CKAD Practice Test 37 — 15 Questions

Question 1

Which THREE of the following are best practices for configuring readiness probes?

Accepted Answer

Set initialDelaySeconds to avoid startup race conditions. Setting `initialDelaySeconds` in a readiness probe prevents the probe from starting before the container's application has had time to initialize. Without this delay, the probe might fail immediately during startup, causing the container to be prematurely marked as not ready and removed from service, even though the application would have become ready given a few more seconds. This avoids race conditions between container startup and probe evaluation.

Answer

Use the same endpoint as the liveness probe

Answer

Configure the probe to restart the container if it fails

Question 2

Which THREE of the following are valid fields in a PodSecurityPolicy (PSP) that control Linux capabilities? (Select exactly 3)

Accepted Answer

defaultAddCapabilities. `defaultAddCapabilities` is a valid field in a PodSecurityPolicy (PSP) that specifies a list of Linux capabilities to be added to containers by default, even if not explicitly requested in the container's security context. This field is part of the PSP's capabilities control mechanism, as defined in the Kubernetes PodSecurityPolicy spec.

Answer

privileged

Answer

readOnlyRootFilesystem

Question 3

A DevOps engineer wants to deploy a logging sidecar container that reads log files from the main application container. Which volume type should be used to share files between the two containers?

Accepted Answer

emptyDir. An emptyDir volume is the correct choice because it provides a shared, ephemeral storage space that is created when a Pod is assigned to a node and exists as long as that Pod is running. Both the main application container and the sidecar container can mount the same emptyDir volume at different mount paths, allowing the sidecar to read log files written by the main container. This volume type is ideal for sharing files between containers in the same Pod without requiring persistent storage.

Answer

persistentVolumeClaim

Answer

configMap

Answer

hostPath

Question 4

Which TWO fields are required in a CronJob manifest? (Select 2)

Accepted Answer

schedule. The `schedule` field defines the cron expression that determines when the CronJob runs (e.g., `*/5 * * * *`). This is a mandatory field in a CronJob manifest as per the Kubernetes API specification, without which the controller cannot determine the execution timing.

Answer

startingDeadlineSeconds

Answer

successfulJobsHistoryLimit

Answer

concurrencyPolicy

Question 5

Arrange the steps to create a ConfigMap from a file and mount it as a volume in a Pod.

Accepted Answer

Step 1: Create ConfigMap from file, Step 2: Define Pod YAML with volume and volumeMount, Step 3: Apply the Pod manifest, Step 4: Verify the ConfigMap mount in the Pod. Create ConfigMap first, then define Pod with volume and volumeMount, apply, and verify.

Answer

Step 1: Define Pod YAML with volume and volumeMount, Step 2: Create ConfigMap from file, Step 3: Apply the Pod manifest, Step 4: Verify the ConfigMap mount in the Pod

Answer

Step 1: Create ConfigMap from file, Step 2: Apply the Pod manifest, Step 3: Define Pod YAML with volume and volumeMount, Step 4: Verify the ConfigMap mount in the Pod

Answer

Step 1: Verify the ConfigMap mount in the Pod, Step 2: Create ConfigMap from file, Step 3: Define Pod YAML with volume and volumeMount, Step 4: Apply the Pod manifest

Question 6

You want to restrict total memory usage in a namespace to 10 Gi. Which resource should you create?

Accepted Answer

ResourceQuota. A ResourceQuota is the correct Kubernetes object to enforce aggregate resource consumption limits at the namespace level. By defining a ResourceQuota with `spec.hard.memory: 10Gi`, you restrict the total memory requested and used by all pods in that namespace to 10 GiB. This directly meets the requirement to limit total memory usage.

Answer

PodDisruptionBudget

Answer

LimitRange

Answer

NetworkPolicy

Question 7

A developer is creating a Deployment with 4 replicas. The application requires a rolling update with zero downtime. Which TWO strategies ensure zero downtime during an update?

Accepted Answer

Set maxSurge=1. Setting maxSurge=1 allows Kubernetes to spin up one new Pod before terminating any old Pod during a rolling update. This ensures that the total number of available Pods never drops below the desired replica count, maintaining service capacity and achieving zero downtime.

Answer

Set maxUnavailable=1

Answer

Use Recreate strategy

Answer

Set maxSurge=0

Question 8

Which THREE statements about NetworkPolicy are correct? (Select 3)

Accepted Answer

NetworkPolicy follows an allow-list model; if no policy matches, traffic is denied.. NetworkPolicy follows an allow-list model: by default, all traffic to and from pods is allowed. Once a NetworkPolicy selects a pod, that pod becomes isolated, and only traffic explicitly allowed by the policy's rules is permitted for the specified direction (ingress/egress). Any traffic not matching an allow rule is denied for that direction. Option A is correct because once a policy applies, the default behavior becomes deny for unmatched traffic. Option C is correct because namespaceSelector can select a namespace, allowing traffic from all pods in that namespace. Option E is correct because NetworkPolicy can restrict egress traffic via egress rules. Option B is incorrect because ipBlock can be used to allow or block IP ranges, but blocking specific external IPs is possible only if the CNI supports it (and it's not universally supported). Option D is incorrect because NetworkPolicy is namespaced, not cluster-scoped.

Answer

NetworkPolicy can block traffic to specific external IP addresses using ipBlock.

Answer

NetworkPolicy is a cluster-scoped resource.

Question 9

When using 'kubectl apply' vs 'kubectl create', which statement is correct?

Accepted Answer

'kubectl apply' can create or update resources; 'kubectl create' only creates and fails if resource exists. 'kubectl apply' uses a declarative approach that creates a resource if it does not exist and updates it if it does, while 'kubectl create' is imperative and will fail with an error if the resource already exists. This distinction is fundamental to Kubernetes resource management, where 'apply' manages the full object state via last-applied-configuration annotations, and 'create' only handles initial creation.

Answer

'kubectl create' will update a resource if it already exists

Answer

'kubectl apply' and 'kubectl create' are interchangeable

Answer

'kubectl apply' can only create resources, not update them

Question 10

Which kubectl command is used to view the rollout history of a Deployment?

Accepted Answer

kubectl rollout history deployment my-deployment. `kubectl rollout history` is the dedicated command to view the revision history of a Deployment, including the list of revisions and, optionally, details of a specific revision when combined with `--revision`. This command directly queries the Deployment's rollout history stored in its annotations (e.g., `deployment.kubernetes.io/revision`).

Answer

kubectl rollout history deployment my-deployment --revision=2

Answer

kubectl rollout list deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Question 11

You need to create a Secret to store a TLS certificate and private key for use by an Ingress resource. Which two statements are correct? (Choose two.)

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. `kubectl create secret tls my-tls --cert=cert.pem --key=key.pem` is the dedicated command to create a TLS secret, which automatically sets the type to `kubernetes.io/tls` and stores the certificate under the key `tls.crt` and the private key under `tls.key`. This is the standard method for creating secrets intended for use with Ingress resources.

Answer

Use 'kubectl create secret generic tls-secret --from-file=cert.pem --from-file=key.pem' with type Opaque.

Answer

The keys in the data section must be 'cert' and 'key'.

Answer

The Ingress resource references the Secret's data keys directly.

Question 12

Which TWO Service types allow external access to pods from outside the Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. NodePort is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the service by targeting any node's IP and that port. This works by opening a high-range port (30000-32767) on all nodes, which forwards traffic to the ClusterIP service and then to the pods.

Answer

Headless

Answer

ClusterIP

Answer

ExternalName

Question 13

You have a CronJob that runs every 5 minutes. The previous job is still running when the next scheduled time arrives. You want the new job to be skipped if the previous one is still running. Which concurrencyPolicy should you set?

Accepted Answer

Forbid. The `Forbid` concurrency policy in Kubernetes CronJobs ensures that if a previous job instance is still running when the next scheduled time arrives, the new job is skipped entirely. This prevents overlapping executions, which is exactly the requirement in the question.

Answer

Skip

Answer

Allow

Answer

Replace

Question 14

Which THREE of the following are valid ways to debug a pod that is not responding? (Select three.)

Accepted Answer

Run 'kubectl debug -it pod-name --image=busybox --target=container-name' to start an ephemeral debug container. `kubectl debug` with `--target=container-name` creates an ephemeral container in the same pod, sharing the network and process namespace (if supported) with the target container. This allows you to run debugging tools (e.g., `busybox`) without modifying the original container image, which is essential when the container lacks a shell or necessary utilities.

Answer

Run 'kubectl attach pod-name' to attach to the container's main process

Answer

Run 'kubectl get pod pod-name -o yaml' to examine the pod's current YAML definition

Question 15

You want to expose a Deployment named 'nginx' on port 80 using a LoadBalancer service. Which YAML snippet is correct?

Accepted Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: nginx. It defines a Service of type LoadBalancer, exposing the 'nginx' Deployment on port 80. The apiVersion v1 is appropriate for a Service, and the selector matches the Deployment's labels. Option B includes an unnecessary explicit targetPort: 80, making it less preferred for the CKAD exam, which expects the most concise correct YAML. Option A uses NodePort instead of LoadBalancer, and Option D uses an incorrect apiVersion.

Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: NodePort
  ports:
  - port: 80
  selector:
    app: nginx

Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  targetPort: 80
  selector:
    app: nginx

Answer

apiVersion: apps/v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: nginx