CKAD Application Environment, Configuration and Security Practice Test 14 — 15 Questions

Question 1

A developer wants to ensure that a pod runs with a non-root user and cannot gain root privileges. Which SecurityContext settings should be used?

Accepted Answer

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false. Setting `runAsNonRoot: true` enforces that the container's user ID is non-zero (non-root), and `allowPrivilegeEscalation: false` prevents the container from gaining additional privileges beyond its initial set, such as through setuid binaries or kernel capabilities. Together, they ensure the pod runs as a non-root user and cannot escalate to root, satisfying the developer's requirement.

Answer

securityContext:
  allowPrivilegeEscalation: false

Answer

securityContext:
  runAsNonRoot: true

Answer

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: true

Question 2

A pod is running with a service account that has been granted a Role to get pods. The pod's code uses the Kubernetes API from within the container. However, the API call fails with a 403 Forbidden error. Which file should the pod read to obtain the authentication token?

Accepted Answer

/var/run/secrets/kubernetes.io/serviceaccount/token. The pod's service account token is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. This token is a signed JWT that the pod uses to authenticate to the Kubernetes API server. Without reading this file, the pod cannot present valid credentials, resulting in a 403 Forbidden error.

Answer

/etc/kubernetes/admin.conf

Answer

/var/run/secrets/kubernetes.io/serviceaccount/namespace

Answer

/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

Question 3

Which THREE of the following are valid fields in a PodSecurityContext?

Accepted Answer

fsGroup. `fsGroup` is a valid field in a PodSecurityContext. It specifies the supplemental group ID applied to all containers in the pod when accessing volumes, ensuring proper file ownership and permissions for shared storage.

Answer

capabilities

Answer

allowPrivilegeEscalation

Question 4

A Pod in a namespace with a ResourceQuota that sets 'limits.cpu: 4' and 'limits.memory: 8Gi' is being created with the following container resources: requests: cpu: 2, memory: 4Gi; limits: cpu: 4, memory: 8Gi. The namespace also has a LimitRange with default limits of cpu: 500m, memory: 512Mi. Which statement is true about this resource configuration?

Accepted Answer

The Pod will be admitted because it respects both the ResourceQuota and the LimitRange. B is correct because the Pod explicitly sets its own limits (cpu: 4, memory: 8Gi) and requests (cpu: 2, memory: 4Gi), which are within the ResourceQuota's 'limits.cpu: 4' and 'limits.memory: 8Gi' constraints. The LimitRange default limits only apply to containers that do not specify limits; since this Pod specifies limits, the defaults are ignored. The Pod is admitted as it satisfies both admission controllers.

Answer

The Pod will have its limits overridden by the LimitRange defaults because limits must be set

Answer

The Pod will be rejected because the limits exceed the LimitRange default

Answer

The Pod will be rejected because requests must equal limits

Question 5

A pod needs to run as a non-root user with UID 1000. Which SecurityContext field should be set?

Accepted Answer

runAsUser: 1000. The `runAsUser` field in the PodSecurityContext or container SecurityContext sets the user ID (UID) under which the container's main process runs. Setting `runAsUser: 1000` ensures the container runs as a non-root user with UID 1000, meeting the requirement. This field directly controls the effective UID of the process, overriding the default root (UID 0).

Answer

runAsGroup: 1000

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Question 6

A pod is using a Secret to authenticate to a private registry. The Secret type must be 'kubernetes.io/dockerconfigjson'. Which of the following is the correct way to create such a Secret using kubectl?

Accepted Answer

kubectl create secret docker-registry regcred --docker-server=my-registry.example.com --docker-username=myuser --docker-password=mypassword --docker-email=myemail@example.com. `kubectl create secret docker-registry` is the dedicated command to create a Secret of type `kubernetes.io/dockerconfigjson`. It automatically generates the required `.dockerconfigjson` field with the base64-encoded Docker credentials in the correct JSON format, which the kubelet uses to authenticate to a private registry when pulling images.

Answer

kubectl create secret generic regcred --type=kubernetes.io/dockercfg --from-literal=.dockercfg=...

Answer

kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json

Answer

kubectl create secret tls regcred --cert=cert.crt --key=key.key

Question 7

Which TWO of the following are valid Kubernetes Secret types? (Select two.)

Accepted Answer

kubernetes.io/ssh-auth. kubectl create secret tls, kubectl create secret ssh-auth, and kubectl create secret generic (which creates an Opaque secret) are all valid Kubernetes Secret types. The type kubernetes.io/ssh-auth is used for SSH credentials, kubernetes.io/tls is used for TLS certificates, and Opaque is the default type for arbitrary user-defined data. Options A (kubernetes.io/password) and C (kubernetes.io/configmap) are not valid Secret types.

Answer

kubernetes.io/password

Answer

kubernetes.io/configmap

Question 8

You have a ConfigMap named 'app-config' with key 'database.url'. Which environment variable definition correctly injects this value into a pod using a configMapKeyRef?

Accepted Answer

- name: DATABASE_URL
  valueFrom:
    configMapKeyRef:
      name: app-config
      key: database.url. It properly defines an environment variable with a name and uses `valueFrom.configMapKeyRef` to reference the specific key 'database.url' from the ConfigMap 'app-config'. The `name` field is required in the env entry to specify the environment variable name. Option D is incorrect because it omits the `name` field, making the definition incomplete.

Answer

envFrom:
- configMapRef:
    name: app-config

Answer

- name: DATABASE_URL
  valueFrom:
    secretKeyRef:
      name: app-config
      key: database.url

Answer

- valueFrom:
    configMapKeyRef:
      name: app-config
      key: database.url

Question 9

Which kubectl command creates a Secret from literal username and password values?

Accepted Answer

kubectl create secret generic my-secret --from-literal=username=admin --from-literal=password=secret123. `kubectl create secret generic` with `--from-literal` is the proper syntax for specifying literal key-value pairs directly in the command. Each literal must be prefixed with `--from-literal=key=value`, and multiple literals can be provided to create a Secret containing both the username and password keys.

Answer

kubectl create secret generic my-secret --literal username=admin password=secret123

Answer

kubectl create secret generic my-secret --from-file=username --from-file=password

Answer

kubectl create secret generic my-secret --from-env-file=creds.txt

Question 10

A pod's container needs to run as non-root user with UID 1000 and ensure its filesystem is read-only. Which SecurityContext settings achieve this?

Accepted Answer

spec:
  securityContext:
    runAsUser: 1000
    runAsNonRoot: true
  containers:
  - name: app
    securityContext:
      readOnlyRootFilesystem: true. Ly sets runAsUser and runAsNonRoot at the pod level to enforce non-root execution with UID 1000, and readOnlyRootFilesystem at the container level, which is the correct placement for that field. The other options either use invalid fields (runAsRoot), omit runAsNonRoot, or incorrectly place readOnlyRootFilesystem at the pod level.

Answer

securityContext:
  runAsNonRoot: true
  runAsRoot: false
  readOnlyRootFilesystem: true

Answer

securityContext:
  runAsGroup: 1000
  readOnlyRootFilesystem: true

Answer

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  readOnlyRootFilesystem: true

Question 11

You need to create a TLS secret for an ingress with certificate and key. Which command correctly creates the secret?

Accepted Answer

kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key. `kubectl create secret tls` is the dedicated subcommand for creating a TLS secret, which automatically encodes the certificate and key files and stores them under the expected keys (`tls.crt` and `tls.key`). This is the only command that produces a secret of type `kubernetes.io/tls`, which is required by Ingress controllers to serve HTTPS traffic.

Answer

kubectl create secret docker-registry tls-secret --docker-cert=tls.crt --docker-key=tls.key

Answer

kubectl create secret generic tls-secret --from-file=tls.crt --from-file=tls.key

Answer

kubectl create secret certificate tls-secret --cert= --key=

Question 12

A developer wants to inject database credentials into a pod as environment variables. The credentials are stored in a Kubernetes Secret named 'db-creds' with keys 'username' and 'password'. Which pod spec snippet correctly injects both values as environment variables?

Accepted Answer

envFrom:
- secretRef:
    name: db-creds. `envFrom` with `secretRef` injects all key-value pairs from a Secret as environment variables into the pod. This directly satisfies the requirement to inject both 'username' and 'password' from the 'db-creds' Secret without needing to specify each key individually.

Answer

env:
- name: username
  valueFrom:
    secretKeyRef:
      name: db-creds
      key: username

Answer

envFrom:
- configMapRef:
    name: db-creds

Answer

envFrom:
- secretKeyRef:
    name: db-creds

Question 13

A pod fails to start with a 'CreateContainerConfigError'. Running 'kubectl describe pod my-pod' reveals: 'Error: container has runAsNonRoot and image will run as root'. The pod definition includes 'securityContext.runAsNonRoot: true'. What is the most likely cause?

Accepted Answer

The container image's default user is root (UID 0), conflicting with runAsNonRoot. The error 'container has runAsNonRoot and image will run as root' occurs because the pod's securityContext sets `runAsNonRoot: true`, but the container image's default user is root (UID 0). Kubernetes checks the image's user at container startup; if the image runs as root and the pod enforces non-root, the container fails to start with a CreateContainerConfigError.

Answer

The container does not have the CAP_SYS_ADMIN capability

Answer

The container's filesystem is read-only

Answer

The runAsUser field is missing, so the pod uses a random UID

Question 14

A pod uses a ServiceAccount 'my-sa' with a RoleBinding that grants get and list on pods. The pod makes an API call to list pods in its own namespace. Which RBAC resource is necessary?

Accepted Answer

A RoleBinding that binds the Role to the ServiceAccount. The pod uses a ServiceAccount 'my-sa' and the API call is to list pods in its own namespace. A RoleBinding binds a Role (which contains the rules) to a ServiceAccount within a specific namespace, granting the permissions only in that namespace. Since the operation is namespace-scoped and the Role already has the necessary get and list rules, a RoleBinding is the minimal and correct RBAC resource to associate the Role with the ServiceAccount.

Answer

A Role with the appropriate rules

Answer

A ClusterRoleBinding that binds the ClusterRole to the ServiceAccount

Answer

A ClusterRole with the same rules

Question 15

A pod needs to mount a Secret named 'db-secret' as a volume at /etc/secret. Which volume mount definition is correct?

Accepted Answer

volumes:
- name: secret-volume
  secret:
    secretName: db-secret. It uses the proper `secret` key under the `volumes` field to reference a Secret object by its `secretName`. When this volume is mounted at `/etc/secret`, Kubernetes automatically creates a file for each key in the Secret, with the file content being the decoded value of the key. This is the standard syntax for mounting a Secret as a volume.

Answer

volumes:
- name: secret-volume
  secretVolumeSource:
    secretName: db-secret

Answer

volumes:
- name: db-secret
  secret:
    secretName: db-secret

Answer

volumes:
- name: secret-volume
  secret:
    name: db-secret