CKAD Practice Test 3 — 30 Questions

Question 1

Which of the following is true about the CMD instruction in a Dockerfile?

Accepted Answer

CMD provides a default command that can be overridden at runtime. The CMD instruction in a Dockerfile provides default arguments for the container's main process, which can be overridden when the container is started with a command-line argument (e.g., `docker run `). It is not executed during the image build (that's RUN), it does not expose ports (that's EXPOSE), and it can be used with ENTRYPOINT to supply default parameters that are overridable.

Answer

CMD is always executed during the image build process

Answer

CMD is used to expose ports

Answer

CMD cannot be used in conjunction with ENTRYPOINT

Question 2

Which THREE of the following are valid fields in a LimitRange resource to enforce resource constraints at the container level? (Choose three.)

Accepted Answer

min. The three valid fields in a LimitRange resource that enforce resource constraints at the container level are `min`, `defaultRequest`, and `maxLimitRequestRatio`. `min` sets the minimum resource request or limit per container. `defaultRequest` sets the default resource request if not specified, ensuring a minimum request is applied. `maxLimitRequestRatio` enforces a maximum ratio between limit and request, constraining the relationship. While `default` is a valid field, it sets a default limit rather than enforcing a constraint directly, so it is not among the three asked.

Answer

default

Question 3

A Service of type NodePort is created with 'spec.ports[0].nodePort: 30080'. The cluster nodes have IPs 10.0.0.1, 10.0.0.2. Which command can be used to test connectivity to the Service from outside the cluster?

Accepted Answer

curl 10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every cluster node's IP address. From outside the cluster, you can reach the service by targeting any node's IP and the nodePort, so `curl 10.0.0.1:30080` will connect to the service via node 10.0.0.1.

Answer

curl 10.0.0.1:80 --header 'Host: service.namespace.svc.cluster.local'

Answer

curl 10.0.0.1:80

Answer

curl 10.96.0.1:30080

Question 4

You have a Deployment named 'web' with label 'app: web'. You want to create a Service that exposes the Deployment on port 80 internally within the cluster. Which kubectl command achieves this?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a ClusterIP Service that selects Pods based on the Deployment's label selector (app: web) and exposes port 80 internally within the cluster. This command directly maps the Deployment's Pods to a Service without requiring manual specification of the target port or protocol, defaulting to TCP.

Answer

kubectl create service clusterip web --tcp=80

Answer

kubectl create deployment web --image=nginx --expose --port=80

Answer

kubectl expose pod web --port=80

Question 5

A company runs a Kubernetes cluster with multiple namespaces. The operations team wants to ensure that any application crash or container restart is automatically detected and the team is notified. Which built-in Kubernetes resource should they configure to achieve this?

Accepted Answer

Event. Kubernetes Events are the built-in resource that records state changes, including pod crashes and container restarts. By configuring a monitoring tool or custom controller to watch Events (e.g., via the Kubernetes API or `kubectl get events`), the operations team can automatically detect application failures and trigger notifications. Events provide the necessary metadata (reason, message, timestamp) to identify crash loops or restart backoffs.

Answer

ConfigMap

Answer

Secret

Answer

CronJob

Question 6

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 7

Which TWO statements about labels and selectors are correct? (Select TWO.)

Accepted Answer

Services use selectors to determine which pods receive traffic.. A is correct because Services use label selectors in their spec.selector field to determine which Pods receive traffic. B is correct because labels are key-value pairs that can be attached to Kubernetes objects for identification and grouping. C is incorrect because selectors return a set of objects matching the given labels, not a single object. D is false because selectors are not required to be defined in the resource definition itself; they are used in controllers and Services to select objects. E is false because labels can be added or modified after creation.

Answer

Selectors are used to identify a single object based on its labels.

Answer

Selectors must be defined in the resource definition itself.

Answer

Labels cannot be added after an object is created.

Question 8

You want to collect logs from a pod that has multiple containers. Which TWO approaches allow you to view logs from a specific container?

Accepted Answer

kubectl logs pod-name -c container-name. To view logs from a specific container in a multi-container pod, use `kubectl logs` with the container name. Option A uses the shorthand `-c` flag, and Option B uses the long form `--container`; both are equivalent and valid. Option D is a duplicate of Option B, so it is not a distinct approach. Option C (`--all-containers`) streams logs from all containers, not a specific one. Option E (no flags) returns logs from all containers by default, which is not what the question asks.

Answer

kubectl logs pod-name --all-containers

Answer

kubectl logs pod-name --container container-name

Answer

kubectl logs pod-name

Question 9

You need to schedule a task that runs every day at 2:00 AM. The task should be allowed to run even if a previous instance is still running. Which concurrencyPolicy should you set in the CronJob spec?

Accepted Answer

Allow. Setting `concurrencyPolicy: Allow` in a CronJob spec permits a new job instance to start even if a previous instance is still running. This is the default behavior when the field is omitted, and it directly satisfies the requirement that the task must run at 2:00 AM regardless of any overlapping executions.

Answer

Replace

Answer

Forbid

Answer

Ignore

Question 10

A Job must run 10 times in total, with up to 3 pods running simultaneously. Which fields should be set?

Accepted Answer

completions: 10, parallelism: 3. In a Kubernetes Job, `completions: 10` specifies the total number of successful Pod completions required, and `parallelism: 3` limits the number of Pods that can run concurrently. This ensures the Job runs exactly 10 times with up to 3 Pods in parallel, which matches the requirement.

Answer

completions: 10, successfulJobsHistoryLimit: 3

Answer

completions: 10, parallelism: 10

Answer

completions: 3, parallelism: 10

Question 11

You are performing a canary deployment using two Deployments: 'app-stable' (replicas: 9) and 'app-canary' (replicas: 1), both with label 'app: myapp'. A Service selects pods with 'app: myapp' and 'version: stable'. How can you route traffic to the canary?

Accepted Answer

Add label 'version: stable' to the canary Deployment's pod template, so both Deployments have the same label, and keep the Service selector as is.. Adding the label 'version: stable' to the canary Deployment's pod template makes its pods match the Service's selector ('app: myapp' and 'version: stable'). This allows the Service to include both stable and canary pods, distributing traffic according to the replica ratio (9:1). The canary image can be different from stable, but the label ensures the Service routes traffic to both sets of pods.

Answer

Update the canary Deployment's image to a different version.

Answer

Change the Service's selector to 'version: canary'.

Answer

Add label 'version: canary' to the canary Deployment's template and update the Service selector to 'version: stable || version: canary'.

Question 12

You have a pod with two containers: one runs a web server, and the other is a sidecar that logs the web server's output to a central logging system. Which pattern does this represent?

Accepted Answer

Sidecar pattern. The sidecar pattern involves deploying a helper container alongside the main application container within the same pod. In this scenario, the sidecar container consumes the web server's logs (e.g., by tailing a shared volume or reading stdout/stderr) and forwards them to a central logging system, such as Elasticsearch or Fluentd. This pattern is a core Kubernetes design principle for extending or enhancing the main container without modifying its code.

Answer

Decorator pattern

Answer

Ambassador pattern

Answer

Adapter pattern

Question 13

A developer creates a pod with two containers: a main web server and a sidecar that rotates logs. The sidecar must start before the main container. Which field enforces this startup order?

Accepted Answer

initContainers. `initContainers` run sequentially before the main application containers in a Pod, ensuring the sidecar log-rotation container completes its startup tasks before the web server container starts. This enforces a strict startup order, which is not achievable with regular containers that start concurrently.

Answer

startupProbe

Answer

lifecycle.preStop

Answer

restartPolicy: Always

Question 14

A Pod with an init container and a main container is created. The init container runs a script that takes 10 seconds. The main container's startupProbe has initialDelaySeconds: 5. When does the startupProbe begin?

Accepted Answer

After the init container completes, then plus 5 seconds. The startupProbe does not begin until the Pod's containers are actually running. Init containers must complete successfully before any main containers start. Therefore, the startupProbe's initialDelaySeconds of 5 is counted from the moment the main container starts, which is after the init container finishes its 10-second script. The probe begins 5 seconds after the main container starts, not from Pod creation.

Answer

5 seconds after the pod is created

Answer

10 seconds after the pod is created

Answer

Immediately after the pod is created

Question 15

Which THREE are valid reasons to use a StatefulSet instead of a Deployment?

Accepted Answer

Each pod requires a stable, unique network identity.. StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Answer

The application requires rolling updates.

Answer

The application cannot be scaled down.

Question 16

A developer wants to ensure that a container runs as a non-root user and the filesystem is read-only except for a tmpfs volume. Which fields should be set in the container's securityContext?

Accepted Answer

runAsNonRoot: true and readOnlyRootFilesystem: true. `runAsNonRoot: true` enforces that the container cannot run as the root user (UID 0), and `readOnlyRootFilesystem: true` makes the container's filesystem read-only except for volumes explicitly mounted as writable, such as a tmpfs volume. Together, these fields satisfy the requirement of a non-root container with a read-only filesystem except for a tmpfs mount.

Answer

runAsUser: 1000 and readOnlyRootFilesystem: true

Answer

runAsNonRoot: true and privileged: false

Answer

allowPrivilegeEscalation: false and readOnlyRootFilesystem: true

Question 17

A team is deploying a microservice that requires initialization of a database schema before the main application starts. The init container must run a script that writes to a shared volume. Which configuration correctly ensures the init container completes before the main container runs?

Accepted Answer

Define an init container with the script and mount the shared volume to both init and main containers.. An init container runs to completion before any main container in the Pod starts, ensuring the database schema script finishes. By mounting the shared volume to both the init container and the main container, the script's output (e.g., schema files) is available to the main application when it launches.

Answer

Run the script as a sidecar container that shares the volume with the main container.

Answer

Use a postStart lifecycle hook on the main container to run the script.

Answer

Add a readiness probe to the main container that checks the shared volume.

Question 18

Arrange the steps to create a PersistentVolumeClaim and use it in a Pod.

Accepted Answer

Create PVC, then verify PVC is bound to a PV, then create Pod referencing PVC in volumes.. Create PVC first, ensure it's bound, then define Pod with volume referencing PVC.

Answer

Create Pod referencing PVC first, then create PVC.

Answer

Create PVC, then create Pod referencing PVC, without verifying binding.

Answer

Create Pod with inline volume, then convert to PVC-based volume.

Question 19

A Pod in a namespace with a ResourceQuota that sets 'limits.cpu: 4' and 'limits.memory: 8Gi' is being created with the following container resources: requests: cpu: 2, memory: 4Gi; limits: cpu: 4, memory: 8Gi. The namespace also has a LimitRange with default limits of cpu: 500m, memory: 512Mi. Which statement is true about this resource configuration?

Accepted Answer

The Pod will be admitted because it respects both the ResourceQuota and the LimitRange. B is correct because the Pod explicitly sets its own limits (cpu: 4, memory: 8Gi) and requests (cpu: 2, memory: 4Gi), which are within the ResourceQuota's 'limits.cpu: 4' and 'limits.memory: 8Gi' constraints. The LimitRange default limits only apply to containers that do not specify limits; since this Pod specifies limits, the defaults are ignored. The Pod is admitted as it satisfies both admission controllers.

Answer

The Pod will have its limits overridden by the LimitRange defaults because limits must be set

Answer

The Pod will be rejected because the limits exceed the LimitRange default

Answer

The Pod will be rejected because requests must equal limits

Question 20

You want to view the logs of a pod named 'web-pod' that has two containers: 'nginx' and 'sidecar'. Which command correctly retrieves the logs from the 'nginx' container?

Accepted Answer

kubectl logs web-pod -c nginx. The correct command uses the proper syntax: `kubectl logs -c `. Option B follows this syntax correctly. Option A places the container flag before the pod name, which is invalid. Option C omits the -c flag, which is required when the pod has multiple containers. Option D uses the long form --container, which is valid but the question expects the short form as seen in B. Therefore, B is the best answer.

Answer

kubectl logs -c nginx web-pod

Answer

kubectl logs web-pod nginx

Answer

kubectl logs web-pod --container nginx