CKAD Practice Exam 54 — 20 Questions

Question 1

An Ingress resource specifies TLS termination using a secret. The secret must contain which keys?

Accepted Answer

tls.crt and tls.key. Kubernetes Ingress resources require TLS termination secrets to contain exactly two keys: `tls.crt` (the TLS certificate) and `tls.key` (the private key). The Ingress controller reads these specific key names from the Secret's `data` or `stringData` field to configure HTTPS termination, as defined by the Kubernetes API specification.

Answer

username and password

Answer

cert.pem and key.pem

Answer

ca.crt and tls.crt

Question 2

A pod named 'db-pod' is running but not responding as expected. You want to check its logs from the previous instantiation (after a crash). Which command should you use?

Accepted Answer

kubectl logs db-pod --previous. The `--previous` flag in `kubectl logs` retrieves logs from the previous instantiation of a container in a pod that has crashed or restarted. This allows you to inspect the logs from the terminated container before the current running instance, which is essential for debugging why the pod is not responding as expected after a crash.

Answer

kubectl exec db-pod -- cat /var/log/app.log

Answer

kubectl logs -f db-pod

Answer

kubectl describe pod db-pod

Question 3

A cluster has a node that is NotReady. The kubelet on that node is not responding. Which command should be used to investigate the kubelet logs on the node?

Accepted Answer

journalctl -u kubelet. `journalctl -u kubelet` directly queries the systemd journal for logs from the kubelet service on the node. Since the kubelet is not responding, you cannot use `kubectl` to access its logs remotely; you must SSH into the node and use `journalctl` (or `systemctl status kubelet`) to read the kubelet's logs locally.

Answer

kubectl logs --node=

Answer

kubectl describe node <node>

Answer

kubectl get events --field-selector involvedObject.kind=Node

Question 4

Which THREE of the following are true about using 'kubectl rollout undo'? (Select three)

Accepted Answer

It rolls back to the previous revision by default. 'kubectl rollout undo' without any flags reverts a Deployment to the previous revision (revision N-1) by default. This is the standard behavior for rollback operations in Kubernetes, where each change to a Deployment's pod template creates a new revision in the rollout history.

Answer

It pauses the current rollout

Answer

It deletes the current Deployment and recreates it from scratch

Question 5

A Deployment named 'web' has replicas: 3 and update strategy type: Recreate. You run 'kubectl set image deployment/web web=nginx:1.22'. What immediate effect will this have on the existing pods?

Accepted Answer

All existing pods are terminated simultaneously, then new pods are created.. The Deployment's update strategy type is set to 'Recreate', which means all existing pods are terminated simultaneously before any new pods are created. When you run 'kubectl set image deployment/web web=nginx:1.22', it triggers a rollout that follows the Recreate strategy: first, all current pods are deleted, then the new pods are created with the updated image. This is in contrast to the RollingUpdate strategy, which updates pods gradually.

Answer

One pod is terminated, then a new pod is created, repeating until all are updated.

Answer

The command fails because Recreate does not support image updates.

Answer

The pods are updated in place without termination.

Question 6

You have an Ingress resource with TLS configured. The certificate is stored in a Secret named 'my-tls'. Which field in the Ingress YAML specifies the Secret name?

Accepted Answer

.spec.tls[0].secretName. In Kubernetes Ingress resources, the TLS configuration is defined under `.spec.tls`, which is an array of TLS objects. Each object contains a `hosts` field and a `secretName` field that references the Kubernetes Secret holding the TLS certificate and private key. Option A correctly identifies `.spec.tls[0].secretName` as the field that specifies the Secret name.

Answer

.spec.tls[0].secret

Answer

.metadata.annotations['cert-manager.io/cluster-issuer']

Answer

.spec.tlsSecretName

Question 7

You have a Service named 'my-svc' in the 'prod' namespace. What is the fully qualified DNS name for this Service?

Accepted Answer

my-svc.prod.svc.cluster.local. The fully qualified DNS name for a Service in Kubernetes follows the pattern `..svc.cluster.local`. For 'my-svc' in the 'prod' namespace, this resolves to 'my-svc.prod.svc.cluster.local'. This is the standard DNS naming convention used by CoreDNS (or kube-dns) for Service discovery within a cluster.

Answer

my-svc.svc.cluster.local

Answer

prod.my-svc.svc.cluster.local

Answer

my-svc.prod.cluster.local

Question 8

A pod is running but not responding to requests. The developer suspects the liveness probe is misconfigured. Which command can they use to check the probe configuration of a running pod?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` displays the full pod specification, including the liveness probe configuration (e.g., `Liveness: http-get /healthz delay=0s timeout=1s period=10s #success=1 #failure=3`). This allows the developer to verify the probe type, endpoint, initial delay, timeout, and failure threshold directly from the running pod's definition.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- env

Answer

kubectl get pod <pod-name>

Question 9

A Deployment has replicas: 3 and uses a ConfigMap. The ConfigMap is updated. The developer wants to update the pods to use the new ConfigMap without recreating the Deployment. What is the correct approach?

Accepted Answer

kubectl rollout restart deployment/. A `kubectl rollout restart deployment/` triggers a rolling restart of the Pods managed by the Deployment. Since ConfigMaps are mounted as volumes or injected as environment variables at Pod creation time, the only way to pick up updated ConfigMap data without recreating the Deployment object itself is to force the existing Pods to be terminated and recreated. The Deployment controller handles this gracefully, ensuring zero downtime by following the configured rolling update strategy.

Answer

kubectl set image deployment/ =

Answer

The pods automatically mount the new ConfigMap within seconds

Answer

Delete and recreate each pod manually

Question 10

A CronJob is configured with 'concurrencyPolicy: Forbid'. What happens if the scheduled time arrives while the previous job is still running?

Accepted Answer

The new job is skipped until the next scheduled time. When `concurrencyPolicy: Forbid` is set on a CronJob, Kubernetes ensures that no new Job is created if the previous Job is still running. The CronJob controller checks the status of the most recent Job; if it has not completed, the scheduled execution is skipped entirely, and the next run occurs at the next scheduled time. This prevents overlapping executions, which is critical for workloads that must not run concurrently.

Answer

The new job starts immediately, running concurrently

Answer

The running job is terminated and the new job starts

Answer

The CronJob enters an error state

Question 11

A developer needs to expose a database password to a Pod as an environment variable, securely. What should they do?

Accepted Answer

Create a Secret and use secretKeyRef in the env definition. Kubernetes Secrets are the recommended mechanism for storing sensitive data like passwords. By referencing the Secret's key via `secretKeyRef` in the `env` definition of a Pod, the password is injected as an environment variable without being exposed in the Pod manifest or stored in plaintext. This approach ensures the data is base64-encoded at rest (and can be encrypted at rest with etcd encryption) and avoids the security risks of hardcoding or using ConfigMaps for secrets.

Answer

Hardcode the password in the Pod YAML

Answer

Store the password in a ConfigMap and use configMapKeyRef

Answer

Use a ConfigMap with binaryData field

Question 12

You have a Service named 'app-service' in namespace 'default'. You want a pod in namespace 'monitoring' to resolve the service DNS name. What is the correct fully qualified domain name (FQDN)?

Accepted Answer

app-service.default.svc.cluster.local. The standard FQDN for a Kubernetes Service follows the pattern `..svc.cluster.local`. This allows a pod in any namespace (including 'monitoring') to resolve the service by appending the cluster's DNS suffix. The DNS query for `app-service.default.svc.cluster.local` will be handled by CoreDNS (or kube-dns) and return the cluster IP of the service.

Answer

app-service.default.cluster.local

Answer

app-service.svc.default.cluster.local

Answer

app-service.cluster.local.default.svc

Question 13

Which command is used to undo the most recent rollout of a Deployment named 'myapp'?

Accepted Answer

kubectl rollout undo deployment myapp. `kubectl rollout undo deployment myapp` reverts the Deployment to the previous revision by default, effectively undoing the most recent rollout. This command uses the rollout history stored in the Deployment's annotations (e.g., `deployment.kubernetes.io/revision`) to identify and apply the prior ReplicaSet.

Answer

kubectl rollout undo deployment myapp --to-revision=2

Answer

kubectl rollout status deployment myapp

Answer

kubectl rollback deployment myapp

Question 14

Which kubectl command creates a Secret named 'db-secret' with key 'password' and value 'mypwd'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=mypwd. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=mypwd` creates a secret with key 'password' and value 'mypwd', which is the exact requirement.

Answer

kubectl create secret generic db-secret password=mypwd

Answer

kubectl create secret generic db-secret --from-file=password=mypwd

Answer

kubectl create secret generic db-secret --from-env-file=password=mypwd

Question 15

You have a Job that runs a batch process. The Job YAML is as follows:

apiVersion: batch/v1
kind: Job
metadata:
  name: batch-job
spec:
  parallelism: 4
  completions: 12
  backoffLimit: 2
  template:
    spec:
      containers:
      - name: worker
        image: myapp:latest
      restartPolicy: Never

If one pod fails after 3 successful completions, and the Job has already completed 7 successes, how many pods will be running at that point? Assume no other failures.

Accepted Answer

4. The Job is configured with parallelism: 4, meaning up to 4 pods run concurrently. At the moment a pod fails after 3 successful completions and the Job has already achieved 7 successes, the Job controller will still be running pods to reach the target of 12 completions. Since the failure does not reduce the number of running pods below the parallelism limit, and no other failures have occurred, the Job will continue to run 4 pods simultaneously.

Answer

3

Answer

7

Answer

5

Question 16

You are tasked with improving the observability of a microservices application running in Kubernetes. The application is deployed with multiple replicas and experiences occasional high latency. Which TWO actions should you take to gain better insight into the application's performance?

Accepted Answer

Enable Prometheus metrics endpoints on each pod and configure a Prometheus server to scrape them.. Option B is correct because exposing Prometheus metrics endpoints on each pod and configuring a Prometheus server to scrape them provides quantitative observability into request rates, error rates, and latency histograms per service and replica, which is essential for diagnosing occasional high latency in a microservices application. Option E is correct because implementing distributed tracing with Jaeger captures end-to-end request flows across service boundaries, letting you pinpoint which service or call in a chain contributes to latency spikes, something metrics alone cannot attribute to a specific request path. The unmarked options do not belong: A (increasing replica count) is a scaling remediation, not an observability action, and may mask rather than reveal the root cause; C (readiness probes) and D (liveness probes) are availability and health-management mechanisms that affect traffic routing and container restarts but do not provide performance insight into latency.

Answer

Increase the replica count for each deployment to reduce latency.

Answer

Configure readiness probes to ensure only healthy pods receive traffic.

Answer

Add liveness probes to all containers to detect when they are unresponsive.

Question 17

Which kubectl command creates a ConfigMap named 'app-config' from a file called 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. The `kubectl create configmap` command with the `--from-file` flag directly creates a ConfigMap from the contents of a specified file, using the filename as the key and the file content as the value. This is the standard method for creating a ConfigMap from a single file like 'config.properties'.

Answer

kubectl create configmap app-config --from-env-file=config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl apply -f config.properties

Question 18

Which Dockerfile instruction is used to specify the base image for a build?

Accepted Answer

FROM. The FROM instruction initializes a new build stage and sets the base image for subsequent instructions. In Docker, every Dockerfile must start with a FROM (or ARG before FROM) to specify an existing image, such as `FROM ubuntu:22.04` or `FROM alpine:3.18`, from which the new image is built. Without FROM, the build has no foundation and will fail.

Answer

COPY

Answer

RUN

Answer

CMD

Question 19

A pod needs to mount a Secret named 'db-secret' as a volume at /etc/secret. Which volume mount definition is correct?

Accepted Answer

volumes:
- name: secret-volume
  secret:
    secretName: db-secret. It uses the proper `secret` key under the `volumes` field to reference a Secret object by its `secretName`. When this volume is mounted at `/etc/secret`, Kubernetes automatically creates a file for each key in the Secret, with the file content being the decoded value of the key. This is the standard syntax for mounting a Secret as a volume.

Answer

volumes:
- name: secret-volume
  secretVolumeSource:
    secretName: db-secret

Answer

volumes:
- name: db-secret
  secret:
    secretName: db-secret

Answer

volumes:
- name: secret-volume
  secret:
    name: db-secret

Question 20

You have a HorizontalPodAutoscaler (HPA) that targets CPU utilization at 50%. The current average CPU utilization is 80%. The HPA has a stabilization window of 300 seconds and a scale-down policy with a periodSeconds of 60. CPU utilization drops to 40%. How long will it take for the HPA to begin scaling down?

Accepted Answer

After 300 seconds. The HPA will begin scaling down after 300 seconds because the stabilization window for scale-down is set to 300 seconds. During this window, the HPA evaluates all recommended replica counts and selects the highest one, effectively delaying any scale-down action until the window expires. Even though CPU dropped to 40% (below the 50% target), the stabilization window prevents premature scale-down.

Answer

Immediately

Answer

After 60 seconds

Answer

After 360 seconds