take to resolve the immediate issue and prevent recurrence?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the size of the PVC to provide more disk space, and configure log rotation inside the container to limit log file size. The immediate issue is a full disk caused by unrotated logs. Increasing the PVC size provides temporary relief, while configuring log rotation inside the container (e.g., using logrotate or the application's own rotation) prevents the disk from filling up again. This directly addresses the root cause without changing the application's logging behavior or introducing unnecessary sidecars.

Answer

Add a sidecar container that compresses and archives logs to a remote storage every hour

Answer

Change the application to log to stdout and configure Docker log rotation on the host

Answer

Configure a log rotation sidecar that writes logs to an emptyDir volume with size limit

Question 2

A Pod in a namespace with a ResourceQuota fails to create with the error: 'exceeded quota: compute-quota, requested: pods=1, used: pods=5, limited: pods=5'. What is the issue?

Accepted Answer

The namespace has reached its maximum number of Pods allowed by the ResourceQuota.. The error message explicitly states 'requested: pods=1, used: pods=5, limited: pods=5'. This means the ResourceQuota named 'compute-quota' has a hard limit of 5 pods in the namespace, and that limit has already been reached. The Pod creation fails because the quota's `count/pods` scope is exhausted, not because of resource requests or permissions.

Answer

The Pod's service account does not have permission to create Pods.

Answer

The Pod's resource requests exceed the quota.

Answer

The Pod is trying to mount a Secret that does not exist.

Question 3

An administrator applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

After applying this policy, which traffic flows are affected?

Accepted Answer

Both inbound and outbound traffic for all pods in the namespace is denied. The NetworkPolicy has an empty `podSelector: {}` which selects all pods in the namespace, and it specifies both `Ingress` and `Egress` in `policyTypes`. By default, if no rules are defined under `ingress` or `egress` (as in this case), Kubernetes denies all traffic of that type. Thus, both inbound and outbound traffic for all pods in the namespace is denied.

Answer

Only inbound traffic to pods is denied

Answer

Only outbound traffic from pods is denied

Answer

Traffic to and from the kube-system namespace is also denied

Question 4

You need to run a database migration as a container before the main application container starts. Which Kubernetes concept should you use?

Accepted Answer

Init container. Init containers run sequentially before the main application container starts and are designed for setup tasks like database migrations. They complete successfully before any regular containers in the Pod begin, ensuring the migration finishes before the main app starts.

Answer

Job

Answer

Sidecar container

Answer

Ephemeral container

Question 5

An admin wants to expose a Service only for internal cluster communication, without external access. Which Service type should they use?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type and exposes the Service on a cluster-internal IP address, making it reachable only from within the cluster. This is the correct choice for internal cluster communication because no external endpoints are created, and traffic is routed via kube-proxy using iptables or IPVS rules.

Answer

ExternalName

Answer

NodePort

Answer

LoadBalancer

Question 6

Which annotation is used to enforce Pod Security Admission at the 'restricted' level on a namespace?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. The `pod-security.kubernetes.io/enforce` annotation enforces Pod Security Standards (PSS) at the namespace level, and setting it to `restricted` blocks any pod that violates the most stringent set of security controls (e.g., running as root, privileged containers). This is the only annotation that actively prevents non-compliant pods from being created, rather than just warning or logging violations.

Answer

pod-security.kubernetes.io/warn: restricted

Answer

pod-security.kubernetes.io/enforce: baseline

Answer

pod-security.kubernetes.io/audit: restricted

Question 7

A Secret of type kubernetes.io/tls requires two data keys. What are they?

Accepted Answer

tls.crt and tls.key. Kubernetes requires that a Secret of type `kubernetes.io/tls` contain exactly two data keys: `tls.crt` for the TLS certificate and `tls.key` for the private key. This is mandated by the Kubernetes API specification for TLS secrets, which are used to secure ingress and other TLS-terminated endpoints.

Answer

ca.crt and tls.key

Answer

certificate and key

Answer

cert.crt and cert.key

Question 8

Which of the following is the correct apiVersion for a Kubernetes Job in v1.29?

Accepted Answer

batch/v1. In Kubernetes v1.29, the correct apiVersion for a Job is `batch/v1`. The `batch/v1` API version has been stable since Kubernetes 1.21, and Jobs are part of the batch API group. Using `batch/v1` ensures compatibility with the current stable release and provides access to all Job features, including parallelism, completions, and backoff limits.

Answer

apps/v1

Answer

v1

Answer

batch/v1beta1

Question 9

A pod named 'web' is in a CrashLoopBackOff state. You suspect the application is failing due to a configuration error. You want to see the logs from the previous instance of the container. Which command should you use?

Accepted Answer

kubectl logs web --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container in a pod that has restarted. Since the pod is in CrashLoopBackOff, the current container has likely crashed and a new one has started; `--previous` shows the logs from the terminated container that caused the crash, helping diagnose the configuration error.

Answer

kubectl logs web

Answer

kubectl logs -f web

Answer

kubectl describe pod web

Question 10

How can you set the environment variable 'DATABASE_URL' in a pod to the value stored in a Kubernetes Secret named 'db-secret' under the key 'url'?

Accepted Answer

env:
  - name: DATABASE_URL
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: url. The `env.valueFrom.secretKeyRef` field in a Pod spec is the proper mechanism to inject a specific key from a Kubernetes Secret as an environment variable. The `name` field identifies the Secret (`db-secret`), and the `key` field specifies which key within that Secret (`url`) to use. This is defined in the Kubernetes API for exposing Secret data as environment variables.

Answer

env:
  - name: DATABASE_URL
    valueFrom:
      configMapKeyRef:
        name: db-secret
        key: url

Answer

env:
  - name: DATABASE_URL
    valueFrom:
      secretRef:
        name: db-secret

Answer

env:
  - name: DATABASE_URL
    value:
      secretKeyRef:
        name: db-secret
        key: url

Question 11

A ClusterIP service named 'svc' has no endpoints. Which command can you use to debug why the service is not routing traffic?

Accepted Answer

kubectl get endpoints svc. `kubectl get endpoints svc` directly shows the list of pod IPs and ports that the ClusterIP service is routing traffic to. If the service has no endpoints, this command will return an empty list, confirming that no pods match the service's selector, which is the most common reason for traffic not being routed.

Answer

kubectl describe service svc

Answer

kubectl logs svc

Answer

kubectl exec -it svc -- /bin/sh

Question 12

A pod in the 'staging' namespace is in a CrashLoopBackOff state. You run 'kubectl logs pod -n staging' and see: 'Error: container has been OOMKilled'. The pod YAML has resources: requests: memory: 256Mi, limits: memory: 256Mi. Which change should you make first?

Accepted Answer

Increase the memory limit to 512Mi.. The pod is in CrashLoopBackOff due to OOMKill, meaning the container exceeded its memory limit and was terminated. Since the current memory limit is 256Mi and the container needs more, increasing the limit to 512Mi directly addresses the out-of-memory condition. This is the correct first step because it provides the container with the additional memory it requires to run without being killed.

Answer

Increase the CPU limit to 1.

Answer

Reduce the memory request to 128Mi.

Answer

Set memory request to 512Mi and memory limit to 256Mi.

Question 13

Which command creates a ConfigMap named 'app-config' with two keys: 'key1=value1' and 'key2=value2'?

Accepted Answer

kubectl create configmap app-config --from-literal key1=value1 --from-literal key2=value2. `kubectl create configmap` with the `--from-literal` flag allows you to specify key-value pairs directly on the command line. Each `--from-literal` flag creates one entry in the ConfigMap, so using two separate flags correctly creates a ConfigMap named 'app-config' with keys 'key1' and 'key2' mapped to 'value1' and 'value2' respectively.

Answer

kubectl create configmap app-config --from-literal=key1=value1,key2=value2

Answer

kubectl create configmap app-config --from-file key1=value1 --from-file key2=value2

Answer

kubectl create configmap app-config --from-env-file=key1=value1 --from-env-file=key2=value2

Question 14

A pod with a liveness probe using 'httpGet' is restarting repeatedly. The probe checks '/healthz' on port 8080. The application is healthy and responds with HTTP 200. What is the most likely cause?

Accepted Answer

The timeoutSeconds value is too low. The liveness probe is restarting the pod despite the application returning HTTP 200 on /healthz. A timeoutSeconds value that is too low can cause the probe to fail if the application takes longer than the timeout to respond, even though it is healthy. Kubernetes will restart the container when the probe fails, leading to repeated restarts.

Answer

The initialDelaySeconds is too high

Answer

The liveness probe is checking the wrong port

Answer

The readiness probe is misconfigured

Question 15

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Accepted Answer

resources:
  requests:
    cpu: 250m
  limits:
    memory: 512Mi. In Kubernetes, CPU requests are specified in millicores (e.g., 250m) and memory limits use binary units like Mi (Mebibytes). The value '250m' equals 0.25 CPU cores, and '512Mi' is 512 Mebibytes (512 * 1024^2 bytes), which is the standard unit for memory limits.

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512M

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512MB

Answer

resources:
  requests:
    cpu: 0.25
  limits:
    memory: 512MB

Question 16

Which of the following best describes the purpose of an init container?

Accepted Answer

Init containers run to completion before the main containers start, and are used for setup tasks. Init containers are specialized containers that run and complete to exit before any pod's main containers start. They are ideal for performing setup tasks such as waiting for a service to be ready, populating configuration files, or running database migrations. This ensures the main application containers start in a fully prepared environment.

Answer

Init containers run in parallel with the main containers to provide auxiliary functionality

Answer

Init containers share the same lifecycle as the main containers

Answer

Init containers are restarted if they exit with a non-zero exit code

Question 17

Which command creates a generic secret named 'db-secret' with key 'password' and value 'p@ss'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=p@ss. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=p@ss` creates a generic secret with the key 'password' and the literal value 'p@ss', which matches the requirement exactly.

Answer

kubectl create secret generic db-secret --from-file=password=p@ss

Answer

kubectl create secret tls db-secret --from-literal=password=p@ss

Answer

kubectl create secret docker-registry db-secret --from-literal=password=p@ss

Question 18

You have a Dockerfile with a multi-stage build. The first stage is named 'builder' and uses 'golang:1.20' to compile a binary. The second stage uses 'alpine:3.18' and should copy the binary from the first stage. Which COPY instruction is correct?

Accepted Answer

COPY --from=builder /app/myapp /usr/local/bin/myapp. In a multi-stage Docker build, the `COPY --from=<name|index>` instruction copies files from a named previous stage. Option D correctly uses the stage name 'builder' to copy the compiled binary from the first stage into the final Alpine image. This is the standard and most readable approach for multi-stage builds.

Answer

ADD --from=builder /app/myapp /usr/local/bin/myapp

Answer

COPY /app/myapp /usr/local/bin/myapp

Answer

COPY --from=0 /app/myapp /usr/local/bin/myapp

Question 19

Which two statements about ConfigMaps and Secrets are correct? (Select TWO.)

Accepted Answer

Secrets store data in base64-encoded form, while ConfigMaps store plaintext. Secrets store data as base64-encoded strings, which is not encryption but a simple encoding that obscures the data. ConfigMaps store data in plaintext (UTF-8) without any encoding. This distinction is fundamental: base64 encoding is reversible and provides no security, while plaintext is human-readable.

Answer

ConfigMaps are immutable and cannot be updated after creation

Answer

ConfigMaps are suitable for storing sensitive data like passwords

Answer

Secrets are encrypted at rest by default in Kubernetes

Question 20

A pod is stuck in 'Pending' state. You run 'kubectl describe pod my-pod' and see the event: '0/3 nodes are available: 3 Insufficient cpu.' Which action should you take?

Accepted Answer

Reduce the CPU request of the pod and reapply the manifest.. The pod is stuck in 'Pending' because the scheduler cannot find a node with enough allocatable CPU to satisfy the pod's CPU request. Reducing the CPU request (the amount guaranteed to the container) makes the pod schedulable on existing nodes. Increasing limits would only worsen the problem, as limits are a cap on usage, not a scheduling constraint.

Answer

Increase the CPU limits on the pod to give it more resources.

Answer

Add another node to the cluster to increase overall CPU capacity.

Answer

Add a nodeSelector to the pod to target a specific node.