CKAD Application Environment, Configuration and Security Practice Test 10 — 15 Questions

Question 1

Which THREE of the following are characteristics of Pod Security Admission (PSA) standards? (Select three.)

Accepted Answer

PSA can be configured to warn or audit violations without blocking. Pod Security Admission (PSA) supports three modes: enforce (blocks violations), audit (logs violations in audit logs), and warn (returns a warning to the user). This allows administrators to test or monitor PSA policies without immediately blocking pod creation, which is critical for gradual adoption.

Answer

PSA requires Open Policy Agent (OPA) Gatekeeper to function

Answer

PSA is a CustomResourceDefinition (CRD) that must be installed separately

Question 2

A developer wants to create a ConfigMap named 'app-config' with two key-value pairs: 'color=blue' and 'size=large'. Which kubectl command should they use?

Accepted Answer

kubectl create configmap app-config --from-literal=color=blue --from-literal=size=large. `kubectl create configmap` with `--from-literal` allows specifying key-value pairs directly in the command line. Each literal must be provided as a separate `--from-literal=key=value` flag, and this command correctly creates the ConfigMap with the two entries 'color=blue' and 'size=large'.

Answer

kubectl create configmap app-config --from-literal=color,size --value=blue,large

Answer

kubectl create configmap app-config --from-env-file=color=blue,size=large

Answer

kubectl create configmap app-config --from-file=color=blue --from-file=size=large

Question 3

A pod is scheduled but remains in 'Pending' state. Running 'kubectl describe pod mypod' shows: '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds the available memory on any node. The '0/1 nodes are available: 1 Insufficient memory' message indicates that the Kubernetes scheduler attempted to place the pod on a node but found that the node's allocatable memory is less than the pod's memory request. The pod's memory request must be satisfied by at least one node for scheduling to succeed; if no node has enough unallocated memory, the pod remains Pending. This is a resource request, not a limit, that gates scheduling.

Answer

The pod is using too many CPU resources

Answer

The pod's memory limit is too low

Answer

The pod's container is crashing due to a bug

Question 4

A Pod specification includes: securityContext: { runAsNonRoot: true }. The container image runs as root by default. What will happen when the Pod is created?

Accepted Answer

The Pod will not start; the kubelet will reject it because the container tries to run as root. When a Pod specifies `runAsNonRoot: true` in its `securityContext`, the kubelet verifies that the container's user ID is non-zero (non-root) before starting the container. If the container image runs as root by default (UID 0), the kubelet will reject the Pod, and it will remain in a `ContainerCreating` or `CrashLoopBackOff` state with an error like 'container has runAsNonRoot and image will run as root'. This is a security enforcement mechanism that prevents privileged execution.

Answer

The Pod will start and immediately be OOMKilled

Answer

The Pod will run but with a warning

Answer

The Pod will run successfully because K8s overrides the user to non-root

Question 5

An administrator creates a Role and RoleBinding in the 'dev' namespace to allow a ServiceAccount 'sa-dev' to list Pods. Which YAML snippet correctly defines the Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It uses the empty string `""` for `apiGroups`, which represents the core API group where Pods reside, and specifies the `list` verb to allow listing Pods. This matches the requirement to allow the ServiceAccount 'sa-dev' to list Pods in the 'dev' namespace.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["v1"]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["apps/v1"]
  resources: ["pods"]
  verbs: ["get"]

Question 6

A developer needs to expose a database password to a Pod as an environment variable, securely. What should they do?

Accepted Answer

Create a Secret and use secretKeyRef in the env definition. Kubernetes Secrets are the recommended mechanism for storing sensitive data like passwords. By referencing the Secret's key via `secretKeyRef` in the `env` definition of a Pod, the password is injected as an environment variable without being exposed in the Pod manifest or stored in plaintext. This approach ensures the data is base64-encoded at rest (and can be encrypted at rest with etcd encryption) and avoids the security risks of hardcoding or using ConfigMaps for secrets.

Answer

Hardcode the password in the Pod YAML

Answer

Store the password in a ConfigMap and use configMapKeyRef

Answer

Use a ConfigMap with binaryData field

Question 7

A Pod is in 'CrashLoopBackOff' state. 'kubectl logs mypod' shows: 'Error: listen tcp :8080: bind: address already in use'. What is the most likely cause?

Accepted Answer

The container's application is attempting to use a port that is already occupied. The error 'listen tcp :8080: bind: address already in use' indicates that the container's application is trying to bind to port 8080, but that port is already occupied by another process within the same network namespace (typically the same Pod or container). This is a classic port conflict, not a resource or permission issue, making option B correct.

Answer

The pod's resource limits are too low

Answer

The pod's ServiceAccount token is not mounted

Answer

The pod is using a readOnlyRootFilesystem

Question 8

An administrator wants to enforce that all Pods in a namespace run with a read-only root filesystem. Which admission controller should be configured?

Accepted Answer

Pod Security Admission (PSA). Pod Security Admission (PSA) is the correct choice because it enforces Pod Security Standards (PSS) at the namespace level, including the `Restricted` profile which mandates a read-only root filesystem (`readOnlyRootFilesystem: true`). PSA is a built-in admission controller that evaluates pod specifications against predefined security policies and rejects pods that violate them, making it the appropriate tool for this requirement.

Answer

LimitRange

Answer

ResourceQuota

Answer

MutatingAdmissionWebhook

Question 9

A Pod specification includes: securityContext: { seccompProfile: { type: RuntimeDefault } }. What does this configuration do?

Accepted Answer

It applies the container runtime's default seccomp profile. Setting `seccompProfile.type: RuntimeDefault` in the Pod's securityContext instructs the container runtime (e.g., containerd or CRI-O) to apply its own default seccomp profile to the container. This default profile restricts system calls to a safe subset, blocking dangerous or unnecessary syscalls while allowing common ones required for typical application execution. It is the recommended way to enable seccomp without managing a custom profile.

Answer

It disables seccomp for the pod

Answer

It allows all syscalls

Answer

It uses a custom seccomp profile from a file

Question 10

Which command creates a generic Secret with username=admin and password=secret123?

Accepted Answer

kubectl create secret generic mysecret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line, creating a generic (opaque) Secret with the literal values `username=admin` and `password=secret123`. This is the standard way to create a generic Secret from literal data.

Answer

kubectl create secret tls mysecret --from-literal=username=admin --from-literal=password=secret123

Answer

kubectl create secret generic mysecret --from-env-file=username=admin,password=secret123

Answer

kubectl create secret generic mysecret --from-file=username=admin --from-file=password=secret123

Question 11

A Pod has the following environment variable definition:
- name: DB_HOST
  valueFrom:
    configMapKeyRef:
      name: db-config
      key: host
The ConfigMap 'db-config' exists in the same namespace but does not have a key 'host'. What will happen when the Pod starts?

Accepted Answer

The Pod will fail to start because the key is not found. When a Pod references a ConfigMap key that does not exist, the Pod will fail to start. Kubernetes validates the ConfigMap key reference at Pod creation time; if the key is missing, the kubelet will not start the container, and the Pod will remain in a 'CreateContainerConfigError' or 'RunContainerError' state. This is because environment variables are resolved before the container starts, and a missing key is treated as a fatal configuration error.

Answer

The Pod will start and the environment variable will be set to the key name 'host'

Answer

The Pod will start and the environment variable will be empty

Answer

The Pod will start but the variable will be set to the ConfigMap's name

Question 12

A Pod is configured with automountServiceAccountToken: false. The application inside the pod needs to access the Kubernetes API. What should be done?

Accepted Answer

Mount the service account token manually by adding a volume and volumeMount. Setting automountServiceAccountToken: false prevents automatic mounting of the service account token. To still access the Kubernetes API, you must manually mount the token by adding a volume of type projected (or secret) containing the service account token, and a corresponding volumeMount in the container. This allows the application to authenticate with the API server using the mounted token.

Answer

Create a new Secret of type kubernetes.io/dockerconfigjson

Answer

The application cannot access the API; the setting is final

Answer

Add a ConfigMap with the token

Question 13

A developer wants to enforce that containers in a namespace cannot run as privileged. Which Pod Security Standard profile should they apply to the namespace?

Accepted Answer

baseline. (baseline) is correct because the baseline Pod Security Standard (PSS) profile enforces the minimum restrictions necessary to prevent known privilege escalations, including the prohibition of privileged containers (i.e., `privileged: true` in the security context). This profile is designed to be applied to namespaces where most workloads run, blocking the most common security issues without breaking typical applications. The restricted profile would also block privileged containers but imposes additional constraints (e.g., dropping all capabilities, read-only root filesystem) that are not required by the question's specific goal.

Answer

privileged

Answer

restricted

Answer

custom

Question 14

Which TWO actions can help prevent a container from being compromised if an attacker gains access? (Select 2)

Accepted Answer

Setting securityContext.readOnlyRootFilesystem: true. Setting `securityContext.readOnlyRootFilesystem: true` makes the container's root filesystem read-only, preventing an attacker who gains access from modifying system binaries, libraries, or configuration files. This is a key defense-in-depth measure that limits the impact of a compromise by restricting write access to only explicitly mounted volumes.

Answer

Setting automountServiceAccountToken: true

Answer

Setting securityContext.allowPrivilegeEscalation: true

Answer

Setting securityContext.runAsUser: 0

Question 15

Which THREE statements about ResourceQuota are correct? (Select 3)

Accepted Answer

ResourceQuota can specify both requests and limits for compute resources. A ResourceQuota can specify both `requests` and `limits` for compute resources such as CPU and memory. This allows the quota to enforce constraints on the minimum requested resources and the maximum allowed usage across all pods in a namespace, ensuring fair resource distribution and preventing resource exhaustion.

Answer

ResourceQuota can limit the maximum CPU limit for a single pod

Answer

ResourceQuota applies across all namespaces