CKAD Application Deployment — Timed 100 Questions

Question 1

You have a HorizontalPodAutoscaler (HPA) targeting a Deployment. The HPA is configured with 'targetCPUUtilizationPercentage: 50'. The current CPU utilization is 60% across the pods. What action does the HPA take?

100 minute time limit — choose an answer to begin.

Accepted Answer

Scale up the Deployment to reduce per-pod CPU utilization.. The HPA is configured with a targetCPUUtilizationPercentage of 50%, and the current CPU utilization is 60%, which exceeds the target. The HPA will scale up the Deployment by increasing the number of replicas to distribute the load, thereby reducing per-pod CPU utilization toward the target. This is the core behavior of the Kubernetes Horizontal Pod Autoscaler: it adjusts replica count based on observed metrics to meet the target.

Answer

Scale down the Deployment because the target is 50%.

Answer

Mark the HPA as unable to calculate metrics and stop scaling.

Answer

Take no action because the deviation is within tolerance.

Question 2

You are performing a blue-green deployment for an application. You have two Deployments: 'app-blue' (current production) and 'app-green' (new version). Both have label 'app: myapp' and are exposed by a Service 'myapp-svc'. How do you switch traffic from blue to green?

Accepted Answer

Update the Service's selector to match the labels of the green Deployment's pods (e.g., 'version: green').. Updating the Service's selector to match the green Deployment's pod label routes traffic to green. Option A is incorrect because the Service cannot be deleted and recreated without downtime if done incorrectly. Option C is incorrect because deleting the blue Deployment before ensuring the green is serving traffic would cause downtime. Option D is incorrect because changing the image in the same Deployment would perform a rolling update, not a blue-green switch.

Answer

Delete the Service and recreate it with the selector pointing to app-green.

Answer

Delete the blue Deployment after ensuring green is ready.

Answer

Update the blue Deployment's image to the new version.

Question 3

Which TWO of the following are valid ways to view the rollout history of a Deployment named 'myapp'? (Select two.)

Accepted Answer

kubectl get replicasets -l app=myapp. `kubectl get replicasets -l app=myapp` lists all ReplicaSets associated with the Deployment via the label selector. Each ReplicaSet corresponds to a revision in the rollout history, so viewing them effectively shows the history of revisions.

Option B is correct because `kubectl rollout history deployment myapp` directly displays the rollout history with revision numbers and change causes.

Option C is incorrect because `kubectl describe deployment myapp` only shows the current state of the Deployment, including the current revision annotation, but does not list past revisions or the full history.

Option D is incorrect because `kubectl rollout status deployment myapp` monitors the progress of a single rollout (e.g., during an update) and does not show historical rollouts.

Option E is incorrect because `kubectl get deployment myapp -o yaml` outputs the current Deployment manifest, which contains only the desired state and current status, not the revision history.

Answer

kubectl describe deployment myapp

Answer

kubectl rollout status deployment myapp

Answer

kubectl get deployment myapp -o yaml

Question 4

You are using a canary deployment pattern with two Deployments: 'web-stable' (version 1) and 'web-canary' (version 2). Both have the label 'app: web'. The Service 'web-svc' selects pods with 'app: web' and 'version: stable'. How do you route traffic to the canary?

Accepted Answer

Add the label 'version: canary' to the canary Deployment's pod template and update the Service's selector to 'app: web, version in (stable, canary)'.. The Service 'web-svc' currently selects pods with 'app: web' and 'version: stable'. To route traffic to the canary pods (version 2), you need to add the label 'version: canary' to the canary Deployment's pod template so that those pods are created with that label. Then, updating the Service's selector to 'app: web, version in (stable, canary)' allows the Service to match both stable and canary pods, distributing traffic between them according to the Service's default round-robin behavior.

Answer

Use kubectl rollout canary on the stable Deployment.

Answer

Create a new Service with selector 'app: web, version: canary' and use an ingress to split traffic.

Answer

Change the Service selector to 'app: web' only (remove version label).

Question 5

You need to scale a Deployment named 'frontend' to 10 replicas. Which command correctly accomplishes this?

Accepted Answer

kubectl scale deployment/frontend --replicas=10. It uses the standard imperative syntax 'kubectl scale / --replicas=N' with the resource specified as 'deployment/frontend' and the flag after the resource. Option D places the flag before the resource and uses space-separated type and name, which is not the expected form in the CKAD exam, making it incorrect despite being functionally valid in some kubectl versions.

Answer

kubectl patch deployment frontend -p '{"spec":{"replicas":10}}'

Answer

kubectl set replicas deployment/frontend 10

Answer

kubectl scale --replicas=10 deployment frontend

Question 6

You have installed a Helm chart for an application named 'myapp' in the namespace 'prod'. You need to upgrade the release to a new chart version, but you want to be able to revert to the current version quickly if the upgrade fails. Which command should you run?

Accepted Answer

helm upgrade myapp ./chart --namespace prod --history-max 10. The correct command is `helm upgrade myapp ./chart --namespace prod --history-max 10`. This ensures that the Helm release history is kept for at least 10 revisions, allowing you to manually roll back to the previous version if the upgrade fails. Option A (`--atomic`) automatically rolls back on failure, which also satisfies the requirement to revert quickly, but the question is specifically about preserving the ability to manually revert. However, the exam expects that explicit `--history-max` is the best practice to guarantee that rollback history is available. Therefore, option D is the intended correct answer.

Answer

helm upgrade myapp ./chart --namespace prod --atomic

Answer

helm upgrade myapp ./chart --namespace prod --recreate-pods

Answer

helm upgrade myapp ./chart --namespace prod

Question 7

Which THREE statements correctly describe Kustomize? (Select THREE.)

Accepted Answer

Kustomize uses a kustomization.yaml file to define customization rules.. Kustomize relies on a `kustomization.yaml` file to define customization rules such as resources, patches, namePrefix, and commonLabels. This file is placed in a directory and instructs Kustomize how to transform base Kubernetes manifests without altering the original YAML files.

Answer

Kustomize can only be used with Helm charts.

Answer

Kustomize requires a separate server component to run.

Question 8

What is the purpose of a HorizontalPodAutoscaler (HPA)?

Accepted Answer

To automatically adjust the number of pods based on resource metrics. A HorizontalPodAutoscaler automatically scales the number of pods in a Deployment, ReplicaSet, or StatefulSet based on observed CPU utilization (or other custom metrics).

Answer

To update the application version without downtime

Answer

To restart pods automatically when they fail

Answer

To distribute incoming traffic across multiple pods

Question 9

A canary deployment is being implemented using two Deployments (stable and canary) and a Service. The Service's label selector has two entries: 'app: myapp' and 'version: stable'. Initially, the canary Deployment's pods have label 'version: canary'. To route a small percentage of traffic to the canary, what should you do?

Accepted Answer

Change the canary Deployment's pod template labels to also include 'version: stable' so that the Service selects them. A Service selects pods based on the union of all key-value pairs in its label selector. By adding 'version: stable' to the canary Deployment's pod template, the canary pods will match the Service's selector (app: myapp AND version: stable), causing the Service to include them in its endpoints. This allows a small percentage of traffic to reach the canary pods via the Service's round-robin load balancing, proportional to the number of replicas in each Deployment.

Answer

Update the Service's selector to include both 'version: stable' and 'version: canary'

Answer

Use a NetworkPolicy to allow traffic to the canary

Answer

Create a new Service that points to both Deployments

Question 10

Which command is used to scale a Deployment named 'frontend' to 10 replicas?

Accepted Answer

kubectl scale deploy frontend --replicas 10. Both Option A and Option B are valid commands to scale a Deployment. Option A uses the abbreviation 'deploy' and the --replicas flag without equals sign, which is accepted. Option B uses the full resource type 'deployment/frontend' with the equals sign. Both achieve the same result. Options C and D are not the direct scale command; Option C uses 'set replicas' which is not a valid kubectl command for scaling, and Option D uses 'edit' which is indirect and not the command for scaling.

Answer

kubectl set replicas deployment/frontend 10

Answer

kubectl edit deployment frontend and change replicas to 10

Question 11

A developer wants to deploy a stateless application as a set of identical pods. They need the pods to be distributed across nodes and have stable network identities. Which resource should they use?

Accepted Answer

StatefulSet. StatefulSet is the correct resource because it provides each pod with a stable, unique network identity (e.g., pod-name-0, pod-name-1) that persists across rescheduling. While Deployment manages replicas for stateless applications, it does not assign per-pod stable hostnames. The question explicitly requires 'stable network identities' for identical pods, which is a defining feature of StatefulSet. A Service combined with a Deployment gives a stable endpoint for the set, not per-pod identities.

Answer

Job

Answer

Deployment

Answer

DaemonSet

Question 12

A team is deploying a microservice that must be reachable within the cluster via a stable DNS name. They also need to distribute traffic among pods. Which Kubernetes resource provides both service discovery and load balancing?

Accepted Answer

Service. A Service in Kubernetes provides a stable DNS name (via cluster DNS, e.g., CoreDNS) that resolves to the Service's ClusterIP, and it load-balances traffic across the pods selected by its label selector using iptables or IPVS rules. This directly fulfills the requirement for both service discovery and load balancing within the cluster.

Answer

ConfigMap

Answer

Secret

Answer

Ingress

Question 13

During a deployment update, the rollout is stuck and new pods are not becoming ready. The developer checks the events and sees 'Back-off restarting failed container'. What is the most likely cause?

Accepted Answer

The container's entrypoint command fails immediately after start. The 'Back-off restarting failed container' event indicates that the container process exits immediately after starting, causing Kubernetes to repeatedly restart it with increasing back-off delays. This is most commonly caused by a container entrypoint or command that fails at runtime, such as a misconfigured binary, missing dependency, or incorrect startup script. Unlike probe failures, which cause restarts after the container is already running, this error occurs before the container can even become ready.

Answer

The liveness probe is failing

Answer

The image pull secret is missing

Answer

The pod exceeds its memory limit and is OOMKilled

Question 14

A developer needs to run a one-time batch job to process data. After completion, the pod should be retained for logs inspection. Which Job configuration parameter should be set?

Accepted Answer

Leave ttlSecondsAfterFinished unset. To retain a Job's Pod after completion for log inspection, the `ttlSecondsAfterFinished` field must be left unset (or set to nil). When this field is unset, the Job controller does not automatically delete the Pod, allowing logs to be inspected. Setting it to any non-negative integer would schedule automatic deletion after that many seconds, which contradicts the requirement.

Answer

backoffLimit: 0

Answer

ttlSecondsAfterFinished: -1

Answer

activeDeadlineSeconds: 3600

Question 15

A company wants to deploy a stateful database cluster where each pod has its own persistent storage. They need stable network identities and ordered pod creation. Which resource should they use?

Accepted Answer

StatefulSet. StatefulSet is the correct resource because it provides stable, unique network identities (via headless Services and ordinal hostnames) and ordered, graceful deployment and scaling (pod creation/deletion in sequence). This matches the requirements for a stateful database cluster where each pod requires its own PersistentVolumeClaim (PVC) and stable identity for clustering.

Answer

Deployment

Answer

CronJob

Answer

DaemonSet

Question 16

A Deployment has replicas: 5. During a rolling update, the developer sets maxSurge: 2 and maxUnavailable: 1. What is the maximum number of pods that can be running during the update?

Accepted Answer

7. During a rolling update, the total number of pods running is the sum of the desired replicas (5) plus the maxSurge (2), which equals 7. The maxUnavailable setting (1) controls how many pods can be down, not the upper limit of running pods. Kubernetes ensures that the number of pods above the desired count does not exceed maxSurge, so the maximum running pods is 5 + 2 = 7.

Answer

5

Answer

8

Answer

6

Question 17

A developer wants to ensure that a critical application always runs on every node in the cluster. Which resource should they use?

Accepted Answer

DaemonSet. A DaemonSet ensures that a pod runs on every node in the cluster, or on a subset of nodes based on a node selector. This is the correct resource for deploying a critical application that must be present on all nodes, such as a logging agent or a monitoring daemon.

Answer

StatefulSet

Answer

ReplicaSet

Answer

Deployment

Question 18

A pod is running but not responding to requests. The developer suspects the liveness probe is misconfigured. Which command can they use to check the probe configuration of a running pod?

Accepted Answer

kubectl describe pod . `kubectl describe pod ` displays the full pod specification, including the liveness probe configuration (e.g., `Liveness: http-get /healthz delay=0s timeout=1s period=10s #success=1 #failure=3`). This allows the developer to verify the probe type, endpoint, initial delay, timeout, and failure threshold directly from the running pod's definition.

Answer

kubectl logs <pod-name>

Answer

kubectl exec <pod-name> -- env

Answer

kubectl get pod <pod-name>

Question 19

A Deployment has replicas: 3 and uses a ConfigMap. The ConfigMap is updated. The developer wants to update the pods to use the new ConfigMap without recreating the Deployment. What is the correct approach?

Accepted Answer

kubectl rollout restart deployment/. A `kubectl rollout restart deployment/` triggers a rolling restart of the Pods managed by the Deployment. Since ConfigMaps are mounted as volumes or injected as environment variables at Pod creation time, the only way to pick up updated ConfigMap data without recreating the Deployment object itself is to force the existing Pods to be terminated and recreated. The Deployment controller handles this gracefully, ensuring zero downtime by following the configured rolling update strategy.

Answer

kubectl set image deployment/ =

Answer

The pods automatically mount the new ConfigMap within seconds

Answer

Delete and recreate each pod manually

Question 20

Which TWO of the following are valid strategies for updating a Deployment?

Accepted Answer

RollingUpdate. RollingUpdate is the default update strategy in Kubernetes Deployments. It gradually replaces old Pods with new ones, ensuring zero downtime by incrementally scaling down old ReplicaSets and scaling up new ones based on configurable parameters like maxSurge and maxUnavailable.

Answer

Canary

Answer

Ramped

Answer

Blue/Green