CKAD Practice Test 38 — 15 Questions

Question 1

Which Dockerfile instruction sets a default command that can be overridden by arguments passed to 'docker run'?

Accepted Answer

CMD. The CMD instruction in a Dockerfile sets a default command that runs when a container starts. This default can be overridden by providing arguments directly to 'docker run' after the image name, making it the correct choice for a command that is intended to be easily replaced.

Answer

ENTRYPOINT

Answer

EXPOSE

Answer

RUN

Question 2

Which TWO of the following are valid fields in a Job spec? (Select TWO.)

Accepted Answer

backoffLimit. Options B (backoffLimit) and E (parallelism) are correct fields in a Job spec. 'backoffLimit' controls the number of retries before marking the Job as failed, and 'parallelism' specifies the maximum number of Pods running in parallel. Option A (replicas) is a field for Deployments, not Jobs. Option C (schedule) is used in CronJobs. Option D (restartPolicy) is a Pod-level field; in Jobs, the restartPolicy is defaulted to OnFailure or Never but is not a top-level Job spec field.

Answer

replicas

Answer

schedule

Answer

restartPolicy

Question 3

A deployment 'web-app' is running with 3 replicas. Users report that the application is slow. The team suspects a memory leak. Which command provides the most immediate insight into the memory usage of the pods?

Accepted Answer

kubectl top pod. `kubectl top pod` directly queries the metrics server to display real-time CPU and memory usage for each pod, providing the most immediate insight into whether a pod is consuming excessive memory due to a suspected leak. Unlike logs or events, it gives quantitative resource utilization data without requiring additional configuration or parsing.

Answer

kubectl describe deployment web-app

Answer

kubectl get events

Answer

kubectl logs <pod>

Question 4

You have a Deployment named 'web-app' with 3 replicas. You want to expose the pods on port 80 internally within the cluster using a ClusterIP service. Which kubectl command should you use?

Accepted Answer

kubectl expose deployment web-app --port=80 --target-port=8080. `kubectl expose deployment web-app --port=80 --target-port=8080` creates a ClusterIP Service that maps port 80 on the Service to port 8080 on the Pods, allowing internal cluster traffic to reach the application. The `--port` flag defines the Service's listening port, while `--target-port` specifies the container port the traffic is forwarded to, which is essential when the container listens on a different port than the Service exposes.

Answer

kubectl create service clusterip web-app --tcp=80:8080

Answer

kubectl create service nodeport web-app --tcp=80:8080

Answer

kubectl expose pod web-app --port=80 --target-port=8080

Question 5

You want to deploy an application with zero downtime by using a blue-green deployment pattern. Which Kubernetes resources are essential for implementing this strategy?

Accepted Answer

Two Deployments (blue and green) and a Service that can switch its selector. Blue-green deployments in Kubernetes require two separate Deployments (blue and green) to maintain separate environments, and a Service that can switch its selector labels to route traffic to the active deployment. Option D is correct because it describes exactly this pattern. Option A uses a single Deployment with RollingUpdate, which is a different strategy for zero downtime but not blue-green. Option B uses StatefulSet and Headless Service, which are for stateful applications and do not support blue-green switching. Option C uses a Recreate strategy, which causes downtime by terminating all pods before creating new ones, and Ingress alone cannot switch between two deployments without additional configuration.

Answer

A single Deployment with a RollingUpdate strategy

Answer

A StatefulSet and a Headless Service

Answer

A Deployment with a Recreate strategy and an Ingress

Question 6

Which THREE of the following are valid ways to update a Deployment's container image in Kubernetes?

Accepted Answer

kubectl apply -f updated-deployment.yaml with the new image.. `kubectl apply -f updated-deployment.yaml` applies a declarative configuration that includes the new container image. When the Deployment manifest is updated with the new image and reapplied, Kubernetes performs a rolling update to gradually replace pods with the new image, ensuring zero downtime if configured correctly.

Answer

kubectl update deployment myapp --image=nginx:1.20

Answer

kubectl rollout image deployment myapp nginx:1.20

Question 7

Which TWO of the following are valid ways to expose a container port in a pod spec?

Accepted Answer

spec.containers[].ports[].hostPort. `spec.containers[].ports[].hostPort` is a valid field in the Pod spec that maps a container port to the host node's network interface. This allows external traffic to reach the container via the host's IP address and specified port, though it is typically used for daemon sets or host-networking scenarios rather than general service exposure.

Answer

spec.containers[].hostPort

Answer

spec.containers[].containerPort

Answer

EXPOSE 8080 in Dockerfile

Question 8

What is the default Service type when creating a Service via 'kubectl create service' or YAML without specifying type?

Accepted Answer

ClusterIP. When creating a Service via `kubectl create service` or defining it in YAML without specifying the `type` field, Kubernetes defaults to `ClusterIP`. This is because `ClusterIP` is the implicit default type defined in the Service spec, providing internal cluster-wide virtual IP-based load balancing without external exposure.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 9

Match each Kubernetes probe to its check behavior.

Accepted Answer

Liveness probe: Checks if container is running and healthy; restarts container on failure. Liveness probes check if a container is running (if they fail, the container is restarted). Readiness probes check if a container is ready to serve traffic (if they fail, traffic is not routed to it). Startup probes check if an application has started, used mainly for slow-starting containers.

Answer

Readiness probe: Checks if container is running and restarts it on failure

Answer

Startup probe: Checks if container is ready to serve traffic

Question 10

Which TWO practices optimize Docker image size? (Select 2)

Accepted Answer

Including a .dockerignore file to exclude unnecessary files. A `.dockerignore` file prevents unnecessary files (e.g., local logs, node_modules, .git) from being sent to the Docker daemon during the `docker build` context, reducing the build context size and avoiding bloating the image with irrelevant data. Option D is correct because multi-stage builds allow you to compile or install dependencies in a temporary stage and then copy only the final runtime artifacts (e.g., compiled binaries) into a minimal final image, discarding build tools and intermediate layers.

Answer

Running 'apt-get upgrade' in the Dockerfile

Answer

Using a full OS base image like ubuntu:latest

Answer

Installing all packages in one layer without cleanup

Question 11

Which THREE of the following are valid use cases for a Headless Service (clusterIP: None)?

Accepted Answer

Discovering all Pod IPs via DNS A/AAAA records. A Headless Service (clusterIP: None) does not provide a virtual IP or load balancing. Instead, DNS queries return A/AAAA records containing the IP addresses of all healthy Pods selected by the service. This allows clients to discover and connect directly to individual Pod IPs, which is essential for stateful applications or custom discovery patterns.

Answer

Exposing the service externally via cloud load balancer

Answer

Providing a stable virtual IP for load balancing

Question 12

Which TWO of the following are valid approaches to debug a pod that is in a CrashLoopBackOff state? (Select 2)

Accepted Answer

Use 'kubectl debug' to start an ephemeral container for troubleshooting. 'kubectl debug' can start an ephemeral container in the same pod as the crashing container, allowing you to inspect the environment (e.g., filesystem, network, processes) without the main container running. This is especially useful when the main container crashes immediately and you cannot exec into it. Ephemeral containers share the pod's namespaces (e.g., network, PID) and can mount the same volumes, giving you a live debugging environment.

Answer

Exec into the pod with 'kubectl exec -it' to inspect the environment

Answer

Check resource usage with 'kubectl top pod'

Answer

Create a new pod with 'kubectl run' using the same image

Question 13

A developer runs `kubectl expose deployment web-deploy --port=80 --target-port=8080 --type=NodePort` and later wants to access the Service from outside the cluster. What is the correct way to find the external port?

Accepted Answer

Run `kubectl describe svc web-deploy` and look for the NodePort field.. `kubectl expose` with `--type=NodePort` creates a Service that maps a high-port (30000-32767) on each cluster node to the target container port. The `kubectl describe svc web-deploy` output includes the `NodePort` field, which shows this externally accessible port. To reach the Service from outside the cluster, you must use the node's external IP combined with this NodePort, not the Service's cluster-internal port (80).

Answer

Run `kubectl get nodes -o wide` and use the node's external IP and port 80.

Answer

Run `kubectl get pod -l app=web-deploy` and use the pod IP with port 8080.

Answer

Run `kubectl get svc web-deploy -o yaml` and look for `spec.ports[0].port`.

Question 14

You create a ResourceQuota in a namespace that sets requests.cpu: '1' and limits.cpu: '2'. A pod spec has no resource limits or requests. What happens when you try to create this pod?

Accepted Answer

The pod creation is denied because the spec does not specify resource limits or requests. When a ResourceQuota is defined with requests.cpu and limits.cpu, Kubernetes requires that every pod in that namespace have explicit resource requests and limits that match the quota constraints. If a pod spec omits these fields, the API server denies the pod creation because it cannot determine whether the pod complies with the quota. This is enforced at admission time, not at runtime.

Answer

The pod is created without limits, but the quota is enforced at runtime

Answer

The pod is created and the quota is ignored

Answer

The pod is created with default limits from the LimitRange

Question 15

Which FOUR of the following are valid fields in a HorizontalPodAutoscaler (HPA) v2 specification?

Accepted Answer

spec.metrics. In HPA v2 (autoscaling/v2), the spec includes 'metrics', 'behavior', 'minReplicas', and 'maxReplicas'. All four of these fields are valid in the v2 specification. 'targetCPUUtilizationPercentage' is a deprecated field from v1 and is not part of the v2 spec. Therefore, options B, C, D, and E are correct.

Answer

spec.targetCPUUtilizationPercentage