CKAD Application Environment, Configuration and Security Practice Test 6 — 15 Questions

Question 1

Which TWO are true about LimitRange objects?

Accepted Answer

A LimitRange is enforced at container creation time.. LimitRange objects enforce resource constraints at the time a container is created within a namespace. When a Pod is created, the LimitRange admission controller validates that the container's resource requests and limits fall within the defined minimum, maximum, and default values. If the container violates the LimitRange (e.g., requests less than the minimum memory), the Pod creation is rejected immediately.

Answer

A LimitRange can be applied to the entire cluster.

Answer

A LimitRange can set a default CPU limit for pods.

Answer

A LimitRange can limit the total number of pods in a namespace.

Question 2

Which kubectl command creates a ConfigMap named 'app-config' with key 'color' and value 'blue'?

Accepted Answer

kubectl create configmap app-config --from-literal=color=blue. `kubectl create configmap app-config --from-literal=color=blue` directly creates a ConfigMap with a key-value pair. The `--from-literal` flag specifies a literal key=value string, which is the standard way to inject a single key-value pair into a ConfigMap without referencing an external file.

Answer

kubectl create configmap app-config --from-file=color=blue

Answer

kubectl create configmap app-config --from-env-file=color=blue

Answer

kubectl run configmap app-config --data color=blue

Question 3

A pod uses a ServiceAccount 'my-sa' but the pod's container needs to list pods in the namespace. Which RBAC resources are necessary?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are necessary because the pod's ServiceAccount 'my-sa' needs permissions to list pods within a specific namespace. A Role defines the allowed API operations (e.g., 'list pods') scoped to a namespace, and a RoleBinding binds that Role to the ServiceAccount, granting those permissions within that namespace. This is the standard RBAC pattern for namespace-scoped access in Kubernetes.

Answer

Role and ClusterRoleBinding

Answer

ServiceAccount and RoleBinding only

Answer

ClusterRole and ClusterRoleBinding

Question 4

Given the following partial pod spec:
```yaml
securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
```
Which combination correctly describes the resulting permissions on a mounted volume?

Accepted Answer

Volume owned by user 1000, group 2000; container runs with user 1000 and group 3000. With `runAsUser: 1000`, the container's primary user ID is set to 1000, and this also makes the volume owned by user 1000. `runAsGroup: 3000` sets the container's primary group ID to 3000. `fsGroup: 2000` changes the group ownership of the mounted volume to group 2000 and adds it as a supplemental group. Thus, the volume is owned by user 1000 and group 2000, and the container runs with UID 1000 and GID 3000.

Answer

Volume owned by user 2000, group 1000; container runs with user 2000 and group 1000

Answer

Volume owned by user 3000, group 2000; container runs with user 1000 and group 3000

Answer

Volume owned by user 1000, group 3000; container runs with user 1000 and group 2000

Question 5

To prevent a container from running as root, which field should be set in the securityContext?

Accepted Answer

runAsNonRoot: true. The `runAsNonRoot: true` field in the securityContext explicitly prevents the container from running as the root user (UID 0). When set, Kubernetes will refuse to start the container if the image is configured to run as root, enforcing a non-root execution policy at the pod or container level. This is the direct and intended mechanism for ensuring the container does not run with root privileges.

Answer

runAsUser: 1000

Answer

allowPrivilegeEscalation: false

Answer

readOnlyRootFilesystem: true

Question 6

A pod uses a Secret 'db-secret' with keys 'username' and 'password'. Which environment variable definition correctly exposes the 'password' as an env var named 'DB_PASSWORD'?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password. It uses `valueFrom.secretKeyRef` to reference the specific key `password` from the Secret `db-secret`, mapping it to the environment variable `DB_PASSWORD`. This is the standard Kubernetes method to expose a single key from a Secret as an environment variable with a custom name.

Answer

env:
  - name: DB_PASSWORD
    value: "password"

Answer

envFrom:
  - secretRef:
      name: db-secret

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef:
        name: db-secret
        key: password

Question 7

A namespace 'team-a' has a ResourceQuota with 'pods: 10' and a LimitRange with default memory request '256Mi'. A user creates a pod with no resource requests. What happens?

Accepted Answer

Pod is created with a default memory request of 256Mi.. When a pod is created in a namespace with a LimitRange that specifies a default memory request, Kubernetes automatically injects that default value into the pod's container spec if no explicit memory request is provided. The ResourceQuota of 'pods: 10' only limits the total number of pods, not the resource consumption of individual pods, so it does not affect this pod's creation. Therefore, the pod is created with a default memory request of 256Mi.

Answer

Pod creation fails because the ResourceQuota is exceeded.

Answer

Pod creation fails because the LimitRange is not satisfied.

Answer

Pod is created with no memory request.

Question 8

Which command creates a TLS secret named 'tls-secret' using certificate file 'tls.crt' and key file 'tls.key'?

Accepted Answer

kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key. The `kubectl create secret tls` command is specifically designed to create a TLS secret from a certificate and key pair. The `--cert` and `--key` flags directly reference the PEM-encoded certificate file (`tls.crt`) and private key file (`tls.key`), which Kubernetes stores as `tls.crt` and `tls.key` data entries in the Secret object.

Answer

kubectl create secret docker-registry tls-secret --docker-server=...

Answer

kubectl create secret generic tls-secret --from-file=tls.crt --from-file=tls.key

Answer

kubectl create secret generic tls-secret --from-literal=tls.crt=...

Question 9

A pod's securityContext has 'allowPrivilegeEscalation: false' and 'capabilities: { drop: ["ALL"] }'. Which statement is true?

Accepted Answer

The container runs with no extra capabilities and cannot gain privileges.. Setting 'allowPrivilegeEscalation: false' prevents processes from gaining more privileges than their parent (e.g., via setuid binaries or kernel exploits), and dropping all capabilities with 'capabilities: { drop: ["ALL"] }' removes every Linux capability from the container's bounding set. Together, these ensure the container runs with no extra capabilities and cannot escalate privileges, even if running as root.

Answer

The container can still gain capabilities via setuid binaries.

Answer

The container runs as root with full privileges.

Answer

The container runs with all Linux capabilities.

Question 10

To mount a ConfigMap as a volume, which field type must be used in the pod spec's volumes and volumeMounts?

Accepted Answer

configMap. To mount a ConfigMap as a volume in a Pod, the `configMap` field type must be specified in the `volumes` array of the Pod spec, and the corresponding `volumeMounts` entry references that volume by name. This tells Kubernetes to populate the volume with the key-value pairs from the ConfigMap, making them available as files in the container's filesystem.

Answer

emptyDir

Answer

secret

Answer

hostPath

Question 11

A Pod Security Admission policy is set to 'restricted' for a namespace. Which of the following pod specs is ALLOWED?

Accepted Answer

A pod with securityContext.runAsNonRoot: true and readOnlyRootFilesystem: true. The 'restricted' Pod Security Admission (PSA) policy enforces the most stringent security controls, requiring pods to meet specific baseline security constraints. Option A satisfies these requirements by setting `runAsNonRoot: true` (preventing root execution) and `readOnlyRootFilesystem: true` (preventing writes to the root filesystem), both of which are mandatory for the restricted profile. The other options violate the restricted policy by either enabling privileged access, adding dangerous capabilities, or omitting required security contexts.

Answer

A pod with securityContext.capabilities.add: ["NET_ADMIN"]

Answer

A pod with no securityContext specified

Answer

A pod with securityContext.privileged: true

Question 12

You need to set environment variables in a pod from a ConfigMap 'app-config' that has keys 'APP_ENV' and 'APP_DEBUG'. Which approach exposes all keys as environment variables?

Accepted Answer

envFrom:
  - configMapRef:
      name: app-config. `envFrom` with `configMapRef` is the Kubernetes-native way to expose all keys from a ConfigMap as environment variables in a pod. This injects each key-value pair from the ConfigMap 'app-config' as an environment variable, matching the requirement to expose all keys without manual enumeration.

Answer

envFrom:
  - secretRef:
      name: app-config

Answer

env:
  - name: APP_ENV
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_ENV
  - name: APP_DEBUG
    valueFrom:
      configMapKeyRef:
        name: app-config
        key: APP_DEBUG

Answer

volumeMounts:
  - name: config
    mountPath: /etc/config
volumes:
  - name: config
    configMap:
      name: app-config

Question 13

A pod is in Pending state. 'kubectl describe pod' shows '0/1 nodes are available: 1 Insufficient cpu'. Which action would resolve this?

Accepted Answer

Reduce the CPU request in the container's resource spec. The pod is in Pending state because no node has enough allocatable CPU to satisfy the container's CPU request. Reducing the CPU request in the container's resource spec lowers the amount of guaranteed CPU the scheduler requires, making it possible to schedule the pod on a node with insufficient CPU capacity. This directly resolves the 'Insufficient cpu' condition shown in 'kubectl describe pod'.

Answer

Increase the CPU limit of the container

Answer

Delete and recreate the pod

Answer

Add more environment variables

Question 14

Which TWO statements about Kubernetes Secrets are correct? (Select 2)

Accepted Answer

A Secret can be mounted as a volume or exposed as environment variables. A is correct because Secrets can be consumed by pods as mounted volumes or as environment variables via `volumes`/`volumeMounts` or `env`/`envFrom`. C is correct because Secret data is base64-encoded in YAML manifests but stored in plaintext in etcd by default (encryption at rest is optional). E is correct because Secrets are namespace-scoped resources; a pod can only reference a Secret in the same namespace. B is incorrect because etcd encryption is not enabled by default for Secrets. D is incorrect because the maximum size of a Secret is 1 MB (default 1 MB, configurable via kube-apiserver flag).

Answer

Secrets are always encrypted in etcd

Answer

The maximum size of a Secret is 1 MB

Question 15

Which THREE of the following are valid fields in a PodSecurityContext that affect container security? (Select 3)

Accepted Answer

runAsUser. (runAsUser) is correct because it is a valid field in a PodSecurityContext that specifies the user ID (UID) under which all containers in the pod run. This field directly affects container security by controlling privilege levels and access to host resources, overriding the container's default user.

Answer

capabilities

Answer

privileged