CKAD Practice Test 40 — 15 Questions

Question 1

A Service uses a selector to target Pods. After updating the Pod labels, you notice the endpoints list is empty. What is the most likely reason?

Accepted Answer

The new labels do not match the Service selector. A Service uses a label selector to dynamically discover Pods and populate its endpoints. When Pod labels are updated, the selector remains unchanged; if the new labels do not match the selector, the Service cannot find any matching Pods, resulting in an empty endpoints list. This is the most direct and common cause of the issue.

Answer

The Service port was changed

Answer

The Service type changed to ExternalName

Answer

The Pods have a different container port

Question 2

Which TWO of the following are valid reasons for using a startup probe?

Accepted Answer

To prevent unnecessary restarts during initial startup. A startup probe is specifically designed to address containers that require a longer initialization time before they are ready to handle traffic or respond to health checks. By delaying the start of liveness and readiness probes until the startup probe succeeds, it prevents the kubelet from prematurely restarting the container due to failed liveness checks during its slow startup phase. This is the primary reason for using a startup probe: to avoid unnecessary restarts during initial startup.

Answer

To monitor the health of a container after it has started

Answer

To provide additional logging for the container

Answer

To replace the need for a readiness probe

Question 3

A Deployment has replicas: 5. During a rolling update, the developer sets maxSurge: 2 and maxUnavailable: 1. What is the maximum number of pods that can be running during the update?

Accepted Answer

7. During a rolling update, the total number of pods running is the sum of the desired replicas (5) plus the maxSurge (2), which equals 7. The maxUnavailable setting (1) controls how many pods can be down, not the upper limit of running pods. Kubernetes ensures that the number of pods above the desired count does not exceed maxSurge, so the maximum running pods is 5 + 2 = 7.

Answer

5

Answer

8

Answer

6

Question 4

Which TWO of the following are valid types of probes in Kubernetes? (Select 2)

Accepted Answer

Readiness probe. A is correct because a Readiness probe determines whether a Pod is ready to serve traffic. If the probe fails, the Pod is removed from the Service's endpoints, preventing traffic from being routed to an unready container. This is essential for rolling updates and graceful shutdowns.

Answer

HTTP probe

Answer

Exec probe

Answer

TCP probe

Question 5

A Pod specification includes: securityContext: { runAsNonRoot: true }. The container image runs as root by default. What will happen when the Pod is created?

Accepted Answer

The Pod will not start; the kubelet will reject it because the container tries to run as root. When a Pod specifies `runAsNonRoot: true` in its `securityContext`, the kubelet verifies that the container's user ID is non-zero (non-root) before starting the container. If the container image runs as root by default (UID 0), the kubelet will reject the Pod, and it will remain in a `ContainerCreating` or `CrashLoopBackOff` state with an error like 'container has runAsNonRoot and image will run as root'. This is a security enforcement mechanism that prevents privileged execution.

Answer

The Pod will start and immediately be OOMKilled

Answer

The Pod will run but with a warning

Answer

The Pod will run successfully because K8s overrides the user to non-root

Question 6

Which THREE of the following are valid fields in the '.spec' of a Job manifest?

Accepted Answer

parallelism. 'parallelism' is a valid field in the '.spec' of a Job manifest. It controls the maximum number of Pods that can run concurrently for the Job, allowing you to manage parallel execution. This field is part of the Job specification in the Kubernetes API, distinct from Deployments or other controllers.

Answer

replicas

Answer

strategy

Question 7

You are writing a Deployment manifest for a container that takes up to 60 seconds to become ready. You want to ensure the liveness probe does not interfere during this startup period. What should you configure?

Accepted Answer

Configure a startup probe with a sufficient failureThreshold and period. A startup probe is specifically designed to handle slow-starting containers. It runs during the initial startup phase and, once successful, hands over responsibility to the liveness probe. By setting a sufficient failureThreshold and periodSeconds, you allow the container up to (failureThreshold * periodSeconds) time to start without the liveness probe killing it prematurely.

Answer

Set liveness probe failureThreshold to a high number

Answer

Set readiness probe initialDelaySeconds to 60

Answer

Set liveness probe initialDelaySeconds to 60

Question 8

Which THREE are valid ways to create a ConfigMap?

Accepted Answer

kubectl create configmap my-config --from-literal=key=value. `kubectl create configmap` with `--from-literal` directly creates a ConfigMap with a key-value pair from the command line, which is a standard and valid method. This approach is ideal for simple, single-key configurations without needing external files.

Answer

kubectl create configmap my-config --from-file=key=file

Answer

kubectl apply configmap my-config --from-literal=key=value

Question 9

During a rolling update, you want to ensure that a maximum of 2 extra pods are created above the desired replicas. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. B is correct because `spec.strategy.rollingUpdate.maxSurge` controls the maximum number of pods that can be created above the desired replica count during a rolling update. Setting `maxSurge` to 2 (or an absolute value of 2) ensures that at most 2 extra pods are created beyond the desired replicas, allowing the update to proceed with controlled parallelism.

Answer

spec.template.spec.containers.resources

Answer

spec.replicas

Answer

spec.strategy.rollingUpdate.maxUnavailable

Question 10

Which command creates a TLS secret from an existing certificate and key file?

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. The `kubectl create secret tls` command is specifically designed to create a TLS secret from an existing certificate and key file. The `--cert` and `--key` flags directly specify the paths to the PEM-encoded certificate and private key, which Kubernetes then stores as a `kubernetes.io/tls` secret type, automatically base64-encoding the data for secure storage in etcd.

Answer

kubectl create secret tls my-tls --from-file=cert.pem --from-file=key.pem

Answer

kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem

Answer

kubectl create secret docker-registry my-tls --docker-server=... --docker-username=... --docker-password=...

Question 11

Which TWO statements are true about Kubernetes Secrets?

Accepted Answer

Secret data is base64 encoded in YAML manifests.. Kubernetes Secrets store data as base64-encoded strings in YAML manifests. This encoding is not encryption; it simply converts binary or non-printable data into an ASCII string format for safe inclusion in YAML. The base64 encoding is a standard practice for representing arbitrary data in Kubernetes resource definitions.

Answer

Secrets cannot be used as environment variables.

Answer

Secrets are always encrypted at rest by default.

Answer

Secrets are limited to 1KB in size.

Question 12

Which kubectl command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` is the command used to forward a local port to a port on a specific pod. The syntax is `kubectl port-forward pod/

:`, so `kubectl port-forward pod/web-pod 8080:80` forwards local port 8080 to port 80 on the pod named 'web-pod'.

Answer

kubectl port-forward pod/web-pod 80:8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Answer

kubectl proxy pod/web-pod 8080:80

Question 13

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` requires the resource type and name, and for a pod, the syntax is `pod/<pod-name>`. The command `kubectl port-forward pod/web-pod 8080:80` forwards local port 8080 to port 80 of the pod, matching the question's requirement exactly.

Answer

kubectl port-forward service/web-service 8080:80

Answer

kubectl port-forward deployment/web-deployment 8080:80

Answer

kubectl port-forward pod/web-pod 80:8080

Question 14

A ClusterIP service named 'db-service' in namespace 'data' is not reachable from a pod in the same namespace. The pod's /etc/resolv.conf shows 'search data.svc.cluster.local svc.cluster.local cluster.local'. Using the pod, which command tests DNS resolution for the service?

Accepted Answer

nslookup db-service.data.svc.cluster.local. `nslookup` is a standard DNS lookup tool that queries the cluster's DNS server (CoreDNS/kube-dns) for the fully qualified domain name (FQDN) of the service. The FQDN `db-service.data.svc.cluster.local` matches the search domains in the pod's `/etc/resolv.conf`, so `nslookup` will resolve the service's ClusterIP, confirming DNS is working. This directly tests DNS resolution, which is the root cause when a service is unreachable by name.

Answer

dig db-service.data.svc.cluster.local

Answer

ping db-service

Answer

curl http://db-service:3306

Question 15

You have a Deployment named 'web-app' with 5 replicas. You run the command: kubectl set image deployment/web-app web-app=nginx:1.25. Which command can you use to monitor the progress of the rollout?

Accepted Answer

kubectl rollout status deployment/web-app. `kubectl rollout status deployment/web-app` is the dedicated command to monitor the progress of a rollout, providing real-time updates on whether the rollout is succeeding, pending, or failed. It watches the deployment's status conditions and reports when the new ReplicaSet has fully replaced the old one, making it the precise tool for tracking the progress of the `kubectl set image` change.

Answer

kubectl describe deployment/web-app

Answer

kubectl rollout history deployment/web-app

Answer

kubectl get events --watch