CKAD Practice Test 4 — 10 Questions

Question 1

A pod has a container with envFrom referencing a ConfigMap. The ConfigMap has keys 'APP_DEBUG=true' and 'APP_NAME=myapp'. The pod also has an env entry with name 'APP_DEBUG' set to 'false'. What is the value of APP_DEBUG in the container?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

false. When a pod has both an `envFrom` referencing a ConfigMap and an explicit `env` entry with the same key, the explicit `env` entry takes precedence. This is because Kubernetes merges environment variables from multiple sources, and individual `env` entries override any values from `envFrom` for the same key. Therefore, `APP_DEBUG` will be set to 'false' as defined in the explicit `env` entry.

Answer

undefined

Answer

Both values are concatenated

Answer

true

Question 2

Which THREE of the following are correct about init containers? (Select THREE.)

Accepted Answer

They run to completion before the main application containers start. Init containers are designed to run sequentially to completion before any of the pod's regular application containers start. This ensures that prerequisites, such as database schema migrations or configuration file generation, are completed before the main application begins execution.

Answer

They cannot have resource limits set

Answer

They run after the main application containers have started

Question 3

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 4

Which of the following is the correct way to scale a Deployment named 'api' to 5 replicas using kubectl?

Accepted Answer

kubectl scale deployment api --replicas=5. `kubectl scale deployment api --replicas=5` is the standard kubectl command to change the replica count of a Deployment. The `scale` subcommand directly modifies the `.spec.replicas` field in the Deployment's manifest, instructing the ReplicaSet controller to adjust the number of Pods to match the desired count.

Answer

kubectl scale deploy api 5

Answer

kubectl update deployment api --replicas=5

Answer

kubectl set replicas deployment api 5

Question 5

Which TWO statements about readiness probes are correct? (Choose two.)

Accepted Answer

Readiness probes run continuously after the container starts. Readiness probes are designed to run continuously throughout the lifecycle of a container, not just during startup. They are periodically executed by the kubelet to determine whether the container is ready to accept traffic, and their success or failure directly controls the pod's inclusion in Service endpoints.

Answer

Readiness probes are only used during initial startup

Answer

Readiness probes can only be of type httpGet

Answer

Readiness probes restart the container if they fail

Question 6

A NetworkPolicy is applied to a namespace with the following rules:
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```
What is the effect on pods in that namespace?

Accepted Answer

All inbound traffic is denied, outbound traffic is allowed. This NetworkPolicy selects all pods in the namespace (podSelector: {}) and specifies only Ingress in policyTypes. By default, if any NetworkPolicy selects a pod, all traffic not explicitly allowed by a rule is denied. Since no ingress rules are defined, all inbound traffic is denied. Outbound traffic is not restricted because Egress is not listed in policyTypes and no egress rules are defined, so it remains allowed by default.

Answer

All traffic is allowed

Answer

Only traffic from specific namespaces is allowed

Answer

All inbound and outbound traffic is denied

Question 7

A Service named `api` in namespace `default` has multiple endpoints. You run `kubectl get endpoints api` and see no IPs. What is the most likely cause?

Accepted Answer

The Service selector does not match any pods. The most likely cause is that the Service's selector does not match any pods. A Service uses its label selector to identify pods and automatically populate its endpoints. If no pods match the selector, the endpoints list will be empty, resulting in no IPs shown by `kubectl get endpoints api`.

Answer

The Service type is ExternalName

Answer

The namespace has a NetworkPolicy blocking traffic

Answer

The Service has a clusterIP of None

Question 8

Which TWO statements about init containers are true? (Select 2)

Accepted Answer

Init containers run sequentially in the order they are defined.. Init containers in a Kubernetes Pod are executed sequentially in the exact order they are defined in the `initContainers` array. Each init container must exit successfully (return code 0) before the next one starts, ensuring a strict dependency chain for initialization tasks.

Answer

Init containers support liveness and readiness probes.

Answer

Init containers share the same filesystem as the application containers by default.

Answer

Init containers have a restart policy of Always.

Question 9

An Ingress has two rules:
- host: app.example.com, path: /api -> service-a:80
- host: api.example.com, path: / -> service-b:80
A request to `app.example.com/api/v1` reaches which service?

Accepted Answer

service-a. Ingress rules match the longest prefix of the request path for the given host. For `app.example.com/api/v1`, the path `/api` is a prefix match (since `/api/v1` starts with `/api`), so it routes to service-a:80. The second rule requires host `api.example.com`, which does not match, so service-b is not considered.

Answer

Both services

Answer

Neither service

Answer

service-b

Question 10

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.