CKAD Practice Test 5 — 10 Questions

Question 1

When performing a rolling update of a Deployment, which field in the Deployment spec controls the maximum number of Pods that can be created above the desired replicas during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

Answer

spec.strategy.type

Answer

spec.strategy.rollingUpdate.maxUnavailable

Answer

spec.replicas

Question 2

Which THREE of the following are valid fields for configuring a probe in Kubernetes? (Select 3)

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe configuration (e.g., livenessProbe, readinessProbe, startupProbe). It defines the number of seconds after the container has started before the probe is initiated, allowing the application time to initialize before health checks begin.

Answer

retrySeconds

Answer

intervalSeconds

Question 3

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 4

Which TWO approaches can be used to expose a Secret's value as an environment variable in a pod?

Accepted Answer

env:
  - name: MY_SECRET
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: my-key. The `valueFrom.secretKeyRef` field in a container's `env` definition directly references a specific key from a Kubernetes Secret and injects its value as an environment variable. This is the standard method for exposing a single secret key as an environment variable, as defined in the Kubernetes API.

Answer

volumeMounts:
  - name: secret-volume
    mountPath: /etc/secret

Answer

env:
  - name: MY_SECRET
    value: "$(MY_SECRET)"

Answer

env:
  - name: MY_SECRET
    valueFrom:
      configMapKeyRef:
        name: my-secret
        key: my-key

Question 5

Which TWO statements about NetworkPolicy are correct? (Choose two.)

Accepted Answer

NetworkPolicy uses labels to select pods within a namespace. NetworkPolicy uses label selectors in its `spec.podSelector` field to identify which pods within a namespace the policy applies to. This allows fine-grained control over traffic to and from specific sets of pods based on their labels, without needing to reference pod names or IPs.

Answer

If no NetworkPolicy selects a pod, then that pod is isolated and traffic is denied

Answer

NetworkPolicy is only applicable to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 6

You have a Deployment with 'replicas: 3' and the HPA is configured with 'targetCPUUtilizationPercentage: 80'. The current CPU usage is at 60% across all pods, but the HPA has scaled up to 5 replicas. What is the most likely reason?

Accepted Answer

The CPU request in the Deployment's resource spec might be set lower than expected, causing the HPA to perceive higher utilization.. The HPA calculates CPU utilization as the average CPU usage across all pods divided by the CPU request of each pod. If the Deployment's container resource requests are set to a value that is lower than expected (e.g., 0.5 CPU instead of 1.0 CPU), then the same absolute CPU usage results in a higher utilization percentage. With 3 pods at 60% actual usage but a low CPU request, the utilization relative to the request could exceed the 80% target, triggering scale-up to 5 replicas. Therefore, option A is the most likely reason: a mismatch in the CPU request on the Deployment's resource spec causes the HPA to perceive higher utilization.

Answer

The HPA has a behavior policy that scales up aggressively

Answer

The HPA is using the 'averageUtilization' target type on a custom metric, not CPU

Answer

The HPA is reading the total CPU usage instead of average

Question 7

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Accepted Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretKeyRef:
      name: my-secret
      key: key. `secretKeyRef` is the standard Kubernetes API field for referencing a specific key from a Secret object and injecting its value as an environment variable. Option E is correct because `envFrom` with `secretRef` allows you to load all key-value pairs from a Secret as environment variables into the pod, which is a valid and common pattern.

Answer

env:
- name: SECRET_KEY
  valueFrom:
    configMapKeyRef:
      name: my-secret
      key: key

Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretEnvRef:
      name: my-secret
      key: key

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 8

Which THREE of the following are valid parameters for configuring probes? (Select 3)

Accepted Answer

timeoutSeconds. In Kubernetes, probe configuration parameters are defined in the container spec within a Pod. `timeoutSeconds` is a valid parameter that specifies the number of seconds after which the probe times out, defaulting to 1 second if not set. It is used in liveness, readiness, and startup probes to control how long kubelet waits for a probe response before considering it failed.

Answer

retryIntervalSeconds

Answer

cooldownSeconds

Question 9

You have just applied a new Deployment configuration using 'kubectl apply -f deployment.yaml'. You want to see the latest revision number of the rollout. Which command should you run?

Accepted Answer

kubectl rollout history deployment/myapp. 'kubectl rollout history deployment/<name>' shows revision history with revision numbers. The latest revision is shown as the most recent.

Answer

kubectl rollout status deployment/myapp

Answer

kubectl get deployment myapp -o yaml

Answer

kubectl describe deployment myapp

Question 10

To prevent a container from running as root, which field should be set in the securityContext?

Accepted Answer

runAsNonRoot: true. The `runAsNonRoot: true` field in the securityContext explicitly prevents the container from running as the root user (UID 0). When set, Kubernetes will refuse to start the container if the image is configured to run as root, enforcing a non-root execution policy at the pod or container level. This is the direct and intended mechanism for ensuring the container does not run with root privileges.

Answer

runAsUser: 1000

Answer

allowPrivilegeEscalation: false

Answer

readOnlyRootFilesystem: true