CKAD Practice Test 5 — 25 Questions

Question 1

You want to perform a blue-green deployment using Deployments and Services. You have two Deployments: 'app-blue' (current) and 'app-green' (new). The Service 'app-service' currently selects pods with label 'version: blue'. What kubectl command should you run to switch traffic to the green deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kubectl patch service app-service -p '{"spec":{"selector":{"version":"green"}}}'. To switch traffic, update the Service's selector to point to the green deployment's pods, which have label 'version: green'. kubectl patch is a direct way to update the selector.

Answer

kubectl delete service app-service --ignore-not-found && kubectl create service app-service --selector version=green

Answer

kubectl set selector service/app-service version=green

Answer

kubectl apply -f service.yaml where service.yaml has the new selector

Question 2

You need to create a ConfigMap named 'app-config' with key 'APP_COLOR' and value 'blue'. Which command creates this ConfigMap?

Accepted Answer

kubectl create configmap app-config --from-literal=APP_COLOR=blue. `kubectl create configmap app-config --from-literal=APP_COLOR=blue` uses the `--from-literal` flag, which directly creates a ConfigMap entry from a key-value pair specified in the command line. The syntax `key=value` is required for literal data, and this command correctly maps the key 'APP_COLOR' to the value 'blue'.

Answer

kubectl create configmap app-config --from-env-file=APP_COLOR=blue

Answer

kubectl create configmap app-config --from-literal=APP_COLOR:blue

Answer

kubectl create configmap app-config --from-file=APP_COLOR=blue

Question 3

A ClusterIP Service named 'db' in namespace 'data' is not reachable from a pod in namespace 'app'. Which DNS name should the pod use to resolve the service?

Accepted Answer

db.data.svc.cluster.local. A pod in namespace 'app' must use the fully qualified DNS name 'db.data.svc.cluster.local' to resolve a ClusterIP Service named 'db' in namespace 'data'. Kubernetes DNS appends the service's namespace before 'svc.cluster.local', so the format is ..svc.cluster.local. This allows cross-namespace service discovery.

Answer

data.db.svc.cluster.local

Answer

db.app.svc.cluster.local

Answer

db.svc.cluster.local

Question 4

You need to set environment variables in a pod from a ConfigMap 'app-config' that has keys 'APP_ENV' and 'APP_DEBUG'. Which approach exposes all keys as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with `configMapRef` is the Kubernetes-native way to expose all keys from a ConfigMap as environment variables in a pod. This injects each key-value pair from the ConfigMap 'app-config' as an environment variable, matching the requirement to expose all keys without manual enumeration.

Answer

envFrom:
  - secretRef:
      name: app-config

Answer

env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_ENV
  - name: APP_DEBUG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_DEBUG

Answer

volumeMounts:
  - name: config
    mountPath: /etc/config
volumes:
  - name: config
    configMap:
      name: app-config

Question 5

Which TWO of the following are valid ways to inject configuration data into a Kubernetes Pod?

Accepted Answer

Using a ConfigMap to set environment variables in the Pod spec.. A ConfigMap is specifically designed to inject configuration data into Pods, and one of the primary methods is by setting environment variables in the Pod spec using `envFrom` or `valueFrom: configMapKeyRef`. This allows decoupling configuration from container images, enabling environment-specific settings without rebuilding images.

Answer

Mounting a ServiceAccount token as a volume.

Answer

Using a PersistentVolumeClaim to store configuration files.

Answer

Referencing a NetworkPolicy in the Pod spec.

Question 6

A developer wants to test a service locally using kubectl. Which command forwards local port 8080 to the service's port 80?

Accepted Answer

kubectl port-forward service/myservice 8080:80. `kubectl port-forward` requires the resource type (e.g., `service/`) to be specified when targeting a Service. The syntax `kubectl port-forward service/myservice 8080:80` forwards local port 8080 to the Service's port 80, allowing local traffic to reach the Service's cluster IP.

Answer

kubectl port-forward pod/myservice 8080:80

Answer

kubectl port-forward myservice 8080:80

Answer

kubectl port-forward service/myservice 80:8080

Question 7

Which TWO instructions are commonly used to add files to a Docker image during build? (Select 2)

Accepted Answer

COPY. The COPY instruction is used to copy files and directories from the build context into the Docker image filesystem. It is the preferred method for adding local files because it is explicit and does not perform any automatic extraction or URL fetching, making builds more predictable and secure.

Answer

ENTRYPOINT

Answer

RUN

Answer

CMD

Question 8

You want to undo a rollout to the previous revision. Which command should you use?

Accepted Answer

kubectl rollout undo deployment/myapp. `kubectl rollout undo deployment/myapp` reverts the deployment to the previous revision by default, using the rollout history stored in the deployment's ReplicaSet annotations. This command directly triggers a new rollout that matches the pod template of the prior revision, effectively undoing the last change.

Answer

kubectl delete deployment/myapp --cascade=orphan

Answer

kubectl set image deployment/myapp app=myapp:previous

Answer

kubectl rollout history deployment/myapp --revision=2

Question 9

You want to view the resource usage of all pods running on a node named 'node01'. Which command should you use?

Accepted Answer

kubectl top pods --all-namespaces --field-selector spec.nodeName=node01. `kubectl top pods` retrieves real-time CPU and memory usage metrics for pods, and the `--field-selector spec.nodeName=node01` filter restricts the output to only pods scheduled on the specified node. This directly answers the requirement to view resource usage of all pods on 'node01'.

Answer

kubectl top nodes node01

Answer

kubectl get pods -o wide --all-namespaces --field-selector spec.nodeName=node01

Answer

kubectl describe node node01 | grep -A 10 'Non-terminated Pods'

Question 10

In a Deployment YAML, which field defines the number of pods to run?

Accepted Answer

spec.replicas. In a Kubernetes Deployment YAML, the `spec.replicas` field directly specifies the desired number of Pod replicas that the Deployment controller should maintain. This field is part of the Deployment's specification and tells the controller to create or scale Pods to match the given count.

Answer

spec.strategy.replicas

Answer

spec.template.replicas

Answer

metadata.replicas

Question 11

Which command shows resource usage (CPU/memory) of pods in the default namespace?

Accepted Answer

kubectl top pod. `kubectl top pod` is the Kubernetes command that displays real-time CPU and memory usage metrics for pods, leveraging the metrics server to collect resource utilization data. This command is essential for monitoring pod performance and is part of the Application Observability and Maintenance domain.

Answer

kubectl get pods -o wide

Answer

kubectl logs pod

Answer

kubectl describe pod

Question 12

Match each volume type to its use case.

Accepted Answer

emptyDir: Provides temporary storage that is created empty and persists for the lifetime of the pod.. The correct matches are: emptyDir - temporary storage, hostPath - host node directory, PVC - persistent storage, ConfigMap - configuration data. Common confusions involve mixing hostPath and PVC, or emptyDir with hostPath.

Answer

emptyDir: Mounts a file or directory from the host node's filesystem.

Answer

hostPath: Requests persistent storage that survives pod restarts.

Question 13

A deployment 'api-deploy' has resource limits set but is frequently being OOMKilled. The team suspects the memory limit is too low. Which approach should be taken to confirm this without causing downtime?

Accepted Answer

Increase the memory limit in the deployment spec and apply the change; the rollout will automatically restart pods.. Updating the deployment spec triggers a rolling update, which replaces pods with new ones having the increased memory limit without downtime. This approach leverages Kubernetes' deployment controller to manage the rollout automatically, ensuring service continuity while adjusting resource limits.

Answer

Create a new pod with a higher memory limit and delete the old pods manually.

Answer

Set the memory limit to unlimited by removing the limit section and restart the pod.

Answer

Use 'kubectl set resources' to increase the limit on the running pod dynamically.

Question 14

Which of the following is a valid Pod Security Admission standard?

Accepted Answer

Restricted. The Pod Security Admission (PSA) standard defines three levels: Privileged, Baseline, and Restricted. Option C is correct because 'Restricted' is one of the three valid standards, designed to enforce the most restrictive pod security policies.

Answer

Privileged, Default

Answer

Default

Answer

Secure

Question 15

Which of the following is the correct way to scale a Deployment named 'api' to 5 replicas using kubectl?

Accepted Answer

kubectl scale deployment api --replicas=5. `kubectl scale deployment api --replicas=5` is the standard kubectl command to change the replica count of a Deployment. The `scale` subcommand directly modifies the `.spec.replicas` field in the Deployment's manifest, instructing the ReplicaSet controller to adjust the number of Pods to match the desired count.

Answer

kubectl scale deploy api 5

Answer

kubectl update deployment api --replicas=5

Answer

kubectl set replicas deployment api 5

Question 16

Match each Kubernetes concept to its definition.

Accepted Answer

Pod: Smallest deployable unit in Kubernetes that can contain one or more containers.. Correct matches are Pod with smallest deployable unit, Service with logical set and access policy, Deployment with declarative updates, and Ingress with external HTTP access. Common confusions include swapping Pod and Service definitions.

Answer

Pod: An abstraction that defines a logical set of Pods and a policy to access them.

Answer

Service: Smallest deployable unit in Kubernetes that can contain one or more containers.

Question 17

A Deployment named 'web-app' has 4 replicas. You need to perform a rolling update with a maxSurge of 50% and maxUnavailable of 25%. Which YAML snippet configures this correctly?

Accepted Answer

strategy:
  rollingUpdate:
    maxSurge: 50%
    maxUnavailable: 25%. Ly uses the fields maxSurge and maxUnavailable with the required percentages (50% and 25%). Option A uses incorrect field names (surge, unavailable). Option C uses absolute numbers instead of percentages. Option D swaps the values (maxSurge: 25%, maxUnavailable: 50%). Therefore, option B is the correct configuration for the rolling update.

Answer

strategy:
  rollingUpdate:
    surge: 50%
    unavailable: 25%

Answer

strategy:
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 1

Answer

strategy:
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 50%

Question 18

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build` command requires both the `-t` flag to specify the image tag (name:version) and the build context path (`.` for the current directory). The syntax `docker build -t myapp:v1 .` correctly tags the image as 'myapp:v1' and uses the current directory as the build context, which includes the Dockerfile and any referenced files.

Answer

docker build .

Answer

docker build -t myapp:v1

Answer

docker push myapp:v1

Question 19

Which annotation is used to specify the IngressClass for an Ingress resource in Kubernetes v1.18+?

Accepted Answer

kubernetes.io/ingress.class. In Kubernetes v1.18+, the `kubernetes.io/ingress.class` annotation is the standard way to specify which Ingress controller should process an Ingress resource. This annotation tells the cluster which IngressClass (e.g., 'nginx', 'traefik') to use, enabling multiple controllers to coexist without conflict. It was the primary method before the `spec.ingressClassName` field was introduced in v1.18 and remains widely used for backward compatibility.

Answer

nginx.ingress.kubernetes.io/rewrite-target

Answer

ingress.kubernetes.io/class

Answer

kubernetes.io/ingress-controller

Question 20

What is the purpose of the 'spec.externalName' field in a Service of type ExternalName?

Accepted Answer

To return a CNAME record pointing to an external domain. The 'spec.externalName' field in a Service of type ExternalName is used to map the service to a DNS name (e.g., 'api.example.com') rather than to a set of pods. When a client resolves the service's DNS name, Kubernetes returns a CNAME record pointing to the external domain, effectively aliasing the service to an external endpoint. This allows internal applications to access external services using a local Kubernetes service name without needing to manage endpoints manually.

Answer

To expose the service on a static port on each node

Answer

To expose the service using an external load balancer

Answer

To assign a static cluster IP