CKAD Application Environment, Configuration and Security Practice Test 13 — 15 Questions

Question 1

An administrator creates a Role and RoleBinding in the 'dev' namespace to allow a ServiceAccount 'sa-dev' to list Pods. Which YAML snippet correctly defines the Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It uses the empty string `""` for `apiGroups`, which represents the core API group where Pods reside, and specifies the `list` verb to allow listing Pods. This matches the requirement to allow the ServiceAccount 'sa-dev' to list Pods in the 'dev' namespace.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["v1"]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["apps/v1"]
  resources: ["pods"]
  verbs: ["get"]

Question 2

A developer needs to expose a database password to a Pod as an environment variable, securely. What should they do?

Accepted Answer

Create a Secret and use secretKeyRef in the env definition. Kubernetes Secrets are the recommended mechanism for storing sensitive data like passwords. By referencing the Secret's key via `secretKeyRef` in the `env` definition of a Pod, the password is injected as an environment variable without being exposed in the Pod manifest or stored in plaintext. This approach ensures the data is base64-encoded at rest (and can be encrypted at rest with etcd encryption) and avoids the security risks of hardcoding or using ConfigMaps for secrets.

Answer

Hardcode the password in the Pod YAML

Answer

Store the password in a ConfigMap and use configMapKeyRef

Answer

Use a ConfigMap with binaryData field

Question 3

A Pod is in 'CrashLoopBackOff' state. 'kubectl logs mypod' shows: 'Error: listen tcp :8080: bind: address already in use'. What is the most likely cause?

Accepted Answer

The container's application is attempting to use a port that is already occupied. The error 'listen tcp :8080: bind: address already in use' indicates that the container's application is trying to bind to port 8080, but that port is already occupied by another process within the same network namespace (typically the same Pod or container). This is a classic port conflict, not a resource or permission issue, making option B correct.

Answer

The pod's resource limits are too low

Answer

The pod's ServiceAccount token is not mounted

Answer

The pod is using a readOnlyRootFilesystem

Question 4

An administrator wants to enforce that all Pods in a namespace run with a read-only root filesystem. Which admission controller should be configured?

Accepted Answer

Pod Security Admission (PSA). Pod Security Admission (PSA) is the correct choice because it enforces Pod Security Standards (PSS) at the namespace level, including the `Restricted` profile which mandates a read-only root filesystem (`readOnlyRootFilesystem: true`). PSA is a built-in admission controller that evaluates pod specifications against predefined security policies and rejects pods that violate them, making it the appropriate tool for this requirement.

Answer

LimitRange

Answer

ResourceQuota

Answer

MutatingAdmissionWebhook

Question 5

A Pod specification includes: securityContext: { seccompProfile: { type: RuntimeDefault } }. What does this configuration do?

Accepted Answer

It applies the container runtime's default seccomp profile. Setting `seccompProfile.type: RuntimeDefault` in the Pod's securityContext instructs the container runtime (e.g., containerd or CRI-O) to apply its own default seccomp profile to the container. This default profile restricts system calls to a safe subset, blocking dangerous or unnecessary syscalls while allowing common ones required for typical application execution. It is the recommended way to enable seccomp without managing a custom profile.

Answer

It disables seccomp for the pod

Answer

It allows all syscalls

Answer

It uses a custom seccomp profile from a file

Question 6

Which command creates a generic Secret with username=admin and password=secret123?

Accepted Answer

kubectl create secret generic mysecret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line, creating a generic (opaque) Secret with the literal values `username=admin` and `password=secret123`. This is the standard way to create a generic Secret from literal data.

Answer

kubectl create secret tls mysecret --from-literal=username=admin --from-literal=password=secret123

Answer

kubectl create secret generic mysecret --from-env-file=username=admin,password=secret123

Answer

kubectl create secret generic mysecret --from-file=username=admin --from-file=password=secret123

Question 7

A Pod has the following environment variable definition:
- name: DB_HOST
  valueFrom:
    configMapKeyRef:
      name: db-config
      key: host
The ConfigMap 'db-config' exists in the same namespace but does not have a key 'host'. What will happen when the Pod starts?

Accepted Answer

The Pod will fail to start because the key is not found. When a Pod references a ConfigMap key that does not exist, the Pod will fail to start. Kubernetes validates the ConfigMap key reference at Pod creation time; if the key is missing, the kubelet will not start the container, and the Pod will remain in a 'CreateContainerConfigError' or 'RunContainerError' state. This is because environment variables are resolved before the container starts, and a missing key is treated as a fatal configuration error.

Answer

The Pod will start and the environment variable will be set to the key name 'host'

Answer

The Pod will start and the environment variable will be empty

Answer

The Pod will start but the variable will be set to the ConfigMap's name

Question 8

A Pod is configured with automountServiceAccountToken: false. The application inside the pod needs to access the Kubernetes API. What should be done?

Accepted Answer

Mount the service account token manually by adding a volume and volumeMount. Setting automountServiceAccountToken: false prevents automatic mounting of the service account token. To still access the Kubernetes API, you must manually mount the token by adding a volume of type projected (or secret) containing the service account token, and a corresponding volumeMount in the container. This allows the application to authenticate with the API server using the mounted token.

Answer

Create a new Secret of type kubernetes.io/dockerconfigjson

Answer

The application cannot access the API; the setting is final

Answer

Add a ConfigMap with the token

Question 9

A developer wants to enforce that containers in a namespace cannot run as privileged. Which Pod Security Standard profile should they apply to the namespace?

Accepted Answer

baseline. (baseline) is correct because the baseline Pod Security Standard (PSS) profile enforces the minimum restrictions necessary to prevent known privilege escalations, including the prohibition of privileged containers (i.e., `privileged: true` in the security context). This profile is designed to be applied to namespaces where most workloads run, blocking the most common security issues without breaking typical applications. The restricted profile would also block privileged containers but imposes additional constraints (e.g., dropping all capabilities, read-only root filesystem) that are not required by the question's specific goal.

Answer

privileged

Answer

restricted

Answer

custom

Question 10

Which TWO actions can help prevent a container from being compromised if an attacker gains access? (Select 2)

Accepted Answer

Setting securityContext.readOnlyRootFilesystem: true. Setting `securityContext.readOnlyRootFilesystem: true` makes the container's root filesystem read-only, preventing an attacker who gains access from modifying system binaries, libraries, or configuration files. This is a key defense-in-depth measure that limits the impact of a compromise by restricting write access to only explicitly mounted volumes.

Answer

Setting automountServiceAccountToken: true

Answer

Setting securityContext.allowPrivilegeEscalation: true

Answer

Setting securityContext.runAsUser: 0

Question 11

Which THREE statements about ResourceQuota are correct? (Select 3)

Accepted Answer

ResourceQuota can specify both requests and limits for compute resources. A ResourceQuota can specify both `requests` and `limits` for compute resources such as CPU and memory. This allows the quota to enforce constraints on the minimum requested resources and the maximum allowed usage across all pods in a namespace, ensuring fair resource distribution and preventing resource exhaustion.

Answer

ResourceQuota can limit the maximum CPU limit for a single pod

Answer

ResourceQuota applies across all namespaces

Question 12

Which TWO commands can be used to create a Secret from a file? (Select 2)

Accepted Answer

kubectl create secret generic mysecret --from-file=key=file.txt. Both options A and E are valid commands to create a Secret from a file. Option A uses `--from-file` to read file contents and store them under a specified key. Option E uses `--from-env-file` to parse a file with key=value pairs and create a Secret for environment variables. Option C is incorrect for this question because `kubectl apply -f secret.yaml` applies a YAML manifest that defines a Secret, but it does not create a Secret directly from a file's contents in the same way as the `kubectl create secret` commands. The question asks for two commands that create a Secret from a file, and both A and E meet that criterion.

Answer

kubectl create configmap mysecret --from-file=file.txt

Answer

kubectl apply -f secret.yaml where secret.yaml contains data fields

Answer

kubectl create secret tls mysecret --cert=file.txt

Question 13

Which kubectl command creates a ConfigMap named 'app-config' from a file 'app.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=app.properties. `kubectl create configmap app-config --from-file=app.properties` reads the file `app.properties` and creates a ConfigMap with a single key-value pair where the key is the filename (without extension) and the value is the entire file content. This is the standard way to create a ConfigMap from a file in Kubernetes.

Answer

kubectl create configmap app-config --from-literal=app.properties

Answer

kubectl create configmap app-config --from-env-file=app.properties

Answer

kubectl create configmap app-config --file=app.properties

Question 14

A pod manifest includes the following securityContext: securityContext: { runAsUser: 1000, runAsGroup: 3000, fsGroup: 2000 }. What UID will be used for processes in the container?

Accepted Answer

1000. The `runAsUser` field in the pod's securityContext explicitly sets the user ID (UID) for all processes in the container. In this manifest, `runAsUser: 1000` overrides the default UID (usually 0, root) and ensures that the container's main process runs with UID 1000. The `runAsGroup` and `fsGroup` fields affect group IDs and file ownership, not the process UID.

Answer

0 (root)

Answer

3000

Answer

2000

Question 15

A pod in a namespace with a ResourceQuota that sets 'requests.cpu: 2' is failing to schedule. The pod manifest specifies 'resources: { requests: { cpu: "500m" } }'. What is the likely cause?

Accepted Answer

The namespace has already used all its CPU request quota.. The ResourceQuota sets a hard limit of 2 CPU cores for total requests across all pods in the namespace. If the sum of CPU requests from all pods already reaches or exceeds 2, a new pod with a 500m CPU request cannot be scheduled because it would exceed the quota. The pod's request (500m) is well within the quota limit, so the issue is that the namespace has exhausted its CPU request budget.

Answer

The ResourceQuota applies to limits, not requests.

Answer

The pod does not specify a CPU limit.

Answer

The pod's CPU request exceeds the ResourceQuota limit.