CKAD Practice Test 45 — 15 Questions

Question 1

Which command shows resource usage (CPU and memory) for pods?

Accepted Answer

kubectl top pod. The `kubectl top pod` command retrieves and displays real-time CPU and memory usage metrics for pods from the metrics server, which aggregates resource usage data from kubelets via the Resource Metrics API. This is the correct command to view per-pod resource consumption in a Kubernetes cluster.

Answer

kubectl top node

Answer

kubectl resource pod

Answer

kubectl metrics pod

Question 2

You need to configure a liveness probe for a container that starts a web server on port 8080. The probe should check the '/healthz' endpoint. Which YAML snippet correctly defines this probe?

Accepted Answer

livenessProbe:
  httpGet:
    path: /healthz
    port: 8080. It defines an HTTP GET liveness probe that checks the '/healthz' endpoint on port 8080, which is the standard way to verify the health of a web server. The `httpGet` probe sends an HTTP GET request to the specified path and port, and the container is considered healthy if the response status code is between 200 and 399.

Answer

livenessProbe:
  exec:
    command: ["curl", "http://localhost:8080/healthz"]

Answer

livenessProbe:
  httpGet:
    port: 8080

Answer

livenessProbe:
  tcpSocket:
    port: 8080

Question 3

Which field in a CronJob spec specifies the maximum number of successful jobs that should be retained?

Accepted Answer

.spec.successfulJobsHistoryLimit. The `.spec.successfulJobsHistoryLimit` field in a CronJob spec explicitly controls the number of successful jobs that are retained after completion. This field defaults to 3 and, when set to 0, suppresses the retention of any successful job history, directly managing cluster resource usage by limiting the accumulation of completed Pods.

Answer

.spec.jobTemplate.spec.backoffLimit

Answer

.spec.jobHistory.succeeded

Answer

.spec.history.successfulJobsLimit

Question 4

Which TWO actions can help prevent a container from being compromised if an attacker gains access? (Select 2)

Accepted Answer

Setting securityContext.readOnlyRootFilesystem: true. Setting `securityContext.readOnlyRootFilesystem: true` makes the container's root filesystem read-only, preventing an attacker who gains access from modifying system binaries, libraries, or configuration files. This is a key defense-in-depth measure that limits the impact of a compromise by restricting write access to only explicitly mounted volumes.

Answer

Setting automountServiceAccountToken: true

Answer

Setting securityContext.allowPrivilegeEscalation: true

Answer

Setting securityContext.runAsUser: 0

Question 5

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, which means the container's memory usage exceeded its configured memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to allocate more memory without being terminated by the Out-of-Memory (OOM) killer.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Question 6

You have a multi-container pod with two containers: container-A and container-B. container-B needs to access the network of container-A. Which configuration is required?

Accepted Answer

No additional configuration is needed; they share the same network namespace. In Kubernetes, containers within the same pod share the same network namespace by default, including the same IP address and port space. This means container-B can reach container-A via localhost and the port that container-A is listening on, without any additional configuration. The shared network namespace is a fundamental property of pod design, enabling direct inter-container communication.

Answer

Define a ServiceAccount for container-B to access container-A

Answer

Set hostNetwork: true in the pod spec

Answer

Expose the port in container-A and map it in container-B

Question 7

Which THREE of the following are valid Kustomize features? (Select THREE)

Accepted Answer

resources. `resources` is a core Kustomize field used to list the YAML files (or directories) that form the base set of Kubernetes resources to be customized. Without `resources`, Kustomize has no manifests to process, making it essential for defining the input to the kustomization build.

Answer

serviceAccount

Answer

ingress

Question 8

Which TWO of the following are correct ways to pause a rollout of a Deployment named 'myapp'? (Select TWO)

Accepted Answer

kubectl rollout pause deployment/myapp. `kubectl rollout pause deployment/myapp` is the dedicated command to pause a rollout. Option C is also correct because the Deployment spec includes a `paused` field; setting `spec.paused: true` via `kubectl edit` or `kubectl patch` achieves the same effect. Option B (`kubectl rollout undo`) rolls back a rollout, not pauses it. Option D (`kubectl rollout resume`) resumes a paused rollout. Option E triggers a new rollout with `set image` before pausing, which does not simply pause the current rollout.

Answer

kubectl rollout undo deployment/myapp

Answer

kubectl rollout resume deployment/myapp

Answer

kubectl set image deployment/myapp app=nginx && kubectl rollout pause deployment/myapp

Question 9

You are using the Recreate strategy for a Deployment. What happens during an update?

Accepted Answer

All existing pods are terminated before new pods are created. The Recreate strategy terminates all existing pods before creating new ones. This is defined in the Deployment's `strategy.type: Recreate` field, which ensures that old Pods are deleted first, and only after they are fully terminated are new Pods created. This guarantees no overlapping versions run simultaneously, but it also causes downtime during the update.

Answer

New pods are created before old ones are terminated

Answer

Pods are updated in-place with a rolling update

Answer

Some old pods remain running until new ones become ready

Question 10

Which kubectl command shows the rollout history of a Deployment named 'app'?

Accepted Answer

kubectl rollout history deployment app. `kubectl rollout history deployment app` is the specific command designed to display the revision history of a Deployment, including revision numbers and, if configured, the change-cause annotation. This command retrieves the stored rollout history from the Deployment's annotation `deployment.kubernetes.io/revision` and lists all previous ReplicaSets that were created during rollouts.

Answer

kubectl rollout status deployment app

Answer

kubectl describe deployment app

Answer

kubectl get events --field-selector involvedObject.kind=Deployment

Question 11

A cluster administrator wants to prevent all pods in a namespace from running with privileged escalation. Which Pod Security Admission standard enforces this?

Accepted Answer

restricted. The 'restricted' Pod Security Admission (PSA) standard enforces the most stringent security controls, including preventing privileged escalation by setting `securityContext.AllowPrivilegeEscalation` to `false` and requiring containers to run as non-root. This directly addresses the cluster administrator's goal of blocking privilege escalation in all pods within a namespace.

Answer

baseline

Answer

privileged

Answer

high

Question 12

A pod has been scheduled on a node but is stuck in 'ContainerCreating' state. The team suspects a missing storage class. Which command would best confirm this?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` provides detailed event logs and status conditions for the pod, including specific error messages like 'failed to provision volume with StorageClass' or 'storageclass.storage.k8s.io "" not found'. This directly confirms whether a missing storage class is the root cause of the 'ContainerCreating' state, as the pod's events will surface the exact provisioning failure.

Answer

kubectl describe node

Answer

kubectl get pvc

Answer

kubectl get storageclass

Question 13

A user creates a Job with '.spec.completions=5' and '.spec.parallelism=2'. How many pods will run at the same time?

Accepted Answer

2. `.spec.parallelism=2` directly specifies the maximum number of Pods that can run concurrently for the Job. The `.spec.completions=5` value only sets the total number of successful completions required, not the parallelism. Therefore, at any given time, only 2 Pods will run simultaneously.

Answer

5

Answer

10

Answer

7

Question 14

What is the default service type in Kubernetes?

Accepted Answer

ClusterIP. The default service type in Kubernetes is ClusterIP, which exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, enabling pod-to-pod communication without external access. If no `type` field is specified in the Service manifest, Kubernetes automatically sets `type: ClusterIP`.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 15

Which THREE components are essential for setting up Horizontal Pod Autoscaling (HPA) based on CPU utilization? (Select three)

Accepted Answer

An HPA resource targeting the Deployment. Option C is correct because the HPA controller scales a target workload, and in this scenario the HPA resource must be created with a scaleTargetRef pointing to the Deployment so it can adjust the replica count. Option D is correct because CPU utilization-based HPA relies on the metrics.k8s.io API provided by metrics-server; without metrics-server installed and registered, the HPA cannot retrieve pod CPU usage and will report unknown metrics. Option E is correct because HPA calculates CPU utilization as a percentage of the container's CPU request, so each container in the target pods must have resources.requests.cpu set for the utilization target to be computed. Option A is not required because readiness probes affect traffic routing and pod availability, not the HPA's ability to read CPU metrics. Option B is not required because a LoadBalancer Service only exposes the workload externally and has no role in HPA metric collection or scaling decisions.

Answer

A readiness probe on the pod

Answer

A Service of type LoadBalancer