CKAD Practice Test 39 — 15 Questions

Question 1

Which kubectl command can you use to pause a rolling update of a Deployment?

Accepted Answer

kubectl rollout pause deployment/my-deployment. The correct command to pause a rolling update of a Deployment is `kubectl rollout pause deployment/my-deployment`. This command temporarily halts the rollout process, allowing you to make changes or investigate issues without triggering a new revision. The `kubectl rollout` subcommand is specifically designed for managing Deployment rollouts, and `pause` is the correct verb to suspend the update.

Answer

kubectl rollout suspend deployment/my-deployment

Answer

kubectl rollout stop deployment/my-deployment

Answer

kubectl rollout halt deployment/my-deployment

Question 2

A security requirement states: 'The container must drop all capabilities and add only NET_BIND_SERVICE'. Which YAML snippet correctly implements this in the securityContext?

Accepted Answer

securityContext:
  capabilities:
    drop: [ALL]
    add: ["NET_BIND_SERVICE"]. It first drops all capabilities with `drop: [ALL]` and then explicitly adds only `NET_BIND_SERVICE` via `add: ["NET_BIND_SERVICE"]`. This matches the security requirement exactly: the container starts with no capabilities and gains only the one needed to bind to privileged ports (<1024). In Kubernetes, the order of `drop` and `add` matters — dropping ALL first ensures a clean slate, then adding the specific capability.

Answer

securityContext:
  capabilities:
    drop: ["NET_BIND_SERVICE"]
    add: [ALL]

Answer

securityContext:
  capabilities:
    add: [ALL]
    drop: ["NET_BIND_SERVICE"]

Answer

securityContext:
  capabilities: "drop ALL; add NET_BIND_SERVICE"

Question 3

Refer to the exhibit. A pod named 'app-backend-6b4c9d8f7-2x4z5' is in CrashLoopBackOff state. What is the MOST likely cause of this issue?

Accepted Answer

The container is crashing due to a misconfiguration or application error.. A CrashLoopBackOff state indicates that the container in the pod is repeatedly crashing and being restarted by the kubelet. The most common cause is a misconfiguration (e.g., incorrect environment variables, missing dependencies, or a faulty entrypoint script) or an application error (e.g., a runtime exception or panic). The kubelet detects the crash via the container runtime (e.g., containerd) and applies an exponential backoff delay before restarting, leading to the CrashLoopBackOff status.

Answer

The container has exceeded its memory limit and is being OOMKilled.

Answer

The node running the pod is down, preventing the container from starting.

Answer

A network policy is blocking the container from accessing required services.

Question 4

Which of the following is the correct way to create a simple Pod named 'nginx' running the nginx:1.25 image using kubectl?

Accepted Answer

kubectl run nginx --image=nginx:1.25. `kubectl run nginx --image=nginx:1.25` is the imperative command to create a Pod directly without a Deployment. The `run` subcommand is specifically designed to create a Pod (or other resources like Deployments) from an image, and when no resource type is specified, it defaults to creating a Pod. This is the standard CKAD approach for quickly launching a standalone Pod.

Answer

kubectl create nginx --image=nginx:1.25

Answer

kubectl create pod nginx --image=nginx:1.25

Answer

kubectl apply nginx --image=nginx:1.25

Question 5

What is the purpose of the '.dockerignore' file?

Accepted Answer

To exclude files from the build context. The `.dockerignore` file is used to exclude files and directories from the build context sent to the Docker daemon during a `docker build` operation. By specifying patterns in this file, you prevent unnecessary or sensitive files (like local development artifacts, `.git` directories, or node_modules) from being included, which speeds up the build and reduces the image size. Option C correctly identifies this purpose.

Answer

To specify which files to include in the image

Answer

To ignore files during docker push

Answer

To list environment variables to ignore

Question 6

A team is deploying a multi-container pod with a main application container and a sidecar container for logging. Which THREE statements about pod design are correct?

Accepted Answer

Containers in a pod share the same network namespace.. Containers within the same Kubernetes pod share the same network namespace, including the same IP address and port space. This allows them to communicate via localhost and share network resources, which is essential for sidecar patterns like logging agents that need to intercept or monitor the main container's traffic.

Answer

Containers in a pod share the same filesystem root.

Answer

The sidecar container must use the same image as the main container.

Question 7

Which of the following Dockerfile instructions is used to set a command that runs when the container starts and can be overridden by command-line arguments?

Accepted Answer

CMD. The CMD instruction in a Dockerfile provides default command(s) for the executing container. When a user runs `docker run image [COMMAND]`, the provided COMMAND overrides the CMD value, making it the correct choice for a command that can be overridden by command-line arguments.

Answer

EXPOSE

Answer

COPY

Answer

RUN

Question 8

A developer needs to expose a deployment named 'web-app' running on port 8080 to external traffic. The cluster is on-premises with no cloud load balancer. Which service type should be used?

Accepted Answer

NodePort. (NodePort) is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the 'web-app' deployment on port 8080 without requiring a cloud load balancer. In on-premises clusters, NodePort is the standard service type for external access when no cloud LB is available, as it opens a high-port (30000-32767) on every node that forwards traffic to the ClusterIP service.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 9

You want to set environment variable 'DB_URL' in a pod from the key 'url' in ConfigMap 'db-config'. Which YAML snippet is correct?

Accepted Answer

env:
- name: DB_URL
  valueFrom:
    configMapKeyRef:
      name: db-config
      key: url. It uses the `configMapKeyRef` field under `valueFrom` to inject a specific key ('url') from a ConfigMap ('db-config') into the environment variable 'DB_URL'. This is the precise syntax required to reference a single key from a ConfigMap in a pod's environment variable definition.

Answer

envFrom:
- configMapRef:
    name: db-config

Answer

env:
- name: DB_URL
  valueFrom:
    secretKeyRef:
      name: db-config
      key: url

Answer

env:
- name: DB_URL
  valueFrom:
    configMap:
      name: db-config
      key: url

Question 10

You have an Ingress that should route requests to 'api.example.com' to a service named 'api-svc' on port 80, and requests to 'www.example.com' to 'web-svc' on port 80. Which host-based routing rule is correct?

Accepted Answer

spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - backend:
          service:
            name: api-svc
            port:
              number: 80
  - host: www.example.com
    http:
      paths:
      - backend:
          service:
            name: web-svc
            port:
              number: 80. It follows the Kubernetes Ingress v1 API specification: each rule in `spec.rules` is an object with a `host` field and an `http` field, and within `http`, a `paths` array containing backend references. This structure correctly routes requests for `api.example.com` to `api-svc:80` and `www.example.com` to `web-svc:80`.

Answer

spec:
  rules:
  - http:
      paths:
      - host: api.example.com
        backend:
          service:
            name: api-svc
            port:
              number: 80
      - host: www.example.com
        backend:
          service:
            name: web-svc
            port:
              number: 80

Answer

spec:
  rules:
  - host: api.example.com
    - backend:
        service:
          name: api-svc
          port:
            number: 80
  - host: www.example.com
    - backend:
        service:
          name: web-svc
          port:
            number: 80

Answer

spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - backend:
          serviceName: api-svc
          servicePort: 80
  - host: www.example.com
    http:
      paths:
      - backend:
          serviceName: web-svc
          servicePort: 80

Question 11

You want to configure a pod so that it receives a SIGTERM signal and has 60 seconds to shut down gracefully before being forcefully killed. Which field should you set?

Accepted Answer

terminationGracePeriodSeconds: 60. The `terminationGracePeriodSeconds` field in the Pod spec defines the duration (in seconds) that Kubernetes waits after sending a SIGTERM to the primary container process before sending a SIGKILL. Setting it to 60 gives the pod 60 seconds to shut down gracefully, which is exactly what the question requires.

Answer

lifecycle.preStop.exec.command with sleep 60

Answer

livenessProbe.initialDelaySeconds: 60

Answer

resources.limits.cpu

Question 12

You are asked to ensure that a pod with a slow-starting container (requires 60 seconds to initialize) is not prematurely restarted by the liveness probe. The liveness probe should start only after the container is fully initialized. Which probe type should you add to the pod spec?

Accepted Answer

startupProbe. A startupProbe is specifically designed for slow-starting containers. It runs at pod startup and only after it succeeds does the liveness probe begin. This prevents the liveness probe from restarting the container during its 60-second initialization period, as the startupProbe will keep failing until the container is fully ready.

Answer

readinessProbe

Answer

livenessProbe with initialDelaySeconds=60

Answer

lifecycle preStop hook

Question 13

A pod is in CrashLoopBackOff state. You need to view the last few lines of its logs to understand why it is crashing. Which command is most appropriate?

Accepted Answer

kubectl logs my-pod --tail=20. The `--tail=20` flag limits the output to the last 20 lines of the pod's logs, which is the most efficient way to see the recent crash-related errors without scrolling through the entire log history. In a CrashLoopBackOff state, the pod is repeatedly restarting, so viewing the tail of the logs directly shows the most recent failure messages, which is the standard diagnostic approach.

Answer

kubectl logs -f my-pod

Answer

kubectl logs my-pod

Answer

kubectl get events --field-selector involvedObject.name=my-pod

Question 14

An admin creates a Service without a selector. Which of the following is true about such a Service?

Accepted Answer

The admin must manually create an Endpoints object with the desired IPs.. When a Service is created without a selector, Kubernetes does not automatically manage its endpoints. The admin must manually create an Endpoints object (or use an EndpointSlice) that lists the IP addresses and ports to which the Service should route traffic. This allows the Service to direct traffic to external resources, such as databases running outside the cluster, or to specific pods not matching a label selector.

Answer

The Service will use the default ClusterIP and route to all pods in the cluster.

Answer

The Service will automatically route traffic to all pods in the namespace.

Answer

The Service will not have any endpoints until a selector is added.

Question 15

Which TWO of the following are required to create a Role and RoleBinding that grants read access to Pods in the 'development' namespace? (Choose two.)

Accepted Answer

A RoleBinding that binds the Role to a subject (User or ServiceAccount). A RoleBinding is the Kubernetes resource that binds a Role (which defines permissions) to a specific subject (User, Group, or ServiceAccount) within a namespace. Without a RoleBinding, the permissions defined in the Role are not granted to any identity, making it a required component for granting access.

Answer

A NetworkPolicy that allows traffic to Pods

Answer

A ClusterRole with the same rules

Answer

A ClusterRoleBinding that binds the Role to a subject