CKAD Application Environment, Configuration and Security Practice Test 2 — 15 Questions

Question 1

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Accepted Answer

resources:
  requests:
    cpu: 250m
  limits:
    memory: 512Mi. In Kubernetes, CPU requests are specified in millicores (e.g., 250m) and memory limits use binary units like Mi (Mebibytes). The value '250m' equals 0.25 CPU cores, and '512Mi' is 512 Mebibytes (512 * 1024^2 bytes), which is the standard unit for memory limits.

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512M

Answer

resources:
  requests:
    cpu: 250
  limits:
    memory: 512MB

Answer

resources:
  requests:
    cpu: 0.25
  limits:
    memory: 512MB

Question 2

Which command creates a generic secret named 'db-secret' with key 'password' and value 'p@ss'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=p@ss. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=p@ss` creates a generic secret with the key 'password' and the literal value 'p@ss', which matches the requirement exactly.

Answer

kubectl create secret generic db-secret --from-file=password=p@ss

Answer

kubectl create secret tls db-secret --from-literal=password=p@ss

Answer

kubectl create secret docker-registry db-secret --from-literal=password=p@ss

Question 3

A pod named 'test-pod' in namespace 'test' has a service account 'my-sa' attached. The service account has a RoleBinding to a Role that allows get/list pods. However, the pod cannot list pods. What is the most likely issue?

Accepted Answer

The RoleBinding is in a different namespace than the pod. RoleBindings in Kubernetes are namespace-scoped and can only grant permissions within the namespace where they are created. If the RoleBinding is in a different namespace than the pod, the service account 'my-sa' will not have the get/list pods permissions in the pod's namespace, causing the pod to fail when trying to list pods.

Answer

The pod is using the default service account instead of 'my-sa'

Answer

RoleBindings cannot grant access to list pods

Answer

The pod has automountServiceAccountToken set to false

Question 4

You want to enforce that all pods in a namespace have a minimum memory request of 100Mi and a maximum memory limit of 1Gi. Which resource should you create?

Accepted Answer

LimitRange. A LimitRange (option D) is the correct resource because it allows you to set default, minimum, and maximum resource constraints (CPU/memory) at the namespace level, which are enforced per pod or container. In this case, you can define a LimitRange with a `min` of 100Mi and a `max` of 1Gi for memory, ensuring every pod in the namespace adheres to these bounds.

Answer

PodSecurityPolicy

Answer

LimitRange with limits:
- max:
    memory: 128Mi
  min:
    memory: 100Mi

Answer

ResourceQuota

Question 5

A cluster administrator wants to enforce that all pods in a namespace run with the 'restricted' Pod Security Standard. Which of the following is the correct way to label the namespace?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. The `restricted` Pod Security Standard is enforced by applying the label `pod-security.kubernetes.io/enforce: restricted` to the namespace. This label causes the Pod Security Admission controller to reject any pod that violates the restricted policy, ensuring compliance. Only option A correctly specifies this label. Option D is a duplicate and not considered distinct.

Answer

pod-security.kubernetes.io/warn: restricted

Answer

pod-security.kubernetes.io/audit: restricted

Answer

pod-security.kubernetes.io/enforce: restricted

Question 6

A pod needs to mount a ConfigMap as a volume so that when the ConfigMap is updated, the pod automatically gets the updates. Which volume type should be used?

Accepted Answer

configMap volume. A configMap volume type directly mounts a ConfigMap as a volume in a pod. When the ConfigMap is updated, the kubelet periodically syncs the volume's content (default sync period is 60 seconds), so the pod automatically sees the updated data without requiring a restart. This makes it the correct choice for live updates from a ConfigMap.

Answer

emptyDir volume

Answer

projected volume with configMap source

Answer

downwardAPI volume

Question 7

Which command lists all the secrets in the current namespace?

Accepted Answer

kubectl get secrets. The correct command to list all secrets in the current namespace is `kubectl get secrets`. This command retrieves and displays all Secret resources in the namespace specified by the current context (or the `--namespace` flag). Secrets are stored in etcd as base64-encoded data and are managed via the Kubernetes API, and `kubectl get` is the standard verb for listing resources.

Answer

kubectl get configmaps

Answer

kubectl describe secrets

Answer

kubectl list secrets

Question 8

Which THREE of the following are valid types of Secrets in Kubernetes?

Accepted Answer

Opaque. Options A, B, and E are valid Kubernetes Secret types. Opaque is the default type for arbitrary data. kubernetes.io/ssh-auth is used for SSH authentication credentials. kubernetes.io/tls is used for TLS certificates. Options C and D are invalid: configmap is a separate resource, and dockerconfigjson lacks the kubernetes.io/ prefix (the valid type is kubernetes.io/dockerconfigjson).

Answer

configmap

Answer

dockerconfigjson

Question 9

Which TWO of the following are valid ways to consume environment variables from a ConfigMap in a pod?

Accepted Answer

envFrom:
- configMapRef:
    name: myconfig. `envFrom` with a `configMapRef` injects all key-value pairs from the named ConfigMap as environment variables into the container. This is a concise way to consume multiple variables without specifying each key individually, as defined in the Kubernetes API for Pods.

Answer

env:
- name: VAR
  configMapRef:
    name: myconfig
    key: mykey

Answer

volumeMounts:
- name: config-volume
  mountPath: /etc/config
volumes:
- name: config-volume
  configMap:
    name: myconfig

Answer

env:
- name: VAR
  valueFrom:
    configMapRef:
      name: myconfig
      key: mykey

Question 10

You need to create a ConfigMap named 'app-config' from a file 'config.properties'. Which kubectl command should you use?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` reads the file `config.properties` and creates a ConfigMap named `app-config` with a data key equal to the filename (`config.properties`) and the value set to the file's contents. This is the standard way to create a ConfigMap from a single file in Kubernetes.

Answer

kubectl create configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 11

Which of the following YAML fields can be used to mount a Secret as a volume in a Pod?

Accepted Answer

volumes. The `volumes` field in a Pod spec allows you to define a volume of type `secret`, which can then be mounted into a container using the `volumeMounts` field. This is the standard Kubernetes mechanism for exposing Secret data as files in the container's filesystem.

Answer

imagePullSecrets

Answer

annotations

Answer

envFrom

Question 12

A developer wants to ensure a container runs as a non-root user with user ID 1000 and group ID 2000. Which SecurityContext fields should be set?

Accepted Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: true. Setting `runAsUser: 1000` and `runAsGroup: 2000` ensures the container's processes run with user ID 1000 and group ID 2000, while `runAsNonRoot: true` enforces that the container cannot run as root (UID 0), providing a security best practice for non-root execution.

Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: false

Answer

runAsUser: 1000, runAsGroup: 2000, allowPrivilegeEscalation: false

Answer

runAsUser: 1000, fsGroup: 2000, runAsNonRoot: true

Question 13

What is the primary purpose of a Kubernetes ServiceAccount?

Accepted Answer

To provide an identity for processes running in a Pod. A ServiceAccount provides an identity for processes running in a Pod. Option B is incorrect because ServiceAccounts are for processes, not users (User accounts are for humans). Option C describes NetworkPolicy, which is unrelated to ServiceAccounts. Option D refers to image pull secrets, which can be associated with a ServiceAccount but are not the primary purpose.

Answer

To grant permissions to users

Answer

To define network policies for Pods

Answer

To store Docker registry credentials

Question 14

A pod is stuck in Pending state. You run 'kubectl describe pod my-pod' and see the event: '0/4 nodes are available: 1 Insufficient cpu, 3 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's resource requests exceed the available node resources. The event '0/4 nodes are available: 1 Insufficient cpu, 3 Insufficient memory' indicates that the Kubernetes scheduler could not find any node that satisfies the pod's resource requests. The pod's resource requests (spec.containers[].resources.requests) define the minimum CPU and memory the pod requires to run. If the sum of requests across all pods on a node exceeds the node's allocatable resources, the scheduler marks the node as unschedulable for that pod, leaving it in Pending state.

Answer

The pod uses too many secrets

Answer

The pod's resource limits are too low

Answer

The pod's container is failing health checks

Question 15

You want to restrict a Pod to only run with a seccomp profile of 'RuntimeDefault'. Which SecurityContext field should you set?

Accepted Answer

seccompProfile. The `seccompProfile` field in a Pod's SecurityContext allows you to specify a seccomp profile to restrict system calls. Setting it to `RuntimeDefault` applies the container runtime's default seccomp profile, which blocks a set of dangerous syscalls while allowing normal operation. This is the correct field to enforce a seccomp profile of 'RuntimeDefault'.

Answer

appArmorProfile

Answer

capabilities

Answer

seLinuxOptions