CKAD Application Environment, Configuration and Security Practice Test 4 — 15 Questions

Question 1

A developer runs 'kubectl create secret generic tls-secret --cert=cert.crt --key=key.pem'. What type of Secret is created?

Accepted Answer

kubernetes.io/tls. The command `kubectl create secret generic tls-secret --cert=cert.crt --key=key.pem` creates a Secret of type `kubernetes.io/tls`. This is because the `--cert` and `--key` flags automatically set the type to TLS, which is used to store TLS certificates and private keys for ingress or other TLS termination. The `generic` subcommand is a misnomer here; it does not create an Opaque secret when these specific flags are provided.

Answer

Opaque

Answer

kubernetes.io/dockerconfigjson

Answer

kubernetes.io/ssh-auth

Question 2

A pod is configured with 'securityContext.seccompProfile.type: RuntimeDefault' but the container still attempts to use a syscall that is blocked by the default seccomp profile. What happens?

Accepted Answer

The syscall fails with an error, but the container may continue running.. When a container uses a syscall blocked by the seccomp profile, the syscall itself fails (returns an error like EPERM or is killed by SIGSYS), but the container process can handle that error and continue running. The `RuntimeDefault` profile applies Docker's default seccomp profile, which blocks around 44 syscalls (e.g., `mount`, `ptrace`, `perf_event_open`), but does not terminate the container unless the process exits due to the failed syscall. The container is not killed by Kubernetes; only the specific syscall is denied by the kernel's seccomp mechanism.

Answer

The container is killed because it violated the seccomp policy.

Answer

The pod is evicted by the kubelet because of a security violation.

Answer

The container runs successfully because RuntimeDefault allows all syscalls.

Question 3

Which command correctly creates a Role named 'pod-reader' that allows get, list, and watch on pods?

Accepted Answer

kubectl create role pod-reader --verb=get,list,watch --resource=pods. The `kubectl create role` command uses the `--verb` flag (singular) with comma-separated values and the `--resource` flag (singular) with the lowercase plural resource name 'pods'. This matches the Kubernetes API convention where resources are specified as lowercase plurals (e.g., 'pods', 'deployments') and verbs are comma-separated.

Answer

kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods

Answer

kubectl create role pod-reader --verb=get,list,watch --resource=Pod

Answer

kubectl create role pod-reader --verbs=get,list,watch --resources=pods

Question 4

A namespace 'dev' has a ResourceQuota that sets 'requests.cpu: 4' and 'limits.cpu: 8'. A pod is created with a container that has 'resources.requests.cpu: 1' and 'resources.limits.cpu: 3'. However, the pod remains in Pending state. The output of 'kubectl describe quota -n dev' shows 'used requests.cpu: 3.5' and 'used limits.cpu: 7'. What is the most likely reason the pod is pending?

Accepted Answer

The pod's CPU limit exceeds the remaining quota.. The ResourceQuota in namespace 'dev' has a limit of 8 CPUs for limits.cpu, with 7 already used, leaving only 1 CPU remaining. The pod's container requests a limit of 3 CPUs, which exceeds the available 1 CPU, causing the scheduler to reject the pod and leave it in Pending state. ResourceQuota enforcement occurs at admission time, and the scheduler will not schedule a pod that would cause the namespace to exceed its quota limits.

Answer

The pod's CPU request exceeds the remaining quota.

Answer

The pod's memory request is not set.

Answer

The namespace does not have a LimitRange set.

Question 5

Which TWO of the following are valid ways to consume a ConfigMap in a pod?

Accepted Answer

envFrom:
  - configMapRef:
      name: my-config. ConfigMaps can be consumed in a pod via environment variables or volumes. For environment variables, you can use `envFrom` with `configMapRef` to inject all key-value pairs, or `env` with `valueFrom.configMapKeyRef` to inject a specific key. For volumes, use a `configMap` volume source with the `name` field and mount it with `volumeMounts`. Therefore options C, D, and E are all valid. Option A is invalid because `secretRef` is for Secrets, not ConfigMaps. Option B is invalid because the correct field name is `name`, not `configMapName`.

Answer

envFrom:
  - secretRef:
      name: my-config

Answer

volumes:
  - name: config-vol
    configMap:
      configMapName: my-config

Question 6

Which THREE of the following are capabilities that can be added to a container's securityContext?

Accepted Answer

NET_ADMIN. (NET_ADMIN) is correct because it is a Linux capability that can be added to a container's securityContext under the `capabilities.add` field. This capability allows the container to perform network administration tasks such as interface configuration, firewall management, and routing table manipulation, which are common in network-focused pods.

Answer

RuntimeDefault

Answer

CAP_SYS_ADMIN

Question 7

Which TWO of the following are valid sources for creating a ConfigMap?

Accepted Answer

A file. A file is a valid source for creating a ConfigMap because the `kubectl create configmap` command supports the `--from-file` flag, which reads the entire contents of a file and creates a key-value pair where the key defaults to the filename. This is commonly used to inject configuration data like application properties or scripts into a Pod.

Answer

An environment variable file

Answer

A directory

Answer

A Secret

Question 8

A developer wants to use a ConfigMap named 'app-config' to set environment variables for a pod. The ConfigMap has keys 'DEBUG' and 'DATABASE_URL'. Which annotation should be added to the pod spec to inject all keys from the ConfigMap as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. The `envFrom` field in a Pod spec allows injecting all key-value pairs from a ConfigMap as environment variables into the container. By specifying `configMapRef` with the ConfigMap name, every key in the ConfigMap becomes an environment variable, which matches the requirement to inject all keys without listing them individually.

Answer

env:
  - name: DEBUG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: DEBUG

Answer

envFrom:
  - secretRef:
      name: app-config

Answer

env:
  - configMapRef:
      name: app-config

Question 9

Which kubectl command correctly creates a ConfigMap from a file named 'app.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=app.properties. `kubectl create configmap app-config --from-file=app.properties` creates a ConfigMap by reading the entire contents of the file 'app.properties' and storing it under a key that defaults to the filename (app.properties). This is the standard way to import a file's data as a single key-value pair in a ConfigMap.

Answer

kubectl create configmap app-config --from-file=app.properties --from-env-file=app.properties

Answer

kubectl create configmap app-config --from-literal=app.properties

Answer

kubectl create configmap app-config --from-env-file=app.properties

Question 10

A security requirement states that a container must run with a read-only root filesystem. Which field must be set in the container's securityContext?

Accepted Answer

readOnlyRootFilesystem: true. Setting `readOnlyRootFilesystem: true` in the container's `securityContext` enforces that the container's root filesystem is mounted as read-only, preventing any writes to the filesystem at the root level. This satisfies the security requirement by ensuring that even if a process is compromised, it cannot modify system binaries, configuration files, or other critical files within the container's root filesystem.

Answer

runAsUser: 1000

Answer

capabilities:
  drop: ["ALL"]

Answer

allowPrivilegeEscalation: false

Question 11

A pod needs to run as a non-root user. Which securityContext field should be set to enforce this?

Accepted Answer

runAsNonRoot: true. Setting `runAsNonRoot: true` in the pod's securityContext explicitly enforces that the container must not run as the root user (UID 0). If the container image attempts to run as root, the Pod will fail to start, ensuring compliance with non-root security policies.

Answer

runAsGroup: 3000

Answer

runAsUser: 1000

Answer

readOnlyRootFilesystem: true

Question 12

A developer creates a ServiceAccount 'my-sa' in namespace 'default'. They want to prevent pods from automatically mounting the ServiceAccount token. Which field should be set to false in the pod spec?

Accepted Answer

automountServiceAccountToken: false. Setting `automountServiceAccountToken: false` in the pod spec explicitly prevents the automatic mounting of the ServiceAccount token into the pod. This is the standard Kubernetes field for controlling token mounting at the pod level, overriding the default behavior where the token is mounted automatically.

Answer

serviceAccountName: my-sa

Answer

serviceAccountName: my-sa
  automountServiceAccountToken: false

Answer

containers:
  - automountServiceAccountToken: false

Question 13

An administrator wants to grant a ServiceAccount 'app-sa' in namespace 'dev' read-only access to pods in the same namespace. Which YAML snippet correctly defines the required RBAC resources?

Accepted Answer

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: dev
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: dev
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io. Ly defines a Role with read-only verbs (get, list, watch) on pods in the 'dev' namespace, and binds it to the ServiceAccount 'app-sa' using a RoleBinding. Since both the Role and RoleBinding are scoped to the same namespace, this grants the ServiceAccount the required read-only access to pods within that namespace.

Answer

Same as A but subjects:
- kind: Group
  name: app-sa

Answer

Same as A but subjects:
- kind: User
  name: app-sa

Answer

Same as A but RoleBinding uses kind: ClusterRole

Question 14

A pod is stuck in Pending state. You run 'kubectl describe pod mypod' and see the event: '0/3 nodes are available: 1 Insufficient memory, 2 Insufficient cpu'. The pod has resource requests defined. Which action would allow the pod to be scheduled?

Accepted Answer

Decrease the memory and CPU requests to fit within available node resources. The pod is unschedulable because the cluster's three nodes collectively lack sufficient CPU and memory to satisfy the pod's resource requests. Decreasing the memory and CPU requests to fit within the available node resources (option C) directly resolves the scheduling failure by making the pod's resource demands compatible with the remaining capacity on at least one node.

Answer

Increase the resource requests for the container

Answer

Delete the pod and recreate it with the same spec

Answer

Decrease the CPU request but keep the memory request the same

Question 15

Which of the following is a valid Pod Security Admission standard?

Accepted Answer

Restricted. The Pod Security Admission (PSA) standard defines three levels: Privileged, Baseline, and Restricted. Option C is correct because 'Restricted' is one of the three valid standards, designed to enforce the most restrictive pod security policies.

Answer

Privileged, Default

Answer

Default

Answer

Secure