CKAD Application Environment, Configuration and Security — 40 Questions

Question 1

A pod named 'web-app' is running but has no environment variables. The developer wants to inject a variable 'DB_URL=postgres://db:5432' from a ConfigMap named 'db-config'. Which pod spec snippet correctly achieves this?

Accepted Answer

env:
- name: DB_URL
  valueFrom:
    configMapKeyRef:
      name: db-config
      key: DB_URL. Option D is correct because it uses the `configMapKeyRef` field under `valueFrom` to inject a specific key from a ConfigMap as an environment variable. This allows the pod to consume the `DB_URL` value from the `db-config` ConfigMap without exposing it as a file or using `envFrom`.

Answer

env:
- name: DB_URL
  value: "postgres://db:5432"

Answer

envFrom:
- configMapRef:
    name: db-config
    key: DB_URL

Answer

env:
- name: DB_URL
  valueFrom:
    secretKeyRef:
      name: db-config
      key: DB_URL

Question 2

A deployment runs a container that needs to read a file from a host path '/var/log/app' on the node. The file must be available to all pods on that node. Which volume type should be used?

Accepted Answer

hostPath. B is correct because hostPath mounts a file or directory from the host node's filesystem into the pod, making it available to all pods scheduled on that node. This is the only volume type that directly accesses a specific host path like '/var/log/app', ensuring the file is shared across all pods on the same node.

Answer

emptyDir

Answer

persistentVolumeClaim

Answer

configMap

Question 3

A pod uses a service account 'my-sa' with a RoleBinding that grants get and list on pods in namespace 'app'. The pod runs a process that calls the Kubernetes API to list pods. However, the API call returns 403. What is the most likely cause?

Accepted Answer

The pod does not have the service account token mounted.. Option C is correct because the pod must have the service account token mounted to authenticate to the Kubernetes API server. By default, Kubernetes automatically mounts the service account token into pods via a projected volume at /var/run/secrets/kubernetes.io/serviceaccount/token. If the pod is configured with automountServiceAccountToken: false or the token is not mounted, the API client cannot authenticate, resulting in a 403 Forbidden error even if the RoleBinding grants the correct permissions.

Answer

The API server is not running.

Answer

The RoleBinding is in the wrong namespace.

Answer

The Role does not include list permission.

Question 4

A developer wants to restrict network traffic so that only pods with label 'app: frontend' can communicate with pods labeled 'app: backend' on port 8080. Which Kubernetes resource should be used?

Accepted Answer

NetworkPolicy. A NetworkPolicy is the correct Kubernetes resource because it defines ingress and egress rules to control pod-to-pod communication based on labels, namespaces, and ports. By specifying a podSelector matching 'app: backend', an ingress rule allowing traffic from pods with label 'app: frontend' on port 8080, and a policyTypes field including 'Ingress', this resource enforces the desired restriction at the network layer using iptables or eBPF under the hood.

Answer

ResourceQuota

Answer

PodSecurityPolicy

Answer

RoleBinding

Question 5

A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?

Accepted Answer

runAsUser: 1000. Option B is correct because `runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This directly satisfies the security policy requirement to run as UID 1000, overriding the default root (UID 0) behavior.

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Answer

privileged: false

Question 6

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Accepted Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretKeyRef:
      name: my-secret
      key: key. Option D is correct because `secretKeyRef` is the standard Kubernetes API field for referencing a specific key from a Secret object and injecting its value as an environment variable. Option E is correct because `envFrom` with `secretRef` allows you to load all key-value pairs from a Secret as environment variables into the pod, which is a valid and common pattern.

Answer

env:
- name: SECRET_KEY
  valueFrom:
    configMapKeyRef:
      name: my-secret
      key: key

Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretEnvRef:
      name: my-secret
      key: key

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 7

Which THREE of the following are valid fields in a PodSecurityPolicy (PSP) that control Linux capabilities? (Select exactly 3)

Accepted Answer

defaultAddCapabilities. Option B is correct because `defaultAddCapabilities` is a valid field in a PodSecurityPolicy (PSP) that specifies a list of Linux capabilities to be added to containers by default, even if not explicitly requested in the container's security context. This field is part of the PSP's capabilities control mechanism, as defined in the Kubernetes PodSecurityPolicy spec.

Answer

privileged

Answer

readOnlyRootFilesystem

Question 8

You are designing a Pod that runs a legacy application requiring a specific configuration file mounted at /etc/config/app.conf. The configuration is stored in a Kubernetes ConfigMap named 'app-config' with key 'config.yaml'. Which approach ensures the configuration is mounted correctly and the container automatically receives updates when the ConfigMap changes?

Accepted Answer

Create a ConfigMap volume mount at /etc/config, mounting the entire ConfigMap, and ensure the application reads /etc/config/config.yaml.. Option A is correct because mounting the entire ConfigMap as a volume at /etc/config creates a symlink-based directory where each key becomes a file. When the ConfigMap is updated, kubelet automatically refreshes the symlink targets, so the container sees the new content without requiring a restart. This satisfies the requirement of mounting the configuration file at /etc/config/app.conf (the file will be /etc/config/config.yaml) and receiving live updates.

Answer

Create a hostPath volume at /etc/config and copy the ConfigMap content to the node.

Answer

Use the ConfigMap to set an environment variable CONFIG and have the application read it from the environment.

Answer

Create a ConfigMap volume mount at /etc/config/app.conf using subPath: config.yaml.

Question 9

A developer creates a Secret named 'db-secret' with key 'password'. They want to expose the password as an environment variable DB_PASSWORD in a Pod. Which of the following is the correct way to achieve this?

Accepted Answer

Set env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password. Option A is correct because it uses the `valueFrom.secretKeyRef` field to reference a specific key (`password`) from the Secret named `db-secret` and expose it as the environment variable `DB_PASSWORD`. This is the standard Kubernetes syntax for injecting a single Secret key into a Pod's environment variable.

Answer

Set env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name: db-secret key: password

Answer

Use envFrom: - secretRef: name: db-secret

Answer

Set env: - name: DB_PASSWORD secretRef: name: db-secret key: password

Question 10

Which TWO of the following are valid ways to inject configuration data into a Kubernetes Pod?

Accepted Answer

Using a ConfigMap to set environment variables in the Pod spec.. Option B is correct because a ConfigMap is specifically designed to inject configuration data into Pods, and one of the primary methods is by setting environment variables in the Pod spec using `envFrom` or `valueFrom: configMapKeyRef`. This allows decoupling configuration from container images, enabling environment-specific settings without rebuilding images.

Answer

Mounting a ServiceAccount token as a volume.

Answer

Using a PersistentVolumeClaim to store configuration files.

Answer

Referencing a NetworkPolicy in the Pod spec.

Question 11

Refer to the exhibit. A Pod is defined with security contexts at both the container and Pod level. Which of the following statements accurately describes the effective security configuration?

Accepted Answer

The container runs as user 1000, group 2000, with NET_ADMIN capability added, and the Pod-level runAsNonRoot: true is also enforced.. Option C is correct because Kubernetes merges Pod-level and container-level security contexts, with the container-level settings taking precedence for fields that overlap, but Pod-level settings that are not overridden (like runAsNonRoot) remain enforced. In this case, the container runs as user 1000, group 2000, with NET_ADMIN capability added, and the Pod-level runAsNonRoot: true is also enforced, ensuring the container does not run as root.

Answer

The Pod will fail to start because runAsNonRoot conflicts with the container's runAsUser.

Answer

The container runs as user 1000, but the Pod-level runAsNonRoot overrides the container's runAsUser to enforce non-root.

Answer

The container runs as root because the Pod-level runAsNonRoot is ignored when container-level capabilities are set.

Question 12

You are a Kubernetes administrator responsible for a production cluster. A development team has deployed a Pod named 'app-pod' that runs a container with a PostgreSQL database. The team reports that the Pod is failing to start with an error: 'Error: container has runAsNonRoot and image will run as root (runtime error)'. The Pod YAML is as follows:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
  - name: db
    image: postgres:latest
    securityContext:
      runAsNonRoot: true
```

The team wants to ensure the container runs securely without running as root. What is the BEST course of action?

Accepted Answer

Add `runAsUser: 999` to the container's securityContext to run the container as the postgres user.. Option A is correct because the PostgreSQL official image runs as the 'postgres' user with UID 999 by default. Adding `runAsUser: 999` to the container's securityContext overrides the user to a non-root UID, satisfying the `runAsNonRoot: true` constraint and allowing the container to start without the runtime error.

Answer

Remove `runAsNonRoot: true` from the securityContext to allow the container to run as root.

Answer

Increase the Pod's resource limits because the error is due to insufficient memory.

Answer

Create a PodSecurityPolicy that allows running as root.

Question 13

Arrange the steps to create a ConfigMap from a file and mount it as a volume in a Pod.

Question 14

Sequence the steps to scale a Deployment to 5 replicas and verify.

Question 15

Match each Kubernetes concept to its definition.

Question 16

Match each Kubernetes probe to its check behavior.

Question 17

You need to create a ConfigMap named 'app-config' with key 'APP_COLOR' and value 'blue'. Which command creates this ConfigMap?

Accepted Answer

kubectl create configmap app-config --from-literal=APP_COLOR=blue. Option B is correct because `kubectl create configmap app-config --from-literal=APP_COLOR=blue` uses the `--from-literal` flag, which directly creates a ConfigMap entry from a key-value pair specified in the command line. The syntax `key=value` is required for literal data, and this command correctly maps the key 'APP_COLOR' to the value 'blue'.

Answer

kubectl create configmap app-config --from-env-file=APP_COLOR=blue

Answer

kubectl create configmap app-config --from-literal=APP_COLOR:blue

Answer

kubectl create configmap app-config --from-file=APP_COLOR=blue

Question 18

A pod is running with the following SecurityContext:
securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  fsGroup: 3000
What UID and GID does the process inside the container use?

Accepted Answer

UID 1000, GID 2000. The `runAsUser` and `runAsGroup` fields in the Pod's SecurityContext directly set the UID and GID for the container's main process. Here, `runAsUser: 1000` sets the process UID to 1000, and `runAsGroup: 2000` sets the process GID to 2000. The `fsGroup: 3000` field only applies to the group ownership of mounted volumes, not to the process's primary GID.

Answer

UID 1000, GID 3000

Answer

UID 0, GID 2000

Answer

UID 3000, GID 2000

Question 19

You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?

Accepted Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: mysecret
      key: password. Option B is correct because it uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Secret named 'mysecret' and inject its value into the environment variable `SECRET_DATA`. This is the standard Kubernetes syntax for exposing a Secret's key-value pair as an environment variable.

Answer

env:
- name: SECRET_DATA
  valueFrom:
    configMapKeyRef:
      name: mysecret
      key: password

Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: password
      key: mysecret

Answer

volumeMounts:
- name: secret-volume
  mountPath: /etc/secret
volumes:
- name: secret-volume
  secret:
    secretName: mysecret
    items:
    - key: password
      path: secret.txt

Question 20

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Accepted Answer

resources:
  requests:
    cpu: 250m
  limits:
    memory: 512Mi. Option D is correct because in Kubernetes, CPU requests are specified in millicores (e.g., 250m) and memory limits use binary units like Mi (Mebibytes). The value '250m' equals 0.25 CPU cores, and '512Mi' is 512 Mebibytes (512 * 1024^2 bytes), which is the standard unit for memory limits.

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512M

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512MB

Answer

resources:
  requests:
    cpu: 0.25
  limits:
    memory: 512MB