CKAD Application Environment, Configuration and Security Practice Test 5 — 15 Questions

Question 1

You want to enforce that all pods in a namespace have a minimum memory request of 100Mi and a maximum memory limit of 1Gi. Which resource should you create?

Accepted Answer

LimitRange. A LimitRange (option D) is the correct resource because it allows you to set default, minimum, and maximum resource constraints (CPU/memory) at the namespace level, which are enforced per pod or container. In this case, you can define a LimitRange with a `min` of 100Mi and a `max` of 1Gi for memory, ensuring every pod in the namespace adheres to these bounds.

Answer

PodSecurityPolicy

Answer

LimitRange with limits:
- max:
    memory: 128Mi
  min:
    memory: 100Mi

Answer

ResourceQuota

Question 2

Which command lists all the secrets in the current namespace?

Accepted Answer

kubectl get secrets. The correct command to list all secrets in the current namespace is `kubectl get secrets`. This command retrieves and displays all Secret resources in the namespace specified by the current context (or the `--namespace` flag). Secrets are stored in etcd as base64-encoded data and are managed via the Kubernetes API, and `kubectl get` is the standard verb for listing resources.

Answer

kubectl get configmaps

Answer

kubectl describe secrets

Answer

kubectl list secrets

Question 3

A pod is running with a service account that has been granted a Role to get pods. The pod's code uses the Kubernetes API from within the container. However, the API call fails with a 403 Forbidden error. Which file should the pod read to obtain the authentication token?

Accepted Answer

/var/run/secrets/kubernetes.io/serviceaccount/token. The pod's service account token is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token. This token is a signed JWT that the pod uses to authenticate to the Kubernetes API server. Without reading this file, the pod cannot present valid credentials, resulting in a 403 Forbidden error.

Answer

/etc/kubernetes/admin.conf

Answer

/var/run/secrets/kubernetes.io/serviceaccount/namespace

Answer

/var/run/secrets/kubernetes.io/serviceaccount/ca.crt

Question 4

Which THREE of the following are valid types of Secrets in Kubernetes?

Accepted Answer

Opaque. Options A, B, and E are valid Kubernetes Secret types. Opaque is the default type for arbitrary data. kubernetes.io/ssh-auth is used for SSH authentication credentials. kubernetes.io/tls is used for TLS certificates. Options C and D are invalid: configmap is a separate resource, and dockerconfigjson lacks the kubernetes.io/ prefix (the valid type is kubernetes.io/dockerconfigjson).

Answer

configmap

Answer

dockerconfigjson

Question 5

Which THREE of the following are valid fields in a PodSecurityContext?

Accepted Answer

fsGroup. fsGroup (A) is a valid PodSecurityContext field that sets a supplemental group ID applied to all containers in the pod, used for volume ownership and permissions. seccompProfile (C) is valid at the pod level and defines the seccomp profile applied to all containers in the pod. runAsNonRoot (D) is a valid PodSecurityContext field that ensures containers run as a non-root user by validating the image's USER directive. capabilities (B) and allowPrivilegeEscalation (E) are not PodSecurityContext fields; they belong to the container-level SecurityContext, not the pod-level one.

Answer

capabilities

Answer

allowPrivilegeEscalation

Question 6

Which TWO of the following are valid ways to consume environment variables from a ConfigMap in a pod?

Accepted Answer

envFrom:
- configMapRef:
    name: myconfig. `envFrom` with a `configMapRef` injects all key-value pairs from the named ConfigMap as environment variables into the container. This is a concise way to consume multiple variables without specifying each key individually, as defined in the Kubernetes API for Pods.

Answer

env:
- name: VAR
  configMapRef:
    name: myconfig
    key: mykey

Answer

volumeMounts:
- name: config-volume
  mountPath: /etc/config
volumes:
- name: config-volume
  configMap:
    name: myconfig

Answer

env:
- name: VAR
  valueFrom:
    configMapRef:
      name: myconfig
      key: mykey

Question 7

You need to create a ConfigMap named 'app-config' from a file 'config.properties'. Which kubectl command should you use?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` reads the file `config.properties` and creates a ConfigMap named `app-config` with a data key equal to the filename (`config.properties`) and the value set to the file's contents. This is the standard way to create a ConfigMap from a single file in Kubernetes.

Answer

kubectl create configmap app-config config.properties

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 8

Which of the following YAML fields can be used to mount a Secret as a volume in a Pod?

Accepted Answer

volumes. The `volumes` field in a Pod spec allows you to define a volume of type `secret`, which can then be mounted into a container using the `volumeMounts` field. This is the standard Kubernetes mechanism for exposing Secret data as files in the container's filesystem.

Answer

imagePullSecrets

Answer

annotations

Answer

envFrom

Question 9

A developer wants to ensure a container runs as a non-root user with user ID 1000 and group ID 2000. Which SecurityContext fields should be set?

Accepted Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: true. Setting `runAsUser: 1000` and `runAsGroup: 2000` ensures the container's processes run with user ID 1000 and group ID 2000, while `runAsNonRoot: true` enforces that the container cannot run as root (UID 0), providing a security best practice for non-root execution.

Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: false

Answer

runAsUser: 1000, runAsGroup: 2000, allowPrivilegeEscalation: false

Answer

runAsUser: 1000, fsGroup: 2000, runAsNonRoot: true

Question 10

What is the primary purpose of a Kubernetes ServiceAccount?

Accepted Answer

To provide an identity for processes running in a Pod. A Kubernetes ServiceAccount provides an identity for processes running in a Pod, allowing them to authenticate to the Kubernetes API server and to external services. When a Pod is created, it can be assigned a ServiceAccount, and the API server then associates that identity with the Pod's requests. This is distinct from user accounts, which are for human users.

Answer

To grant permissions to users

Answer

To define network policies for Pods

Answer

To store Docker registry credentials

Question 11

A pod is stuck in Pending state. You run 'kubectl describe pod my-pod' and see the event: '0/4 nodes are available: 1 Insufficient cpu, 3 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's resource requests exceed the available node resources. The event '0/4 nodes are available: 1 Insufficient cpu, 3 Insufficient memory' indicates that the Kubernetes scheduler could not find any node that satisfies the pod's resource requests. The pod's resource requests (spec.containers[].resources.requests) define the minimum CPU and memory the pod requires to run. If the sum of requests across all pods on a node exceeds the node's allocatable resources, the scheduler marks the node as unschedulable for that pod, leaving it in Pending state.

Answer

The pod uses too many secrets

Answer

The pod's resource limits are too low

Answer

The pod's container is failing health checks

Question 12

You want to restrict a Pod to only run with a seccomp profile of 'RuntimeDefault'. Which SecurityContext field should you set?

Accepted Answer

seccompProfile. The `seccompProfile` field in a Pod's SecurityContext allows you to specify a seccomp profile to restrict system calls. Setting it to `RuntimeDefault` applies the container runtime's default seccomp profile, which blocks a set of dangerous syscalls while allowing normal operation. This is the correct field to enforce a seccomp profile of 'RuntimeDefault'.

Answer

appArmorProfile

Answer

capabilities

Answer

seLinuxOptions

Question 13

Which of the following is a valid way to expose a Secret as an environment variable in a Pod?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef: .... `secretKeyRef` is the Kubernetes API field used to reference a specific key from a Secret object and expose its value as an environment variable in a Pod. This is defined in the Pod spec under `env[].valueFrom.secretKeyRef`, which requires the `name` of the Secret and the `key` within that Secret.

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef: ...

Answer

env:
  - name: DB_PASSWORD
    value: $(DB_PASSWORD_SECRET)

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      fieldRef: ...

Question 14

You have a Secret of type 'kubernetes.io/tls' named 'tls-secret'. What keys are required in the Secret data?

Accepted Answer

tls.crt and tls.key. A is correct because a Kubernetes TLS secret of type 'kubernetes.io/tls' requires exactly two data keys: 'tls.crt' (the TLS certificate) and 'tls.key' (the private key). These are mandatory for the TLS handshake to function, as defined by the Kubernetes API for TLS secrets.

Answer

username and password

Answer

tls.crt, tls.key, and ca.crt

Answer

.dockerconfigjson

Question 15

A Pod in a namespace with a ResourceQuota that sets 'limits.cpu: 4' and 'limits.memory: 8Gi' is being created with the following container resources: requests: cpu: 2, memory: 4Gi; limits: cpu: 4, memory: 8Gi. The namespace also has a LimitRange with default limits of cpu: 500m, memory: 512Mi. Which statement is true about this resource configuration?

Accepted Answer

The Pod will be admitted because it respects both the ResourceQuota and the LimitRange. B is correct because the Pod explicitly sets its own limits (cpu: 4, memory: 8Gi) and requests (cpu: 2, memory: 4Gi), which are within the ResourceQuota's 'limits.cpu: 4' and 'limits.memory: 8Gi' constraints. The LimitRange default limits only apply to containers that do not specify limits; since this Pod specifies limits, the defaults are ignored. The Pod is admitted as it satisfies both admission controllers.

Answer

The Pod will have its limits overridden by the LimitRange defaults because limits must be set

Answer

The Pod will be rejected because the limits exceed the LimitRange default

Answer

The Pod will be rejected because requests must equal limits