CKAD Application Environment, Configuration and Security Practice Test 8 — 15 Questions

Question 1

You apply a ResourceQuota to a namespace that limits memory requests to 2Gi. You then try to create a pod that requests 3Gi memory. What happens?

Accepted Answer

The pod creation fails with an error message indicating the quota would be exceeded.. When a ResourceQuota is applied to a namespace with a memory request limit of 2Gi, any pod creation that would cause the total memory requests in the namespace to exceed that quota is rejected by the Kubernetes API server. The pod creation fails immediately with an error message indicating the quota would be exceeded, because the admission controller validates the request against the quota before allowing the pod to be scheduled.

Answer

The pod is created with a warning, but the request is ignored.

Answer

The pod is created, but the memory request is capped at 2Gi.

Answer

The pod is created, but it will be OOMKilled if it exceeds 2Gi.

Question 2

A pod must run with a seccomp profile that only allows specific syscalls. Which SecurityContext field is used to specify the seccomp profile type?

Accepted Answer

seccompProfile. `seccompProfile` is the field within the Pod or container `SecurityContext` that specifies the seccomp profile type (e.g., `RuntimeDefault`, `Localhost`, or `Unconfined`). This field was introduced in Kubernetes v1.19 (beta) and replaces the older annotation-based seccomp configuration, allowing you to define the profile type directly in the pod spec.

Answer

appArmorProfile

Answer

seLinuxOptions

Answer

seccomp

Question 3

You need to create a TLS secret for an ingress with certificate and key. Which command correctly creates the secret?

Accepted Answer

kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key. `kubectl create secret tls` is the dedicated subcommand for creating a TLS secret, which automatically encodes the certificate and key files and stores them under the expected keys (`tls.crt` and `tls.key`). This is the only command that produces a secret of type `kubernetes.io/tls`, which is required by Ingress controllers to serve HTTPS traffic.

Answer

kubectl create secret docker-registry tls-secret --docker-cert=tls.crt --docker-key=tls.key

Answer

kubectl create secret generic tls-secret --from-file=tls.crt --from-file=tls.key

Answer

kubectl create secret certificate tls-secret --cert= --key=

Question 4

A pod in the 'staging' namespace is in a CrashLoopBackOff state. You run 'kubectl logs pod -n staging' and see: 'Error: container has been OOMKilled'. The pod YAML has resources: requests: memory: 256Mi, limits: memory: 256Mi. Which change should you make first?

Accepted Answer

Increase the memory limit to 512Mi.. The pod is in CrashLoopBackOff due to OOMKill, meaning the container exceeded its memory limit and was terminated. Since the current memory limit is 256Mi and the container needs more, increasing the limit to 512Mi directly addresses the out-of-memory condition. This is the correct first step because it provides the container with the additional memory it requires to run without being killed.

Answer

Increase the CPU limit to 1.

Answer

Reduce the memory request to 128Mi.

Answer

Set memory request to 512Mi and memory limit to 256Mi.

Question 5

You have a pod that needs to mount a Secret as a volume. The Secret has keys 'username' and 'password'. How should the volumes and volumeMounts be configured to mount the secret at /etc/secret with each key as a file?

Accepted Answer

volumes:
- name: secret-vol
  secret:
    secretName: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret. It uses the `secret` volume type with `secretName: my-secret`, which mounts the specified Kubernetes Secret as a volume. When mounted at `/etc/secret`, each key in the Secret (e.g., 'username' and 'password') becomes a file in that directory, with the file name matching the key and the file content being the decoded value of the key. This is the standard method for exposing Secret data as files in a pod.

Answer

volumes:
- name: secret-vol
  hostPath:
    path: /etc/secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  configMap:
    name: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  emptyDir: {}
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Question 6

A PodSecurityPolicy (PSP) has been replaced by Pod Security Admission. Which of the following commands applies a baseline pod security standard to the namespace 'dev'?

Accepted Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=baseline. Pod Security Admission uses labels on namespaces to enforce pod security standards. The label `pod-security.kubernetes.io/enforce=baseline` applies the baseline standard, which prevents known privilege escalations while allowing the default minimal pod configuration. This replaces the deprecated PodSecurityPolicy (PSP) with a built-in admission controller.

Answer

kubectl label ns dev pod-security.kubernetes.io/warn=baseline

Answer

kubectl label ns dev pod-security.kubernetes.io/enforce=privileged

Answer

kubectl label ns dev pod-security.kubernetes.io/audit=baseline

Question 7

You have a ConfigMap created from an env file. Which command creates the ConfigMap from the file 'app.env' containing key=value pairs?

Accepted Answer

kubectl create configmap app-config --from-env-file=app.env. `--from-env-file` is the exact flag used to create a ConfigMap from a file containing key=value pairs in env-file format (e.g., `app.env`). This flag parses each line as a key-value pair and stores them as individual data entries in the ConfigMap, unlike `--from-file` which stores the entire file content under a single key.

Answer

kubectl create configmap app-config --from-file=app.env

Answer

kubectl create configmap app-config --env-file=app.env

Answer

kubectl create configmap app-config --from-literal=app.env

Question 8

Which TWO are valid ways to expose a Secret's data as environment variables in a pod?

Accepted Answer

envFrom:
- secretRef:
    name: my-secret
    prefix: SECRET_. The `envFrom` field in a pod spec can reference a Secret using `secretRef`, and the optional `prefix` field prepends a string to each key from the Secret when exposing them as environment variables. This allows all key-value pairs from the Secret to be injected as environment variables with a common prefix, which is a concise and valid method.

Answer

envFrom:
- fieldRef:
    fieldPath: metadata.namespace

Answer

envFrom:
- literal:
    key: value

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 9

Which kubectl command creates a ConfigMap named 'app-config' with key 'color' and value 'blue'?

Accepted Answer

kubectl create configmap app-config --from-literal=color=blue. `kubectl create configmap app-config --from-literal=color=blue` directly creates a ConfigMap with a key-value pair. The `--from-literal` flag specifies a literal key=value string, which is the standard way to inject a single key-value pair into a ConfigMap without referencing an external file.

Answer

kubectl create configmap app-config --from-file=color=blue

Answer

kubectl create configmap app-config --from-env-file=color=blue

Answer

kubectl run configmap app-config --data color=blue

Question 10

A pod uses a ServiceAccount 'my-sa' but the pod's container needs to list pods in the namespace. Which RBAC resources are necessary?

Accepted Answer

Role and RoleBinding. A Role and RoleBinding are necessary because the pod's ServiceAccount 'my-sa' needs permissions to list pods within a specific namespace. A Role defines the allowed API operations (e.g., 'list pods') scoped to a namespace, and a RoleBinding binds that Role to the ServiceAccount, granting those permissions within that namespace. This is the standard RBAC pattern for namespace-scoped access in Kubernetes.

Answer

Role and ClusterRoleBinding

Answer

ServiceAccount and RoleBinding only

Answer

ClusterRole and ClusterRoleBinding

Question 11

Given the following partial pod spec:
```yaml
securityContext:
  runAsUser: 1000
  runAsGroup: 3000
  fsGroup: 2000
```
Which combination correctly describes the resulting permissions on a mounted volume?

Accepted Answer

Volume owned by user 1000, group 2000; container runs with user 1000 and group 3000. With `runAsUser: 1000`, the container's primary user ID is set to 1000, and this also makes the volume owned by user 1000. `runAsGroup: 3000` sets the container's primary group ID to 3000. `fsGroup: 2000` changes the group ownership of the mounted volume to group 2000 and adds it as a supplemental group. Thus, the volume is owned by user 1000 and group 2000, and the container runs with UID 1000 and GID 3000.

Answer

Volume owned by user 2000, group 1000; container runs with user 2000 and group 1000

Answer

Volume owned by user 3000, group 2000; container runs with user 1000 and group 3000

Answer

Volume owned by user 1000, group 3000; container runs with user 1000 and group 2000

Question 12

To prevent a container from running as root, which field should be set in the securityContext?

Accepted Answer

runAsNonRoot: true. The `runAsNonRoot: true` field in the securityContext explicitly prevents the container from running as the root user (UID 0). When set, Kubernetes will refuse to start the container if the image is configured to run as root, enforcing a non-root execution policy at the pod or container level. This is the direct and intended mechanism for ensuring the container does not run with root privileges.

Answer

runAsUser: 1000

Answer

allowPrivilegeEscalation: false

Answer

readOnlyRootFilesystem: true

Question 13

A pod uses a Secret 'db-secret' with keys 'username' and 'password'. Which environment variable definition correctly exposes the 'password' as an env var named 'DB_PASSWORD'?

Accepted Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      secretKeyRef:
        name: db-secret
        key: password. It uses `valueFrom.secretKeyRef` to reference the specific key `password` from the Secret `db-secret`, mapping it to the environment variable `DB_PASSWORD`. This is the standard Kubernetes method to expose a single key from a Secret as an environment variable with a custom name.

Answer

env:
  - name: DB_PASSWORD
    value: "password"

Answer

envFrom:
  - secretRef:
      name: db-secret

Answer

env:
  - name: DB_PASSWORD
    valueFrom:
      configMapKeyRef:
        name: db-secret
        key: password

Question 14

A namespace 'team-a' has a ResourceQuota with 'pods: 10' and a LimitRange with default memory request '256Mi'. A user creates a pod with no resource requests. What happens?

Accepted Answer

Pod is created with a default memory request of 256Mi.. When a pod is created in a namespace with a LimitRange that specifies a default memory request, Kubernetes automatically injects that default value into the pod's container spec if no explicit memory request is provided. The ResourceQuota of 'pods: 10' only limits the total number of pods, not the resource consumption of individual pods, so it does not affect this pod's creation. Therefore, the pod is created with a default memory request of 256Mi.

Answer

Pod creation fails because the ResourceQuota is exceeded.

Answer

Pod creation fails because the LimitRange is not satisfied.

Answer

Pod is created with no memory request.

Question 15

Which command creates a TLS secret named 'tls-secret' using certificate file 'tls.crt' and key file 'tls.key'?

Accepted Answer

kubectl create secret tls tls-secret --cert=tls.crt --key=tls.key. The `kubectl create secret tls` command is specifically designed to create a TLS secret from a certificate and key pair. The `--cert` and `--key` flags directly reference the PEM-encoded certificate file (`tls.crt`) and private key file (`tls.key`), which Kubernetes stores as `tls.crt` and `tls.key` data entries in the Secret object.

Answer

kubectl create secret docker-registry tls-secret --docker-server=...

Answer

kubectl create secret generic tls-secret --from-file=tls.crt --from-file=tls.key

Answer

kubectl create secret generic tls-secret --from-literal=tls.crt=...