CKAD Application Design and Build — 20 Questions

Question 1

A developer is creating a ConfigMap from a file named 'app.properties'. The file contains key-value pairs. Which command correctly creates the ConfigMap with keys matching the file content?

Accepted Answer

kubectl create configmap my-config --from-env-file=app.properties. The file 'app.properties' contains key-value pairs. To create a ConfigMap with keys that match the keys in the file, use `kubectl create configmap my-config --from-env-file=app.properties`. This parses the file and creates one data entry per key=value line. Option A (`--from-file=app.properties`) stores the entire file content as a single value under the key 'app.properties', which does not produce keys matching the file content. Option B uses `--from-literal` incorrectly, and option C reads from stdin but still treats the input as a single file, not as key-value pairs.

Answer

kubectl create configmap my-config --from-file=app.properties

Answer

kubectl create configmap my-config --from-literal=app.properties

Answer

cat app.properties | kubectl create configmap my-config --from-file=-

Question 2

A developer is designing a Job that should run exactly once and then stop. The Job runs a batch process that is expected to complete within one hour. Which restartPolicy and backoffLimit are appropriate?

Accepted Answer

restartPolicy: OnFailure, backoffLimit: 4. A Job designed to run exactly once and stop should use `restartPolicy: OnFailure` or `Never`, and `backoffLimit: 4` provides a reasonable number of retries (up to 4) before the Job is marked as Failed, ensuring the batch process can recover from transient errors within the expected one-hour completion window. The `restartPolicy: Always` is invalid for Jobs (only `OnFailure` or `Never` are allowed), and `backoffLimit: 0` would prevent any retries, which is too restrictive for a batch process that may encounter temporary failures.

Answer

restartPolicy: Always, backoffLimit: 6

Answer

restartPolicy: Never, backoffLimit: 0

Answer

restartPolicy: Always, backoffLimit: 0

Question 3

Match each Kubernetes resource to its primary purpose.

Accepted Answer

Pod: Runs one or more containers as a cohesive unit of compute. These are core Kubernetes resources with distinct roles. Pods are the smallest deployable units; Services provide networking abstractions; Deployments manage scaling and updates; ConfigMaps handle configuration data.

Answer

Pod: Provides load-balanced access to a set of Pods

Answer

Service: Manages rolling updates of Pods

Question 4

Match each Kubernetes Service type to its behavior.

Accepted Answer

ClusterIP: Exposes the service on a cluster-internal IP.. Common Kubernetes service types: ClusterIP (internal), NodePort (static port on nodes), LoadBalancer (cloud LB), ExternalName (DNS alias). Here, correct matches are A and C.

Answer

ClusterIP: Exposes the service externally via a cloud load balancer.

Answer

NodePort: Exposes the service on a cluster-internal IP only.

Question 5

A developer is creating a CronJob that should not start a new job if the previous one is still running. Which TWO configurations achieve this? (Select exactly 2.)

Accepted Answer

Set concurrencyPolicy: Forbid. Option D is correct because concurrencyPolicy: Forbid tells the CronJob controller to skip the new scheduled run entirely if the previous job is still running, which is exactly the requested behavior. Option E is correct because designing the schedule (for example, spacing runs far enough apart or using a longer interval) so that each job reliably finishes before the next scheduled time prevents overlapping executions at the scheduling level. Option A is wrong because concurrencyPolicy: Allow explicitly permits concurrent jobs, the opposite of what is needed. Option B is wrong because startingDeadlineSeconds only controls how late a missed job may still be started; it does not prevent overlap. Option C is wrong because concurrencyPolicy: Replace cancels the currently running job and starts a new one, which still results in a new job starting rather than being skipped.

Answer

Set concurrencyPolicy: Allow

Answer

Set startingDeadlineSeconds to a low value

Answer

Set concurrencyPolicy: Replace

Question 6

A Kubernetes pod has two containers: a main application container and a sidecar container running a logging agent. The sidecar container is expected to start before the main container because it needs to initialize a shared log directory. What Kubernetes feature ensures this ordering?

Accepted Answer

Init containers. Init containers run to completion before app containers start, ensuring order.

Answer

Lifecycle hooks

Answer

Readiness probe on the sidecar

Answer

Resource limits

Question 7

Which TWO of the following are valid patterns for sidecar containers in a multi-container pod?

Accepted Answer

Adapter. The sidecar pattern involves adding a helper container to a pod. The two common patterns are Adapter and Sidecar. Adapter pattern standardizes output, while Sidecar pattern provides auxiliary functionality. Ambassador is also a sidecar pattern, but this question specifically asks for two correct answers among the options, and Adapter and Sidecar are the correct choices.

Answer

Ambassador

Answer

Init container

Answer

Proxy

Question 8

Which TWO of the following are valid concurrencyPolicy values for a CronJob?

Accepted Answer

Forbid. In Kubernetes, a CronJob's concurrencyPolicy controls how to handle overlapping job executions. The valid values are Allow (default, allowing concurrent runs) and Forbid (skips new run if previous is still running). Among the options given, the two correct answers are Allow and Forbid. Replace is not a valid concurrencyPolicy value; it is a distractor.

Answer

Parallel

Answer

Serial

Answer

Replace

Question 9

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. The `docker build` command requires both the `-t` flag to specify the image tag (name:version) and the build context path (`.` for the current directory). The syntax `docker build -t myapp:v1 .` correctly tags the image as 'myapp:v1' and uses the current directory as the build context, which includes the Dockerfile and any referenced files.

Answer

docker build .

Answer

docker build -t myapp:v1

Answer

docker push myapp:v1

Question 10

Which kubectl command creates a pod named 'nginx' from the image 'nginx:latest'?

Accepted Answer

kubectl run nginx --image=nginx:latest. `kubectl run nginx --image=nginx:latest` creates a Pod named 'nginx' by default in recent Kubernetes versions (1.18+). Option C is also correct: adding `--restart=Never` explicitly creates a Pod and is a common practice to ensure a Pod is created rather than a Deployment. Option B is wrong because `kubectl apply -f` requires a YAML file. Option D is wrong because `kubectl create pod` is not a valid subcommand; the correct imperative command is `kubectl run`.

Answer

kubectl apply -f pod.yaml

Answer

kubectl create pod nginx --image=nginx:latest

Question 11

Which of the following commands creates a Job that runs a single pod executing the command 'sleep 30'?

Accepted Answer

kubectl create job myjob --image=busybox -- sleep 30. `kubectl create job myjob --image=busybox -- sleep 30` creates a Job object that runs a single Pod executing the command `sleep 30`. The `--` separator indicates the end of kubectl options and the start of the container command, which is the correct syntax for passing a command to the Job's container.

Answer

kubectl run myjob --image=busybox --restart=OnFailure -- sleep 30

Answer

kubectl create job myjob --image=busybox --command -- sleep 30

Answer

kubectl create job myjob --image=busybox sleep 30

Question 12

You have a multi-stage Dockerfile for a Go application. The first stage compiles the binary, and the second stage uses a scratch image. Which of the following is the correct way to copy the binary from the first stage into the second stage?

Accepted Answer

COPY --from=builder /app/bin /app/. `COPY --from=builder` references a named stage in a multi-stage Dockerfile. Option D is incorrect because in the CKAD exam, stage numbers are not used; only named stages are valid for the `--from` flag. Using the index `0` is not supported in the expected syntax and would cause a build error.

Answer

ADD --from=builder /app/bin /app/

Answer

COPY /app/bin /app/

Answer

COPY --from=0 /app/bin /app/

Question 13

Which TWO of the following are valid patterns for sidecar containers in Kubernetes?

Accepted Answer

Ambassador. The three common sidecar patterns are sidecar, ambassador, and adapter. However, the sidecar pattern itself is the overarching concept; the question asks for two specific patterns that are commonly implemented as sidecar containers. Ambassador and adapter are the correct choices, as they represent distinct proxy and transformation patterns, respectively, while 'sidecar' is the general term.

Answer

Singleton

Answer

DaemonSet

Answer

Sidecar

Question 14

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to use more memory without being killed by the Out-Of-Memory (OOM) killer.

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop

Question 15

Which TWO statements about init containers are correct?

Accepted Answer

Init containers always run to completion.. Option B is correct because init containers are designed to run once and must terminate successfully before the pod's main containers start; they are not long-running processes, so each init container always runs to completion. Option C is correct because Kubernetes executes init containers strictly sequentially, in the exact order they are defined in the pod spec, with each one finishing before the next begins. Option A is incorrect because init containers do support resource requests and limits just like regular containers. Option D is incorrect because if an init container fails, the pod's restart policy governs whether it is retried, so it can be restarted. Option E is incorrect because init containers must all complete before any main application container starts, so they never run concurrently with the app containers.

Answer

Init containers cannot have resource limits.

Answer

If an init container fails, it is not restarted.

Answer

Init containers can run concurrently with the main application containers.

Question 16

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. `docker build -t myapp:v1 .` uses the `-t` flag to tag the image with the name `myapp` and tag `v1`, and the `.` specifies the build context as the current directory. This is the standard syntax for building and tagging a Docker image from a Dockerfile in the current directory.

Answer

docker build -t myapp:v1

Answer

docker build . -name myapp:v1

Answer

docker image build --tag myapp:v1

Question 17

A developer creates a pod with two containers: a main web server and a sidecar that rotates logs. The sidecar must start before the main container. Which field enforces this startup order?

Accepted Answer

initContainers. `initContainers` run sequentially before the main application containers in a Pod, ensuring the sidecar log-rotation container completes its startup tasks before the web server container starts. This enforces a strict startup order, which is not achievable with regular containers that start concurrently.

Answer

startupProbe

Answer

lifecycle.preStop

Answer

restartPolicy: Always

Question 18

You need to debug a pod that is not responding. Which command attaches an ephemeral debug container to a running pod named 'web-pod'?

Accepted Answer

kubectl debug -it web-pod --image=busybox --target=web-container. `kubectl debug` with the `--image` flag creates an ephemeral container in the specified pod for interactive debugging. The `-it` flag provides an interactive TTY, and `--target=web-container` attaches the ephemeral container to the same Linux namespace as the target container, allowing direct troubleshooting of the unresponsive pod without modifying its original containers.

Answer

kubectl debug web-pod --copy-to=debug-pod --image=busybox

Answer

kubectl attach web-pod

Answer

kubectl run debug --image=busybox -it

Question 19

Which THREE options are valid fields in a CronJob spec? (Select 3)

Accepted Answer

.spec.successfulJobsHistoryLimit. Option B (.spec.successfulJobsHistoryLimit) is correct because it is a top-level CronJob spec field that controls how many completed Jobs are retained in history (default 3). Option C (.spec.schedule) is correct because it is the required cron-format field (e.g., "*/5 * * * *") that defines when the CronJob creates Jobs. Option D (.spec.concurrencyPolicy) is correct because it is a CronJob spec field governing whether concurrent Jobs are allowed, with valid values Allow, Forbid, and Replace. Option A is not a CronJob spec field itself; restartPolicy belongs to the Pod template nested under .spec.jobTemplate.spec.template.spec, not directly at that path as a CronJob field. Option E is also nested incorrectly — parallelism is a Job spec field under .spec.jobTemplate.spec.parallelism, not .spec.jobTemplate.spec.parallelism as a CronJob-level field, so it is not a valid CronJob spec field.

Answer

.spec.jobTemplate.spec.template.spec.restartPolicy

Answer

.spec.jobTemplate.spec.parallelism

Question 20

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' message indicates the container was terminated because it exceeded its memory limit. Increasing the memory limit in the container's resource specification allows the container to use more memory, preventing the out-of-memory kill. This directly addresses the root cause without losing the pod's state or affecting other workloads.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads