CKAD Practice Exam 53 — 20 Questions

Question 1

You run 'kubectl get pods' and see a pod in 'CrashLoopBackOff' state. Which TWO conditions could cause this state?

Accepted Answer

The container exits immediately with a non-zero exit code. A container that exits immediately with a non-zero exit code causes Kubernetes to restart it repeatedly, leading to the CrashLoopBackOff state. The kubelet detects the exit code and increments the restart counter, applying an exponential backoff delay. This is the classic symptom of an application crash or misconfiguration.

Answer

The node is out of disk space

Answer

The readiness probe is failing

Answer

The pod is pending because of insufficient resources

Question 2

Which TWO of the following are valid methods to perform a blue-green deployment in Kubernetes?

Accepted Answer

Create two Services, one for blue and one for green. Initially point an ingress to the blue Service. Update the ingress to point to green after validation.. Option D is correct because blue-green deployment requires two parallel environments and an atomic traffic switch: running separate blue and green Services and using an Ingress (or similar L7 router) to direct traffic to the blue Service, then updating the Ingress backend to the green Service after validation, achieves exactly that cutover without downtime. Option E is correct because two Deployments distinguished by labels (version: blue and version: green) with a Service whose selector initially matches blue, then is updated to match green once the green pods are Ready, is the canonical Kubernetes blue-green pattern using native Service selector switching. Option A is not blue-green because strategy.type: Recreate tears down the old version before starting the new one, causing downtime and providing no parallel green environment to validate. Option B is not blue-green because session affinity on a single Service with two replicas does not create two distinct blue/green versions or an atomic traffic switch. Option C is not blue-green because a RollingUpdate with maxSurge: 100% and maxUnavailable: 0% is a progressive rollout of one version, not two coexisting environments with a controlled cutover.

Answer

Use a Deployment with 'strategy.type: Recreate' and delete the old version before creating the new one.

Answer

Create a Deployment with two replicas and use a Service with session affinity to gradually shift traffic.

Answer

Use a Deployment with 'strategy.type: RollingUpdate' and set 'maxSurge: 100%' and 'maxUnavailable: 0%'.

Question 3

A developer has a Dockerfile that builds a Go application. The final image size is 800MB. Which improvement would MOST reduce the image size?

Accepted Answer

Use multi-stage builds with a scratch final stage. Multi-stage builds allow copying only the binary from the build stage to a minimal base image, drastically reducing final image size.

Answer

Combine all RUN commands into a single layer

Answer

Add a .dockerignore file to exclude unnecessary files

Answer

Use a smaller base image like alpine:3.19

Question 4

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build` command with the `-t` flag (short for `--tag`) is the standard way to build an image from a Dockerfile in the current directory (`.`) and assign it a tag `myapp:v1`. The `-t` flag specifies the repository and tag in the format `name:tag`, and the `.` indicates the build context (the current directory).

Answer

docker image build --name myapp:v1 .

Answer

docker build myapp:v1 .

Answer

docker tag myapp:v1 .

Question 5

A Service of type LoadBalancer is created but the external IP remains <pending>. What is the most likely reason?

Accepted Answer

The cluster does not have a cloud provider configured. A LoadBalancer Service in Kubernetes relies on an external cloud provider (e.g., AWS, GCP, Azure) to provision a real load balancer and assign its external IP. If no cloud provider is configured (e.g., in a bare-metal or Minikube cluster), the external IP will remain <pending> indefinitely because there is no controller to allocate the IP.

Answer

The Service port is already in use

Answer

The Service selector does not match any Pods

Answer

The Pods are not listening on the container port

Question 6

Which TWO of the following conditions must be met for a RollingUpdate to proceed?

Accepted Answer

The new pod must pass its readiness probe. A is correct because during a RollingUpdate, the new pod must pass its readiness probe before the old pod is terminated. This ensures the new pod is capable of serving traffic, preventing service disruption. The readiness probe is checked by the kubelet, and only when it succeeds does the ReplicaSet controller proceed with the update.

Answer

The new ReplicaSet must have the desired number of pods

Answer

The old ReplicaSet must be scaled to zero

Answer

The old ReplicaSet must be deleted

Question 7

A developer wants to restrict network traffic so that only pods with label 'app: frontend' can communicate with pods labeled 'app: backend' on port 8080. Which Kubernetes resource should be used?

Accepted Answer

NetworkPolicy. A NetworkPolicy is the correct Kubernetes resource because it defines ingress and egress rules to control pod-to-pod communication based on labels, namespaces, and ports. By specifying a podSelector matching 'app: backend', an ingress rule allowing traffic from pods with label 'app: frontend' on port 8080, and a policyTypes field including 'Ingress', this resource enforces the desired restriction at the network layer using iptables or eBPF under the hood.

Answer

ResourceQuota

Answer

PodSecurityPolicy

Answer

RoleBinding

Question 8

A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?

Accepted Answer

runAsUser: 1000. `runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This directly satisfies the security policy requirement to run as UID 1000, overriding the default root (UID 0) behavior.

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Answer

privileged: false

Question 9

A developer wants to ensure that a critical application always runs on every node in the cluster. Which resource should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a pod runs on every node in the cluster, or on a subset of nodes based on a node selector. This is the correct resource for deploying a critical application that must be present on all nodes, such as a logging agent or a monitoring daemon.

Answer

StatefulSet

Answer

ReplicaSet

Answer

Deployment

Question 10

A Pod needs to communicate with another Pod in the same cluster but in a different namespace. What is the correct DNS name to use?

Accepted Answer

..svc.cluster.local. Kubernetes DNS resolves services across namespaces using the format `..svc.cluster.local`. When a Pod in one namespace needs to communicate with a service in another namespace, the fully qualified domain name (FQDN) must include the namespace to disambiguate the service. This is defined by the Kubernetes DNS specification, which appends `svc.cluster.local` as the cluster domain suffix.

Answer

..svc.cluster.local

Answer

..pod.cluster.local

Answer

<service>.svc.cluster.local

Question 11

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster?

Accepted Answer

Service type LoadBalancer. Service type LoadBalancer (C) exposes the Service externally by provisioning a cloud load balancer (e.g., AWS ELB, GCP L7) that routes external traffic to the Service's ClusterIP. Service type NodePort (D) exposes the Service on a static port (30000-32767) on every node's IP, allowing external access via :. Both are valid methods for external exposure in Kubernetes.

Answer

Service type ClusterIP

Answer

Service type ExternalName

Answer

Ingress resource with ClusterIP Service

Question 12

A developer creates a headless Service named 'db' to discover all database pod IPs. The Service selects pods with label 'app: db'. The pods are assigned IPs 10.0.0.1, 10.0.0.2, and 10.0.0.3. When a client performs a DNS lookup for 'db', what will it receive?

Accepted Answer

All three pod IPs as separate A records. A headless Service (clusterIP: None) does not have a cluster IP. Instead, DNS queries for the Service name return A records for all pods matching the selector. Since the Service selects pods with label 'app: db', the DNS lookup for 'db' returns the three pod IPs (10.0.0.1, 10.0.0.2, 10.0.0.3) as separate A records, allowing direct pod-to-pod communication.

Answer

The IP of the first pod only

Answer

The cluster IP of the Service

Answer

A round-robin list of pod IPs

Question 13

A pod is scheduled but remains in 'Pending' state. Running 'kubectl describe pod mypod' shows: '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds the available memory on any node. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler attempted to place the pod on a node but found that the node's allocatable memory is less than the pod's memory request. The pod's memory request must be satisfied by at least one node for scheduling to succeed; if no node has enough unallocated memory, the pod remains Pending. This is a resource request, not a limit, that gates scheduling.

Answer

The pod is using too many CPU resources

Answer

The pod's memory limit is too low

Answer

The pod's container is crashing due to a bug

Question 14

You need to view events for a specific pod named 'web-1' in the 'default' namespace. Which command shows events related to this pod?

Accepted Answer

kubectl get events --field-selector involvedObject.name=web-1. `kubectl get events --field-selector involvedObject.name=web-1` filters events by the `involvedObject.name` field, which directly matches the pod name. This is the precise way to retrieve only events related to a specific pod in Kubernetes, as events are associated with objects via the `involvedObject` field, not labels.

Answer

kubectl get events

Answer

kubectl describe pod web-1 --events

Answer

kubectl get events --selector name=web-1

Question 15

Sequence the steps to troubleshoot a Pod stuck in CrashLoopBackOff state.

Accepted Answer

Check Pod status, then inspect logs and events, then fix the issue, then restart the Pod.. Start by checking status, then inspect logs and events to diagnose. Fix the issue, then restart the Pod.

Answer

Restart the Pod, then check Pod status, then inspect logs and events, then fix the issue.

Answer

Inspect logs and events, then fix the issue, then restart the Pod, then check Pod status.

Answer

Fix the issue, then check Pod status, then inspect logs and events, then restart the Pod.

Question 16

You need to run a batch job that processes 10 items in parallel across 10 Pods, but the job should be considered complete only when all 10 Pods have succeeded. Which Job configuration is correct?

Accepted Answer

spec: completions: 10; parallelism: 10. Setting `completions: 10` and `parallelism: 10` tells Kubernetes to run 10 Pods concurrently (parallelism) and consider the Job successful only after all 10 Pods have completed without error (completions). This matches the requirement of processing 10 items in parallel with a completion condition of all Pods succeeding.

Answer

spec: completions: 10; parallelism: 1

Answer

spec: completions: 1; parallelism: 10

Answer

spec: completions: 10; parallelism: 0

Question 17

You need to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates the appropriate Service?

Accepted Answer

kubectl expose deployment web --port=80. The `kubectl expose deployment web --port=80` command creates a Service of type ClusterIP by default, which exposes the Deployment's pods on port 80 internally within the cluster. This matches the requirement to expose the 'web' Deployment on port 80 internally without specifying a target port, as it defaults to the container's port defined in the Deployment.

Answer

kubectl create service clusterip web --tcp=80:80

Answer

kubectl apply -f service.yaml

Answer

kubectl run web --image=nginx --port=80

Question 18

A pod uses a ServiceAccount 'my-sa' but the pod's container needs to list pods in the namespace. Which RBAC resources are necessary?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are necessary because the pod's ServiceAccount 'my-sa' needs permissions to list pods within a specific namespace. A Role defines the allowed API operations (e.g., 'list pods') scoped to a namespace, and a RoleBinding binds that Role to the ServiceAccount, granting those permissions within that namespace. This is the standard RBAC pattern for namespace-scoped access in Kubernetes.

Answer

Role and ClusterRoleBinding

Answer

ServiceAccount and RoleBinding only

Answer

ClusterRole and ClusterRoleBinding

Question 19

Which TWO of the following are valid ways to consume environment variables from a ConfigMap in a pod?

Accepted Answer

envFrom:
- configMapRef:
    name: myconfig. `envFrom` with a `configMapRef` injects all key-value pairs from the named ConfigMap as environment variables into the container. This is a concise way to consume multiple variables without specifying each key individually, as defined in the Kubernetes API for Pods.

Answer

env:
- name: VAR
  configMapRef:
    name: myconfig
    key: mykey

Answer

volumeMounts:
- name: config-volume
  mountPath: /etc/config
volumes:
- name: config-volume
  configMap:
    name: myconfig

Answer

env:
- name: VAR
  valueFrom:
    configMapRef:
      name: myconfig
      key: mykey

Question 20

You create a Secret with 'kubectl create secret generic db-secret --from-literal=password=myPass'. Later, you mount it as a volume in a pod. When you exec into the container and cat the file, what will you see?

Accepted Answer

myPass. When you mount a Secret as a volume, Kubernetes automatically decodes the base64-encoded data and presents the file contents as the original plaintext value. In this case, the Secret stores the literal key-value pair `password=myPass`, and when mounted, the file named `password` contains the decoded value `myPass`.

Answer

password=myPass

Answer

bXlQYXNz

Answer

An error because secrets cannot be mounted as volumes