CKAD Practice Test 27 — 15 Questions

Question 1

A pod is running with a SecurityContext that sets 'runAsUser: 1000' and 'runAsGroup: 3000'. The container process is running as user 1000. However, the container needs to access a file on a mounted volume that is owned by user 1000 and group 2000. Which SecurityContext setting should be added to ensure the container can read the file?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set fsGroup: 2000 in the pod-level securityContext. fsGroup is a pod-level SecurityContext setting that causes Kubernetes to recursively change the group ownership of the volume's files to the specified GID and adds the container's supplemental group list. Setting fsGroup: 2000 makes the mounted volume files group-owned by GID 2000, and the container process running as user 1000 inherits 2000 as a supplemental group, granting read access. This is the canonical fix when a volume's group ownership does not match the container's primary runAsGroup.

Answer

Set readOnlyRootFilesystem: true

Answer

Set runAsGroup: 2000

Answer

Add capability: CAP_DAC_READ_SEARCH

Question 2

When performing a rolling update of a Deployment with 'maxSurge: 1' and 'maxUnavailable: 0', how many additional pods can be created above the desired replicas during the update?

Accepted Answer

1. maxSurge defines the maximum number of pods that can be created above the desired replicas. With maxSurge=1, exactly one extra pod can exist during the update.

Answer

0

Answer

Unlimited

Answer

100%

Question 3

You need to perform a rolling update of a Deployment named 'web-app' with a new image version. Which command should you use?

Accepted Answer

kubectl set image deployment/web-app app=nginx:1.21. The 'kubectl set image' command is used to update the container image of a Deployment, triggering a rolling update. In this case, 'kubectl set image deployment/web-app app=nginx:1.21' updates the container named 'app' to the new image version. Options A, B, and D are incorrect: A requires editing the manifest interactively, B replaces the entire resource definition, and D restarts pods without changing the image.

Answer

kubectl edit deployment web-app

Answer

kubectl replace -f web-app.yaml

Answer

kubectl rollout restart deployment/web-app

Question 4

What is the difference between 'kubectl apply' and 'kubectl create'?

Accepted Answer

'kubectl apply' can be used to create and update resources; 'kubectl create' only creates new resources. 'kubectl apply' is declarative: it creates or updates a resource to match the provided configuration. 'kubectl create' is imperative: it creates a new resource and will fail if the resource already exists.

Answer

'kubectl apply' only works with Deployments, while 'kubectl create' works with all resources

Answer

'kubectl apply' is for creating resources, 'kubectl create' is for updating

Answer

There is no difference

Question 5

You have a Deployment named 'frontend' with 3 replicas. You run 'kubectl rollout history deployment/frontend' and see revision 1 and revision 2. You want to rollback to revision 1. What command should you use?

Accepted Answer

kubectl rollout undo deployment/frontend --to-revision=1. The 'kubectl rollout undo' command with the --to-revision flag rolls back to a specific revision. Option A is correct.

Answer

kubectl set image deployment/frontend app=nginx:1.19

Answer

kubectl rollout undo deployment/frontend revision=1

Answer

kubectl rollout history deployment/frontend --revision=1

Question 6

A pod is running but not serving traffic. You suspect the readiness probe is failing. Which THREE commands or actions would help you diagnose the readiness probe issue?

Accepted Answer

Examine the container logs for errors during readiness probe checks.. Container logs often contain detailed error messages from the readiness probe itself, such as HTTP 4xx/5xx responses or connection timeouts. By examining the logs, you can directly see why the probe is failing, e.g., the application's health endpoint returning a non-2xx status or the probe timing out.

Answer

Run 'kubectl top pod <pod-name>' to check CPU/memory usage.

Answer

Run 'kubectl get nodes' to see node conditions.

Question 7

You have deployed an application using Helm. You want to see the history of revisions for the release 'frontend' in the 'web' namespace. Which command should you use?

Accepted Answer

helm history frontend --namespace web. The command 'helm history frontend --namespace web' lists all revisions for the release 'frontend' in the 'web' namespace.

Answer

helm status frontend --namespace web

Answer

helm list frontend --namespace web

Answer

helm get manifest frontend --namespace web

Question 8

You run 'kubectl rollout undo deployment/app'. What happens?

Accepted Answer

It rolls back the Deployment to the previous revision. The 'kubectl rollout undo' command rolls back a Deployment to the previous revision. By default, it reverts to the immediate prior revision (revision 1 less than current).

Answer

It pauses the rollout

Answer

It shows the rollout history

Answer

It deletes the Deployment

Question 9

A Deployment named 'web-app' has 4 replicas. You need to perform a rolling update with a maxSurge of 50% and maxUnavailable of 25%. Which YAML snippet configures this correctly?

Accepted Answer

strategy:
  rollingUpdate:
    maxSurge: 50%
    maxUnavailable: 25%. Ly uses the fields maxSurge and maxUnavailable with the required percentages (50% and 25%). Option A uses incorrect field names (surge, unavailable). Option C uses absolute numbers instead of percentages. Option D swaps the values (maxSurge: 25%, maxUnavailable: 50%). Therefore, option B is the correct configuration for the rolling update.

Answer

strategy:
  rollingUpdate:
    surge: 50%
    unavailable: 25%

Answer

strategy:
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 1

Answer

strategy:
  rollingUpdate:
    maxSurge: 25%
    maxUnavailable: 50%

Question 10

Which THREE of the following are correct about Kustomize?

Accepted Answer

A 'kustomization.yaml' file is required in each Kustomize directory.. Options A, B, and E are correct. Option A: A kustomization.yaml file is required in each Kustomize directory to define resources, bases, and patches. Option B: The 'patches' field in kustomization.yaml allows overriding fields in resources via strategic merge patches or JSON patches. Option E: A base can be a local directory referenced via path or a remote URL (e.g., git repository). Option C is incorrect because 'kustomize build' outputs the rendered YAML to stdout; there is no 'kustomize apply' command. Option D is incorrect because Kustomize does not use templates; it uses overlays and patching without templating.

Answer

The command 'kustomize apply' deploys resources to the cluster.

Answer

Kustomize uses Helm-style templates to generate resources.

Question 11

You have a Deployment that is currently paused. You want to resume the rollout and then check the status of the rollout. Which set of commands should you run?

Accepted Answer

kubectl rollout resume deployment/myapp && kubectl rollout status deployment/myapp. First, resume the rollout with 'kubectl rollout resume deployment/', then check status with 'kubectl rollout status deployment/'. Option D is correct. Option B uses 'kubectl rollout history' which shows revision history, not current status.

Answer

kubectl rollout pause deployment/myapp && kubectl rollout status deployment/myapp

Answer

kubectl rollout resume deployment/myapp && kubectl rollout history deployment/myapp

Answer

kubectl rollout undo deployment/myapp && kubectl rollout status deployment/myapp

Question 12

Which TWO of the following are correct about the difference between 'kubectl apply' and 'kubectl create'?

Accepted Answer

'kubectl apply' can be used to update existing resources, whereas 'kubectl create' will fail if the resource already exists.. 'kubectl apply' can update existing resources, while 'kubectl create' will fail if the resource already exists. Option B is correct: 'kubectl apply' is declarative (manages desired state), whereas 'kubectl create' is imperative (directly creates). Option C is false: 'kubectl apply' can both create and update resources. Option D is false: 'kubectl apply' does not delete resources removed from the file; it only manages the resources in the file. Option E is false: 'kubectl create' can create resources from stdin, not just YAML files.

Answer

'kubectl apply' can only be used to create resources, not update them.

Answer

'kubectl apply' will delete resources if they are removed from the file.

Answer

'kubectl create' can only create resources from YAML files, not from stdin.

Question 13

You have created a HorizontalPodAutoscaler (HPA) for a Deployment. The HPA is configured with targetCPUUtilizationPercentage: 50. The current CPU utilization is 80%. What will the HPA do?

Accepted Answer

It will increase the number of replicas. The HPA will increase the number of replicas to bring average CPU utilization down to the target.

Answer

It will restart the pods

Answer

It will do nothing because HPA only scales based on memory

Answer

It will decrease the number of replicas

Question 14

Your Deployment is stuck during rollout, and you want to investigate. Which command pauses the rollout and allows you to check the current state?

Accepted Answer

kubectl rollout pause deployment my-deployment. The correct command to pause a deployment rollout is `kubectl rollout pause deployment my-deployment`. While paused, you can inspect the current state with `kubectl rollout status` or other diagnostic commands. Option A (`kubectl rollout resume`) resumes a paused rollout, not pauses it. Option B (`kubectl rollout status`) shows the rollout state but does not pause it. Option D (`kubectl rollout stop`) is not a valid kubectl command; the correct command to stop a rollout is `kubectl rollout undo`. Therefore, only option C pauses the rollout as required.

Answer

kubectl rollout resume deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl rollout stop deployment my-deployment

Question 15

You have a Helm release named 'myapp' that was installed. You need to see all the releases in the current namespace. Which command do you run?

Accepted Answer

helm list. helm list lists all releases in the current namespace. Option A is correct because it displays a list of all Helm releases. Option B, helm repo list, lists repositories, not releases. Option C, helm status myapp, shows status of a single release. Option D, helm get all myapp, retrieves information about a specific release.

Answer

helm repo list

Answer

helm status myapp

Answer

helm get all myapp