CKAD Application Environment, Configuration and Security Practice Test 6 — 15 Questions

Question 1

Which kubectl command creates a Secret named 'db-secret' with key 'password' and value 'mypwd'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=mypwd. `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=mypwd` creates a secret with key 'password' and value 'mypwd', which is the exact requirement.

Answer

kubectl create secret generic db-secret password=mypwd

Answer

kubectl create secret generic db-secret --from-file=password=mypwd

Answer

kubectl create secret generic db-secret --from-env-file=password=mypwd

Question 2

Which THREE of the following are benefits of using a ResourceQuota in a namespace? (Select THREE)

Accepted Answer

It can enforce that every Pod has resource limits set. Option B is correct because a ResourceQuota can include the key limits.cpu and limits.memory (or requests.cpu/requests.memory), which forces every Pod in the namespace to declare matching resource limits or requests—otherwise the Pod is rejected at admission time. Option D is correct because by capping aggregate CPU, memory, storage, and object counts per namespace, ResourceQuota stops one namespace from consuming the entire cluster's capacity and starving other tenants. Option E is correct because ResourceQuota tracks the sum of requests/limits across all Pods in the namespace and denies any new Pod that would push the total past the configured CPU or memory ceiling. Option A is not correct because setting default requests and limits is the job of a LimitRange, not a ResourceQuota. Option C is not correct because restricting which users can create Pods is handled by RBAC (Roles/RoleBindings) or admission policies, not by ResourceQuota.

Answer

It sets default resource requests and limits for Pods that don't specify them

Answer

It restricts which users can create Pods in the namespace

Question 3

You want to apply a Pod Security Admission (PSA) policy that enforces the 'restricted' profile in the 'dev' namespace, but only for Pods that are not exempt. Which TWO steps are required? (Select TWO)

Accepted Answer

Set the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace. Option A is correct because PSA enforcement is enabled per-namespace by applying the label 'pod-security.kubernetes.io/enforce=restricted' to the 'dev' namespace, which tells the Pod Security Admission controller to reject Pods that violate the restricted profile. Option E is correct because the restricted profile imposes strict requirements — such as runAsNonRoot: true, allowPrivilegeEscalation: false, dropping ALL capabilities, and setting seccompProfile.type to RuntimeDefault or Localhost — so workloads must be configured to satisfy these controls to be admitted. Option B is incorrect because merely setting runAsUser: 1000 does not satisfy the restricted profile, which specifically requires runAsNonRoot rather than a fixed UID. Option C is incorrect because 'baseline' is a less restrictive profile than 'restricted' and would not enforce the required policy. Option D is incorrect because the 'warn' label only produces warnings and does not enforce the restricted profile; enforcement requires the 'enforce' label.

Answer

Add a 'securityContext' field to the Pod template with 'runAsUser: 1000'

Answer

Set the label 'pod-security.kubernetes.io/enforce=baseline' on the namespace

Answer

Set the label 'pod-security.kubernetes.io/warn=restricted' on the namespace

Question 4

Which kubectl command creates a ConfigMap named 'app-config' from a file named 'config.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=config.properties. `kubectl create configmap app-config --from-file=config.properties` creates a ConfigMap named 'app-config' by reading the entire contents of the file 'config.properties' and storing it as a single key-value pair, where the key defaults to the filename (config.properties) and the value is the file's content. This is the standard syntax for creating a ConfigMap from a file in Kubernetes.

Answer

kubectl create configmap app-config --from-literal=config.properties

Answer

kubectl create configmap app-config --file=config.properties

Answer

kubectl create configmap app-config --from-env-file=config.properties

Question 5

A pod needs to run as a non-root user with UID 1000. Which SecurityContext field should be set?

Accepted Answer

runAsUser: 1000. The `runAsUser` field in the PodSecurityContext or container SecurityContext sets the user ID (UID) under which the container's main process runs. Setting `runAsUser: 1000` ensures the container runs as a non-root user with UID 1000, meeting the requirement. This field directly controls the effective UID of the process, overriding the default root (UID 0).

Answer

runAsGroup: 1000

Answer

runAsNonRoot: true

Answer

fsGroup: 1000

Question 6

A cluster administrator wants to prevent all pods in a namespace from running with privileged escalation. Which Pod Security Admission standard enforces this?

Accepted Answer

restricted. The 'restricted' Pod Security Admission (PSA) standard enforces the most stringent security controls, including preventing privileged escalation by setting `securityContext.AllowPrivilegeEscalation` to `false` and requiring containers to run as non-root. This directly addresses the cluster administrator's goal of blocking privilege escalation in all pods within a namespace.

Answer

baseline

Answer

privileged

Answer

high

Question 7

A pod has a container with 'readOnlyRootFilesystem: true' in its securityContext. The container writes to /tmp. What is the expected outcome?

Accepted Answer

The container crashes because it tries to write to /tmp but the filesystem is read-only.. When `readOnlyRootFilesystem: true` is set in the container's securityContext, the root filesystem is mounted as read-only. The container writes to `/tmp`, which is part of the root filesystem by default, so the write fails and the container crashes (e.g., with an error like 'Read-only file system'). Kubernetes does not automatically make `/tmp` writable unless an explicit emptyDir volume is mounted at that path.

Answer

The pod runs normally; Kubernetes automatically makes /tmp writable.

Answer

The pod is rejected by the admission controller because readOnlyRootFilesystem conflicts with writing to /tmp.

Answer

The container writes successfully because readOnlyRootFilesystem only applies to the container image layers.

Question 8

You create a ServiceAccount 'my-sa' with automountServiceAccountToken: false. A pod that references this ServiceAccount also sets automountServiceAccountToken: true in its spec. Will the service account token be mounted?

Accepted Answer

Yes, because the pod spec setting takes precedence.. The pod spec's `automountServiceAccountToken: true` takes precedence over the ServiceAccount's `automountServiceAccountToken: false`. Kubernetes merges the ServiceAccount and pod-level settings, with the pod-level setting overriding the ServiceAccount's setting. Therefore, the token will be mounted into the pod.

Answer

No, because the ServiceAccount has automountServiceAccountToken: false, which is a hard block.

Answer

It depends on the namespace default settings.

Answer

No, because the ServiceAccount setting overrides the pod setting.

Question 9

A user wants to create a Kubernetes Secret for storing Docker registry credentials (username and password). Which type of Secret should they use?

Accepted Answer

kubernetes.io/dockerconfigjson. `kubernetes.io/dockerconfigjson` is the dedicated Secret type for storing Docker registry credentials in the format expected by `docker login`. It automatically encodes the username and password into a `.dockerconfigjson` field, which is used by Kubernetes to pull images from private registries. This type is required when referencing a `imagePullSecret` in a Pod spec.

Answer

kubernetes.io/tls

Answer

Opaque

Answer

kubernetes.io/basic-auth

Question 10

What is the purpose of a ResourceQuota in Kubernetes?

Accepted Answer

To limit the total amount of resources (CPU, memory, etc.) that can be consumed by all pods in a namespace.. A ResourceQuota is a Kubernetes object that enforces aggregate resource consumption limits on a per-namespace basis. It constrains the total CPU, memory, and other resource requests and limits across all pods in that namespace, preventing any single namespace from exhausting cluster resources. Option B correctly identifies this namespace-level resource cap.

Answer

To set default resource limits for containers that do not specify them.

Answer

To limit the number of nodes in a cluster.

Answer

To limit the number of replicas in a Deployment.

Question 11

A pod is configured with 'securityContext.seccompProfile.type: RuntimeDefault' but the container still attempts to use a syscall that is blocked by the default seccomp profile. What happens?

Accepted Answer

The syscall fails with an error, but the container may continue running.. When a container uses a syscall blocked by the seccomp profile, the syscall itself fails (returns an error like EPERM or is killed by SIGSYS), but the container process can handle that error and continue running. The `RuntimeDefault` profile applies Docker's default seccomp profile, which blocks around 44 syscalls (e.g., `mount`, `ptrace`, `perf_event_open`), but does not terminate the container unless the process exits due to the failed syscall. The container is not killed by Kubernetes; only the specific syscall is denied by the kernel's seccomp mechanism.

Answer

The container is killed because it violated the seccomp policy.

Answer

The pod is evicted by the kubelet because of a security violation.

Answer

The container runs successfully because RuntimeDefault allows all syscalls.

Question 12

Which command correctly creates a Role named 'pod-reader' that allows get, list, and watch on pods?

Accepted Answer

kubectl create role pod-reader --verb=get,list,watch --resource=pods. The `kubectl create role` command uses the `--verb` flag (singular) with comma-separated values and the `--resource` flag (singular) with the lowercase plural resource name 'pods'. This matches the Kubernetes API convention where resources are specified as lowercase plurals (e.g., 'pods', 'deployments') and verbs are comma-separated.

Answer

kubectl create role pod-reader --verb=get --verb=list --verb=watch --resource=pods

Answer

kubectl create role pod-reader --verb=get,list,watch --resource=Pod

Answer

kubectl create role pod-reader --verbs=get,list,watch --resources=pods

Question 13

Which THREE of the following are capabilities that can be added to a container's securityContext?

Accepted Answer

NET_ADMIN. (NET_ADMIN) is correct because it is a Linux capability that can be added to a container's securityContext under the `capabilities.add` field. This capability allows the container to perform network administration tasks such as interface configuration, firewall management, and routing table manipulation, which are common in network-focused pods.

Answer

RuntimeDefault

Answer

CAP_SYS_ADMIN

Question 14

Which kubectl command correctly creates a ConfigMap from a file named 'app.properties'?

Accepted Answer

kubectl create configmap app-config --from-file=app.properties. `kubectl create configmap app-config --from-file=app.properties` creates a ConfigMap by reading the entire contents of the file 'app.properties' and storing it under a key that defaults to the filename (app.properties). This is the standard way to import a file's data as a single key-value pair in a ConfigMap.

Answer

kubectl create configmap app-config --from-file=app.properties --from-env-file=app.properties

Answer

kubectl create configmap app-config --from-literal=app.properties

Answer

kubectl create configmap app-config --from-env-file=app.properties

Question 15

A pod is using a Secret to authenticate to a private registry. The Secret type must be 'kubernetes.io/dockerconfigjson'. Which of the following is the correct way to create such a Secret using kubectl?

Accepted Answer

kubectl create secret docker-registry regcred --docker-server=my-registry.example.com --docker-username=myuser --docker-password=mypassword --docker-email=myemail@example.com. `kubectl create secret docker-registry` is the dedicated command to create a Secret of type `kubernetes.io/dockerconfigjson`. It automatically generates the required `.dockerconfigjson` field with the base64-encoded Docker credentials in the correct JSON format, which the kubelet uses to authenticate to a private registry when pulling images.

Answer

kubectl create secret generic regcred --type=kubernetes.io/dockercfg --from-literal=.dockercfg=...

Answer

kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json

Answer

kubectl create secret tls regcred --cert=cert.crt --key=key.key