CKAD Application Environment, Configuration and Security Practice Test 2 — 15 Questions

Question 1

Match each Kubernetes probe to its check behavior.

Question 2

You need to create a ConfigMap named 'app-config' with key 'APP_COLOR' and value 'blue'. Which command creates this ConfigMap?

Accepted Answer

kubectl create configmap app-config --from-literal=APP_COLOR=blue. Option B is correct because `kubectl create configmap app-config --from-literal=APP_COLOR=blue` uses the `--from-literal` flag, which directly creates a ConfigMap entry from a key-value pair specified in the command line. The syntax `key=value` is required for literal data, and this command correctly maps the key 'APP_COLOR' to the value 'blue'.

Answer

kubectl create configmap app-config --from-env-file=APP_COLOR=blue

Answer

kubectl create configmap app-config --from-literal=APP_COLOR:blue

Answer

kubectl create configmap app-config --from-file=APP_COLOR=blue

Question 3

A pod is running with the following SecurityContext:
securityContext:
  runAsUser: 1000
  runAsGroup: 2000
  fsGroup: 3000
What UID and GID does the process inside the container use?

Accepted Answer

UID 1000, GID 2000. The `runAsUser` and `runAsGroup` fields in the Pod's SecurityContext directly set the UID and GID for the container's main process. Here, `runAsUser: 1000` sets the process UID to 1000, and `runAsGroup: 2000` sets the process GID to 2000. The `fsGroup: 3000` field only applies to the group ownership of mounted volumes, not to the process's primary GID.

Answer

UID 1000, GID 3000

Answer

UID 0, GID 2000

Answer

UID 3000, GID 2000

Question 4

You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?

Accepted Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: mysecret
      key: password. Option B is correct because it uses the `secretKeyRef` field under `valueFrom` to reference a specific key from a Secret named 'mysecret' and inject its value into the environment variable `SECRET_DATA`. This is the standard Kubernetes syntax for exposing a Secret's key-value pair as an environment variable.

Answer

env:
- name: SECRET_DATA
  valueFrom:
    configMapKeyRef:
      name: mysecret
      key: password

Answer

env:
- name: SECRET_DATA
  valueFrom:
    secretKeyRef:
      name: password
      key: mysecret

Answer

volumeMounts:
- name: secret-volume
  mountPath: /etc/secret
volumes:
- name: secret-volume
  secret:
    secretName: mysecret
    items:
    - key: password
      path: secret.txt

Question 5

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Accepted Answer

resources:
  requests:
    cpu: 250m
  limits:
    memory: 512Mi. Option D is correct because in Kubernetes, CPU requests are specified in millicores (e.g., 250m) and memory limits use binary units like Mi (Mebibytes). The value '250m' equals 0.25 CPU cores, and '512Mi' is 512 Mebibytes (512 * 1024^2 bytes), which is the standard unit for memory limits.

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512M

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512MB

Answer

resources:
  requests:
    cpu: 0.25
  limits:
    memory: 512MB

Question 6

A developer wants to ensure that a pod runs with a non-root user and cannot gain root privileges. Which SecurityContext settings should be used?

Accepted Answer

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: false. Option C is correct because setting `runAsNonRoot: true` enforces that the container's user ID is non-zero (non-root), and `allowPrivilegeEscalation: false` prevents the container from gaining additional privileges beyond its initial set, such as through setuid binaries or kernel capabilities. Together, they ensure the pod runs as a non-root user and cannot escalate to root, satisfying the developer's requirement.

Answer

securityContext:
  allowPrivilegeEscalation: false

Answer

securityContext:
  runAsNonRoot: true

Answer

securityContext:
  runAsNonRoot: true
  allowPrivilegeEscalation: true

Question 7

Which command creates a generic secret named 'db-secret' with key 'password' and value 'p@ss'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=p@ss. Option B is correct because `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=p@ss` creates a generic secret with the key 'password' and the literal value 'p@ss', which matches the requirement exactly.

Answer

kubectl create secret generic db-secret --from-file=password=p@ss

Answer

kubectl create secret tls db-secret --from-literal=password=p@ss

Answer

kubectl create secret docker-registry db-secret --from-literal=password=p@ss

Question 8

A pod named 'test-pod' in namespace 'test' has a service account 'my-sa' attached. The service account has a RoleBinding to a Role that allows get/list pods. However, the pod cannot list pods. What is the most likely issue?

Accepted Answer

The RoleBinding is in a different namespace than the pod. RoleBindings in Kubernetes are namespace-scoped and can only grant permissions within the namespace where they are created. If the RoleBinding is in a different namespace than the pod, the service account 'my-sa' will not have the get/list pods permissions in the pod's namespace, causing the pod to fail when trying to list pods.

Answer

The pod is using the default service account instead of 'my-sa'

Answer

RoleBindings cannot grant access to list pods

Answer

The pod has automountServiceAccountToken set to false

Question 9

You want to enforce that all pods in a namespace have a minimum memory request of 100Mi and a maximum memory limit of 1Gi. Which resource should you create?

Accepted Answer

LimitRange. A LimitRange (option D) is the correct resource because it allows you to set default, minimum, and maximum resource constraints (CPU/memory) at the namespace level, which are enforced per pod or container. In this case, you can define a LimitRange with a `min` of 100Mi and a `max` of 1Gi for memory, ensuring every pod in the namespace adheres to these bounds.

Answer

PodSecurityPolicy

Answer

LimitRange with limits:
- max:
    memory: 128Mi
  min:
    memory: 100Mi

Answer

ResourceQuota

Question 10

A cluster administrator wants to enforce that all pods in a namespace run with the 'restricted' Pod Security Standard. Which of the following is the correct way to label the namespace?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. The 'restricted' Pod Security Standard is enforced by applying the label `pod-security.kubernetes.io/enforce: restricted` to the namespace. This label causes the Pod Security Admission controller to reject any pod that violates the restricted policy, ensuring compliance. The other labels (`warn` and `audit`) only generate warnings or audit annotations without blocking non-compliant pods.

Answer

pod-security.kubernetes.io/warn: restricted

Answer

pod-security.kubernetes.io/audit: restricted

Question 11

A pod needs to mount a ConfigMap as a volume so that when the ConfigMap is updated, the pod automatically gets the updates. Which volume type should be used?

Accepted Answer

configMap volume. A configMap volume type directly mounts a ConfigMap as a volume in a pod. When the ConfigMap is updated, the kubelet periodically syncs the volume's content (default sync period is 60 seconds), so the pod automatically sees the updated data without requiring a restart. This makes it the correct choice for live updates from a ConfigMap.

Answer

emptyDir volume

Answer

projected volume with configMap source

Answer

downwardAPI volume

Question 12

Which command lists all the secrets in the current namespace?

Accepted Answer

kubectl get secrets. The correct command to list all secrets in the current namespace is `kubectl get secrets`. This command retrieves and displays all Secret resources in the namespace specified by the current context (or the `--namespace` flag). Secrets are stored in etcd as base64-encoded data and are managed via the Kubernetes API, and `kubectl get` is the standard verb for listing resources.

Answer

kubectl get configmaps

Answer

kubectl describe secrets

Answer

kubectl list secrets

Question 13

A pod is running with a service account that has been granted a Role to get pods. The pod's code uses the Kubernetes API from within the container. However, the API call fails with a 403 Forbidden error. Which file should the pod read to obtain the authentication token?

Accepted Answer

/var/run/secrets/kubernetes.io/serviceaccount/token. The pod's service account token is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. This token is a signed JWT that the pod uses to authenticate to the Kubernetes API server. Without reading this file, the pod cannot present valid credentials, resulting in a 403 Forbidden error.

Answer

/etc/kubernetes/admin.conf

Answer

/var/run/secrets/kubernetes.io/serviceaccount/namespace

Answer

/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

Question 14

Which TWO of the following are valid types of Secrets in Kubernetes?

Accepted Answer

Opaque. Option A is correct because Opaque is the default Secret type in Kubernetes, used for storing arbitrary key-value pairs such as passwords or tokens. It is defined as `Opaque` in the Secret's `type` field and is the most commonly used Secret type for general-purpose sensitive data.

Answer

kubernetes.io/ssh-auth

Answer

configmap

Answer

dockerconfigjson

Question 15

Which THREE of the following are valid fields in a PodSecurityContext?

Accepted Answer

fsGroup. Option A is correct because `fsGroup` is a valid field in a PodSecurityContext. It specifies the supplemental group ID applied to all containers in the pod when accessing volumes, ensuring proper file ownership and permissions for shared storage.

Answer

capabilities

Answer

allowPrivilegeEscalation