CKAD Application Environment, Configuration and Security Practice Test 13 — 15 Questions

Question 1

Which THREE of the following fields are part of a Pod's securityContext that can restrict container capabilities? (Choose three.)

Accepted Answer

capabilities.drop. Options A, C, and D are correct. The Pod's `securityContext` field can restrict container capabilities through `capabilities.drop`, `capabilities.add`, and `allowPrivilegeEscalation`. `capabilities.drop` removes specified Linux capabilities, while `capabilities.add` adds specific capabilities. `allowPrivilegeEscalation`, when set to false, prevents a process from gaining additional capabilities beyond its parent, indirectly restricting capabilities. Options B (`seccompProfile`) restricts system calls, not capabilities, and option E (`runAsUser`) sets the user ID but does not affect capabilities.

Answer

seccompProfile

Answer

runAsUser

Question 2

Which TWO of the following are valid types for a Kubernetes Secret? (Choose two.)

Accepted Answer

kubernetes.io/tls. Options A and B are correct because kubernetes.io/tls and kubernetes.io/basic-auth are both built-in Secret types in Kubernetes. kubernetes.io/tls stores TLS certificates and private keys with required keys tls.crt and tls.key. kubernetes.io/basic-auth stores credentials for basic authentication with mandatory key username and optional key password. Option C (kubernetes.io/configmap) is not a Secret type but a ConfigMap type. Options D (kubernetes.io/tls-key) and E (kubernetes.io/ssh-key) are not standard Kubernetes Secret types and are invalid.

Answer

kubernetes.io/configmap

Answer

kubernetes.io/tls-key

Answer

kubernetes.io/ssh-key

Question 3

Which THREE of the following are true about ServiceAccount token automounting? (Choose three.)

Accepted Answer

The token is mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. The token is mounted at the path /var/run/secrets/kubernetes.io/serviceaccount/token. Automounting can be disabled at the ServiceAccount level by setting automountServiceAccountToken: false, which affects all Pods using that ServiceAccount. Setting automountServiceAccountToken: false in a Pod spec prevents that specific Pod from automounting the token. Option D is false because token rotation is managed by the TokenRequest API and kube-controller-manager, not the kubelet. Option E is false because it says 'every Pod' – if a Pod specifies a different ServiceAccount, it mounts that SA's token, not the default.

Answer

The token is automatically refreshed by the kubelet.

Answer

By default, Kubernetes automounts the default ServiceAccount token into every Pod.

Question 4

Which TWO of the following are required to create a Role and RoleBinding that grants read access to Pods in the 'development' namespace? (Choose two.)

Accepted Answer

A RoleBinding that binds the Role to a subject (User or ServiceAccount). A RoleBinding is the Kubernetes resource that binds a Role (which defines permissions) to a specific subject (User, Group, or ServiceAccount) within a namespace. Without a RoleBinding, the permissions defined in the Role are not granted to any identity, making it a required component for granting access.

Answer

A NetworkPolicy that allows traffic to Pods

Answer

A ClusterRole with the same rules

Answer

A ClusterRoleBinding that binds the Role to a subject

Question 5

Which THREE of the following are valid fields in a Pod's container spec for resource management? (Choose three.)

Accepted Answer

resources.limits.ephemeral-storage. `ephemeral-storage` is a valid resource type in Kubernetes that can be specified under `resources.limits` to control the maximum temporary storage a container can use, preventing pods from exhausting node storage. This is defined in the Kubernetes resource model and is commonly used for scratch space or logs.

Answer

resources.requests.gpu

Answer

resources.requests.storage

Question 6

A developer wants to mount a ConfigMap as a volume in a Pod so that updates to the ConfigMap are reflected in the Pod without restarting. Which two statements are correct? (Choose two.)

Accepted Answer

Using subPath in the volume mount prevents automatic updates.. When a ConfigMap is mounted using `subPath`, Kubernetes treats the mount as a single file rather than a directory of symlinks. This means the atomic update mechanism (which uses symlinks to swap the directory contents) is bypassed, and updates to the ConfigMap are not reflected in the Pod without a restart or remount.

Answer

Using envFrom to inject ConfigMap data as environment variables will update automatically.

Answer

ConfigMap updates are reflected immediately in the volume mount.

Answer

The Pod must be restarted for any ConfigMap change to take effect.

Question 7

You need to create a Secret to store a TLS certificate and private key for use by an Ingress resource. Which two statements are correct? (Choose two.)

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. `kubectl create secret tls my-tls --cert=cert.pem --key=key.pem` is the dedicated command to create a TLS secret, which automatically sets the type to `kubernetes.io/tls` and stores the certificate under the key `tls.crt` and the private key under `tls.key`. This is the standard method for creating secrets intended for use with Ingress resources.

Answer

Use 'kubectl create secret generic tls-secret --from-file=cert.pem --from-file=key.pem' with type Opaque.

Answer

The keys in the data section must be 'cert' and 'key'.

Answer

The Ingress resource references the Secret's data keys directly.

Question 8

Which two fields can be used in a SecurityContext to control a container's access to the host filesystem? (Choose two.)

Accepted Answer

capabilities. readOnlyRootFilesystem makes the container's root filesystem read-only, preventing writes to the container's layer on the host. capabilities can drop privileges like SYS_ADMIN, preventing mounting or modifying host paths. allowPrivilegeEscalation prevents gaining additional privileges through setuid but does not restrict currently held capabilities, so it is not a primary control for host filesystem access.

Answer

runAsUser

Answer

allowPrivilegeEscalation

Answer

runAsGroup

Question 9

A developer wants to restrict a Pod's resource usage. Which two API resources can be used to enforce limits at the namespace level? (Choose two.)

Accepted Answer

LimitRange. LimitRange (C) is correct because it allows administrators to set default resource requests and limits, as well as minimum and maximum constraints, for Pods and containers within a namespace. This enforces resource boundaries at the namespace level, ensuring that individual Pods cannot exceed defined limits.

Answer

PodSecurityPolicy

Answer

HorizontalPodAutoscaler

Answer

NetworkPolicy

Question 10

You are troubleshooting a Pod that cannot start because it fails with 'Error: container has runAsNonRoot and image will run as root'. The Pod's SecurityContext has 'runAsNonRoot: true' and no explicit 'runAsUser'. Which three actions could resolve this? (Choose three.)

Accepted Answer

Remove 'runAsNonRoot: true' from the SecurityContext.. Removing 'runAsNonRoot: true' eliminates the constraint that the container image must run as a non-root user. Since the image runs as root by default and no 'runAsUser' is set, the Pod fails. Removing the flag allows the container to start with its default root user.

Answer

Set 'readOnlyRootFilesystem: true' in the SecurityContext.

Answer

Set 'runAsGroup: 3000' in the SecurityContext.

Question 11

A developer needs to expose database credentials to a Pod as environment variables. The credentials are stored in a Kubernetes Secret named 'db-secret' with keys 'username' and 'password'. Which two methods correctly inject these values? (Choose two.)

Accepted Answer

Define an env entry with 'valueFrom' and 'secretKeyRef' for each key.. `valueFrom` with `secretKeyRef` allows you to reference a specific key from a Kubernetes Secret and inject its value as an environment variable. This is the standard method for exposing individual secret keys to a Pod. Option E is correct because `envFrom` with `secretRef` injects all keys from the referenced Secret as environment variables into the container, which is efficient when you need to expose multiple keys without defining each one individually.

Answer

Set 'env.name' to 'db-secret' and 'env.value' from 'secretKeyRef'.

Answer

Use 'valueFrom' with 'configMapKeyRef'.

Answer

Mount the Secret as a volume and source environment variables from the mounted files.

Question 12

A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?

Accepted Answer

runAsUser: 1000. `runAsUser: 1000` explicitly sets the container's user ID to 1000, ensuring the container process runs as a non-root user. This directly satisfies the security policy requirement to run as UID 1000, overriding the default root (UID 0) behavior.

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Answer

privileged: false

Question 13

You are a Kubernetes administrator responsible for a production cluster. A development team has deployed a Pod named 'app-pod' that runs a container with a PostgreSQL database. The team reports that the Pod is failing to start with an error: 'Error: container has runAsNonRoot and image will run as root (runtime error)'. The Pod YAML is as follows:

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  containers:
  - name: db
    image: postgres:latest
    securityContext:
      runAsNonRoot: true
```

The team wants to ensure the container runs securely without running as root. What is the BEST course of action?

Accepted Answer

Add `runAsUser: 999` to the container's securityContext to run the container as the postgres user.. The PostgreSQL official image runs as the 'postgres' user with UID 999 by default. Adding `runAsUser: 999` to the container's securityContext overrides the user to a non-root UID, satisfying the `runAsNonRoot: true` constraint and allowing the container to start without the runtime error.

Answer

Remove `runAsNonRoot: true` from the securityContext to allow the container to run as root.

Answer

Increase the Pod's resource limits because the error is due to insufficient memory.

Answer

Create a PodSecurityPolicy that allows running as root.

Question 14

Match each Kubernetes concept to its definition.

Accepted Answer

Pod: Smallest deployable unit in Kubernetes that can contain one or more containers.. Correct matches are Pod with smallest deployable unit, Service with logical set and access policy, Deployment with declarative updates, and Ingress with external HTTP access. Common confusions include swapping Pod and Service definitions.

Answer

Pod: An abstraction that defines a logical set of Pods and a policy to access them.

Answer

Service: Smallest deployable unit in Kubernetes that can contain one or more containers.

Question 15

A pod is running with the following SecurityContext:
securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  fsGroup: 3000
What UID and GID does the process inside the container use?

Accepted Answer

UID 1000, GID 2000. The `runAsUser` and `runAsGroup` fields in the Pod's SecurityContext directly set the UID and GID for the container's main process. Here, `runAsUser: 1000` sets the process UID to 1000, and `runAsGroup: 2000` sets the process GID to 2000. The `fsGroup: 3000` field only applies to the group ownership of mounted volumes, not to the process's primary GID.

Answer

UID 1000, GID 3000

Answer

UID 0, GID 2000

Answer

UID 3000, GID 2000