CKAD Practice Test 44 — 15 Questions

Question 1

You need to run a command inside a running pod's container. The container has a shell available. Which command allows you to execute 'ls -la /data' inside the container?

Accepted Answer

kubectl exec pod-name -- ls -la /data. The `kubectl exec` command is designed to execute arbitrary commands inside a running container. The `--` separator tells kubectl that everything after it is the command to run inside the container, not a kubectl flag. Option C correctly uses `kubectl exec pod-name -- ls -la /data` to run `ls -la /data` inside the specified pod's primary container.

Answer

kubectl exec pod-name

Answer

kubectl run pod-name -- ls -la /data

Answer

kubectl attach pod-name -c container-name

Question 2

You run 'kubectl get pods -o wide' and see that a pod 'worker-pod' is in 'Completed' state with 'Restart Count: 5'. The pod's restart policy is 'OnFailure'. What is the most likely reason the pod has restarted 5 times?

Accepted Answer

The container exited with non-zero exit code multiple times before succeeding. B is correct because the pod's restart policy is 'OnFailure', which means the kubelet will restart the container only when it exits with a non-zero exit code. The pod is in 'Completed' state with a restart count of 5, indicating the container exited with a non-zero code multiple times (triggering restarts) before finally exiting with a zero exit code and reaching completion.

Answer

The liveness probe failed and restarted the container

Answer

The pod's node was rebooted

Answer

The pod was evicted due to node pressure

Question 3

Which of the following is NOT a valid restart policy for a Pod?

Accepted Answer

UnlessStopped. Kubernetes supports exactly three restart policies for Pods: Always, OnFailure, and Never. 'UnlessStopped' is not a valid restart policy in the Kubernetes API; it is a fabricated option designed to test your knowledge of the allowed values for the `restartPolicy` field in a Pod spec.

Answer

OnFailure

Answer

Always

Answer

Never

Question 4

You need to debug a pod that has no running container because it crashed. The pod is in CrashLoopBackOff. Which command allows you to start a temporary container in the same pod for debugging?

Accepted Answer

kubectl debug <pod> -it --image=busybox. `kubectl debug` can create an ephemeral container in an existing pod for debugging purposes, even when the original container is in CrashLoopBackOff. The `-it` flag provides an interactive terminal, and `--image=busybox` supplies a lightweight debugging image. This allows you to inspect the pod's filesystem, network, or environment without restarting the failing container.

Answer

kubectl attach <pod>

Answer

kubectl run debug --image=busybox

Answer

kubectl exec -it <pod> -- /bin/bash

Question 5

You want to see detailed information about a node's resource usage. Which command should you run?

Accepted Answer

kubectl top node. `kubectl top node` retrieves real-time CPU and memory usage metrics for nodes from the metrics server, which is essential for monitoring resource consumption. This command directly answers the question about detailed resource usage, unlike other options that provide configuration or log data.

Answer

kubectl describe node

Answer

kubectl logs node

Answer

kubectl get nodes -o wide

Question 6

You have a YAML file 'deploy.yaml' that defines a Deployment. Which command creates the Deployment if it does not exist, or updates it if it already exists?

Accepted Answer

kubectl apply -f deploy.yaml. `kubectl apply -f deploy.yaml` uses declarative object configuration: it creates the Deployment if it doesn't exist, or performs a strategic merge patch to update it if it already exists. This is the standard command for managing Kubernetes resources with a desired-state file.

Answer

kubectl replace -f deploy.yaml

Answer

kubectl patch -f deploy.yaml

Answer

kubectl create -f deploy.yaml

Question 7

Which THREE of the following are capabilities that can be added to a container's securityContext?

Accepted Answer

NET_ADMIN. (NET_ADMIN) is correct because it is a Linux capability that can be added to a container's securityContext under the `capabilities.add` field. This capability allows the container to perform network administration tasks such as interface configuration, firewall management, and routing table manipulation, which are common in network-focused pods.

Answer

RuntimeDefault

Answer

CAP_SYS_ADMIN

Question 8

Which THREE of the following are valid reasons to use an annotation in Kubernetes?

Accepted Answer

To store the name of the CI/CD tool that deployed the resource. Option B is correct because annotations are designed to hold non-identifying metadata such as tooling information, so recording the CI/CD tool that deployed a resource is a valid use. Option C is correct because annotations commonly store build versions or commit hashes for auditing and traceability, since this metadata does not need to be used for selection or scheduling. Option E is correct because the Kubernetes API explicitly defines annotations as a way to attach arbitrary non-identifying metadata to objects, which is their core purpose. Option A is not valid because Service Pod selection is performed with label selectors, not annotations, which cannot be used in selectors. Option D is not valid because container resource limits are set in the pod spec under resources.limits, not via annotations.

Answer

To enable a Service to select Pods based on the annotation value

Answer

To set resource limits for a container

Question 9

You have a pod that runs a single container with the following resource limits: memory: 256Mi, cpu: 500m. The container is consistently using 300Mi of memory and 300m of CPU. The pod is running but you want to avoid OOMKilled. Which change should you make?

Accepted Answer

Increase memory limit to 512Mi. The container is consistently using 300Mi of memory, which exceeds the current memory limit of 256Mi. When a container exceeds its memory limit, the kernel's OOM killer terminates the process (OOMKilled). Increasing the limit to 512Mi provides headroom above the actual usage, preventing OOM kills while allowing the container to continue running.

Answer

Set memory request to 128Mi and keep limit at 256Mi

Answer

Decrease memory limit to 128Mi

Answer

Increase CPU limit to 1000m

Question 10

What is the purpose of the 'maxUnavailable' field in a Deployment's rolling update configuration?

Accepted Answer

The maximum number of Pods that can be unavailable during the update.. The 'maxUnavailable' field in a Deployment's rolling update configuration specifies the maximum number of Pods that can be unavailable during the update process, relative to the desired replica count. This ensures that a controlled number of Pods are taken down at a time, maintaining application availability while the update progresses. It is defined as either an absolute number or a percentage of the desired replicas, and it works in conjunction with 'maxSurge' to control the update pace.

Answer

The maximum number of Pods that can be created above the desired replicas.

Answer

The maximum time allowed for the update to complete.

Answer

The maximum number of Pods to be terminated simultaneously.

Question 11

You want to restrict a Pod to only run with a seccomp profile of 'RuntimeDefault'. Which SecurityContext field should you set?

Accepted Answer

seccompProfile. The `seccompProfile` field in a Pod's SecurityContext allows you to specify a seccomp profile to restrict system calls. Setting it to `RuntimeDefault` applies the container runtime's default seccomp profile, which blocks a set of dangerous syscalls while allowing normal operation. This is the correct field to enforce a seccomp profile of 'RuntimeDefault'.

Answer

appArmorProfile

Answer

capabilities

Answer

seLinuxOptions

Question 12

You need to perform a canary deployment using a Service and two Deployments (stable and canary). Which TWO resources or configurations are typically used to route a percentage of traffic to the canary? (Select TWO)

Accepted Answer

Service Mesh (e.g., Istio VirtualService). Option A (Service Mesh, e.g., Istio VirtualService) is correct because a service mesh like Istio can split traffic between the stable and canary Deployments at the L7 level, using VirtualService/DestinationRule weights to send a precise percentage of requests to the canary subset. Option D (Ingress with canary annotation) is correct because ingress controllers such as NGINX Ingress support canary annotations (e.g., nginx.ingress.kubernetes.io/canary and canary-weight) to route a defined percentage of traffic to a canary backend Service. Option B is not valid because a Kubernetes Service has a single label selector and cannot natively split traffic by percentage across two Deployments. Option C is incorrect because NetworkPolicy only controls L3/L4 pod-level ingress/egress firewall rules, not HTTP traffic weighting. Option E is incorrect because a HorizontalPodAutoscaler only scales replica counts based on metrics and does not perform traffic routing or canary splitting.

Answer

A single Service with multiple label selectors

Answer

NetworkPolicy

Answer

HorizontalPodAutoscaler

Question 13

Refer to the exhibit. A Pod is defined with security contexts at both the container and Pod level. Which of the following statements accurately describes the effective security configuration?

Accepted Answer

The container runs as user 1000, group 2000, with NET_ADMIN capability added, and the Pod-level runAsNonRoot: true is also enforced.. Kubernetes merges Pod-level and container-level security contexts, with the container-level settings taking precedence for fields that overlap, but Pod-level settings that are not overridden (like runAsNonRoot) remain enforced. In this case, the container runs as user 1000, group 2000, with NET_ADMIN capability added, and the Pod-level runAsNonRoot: true is also enforced, ensuring the container does not run as root.

Answer

The Pod will fail to start because runAsNonRoot conflicts with the container's runAsUser.

Answer

The container runs as user 1000, but the Pod-level runAsNonRoot overrides the container's runAsUser to enforce non-root.

Answer

The container runs as root because the Pod-level runAsNonRoot is ignored when container-level capabilities are set.

Question 14

You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?

Accepted Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: mysecret
      key: password. It uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Secret named 'mysecret' and inject its value into the environment variable `SECRET_DATA`. This is the standard Kubernetes syntax for exposing a Secret's key-value pair as an environment variable.

Answer

env:
- name: SECRET_DATA
  valueFrom:
    configMapKeyRef:
      name: mysecret
      key: password

Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: password
      key: mysecret

Answer

volumeMounts:
- name: secret-volume
  mountPath: /etc/secret
volumes:
- name: secret-volume
  secret:
    secretName: mysecret
    items:
    - key: password
      path: secret.txt

Question 15

A CronJob is configured with concurrencyPolicy: Forbid and schedule: '*/5 * * * *'. The first job takes 7 minutes. What happens when the next scheduled time arrives?

Accepted Answer

The new job is skipped. C is correct because when `concurrencyPolicy: Forbid` is set, the CronJob controller skips creating a new job if the previous job is still running at the next scheduled time. Since the first job takes 7 minutes and the schedule is every 5 minutes, the new job is skipped to prevent overlapping executions.

Answer

The previous job is terminated

Answer

The new job waits until the previous job completes

Answer

A new job is created immediately