CKAD Practice Test 2 — 30 Questions

Question 1

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 2

A developer creates a pod with two containers: a main web server and a sidecar that rotates logs. The sidecar must start before the main container. Which field enforces this startup order?

Accepted Answer

initContainers. `initContainers` run sequentially before the main application containers in a Pod, ensuring the sidecar log-rotation container completes its startup tasks before the web server container starts. This enforces a strict startup order, which is not achievable with regular containers that start concurrently.

Answer

startupProbe

Answer

lifecycle.preStop

Answer

restartPolicy: Always

Question 3

A Pod with an init container and a main container is created. The init container runs a script that takes 10 seconds. The main container's startupProbe has initialDelaySeconds: 5. When does the startupProbe begin?

Accepted Answer

After the init container completes, then plus 5 seconds. The startupProbe does not begin until the Pod's containers are actually running. Init containers must complete successfully before any main containers start. Therefore, the startupProbe's initialDelaySeconds of 5 is counted from the moment the main container starts, which is after the init container finishes its 10-second script. The probe begins 5 seconds after the main container starts, not from Pod creation.

Answer

5 seconds after the pod is created

Answer

10 seconds after the pod is created

Answer

Immediately after the pod is created

Question 4

Which THREE are valid reasons to use a StatefulSet instead of a Deployment?

Accepted Answer

Each pod requires a stable, unique network identity.. StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Answer

The application requires rolling updates.

Answer

The application cannot be scaled down.

Question 5

A developer wants to ensure that a container runs as a non-root user and the filesystem is read-only except for a tmpfs volume. Which fields should be set in the container's securityContext?

Accepted Answer

runAsNonRoot: true and readOnlyRootFilesystem: true. `runAsNonRoot: true` enforces that the container cannot run as the root user (UID 0), and `readOnlyRootFilesystem: true` makes the container's filesystem read-only except for volumes explicitly mounted as writable, such as a tmpfs volume. Together, these fields satisfy the requirement of a non-root container with a read-only filesystem except for a tmpfs mount.

Answer

runAsUser: 1000 and readOnlyRootFilesystem: true

Answer

runAsNonRoot: true and privileged: false

Answer

allowPrivilegeEscalation: false and readOnlyRootFilesystem: true

Question 6

You want to view the logs of a pod named 'web-pod' that has two containers: 'nginx' and 'sidecar'. Which command correctly retrieves the logs from the 'nginx' container?

Accepted Answer

kubectl logs web-pod -c nginx. The correct command uses the proper syntax: `kubectl logs -c `. Option B follows this syntax correctly. Option A places the container flag before the pod name, which is invalid. Option C omits the -c flag, which is required when the pod has multiple containers. Option D uses the long form --container, which is valid but the question expects the short form as seen in B. Therefore, B is the best answer.

Answer

kubectl logs -c nginx web-pod

Answer

kubectl logs web-pod nginx

Answer

kubectl logs web-pod --container nginx

Question 7

Which TWO options are valid ways to tag an image when building with Docker?

Accepted Answer

docker tag myapp:1.0 myrepo/myapp:1.0. The `docker tag` command explicitly creates a new tag referencing an existing image, allowing you to assign a new name and tag (e.g., `myrepo/myapp:1.0`) to an already built image (e.g., `myapp:1.0`). This is a standard way to prepare an image for pushing to a registry without rebuilding.

Answer

docker build --name myapp:1.0 .

Answer

docker commit myapp:1.0 myrepo/myapp:1.0

Answer

docker run -t myapp:1.0 myrepo/myapp:1.0

Question 8

Which THREE capabilities are commonly dropped in a pod's securityContext to adhere to restricted pod security standards?

Accepted Answer

SYS_ADMIN. (SYS_ADMIN) is correct because the restricted pod security standard (PSS) requires dropping all capabilities via `ALL` and then adding back only those needed. However, `SYS_ADMIN` is a highly privileged capability that grants broad system administration access, such as mounting filesystems and performing privileged syscalls, and is explicitly forbidden in restricted profiles. Dropping it is mandatory to comply with restricted PSS.

Answer

ALL

Answer

CHOWN

Question 9

Which THREE are valid fields in a NetworkPolicy spec? (Choose three.)

Accepted Answer

podSelector. `podSelector` is a required field in a NetworkPolicy spec that defines which pods the policy applies to, using standard Kubernetes label selectors. It must be present to target specific pods within a namespace, and an empty `podSelector` selects all pods in the namespace.

Answer

ports

Answer

ipBlock

Question 10

You are using Helm to manage a chart. Which commands are valid to list installed releases? (Choose TWO)

Accepted Answer

helm ls. `helm ls` and `helm list` are both valid commands to list installed releases in Helm. `helm ls` is an alias for `helm list`, and both display all deployed releases in the current namespace by default. These commands are essential for managing Helm-based deployments.

Answer

helm upgrade

Answer

helm status

Answer

helm history

Question 11

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Accepted Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretKeyRef:
      name: my-secret
      key: key. `secretKeyRef` is the standard Kubernetes API field for referencing a specific key from a Secret object and injecting its value as an environment variable. Option E is correct because `envFrom` with `secretRef` allows you to load all key-value pairs from a Secret as environment variables into the pod, which is a valid and common pattern.

Answer

env:
- name: SECRET_KEY
  valueFrom:
    configMapKeyRef:
      name: my-secret
      key: key

Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretEnvRef:
      name: my-secret
      key: key

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 12

Which THREE statements are true about init containers? (Select 3)

Accepted Answer

Init containers must complete successfully before any main container starts. Init containers are specialized containers that run to completion before any main application containers in the pod start. They must exit with a zero status (success) for the pod to proceed to the next init container or to start the main containers. This ensures prerequisite setup tasks are completed before the application runs.

Answer

Init containers support liveness and readiness probes

Answer

Init containers cannot have resource limits

Question 13

Which field in a Deployment's rolling update strategy controls the maximum number of pods that can be created above the desired replicas during a rolling update?

Accepted Answer

maxSurge. In a Deployment's rolling update strategy, `maxSurge` controls the maximum number of pods that can be created above the desired replica count during the update. This allows the system to spin up new pods before terminating old ones, ensuring zero downtime. The value can be an absolute number or a percentage of the desired replicas.

Answer

maxUnavailable

Answer

revisionHistoryLimit

Answer

minReadySeconds

Question 14

You have a Deployment that uses the Recreate strategy. You update the container image. What happens to the existing pods?

Accepted Answer

Existing pods are terminated first, then new pods are created. With the Recreate strategy, all existing pods are killed before new pods are created. This ensures no two versions run simultaneously but causes downtime.

Answer

Existing pods are not affected; you must manually delete them

Answer

Existing pods are gradually terminated while new pods are created

Answer

New pods are created alongside existing pods, then old pods are terminated

Question 15

Which command shows the CPU and memory usage of all pods in the current namespace?

Accepted Answer

kubectl top pod. `kubectl top pod` without a specific pod name retrieves CPU and memory usage metrics for all pods in the current namespace, as the command defaults to listing all pods when no pod name is provided. This relies on the metrics-server collecting resource usage data from the kubelet's cAdvisor endpoint via the Resource Metrics API.

Answer

kubectl top node

Answer

kubectl top --all

Answer

kubectl top pod pod-name

Question 16

A pod is running but not serving traffic. You suspect the readiness probe is failing. Which THREE commands or actions would help you diagnose the readiness probe issue?

Accepted Answer

Examine the container logs for errors during readiness probe checks.. Container logs often contain detailed error messages from the readiness probe itself, such as HTTP 4xx/5xx responses or connection timeouts. By examining the logs, you can directly see why the probe is failing, e.g., the application's health endpoint returning a non-2xx status or the probe timing out.

Answer

Run 'kubectl top pod <pod-name>' to check CPU/memory usage.

Answer

Run 'kubectl get nodes' to see node conditions.

Question 17

Which TWO of the following are valid ways to create a Service named 'web' that targets pods with label 'app: web' on port 80?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a Service named 'web' that selects pods from the Deployment named 'web' (which by default uses the label `app: web` from the Deployment's pod template) and exposes port 80. This command automatically sets the Service's selector to match the Deployment's pod labels and configures the target port to 80.

Answer

kubectl apply -f service.yaml where service.yaml contains a Service with spec.clusterIP: None

Answer

kubectl run web --image=nginx --port=80 --expose

Answer

kubectl create service clusterip web --tcp=80 --selector=app=web

Question 18

Which three security contexts can be set at the pod level (as opposed to container level)? (Select THREE.)

Accepted Answer

fsGroup. B is correct because `fsGroup` is a Pod-level security context field that applies a supplemental group ID to all containers in the Pod, ensuring that volumes mounted with that group ownership are accessible. It is set under `spec.securityContext.fsGroup`, not at the container level, making it a Pod-scoped setting.

Answer

readOnlyRootFilesystem

Answer

capabilities

Question 19

Which THREE of the following are valid fields in a PodSecurityContext that affect container security? (Select 3)

Accepted Answer

runAsUser. (runAsUser) is correct because it is a valid field in a PodSecurityContext that specifies the user ID (UID) under which all containers in the pod run. This field directly affects container security by controlling privilege levels and access to host resources, overriding the container's default user.

Answer

capabilities

Answer

privileged

Question 20

A PodSecurityPolicy (PSP) has been replaced by Pod Security Admission. Which of the following commands applies a baseline pod security standard to the namespace 'dev'?

Accepted Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=baseline. Pod Security Admission uses labels on namespaces to enforce pod security standards. The label `pod-security.kubernetes.io/enforce=baseline` applies the baseline standard, which prevents known privilege escalations while allowing the default minimal pod configuration. This replaces the deprecated PodSecurityPolicy (PSP) with a built-in admission controller.

Answer

kubectl label ns dev pod-security.kubernetes.io/warn=baseline

Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=privileged

Answer

kubectl label ns dev pod-security.kubernetes.io/audit=baseline