CKAD Practice Test 49 — 15 Questions

Question 1

A CronJob is configured with concurrencyPolicy: Forbid. The scheduled job takes longer than the interval between schedules to complete. What happens when the next scheduled time arrives while the previous job is still running?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The CronJob controller skips the new execution and logs a warning. When `concurrencyPolicy: Forbid` is set, the CronJob controller ensures that only one instance of the job runs at a time. If the previous job is still running when the next scheduled time arrives, the controller skips the new execution entirely and logs a warning (e.g., 'job already running'). This prevents overlapping executions, which is critical for workloads that must not run concurrently.

Answer

The running job is killed to make room for the new one

Answer

The new job starts immediately, overriding the running one

Answer

The new job is queued and starts after the running job completes

Question 2

You need to create a TLS secret for an ingress with certificate and key. Which command correctly creates the secret?

Accepted Answer

kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key. `kubectl create secret tls` is the dedicated subcommand for creating a TLS secret, which automatically encodes the certificate and key files and stores them under the expected keys (`tls.crt` and `tls.key`). This is the only command that produces a secret of type `kubernetes.io/tls`, which is required by Ingress controllers to serve HTTPS traffic.

Answer

kubectl create secret docker-registry tls-secret --docker-cert=tls.crt --docker-key=tls.key

Answer

kubectl create secret generic tls-secret --from-file=tls.crt --from-file=tls.key

Answer

kubectl create secret certificate tls-secret --cert= --key=

Question 3

Which THREE statements about ResourceQuota are correct? (Select 3)

Accepted Answer

ResourceQuota can specify both requests and limits for compute resources. A ResourceQuota can specify both `requests` and `limits` for compute resources such as CPU and memory. This allows the quota to enforce constraints on the minimum requested resources and the maximum allowed usage across all pods in a namespace, ensuring fair resource distribution and preventing resource exhaustion.

Answer

ResourceQuota can limit the maximum CPU limit for a single pod

Answer

ResourceQuota applies across all namespaces

Question 4

An Ingress resource uses the annotation 'kubernetes.io/ingress.class: nginx'. However, traffic is not being routed. The cluster has multiple ingress controllers. What is the most likely cause?

Accepted Answer

The annotation is deprecated; use spec.ingressClassName instead.. The annotation `kubernetes.io/ingress.class` is deprecated in Kubernetes 1.18+ and removed in 1.25+. The correct approach is to use `spec.ingressClassName` in the Ingress spec, which references an `IngressClass` resource. Since the cluster has multiple ingress controllers, the deprecated annotation may be ignored or not processed by the intended controller, causing traffic not to be routed.

Answer

The ingress controller is not installed.

Answer

The service backend doesn't exist.

Answer

TLS certificate is invalid.

Question 5

Which probe type is used to determine if a container is ready to serve traffic?

Accepted Answer

Readiness probe. A Readiness probe determines whether a container is ready to accept traffic. If the probe fails, the container is removed from the Service's endpoints, ensuring no requests are routed to an unready pod. This is defined in the PodSpec under `readinessProbe` and is essential for rolling updates and traffic management.

Answer

Liveness probe

Answer

Startup probe

Answer

Resource probe

Question 6

Which command creates a Service named 'my-svc' that exposes a deployment named 'my-deploy' on port 80?

Accepted Answer

kubectl expose deployment my-deploy --name=my-svc --port=80. The `kubectl expose` command is specifically designed to create a Service from an existing resource like a Deployment. By specifying `deployment my-deploy`, `--name=my-svc`, and `--port=80`, it generates a ClusterIP Service that routes traffic to the pods selected by the deployment's labels on port 80.

Answer

kubectl create service my-svc --port=80 --target-port=80

Answer

kubectl run my-svc --expose --port=80 --image=my-image

Answer

kubectl create svc clusterip my-svc --tcp=80:80

Question 7

Which file prevents certain files from being copied into a Docker image during a build?

Accepted Answer

.dockerignore. The `.dockerignore` file is used to specify patterns for files and directories that should be excluded from the Docker build context when running `docker build`. This prevents unnecessary or sensitive files (e.g., `node_modules`, `.git`, secrets) from being sent to the Docker daemon and copied into the image, reducing build time and image size.

Answer

.kubeignore

Answer

Dockerfile.ignore

Answer

.gitignore

Question 8

To mount a ConfigMap as a volume, which field type must be used in the pod spec's volumes and volumeMounts?

Accepted Answer

configMap. To mount a ConfigMap as a volume in a Pod, the `configMap` field type must be specified in the `volumes` array of the Pod spec, and the corresponding `volumeMounts` entry references that volume by name. This tells Kubernetes to populate the volume with the key-value pairs from the ConfigMap, making them available as files in the container's filesystem.

Answer

emptyDir

Answer

secret

Answer

hostPath

Question 9

You have an Ingress with TLS configured. The Ingress controller returns a certificate error when accessing via HTTPS. The secret 'my-tls' exists in the same namespace. Which of the following is the most likely cause?

Accepted Answer

The secret name in the TLS section of the Ingress does not match the actual secret name. The most likely cause is that the secret name specified in the TLS section of the Ingress resource does not match the actual name of the Secret object. When TLS is configured, the Ingress controller reads the `secretName` field to fetch the certificate and key; a mismatch causes the controller to fail to load the TLS material, resulting in a certificate error. Since the secret exists in the same namespace, the only plausible issue is a naming mismatch.

Answer

The Ingress controller does not support TLS

Answer

The secret is in a different namespace than the Ingress

Answer

The certificate is not signed by a trusted CA

Question 10

Which of the following Dockerfile instructions sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions?

Accepted Answer

WORKDIR. The WORKDIR instruction sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions in the Dockerfile. If the directory does not exist, it will be created automatically, and it persists across all subsequent instructions until changed by another WORKDIR.

Answer

EXPOSE

Answer

COPY

Answer

USER

Question 11

Refer to the exhibit. A user has created the Service shown. The application pods listen on port 8080. Which port should an external client use to access the application from outside the cluster?

Accepted Answer

30007. The Service is of type NodePort, which exposes the application on a static port (30007) on each node's IP address. External clients can access the application by hitting any cluster node's IP on port 30007, which forwards traffic to the Service's ClusterIP on port 80, then to the pods on port 8080.

Answer

8080

Answer

80

Answer

30000

Question 12

A namespace 'team-a' has a ResourceQuota with 'pods: 10' and a LimitRange with default memory request '256Mi'. A user creates a pod with no resource requests. What happens?

Accepted Answer

Pod is created with a default memory request of 256Mi.. When a pod is created in a namespace with a LimitRange that specifies a default memory request, Kubernetes automatically injects that default value into the pod's container spec if no explicit memory request is provided. The ResourceQuota of 'pods: 10' only limits the total number of pods, not the resource consumption of individual pods, so it does not affect this pod's creation. Therefore, the pod is created with a default memory request of 256Mi.

Answer

Pod creation fails because the ResourceQuota is exceeded.

Answer

Pod creation fails because the LimitRange is not satisfied.

Answer

Pod is created with no memory request.

Question 13

A Pod has the following environment variable definition:
- name: DB_HOST
  valueFrom:
    configMapKeyRef:
      name: db-config
      key: host
The ConfigMap 'db-config' exists in the same namespace but does not have a key 'host'. What will happen when the Pod starts?

Accepted Answer

The Pod will fail to start because the key is not found. When a Pod references a ConfigMap key that does not exist, the Pod will fail to start. Kubernetes validates the ConfigMap key reference at Pod creation time; if the key is missing, the kubelet will not start the container, and the Pod will remain in a 'CreateContainerConfigError' or 'RunContainerError' state. This is because environment variables are resolved before the container starts, and a missing key is treated as a fatal configuration error.

Answer

The Pod will start and the environment variable will be set to the key name 'host'

Answer

The Pod will start and the environment variable will be empty

Answer

The Pod will start but the variable will be set to the ConfigMap's name

Question 14

Which TWO are valid fields in a Deployment's rollingUpdate configuration? (Select 2)

Accepted Answer

maxSurge. In a Deployment's rolling update configuration, the `maxSurge` field defines the maximum number of Pods that can be created above the desired replica count during the update, while `maxUnavailable` defines the maximum number of Pods that can be unavailable during the update. Both are valid fields within the `spec.strategy.rollingUpdate` object in a Kubernetes Deployment.

Answer

minReadySeconds

Answer

progressDeadlineSeconds

Answer

revisionHistoryLimit

Question 15

You need to get a list of all events in the cluster sorted by timestamp. Which command should you use?

Accepted Answer

kubectl get events --sort-by=.metadata.creationTimestamp. `kubectl get events --sort-by=.metadata.creationTimestamp` retrieves all cluster events and sorts them by the creation timestamp field in the event object's metadata. This is the standard Kubernetes approach for ordering events chronologically, as events are stored in etcd and can be sorted client-side using JSONPath expressions against the resource's metadata.

Answer

kubectl top events

Answer

kubectl describe events

Answer

kubectl logs --events