CKAD Practice Test 33 — 15 Questions

Question 1

You have an HPA that scales a Deployment based on CPU utilization. You want to prevent the Deployment from scaling down for at least 5 minutes. Which HPA behavior field should you configure?

Accepted Answer

behavior.scaleDown.stabilizationWindowSeconds. To prevent scaling down, you can set a stabilization window on the scaleDown policy. Option B correctly sets a stabilizationWindowSeconds in the scaleDown behavior.

Answer

behavior.scaleUp.policies[0].periodSeconds

Answer

behavior.scaleUp.stabilizationWindowSeconds

Answer

behavior.scaleDown.policies[0].periodSeconds

Question 2

Given the following partial pod spec:
```yaml
securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
```
Which combination correctly describes the resulting permissions on a mounted volume?

Accepted Answer

Volume owned by user 1000, group 2000; container runs with user 1000 and group 3000. With `runAsUser: 1000`, the container's primary user ID is set to 1000, and this also makes the volume owned by user 1000. `runAsGroup: 3000` sets the container's primary group ID to 3000. `fsGroup: 2000` changes the group ownership of the mounted volume to group 2000 and adds it as a supplemental group. Thus, the volume is owned by user 1000 and group 2000, and the container runs with UID 1000 and GID 3000.

Answer

Volume owned by user 2000, group 1000; container runs with user 2000 and group 1000

Answer

Volume owned by user 3000, group 2000; container runs with user 1000 and group 3000

Answer

Volume owned by user 1000, group 3000; container runs with user 1000 and group 2000

Question 3

What is the purpose of a HorizontalPodAutoscaler (HPA)?

Accepted Answer

To automatically adjust the number of pods based on resource metrics. A HorizontalPodAutoscaler automatically scales the number of pods in a Deployment, ReplicaSet, or StatefulSet based on observed CPU utilization (or other custom metrics).

Answer

To update the application version without downtime

Answer

To restart pods automatically when they fail

Answer

To distribute incoming traffic across multiple pods

Question 4

You are performing a blue-green deployment. You have two Deployments: 'app-blue' (current) and 'app-green' (new). Both have labels 'app: myapp' and 'version: blue' or 'version: green' respectively. The Service 'myapp-svc' selects pods with 'app: myapp, version: blue'. How do you switch traffic to the green deployment?

Accepted Answer

Update the Service selector to 'app: myapp, version: green'. Updating the Service's selector to 'app: myapp, version: green' directs traffic to the green pods. Option B uses a semicolon instead of a comma, which is invalid syntax. Option A adds a label mismatch and does not change the Service selector. Option C would change the green deployment's label to 'blue', causing both deployments to have the same version label, which is not a proper blue-green switch.

Answer

Add an additional label 'traffic: enabled' to the 'app-green' pods and update the Service to select 'traffic: enabled'

Answer

Update the Service selector to 'app: myapp; version: green'

Answer

Update the 'app-green' Deployment to have label 'version: blue'

Question 5

A container in a pod is crashing repeatedly. You want to see the logs from the previous (crashed) instance of the container. Which command should you use?

Accepted Answer

kubectl logs <pod> --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has crashed and restarted. This allows you to inspect the logs of the terminated container to diagnose the crash, even though the current container instance is running or has restarted.

Answer

kubectl logs --tail=10 <pod>

Answer

kubectl logs -c

Answer

kubectl logs -f <pod>

Question 6

Which kubectl command creates a ConfigMap named 'app-config' from a file named 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' by reading the entire contents of the file 'config.properties' and storing it as a single key-value pair, where the key defaults to the filename (config.properties) and the value is the file's content. This is the standard syntax for creating a ConfigMap from a file in Kubernetes.

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --file=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 7

Which TWO of the following are valid parameters for configuring probes in Kubernetes? (Select TWO.)

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe configuration (liveness, readiness, or startup probe). It specifies the number of seconds to wait after the container starts before initiating the first probe, allowing the application to initialize before being checked.

Answer

intervalSeconds

Answer

retryCount

Answer

readinessProbe

Question 8

An Ingress resource has the following annotation: 'kubernetes.io/ingress.class: nginx'. What is the purpose of this annotation?

Accepted Answer

It specifies the Ingress controller to use (e.g., nginx). The annotation `kubernetes.io/ingress.class: nginx` explicitly tells Kubernetes which Ingress controller should process this Ingress resource. In Kubernetes, multiple Ingress controllers (e.g., nginx, haproxy, traefik) can run in the same cluster; this annotation selects the `nginx` controller, ensuring that only that controller reads and implements the routing rules defined in the Ingress.

Answer

It sets a default backend for the Ingress

Answer

It enables session affinity (sticky sessions)

Answer

It enables TLS for the Ingress

Question 9

A developer reports that a pod named 'api-pod' is restarted repeatedly. You run 'kubectl get events --field-selector involvedObject.name=api-pod' and see multiple events with reason 'BackOff' and message 'Back-off restarting failed container'. Which probe failure is MOST likely causing this?

Accepted Answer

Liveness probe failure. The 'BackOff' event with 'Back-off restarting failed container' indicates the kubelet is repeatedly restarting the container because it exited with a non-zero exit code. This behavior is directly caused by a liveness probe failure: when the liveness probe fails, kubelet kills the container and restarts it, leading to a crash loop and the BackOff state. Readiness and startup probes do not trigger restarts—they only control traffic routing or delay other probes.

Answer

Resource quota exceeded

Answer

Readiness probe failure

Answer

Startup probe failure

Question 10

A developer needs to expose a deployment named 'web-app' running in the 'default' namespace on port 8080 internally within the cluster. Which kubectl command creates a ClusterIP service that selects pods with label 'app: web'?

Accepted Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --selector=app=web. `kubectl expose deployment web-app --port=8080 --target-port=8080 --selector=app=web` creates a ClusterIP service by default (no `--type` flag defaults to ClusterIP), and the `--selector` flag explicitly sets the label selector to `app=web`, ensuring the service routes traffic to pods with that label. The `--port` flag defines the service port, and `--target-port` defines the container port (8080), matching the requirement for internal cluster exposure.

Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --type=ClusterIP

Answer

kubectl run web-app --image=nginx --port=8080 --expose

Answer

kubectl create service clusterip web-app --tcp=8080:8080 --selector=app=web

Question 11

Which THREE of the following are valid patterns for multi-container pods?

Accepted Answer

Ambassador. The Ambassador pattern is a valid multi-container pod pattern where a proxy container handles network communication on behalf of the main application container, abstracting external service connectivity. This pattern is commonly implemented with tools like Envoy or a custom sidecar proxy that manages TLS termination, service discovery, or circuit breaking, allowing the main container to connect to localhost while the ambassador handles remote connections.

Answer

Init

Answer

Daemon

Question 12

Which of the following commands creates a LoadBalancer Service named `web-svc` for a Deployment named `web` on port 80?

Accepted Answer

kubectl expose deployment web --name=web-svc --port=80 --type=LoadBalancer. `kubectl expose deployment` creates a Service from an existing Deployment, and the `--name` flag sets the Service name to `web-svc`. The `--port=80` and `--type=LoadBalancer` flags configure the Service to listen on port 80 and expose it externally via a cloud load balancer, which is the standard way to create a LoadBalancer Service for a Deployment.

Answer

kubectl create service web-svc --port=80 --type=LoadBalancer

Answer

kubectl create deployment web --expose --port=80 --type=LoadBalancer

Answer

kubectl expose pod web --port=80 --type=LoadBalancer

Question 13

You have a Secret of type kubernetes.io/tls. The pod mounting it as a volume expects the files 'tls.crt' and 'tls.key'. What keys must the Secret data contain?

Accepted Answer

tls.crt and tls.key. For a Secret of type `kubernetes.io/tls`, the Kubernetes API server expects the data to contain exactly the keys `tls.crt` and `tls.key`. When such a Secret is mounted as a volume into a pod, the files created in the mount path are named `tls.crt` and `tls.key`, matching these keys. This is enforced by the Kubernetes TLS secret controller and is documented in the official Kubernetes reference for TLS secrets.

Answer

ca.crt and tls.key

Answer

cert and key

Answer

certificate and key

Question 14

A team uses a Service named 'backend' in namespace 'prod' to reach Pods in namespace 'staging'. The Service in 'prod' has no endpoints. What is the most likely cause?

Accepted Answer

The Service selector does not match any Pods in the same namespace. The Service in the 'prod' namespace has no endpoints because its selector does not match any Pods in the same namespace. Kubernetes Services only discover Pods within the same namespace via label selectors; cross-namespace access requires a different approach (e.g., ExternalName Service or manual endpoint configuration). Since the Pods are in 'staging', the selector in 'prod' finds no matching Pods, resulting in zero endpoints.

Answer

The Service port name does not match the container port

Answer

The Service type is ClusterIP but should be NodePort

Answer

DNS resolution is broken in the staging namespace

Question 15

A developer needs to create a Kubernetes Secret for Docker registry authentication. The registry URL is 'myregistry.io', username 'user', password 'pass', email 'user@example.com'. Which command creates this Secret?

Accepted Answer

kubectl create secret docker-registry regcred --docker-server=myregistry.io --docker-username=user --docker-password=pass --docker-email=user@example.com. `kubectl create secret docker-registry` is the dedicated command for creating a Docker registry authentication secret, which automatically encodes the provided credentials into a `.dockerconfigjson` format. This secret type is specifically designed for pulling images from private registries, and the flags `--docker-server`, `--docker-username`, `--docker-password`, and `--docker-email` match the required fields for registry authentication.

Answer

kubectl create secret tls regcred --cert=cert --key=key

Answer

kubectl create secret generic regcred --from-literal=username=user --from-literal=password=pass

Answer

kubectl create secret registry regcred --server=myregistry.io --username=user --password=pass