CKAD Practice Test 9 — 10 Questions

Question 1

You are responsible for a multi-tier application running in a Kubernetes cluster. The frontend Pods communicate with backend Pods via a Service named 'backend' in the same namespace. Recently, the frontend team reported that the backend Service is intermittently unreachable. You inspect the backend Pods and notice that they are all running and ready, but the Endpoints object for the 'backend' Service shows only a subset of the Pod IPs. You also notice that the backend Pods have a readiness probe configured that checks an HTTP endpoint '/healthz'. The readiness probe has a periodSeconds of 5 and failureThreshold of 3. The application logs show occasional spikes in response time on the /healthz endpoint, sometimes exceeding 15 seconds. You need to resolve the intermittent unavailability without removing the readiness probe. Which action should you take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the failureThreshold to 10 and periodSeconds to 10 to tolerate transient slowness. Increasing the failureThreshold to 10 and periodSeconds to 10 gives the readiness probe more time (100 seconds total) to tolerate transient slowness on the /healthz endpoint, preventing premature removal of Pod IPs from the Endpoints object. This keeps all backend Pods in the ready state during response time spikes, ensuring the Service remains reachable.

Answer

Remove the readiness probe configuration from the backend Pods

Answer

Add a second readiness probe on a different endpoint to increase redundancy

Answer

Change the Service type from ClusterIP to NodePort to bypass endpoint issues

Question 2

A developer wants to deploy a stateless application as a set of identical pods. They need the pods to be distributed across nodes and have stable network identities. Which resource should they use?

Accepted Answer

StatefulSet. StatefulSet is the correct resource because it provides each pod with a stable, unique network identity (e.g., pod-name-0, pod-name-1) that persists across rescheduling. While Deployment manages replicas for stateless applications, it does not assign per-pod stable hostnames. The question explicitly requires 'stable network identities' for identical pods, which is a defining feature of StatefulSet. A Service combined with a Deployment gives a stable endpoint for the set, not per-pod identities.

Answer

Job

Answer

Deployment

Answer

DaemonSet

Question 3

A pod is running with the following SecurityContext:
securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  fsGroup: 3000
What UID and GID does the process inside the container use?

Accepted Answer

UID 1000, GID 2000. The `runAsUser` and `runAsGroup` fields in the Pod's SecurityContext directly set the UID and GID for the container's main process. Here, `runAsUser: 1000` sets the process UID to 1000, and `runAsGroup: 2000` sets the process GID to 2000. The `fsGroup: 3000` field only applies to the group ownership of mounted volumes, not to the process's primary GID.

Answer

UID 1000, GID 3000

Answer

UID 0, GID 2000

Answer

UID 3000, GID 2000

Question 4

During a rolling update, you want to ensure that at most 2 pods are unavailable at any time. Which field should you set in the Deployment spec?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable: 2. `spec.strategy.rollingUpdate.maxUnavailable` specifies the maximum number of Pods that can be unavailable during a rolling update. Setting `maxUnavailable: 2` ensures that at most 2 Pods are unavailable at any time, allowing the update to proceed while maintaining the desired availability.

Answer

spec.strategy.type: Recreate

Answer

spec.replicas: 2

Answer

spec.strategy.rollingUpdate.maxSurge: 2

Question 5

Which TWO of the following are valid types for a Kubernetes Secret? (Choose two.)

Accepted Answer

kubernetes.io/tls. Option A, kubernetes.io/tls, is a valid built-in Secret type used to store a TLS certificate and its associated private key, typically consumed by Ingress controllers for HTTPS termination. Option B, kubernetes.io/basic-auth, is also a valid built-in Secret type designed to hold a username and password for basic authentication, with the required keys being 'username' and 'password'. Option C, kubernetes.io/configmap, is not a valid Secret type because ConfigMaps are a separate Kubernetes API object with their own kind and are not represented as a Secret type. Option D, kubernetes.io/tls-key, is not a recognized built-in Secret type; the TLS private key is instead stored as the 'tls.key' data key within a kubernetes.io/tls Secret. Option E, kubernetes.io/ssh-key, is not a built-in Secret type in Kubernetes, as SSH keys would typically be stored using the generic Opaque type or a custom type.

Answer

kubernetes.io/configmap

Answer

kubernetes.io/tls-key

Answer

kubernetes.io/ssh-key

Question 6

What is the purpose of an init container in a pod?

Accepted Answer

To run to completion before the main containers start, often for initialization tasks. Init containers run to completion sequentially before any main containers in the pod start. They are designed for initialization tasks such as setting up databases, waiting for external services, or populating configuration files. Unlike sidecar containers, they do not run alongside the main containers and must exit successfully before the pod transitions to the Running phase.

Answer

To check the health of the main container and restart it if necessary

Answer

To run alongside the main container and provide additional services

Answer

To run a command after the main container starts

Question 7

A pod is scheduled but stays in Pending state. 'kubectl describe pod' shows: '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds the available memory on any node.. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler could not find a node with enough allocatable memory to satisfy the pod's memory request. The pod's memory request (spec.containers[].resources.requests.memory) must be less than or equal to a node's allocatable memory for the pod to be scheduled. Since no node meets this requirement, the pod remains in Pending state.

Answer

The pod has a liveness probe configured incorrectly.

Answer

The namespace has a ResourceQuota that blocks the pod.

Answer

The pod's memory limit is set too low.

Question 8

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/4 nodes are available: 4 Insufficient memory'. Which action will resolve the issue?

Accepted Answer

Scale down other pods in the cluster to free memory. The pod is stuck in 'Pending' because no node has enough allocatable memory to satisfy its memory request. Scaling down other pods frees memory on existing nodes, allowing the scheduler to place the pod. This directly resolves the 'Insufficient memory' condition without changing the pod's specification or cluster topology.

Answer

Add a nodeSelector to target a specific node

Answer

Increase the memory request in the pod spec

Answer

Scale up the Deployment to create more pod replicas

Question 9

You have a Deployment with 3 replicas. The pods have a readiness probe that checks an HTTP endpoint /ready. One pod's readiness probe is failing. What will happen?

Accepted Answer

The pod will be removed from the Service endpoints. C is correct because a failing readiness probe causes the kubelet to mark the pod as not ready, which removes its IP address from the Endpoints object (or EndpointSlice) backing the Service. The pod remains running and is not restarted or terminated; it simply stops receiving traffic from the Service. This ensures that only healthy pods serve requests, maintaining application reliability.

Answer

The pod will be restarted by the kubelet

Answer

The Deployment will create a new pod to maintain 3 replicas

Answer

The pod will be terminated gracefully

Question 10

Which kubectl command creates a ConfigMap named 'app-config' from a file 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap` with the `--from-file` flag creates a ConfigMap from a file, using the filename as the key and the file content as the value. This is the standard Kubernetes method to import configuration data from a local file into a ConfigMap resource.

Answer

kubectl create configmap app-config --file config.properties

Answer

kubectl create configmap app-config --from-env-file config.properties

Answer

kubectl create configmap app-config --from-literal config.properties