CKAD Practice Test 3 — 10 Questions

Question 1

You run the following command: 'kubectl run nginx --image=nginx --restart=Never'. What Kubernetes resource is created?

Accepted Answer

Pod. The `kubectl run nginx --image=nginx --restart=Never` command creates a Pod directly, because the `--restart=Never` flag sets the restart policy to Never, which instructs Kubernetes to run the container as a standalone Pod rather than wrapping it in a higher-level controller like a Deployment or Job. The `kubectl run` command, when used without a controller flag, defaults to creating a Pod when `--restart=Never` is specified, as per the Kubernetes API behavior.

Answer

CronJob

Answer

Deployment

Answer

Job

Question 2

In a Dockerfile, what is the difference between CMD and ENTRYPOINT?

Accepted Answer

ENTRYPOINT defines the executable and CMD provides default arguments. C is correct because in a Dockerfile, ENTRYPOINT specifies the executable that will always run when the container starts, while CMD provides default arguments that can be overridden. When both are defined, CMD arguments are appended to the ENTRYPOINT command, allowing flexible default behavior that users can modify at runtime via the command line.

Answer

CMD always runs, ENTRYPOINT can be overridden

Answer

There is no difference; they are interchangeable

Answer

CMD is used for shell form, ENTRYPOINT for exec form

Question 3

A pod named 'webapp' is stuck in 'Pending' state. 'kubectl describe pod webapp' shows '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds available node memory. The error message '0/1 nodes are available: 1 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on the node. The scheduler cannot place the pod because no node has enough unallocated memory to satisfy the pod's memory request. This is a scheduling failure, not a runtime issue.

Answer

The node has insufficient CPU

Answer

The container was killed due to out-of-memory

Answer

The container image does not exist

Question 4

You have a Deployment named 'web-app' with 5 replicas. You run 'kubectl set image deployment/web-app app=nginx:1.21'. What is the effect of this command?

Accepted Answer

It updates the image of the container named 'app' to nginx:1.21, triggering a rolling update.. The `kubectl set image` command updates the container image in the Deployment's pod template. This triggers a rolling update, where the Deployment's ReplicaSet creates new pods with the new image and gradually terminates old pods, ensuring zero downtime. The container name 'app' matches the container in the pod spec, so the image is updated to nginx:1.21.

Answer

It scales the Deployment to 0 replicas and then scales back up.

Answer

It immediately terminates all running pods and creates new ones with the new image.

Answer

It creates a new Deployment with the updated image.

Question 5

What is the purpose of a readiness probe?

Accepted Answer

To indicate whether the container is ready to serve traffic. A readiness probe determines whether a container is ready to accept traffic. If the probe fails, the Pod's IP address is removed from the Endpoints of the associated Service, preventing traffic from being routed to an unready container. This is distinct from liveness probes, which restart containers, and startup probes, which indicate successful initialization.

Answer

To restart the container if it becomes unresponsive

Answer

To indicate that the container has started successfully

Answer

To measure the resource usage of the container

Question 6

Which command scales a Deployment named 'web' to 5 replicas?

Accepted Answer

kubectl scale deployment web --replicas=5. The correct command to scale a Deployment to a specific number of replicas is `kubectl scale deployment web --replicas=5`. This command directly modifies the `spec.replicas` field of the Deployment object, instructing the Kubernetes controller manager to adjust the number of running Pods to match the desired count.

Answer

kubectl set replicas deployment web 5

Answer

kubectl resize deployment web --replicas=5

Answer

kubectl autoscale deployment web --replicas=5

Question 7

You have a Kustomize overlay that sets 'replicas: 5' in a patch, but the base Deployment has 'replicas: 3'. What is the final number of replicas after applying 'kubectl apply -k overlay/'?

Accepted Answer

5. In Kustomize, overlays are applied on top of the base, and patches override the base values. Since the overlay explicitly sets 'replicas: 5' via a patch, it replaces the base value of 3. The final Deployment will have 5 replicas, making D correct.

Answer

3

Answer

8

Answer

It depends on the strategy

Question 8

You have a Deployment with replicas: 5 and update strategy type: RollingUpdate with maxSurge: 25% and maxUnavailable: 25%. During a rolling update, what is the maximum number of pods that can be unavailable at any given time?

Accepted Answer

1. With maxUnavailable: 25% on a Deployment of 5 replicas, the maximum number of unavailable pods is 25% of 5 = 1.25, and Kubernetes rounds down for maxUnavailable, resulting in 1. Therefore, at most 1 pod can be unavailable at any given time during the rolling update.

Answer

2

Answer

5

Answer

0

Question 9

You need to create a Pod that runs with a specific non-root user (UID 1000), prevents privilege escalation, and mounts the container's filesystem as read-only. Which securityContext field is NOT required to achieve these requirements?

Accepted Answer

runAsGroup: 1000. (runAsGroup: 1000) is not required because the requirement only specifies a non-root user (UID 1000) and does not mandate a specific group ID. The runAsGroup field sets the primary group for the container's processes, but it is optional; without it, the container will use the default group associated with the user or the container's default group. The other options are necessary: runAsUser: 1000 sets the user, readOnlyRootFilesystem: true makes the filesystem read-only, and allowPrivilegeEscalation: false prevents privilege escalation.

Answer

runAsUser: 1000

Answer

readOnlyRootFilesystem: true

Answer

allowPrivilegeEscalation: false

Question 10

A pod's securityContext has 'allowPrivilegeEscalation: false' and 'capabilities: { drop: ["ALL"] }'. Which statement is true?

Accepted Answer

The container runs with no extra capabilities and cannot gain privileges.. Setting 'allowPrivilegeEscalation: false' prevents processes from gaining more privileges than their parent (e.g., via setuid binaries or kernel exploits), and dropping all capabilities with 'capabilities: { drop: ["ALL"] }' removes every Linux capability from the container's bounding set. Together, these ensure the container runs with no extra capabilities and cannot escalate privileges, even if running as root.

Answer

The container can still gain capabilities via setuid binaries.

Answer

The container runs as root with full privileges.

Answer

The container runs with all Linux capabilities.