CKAD Application Design and Build Practice Test 10 — 15 Questions

Question 1

A developer wants to run a one-time batch job that processes exactly 10 items, with up to 3 pods running concurrently. The job should retry each pod up to 2 times if it fails. Which YAML snippet correctly configures the Job?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

.spec.parallelism=3, .spec.completions=10, .spec.backoffLimit=2. The correct Job configuration uses parallelism=3 to run at most 3 pods concurrently, completions=10 to process exactly 10 items, and backoffLimit=2 to retry failed executions before marking the Job as failed. Note that backoffLimit is a Job-level retry count, not a per-pod limit, but the numeric value of 2 aligns with the requirement.

Answer

.spec.parallelism=3, .spec.completions=2, .spec.backoffLimit=3

Answer

.spec.parallelism=10, .spec.completions=3, .spec.backoffLimit=2

Answer

.spec.parallelism=3, .spec.completions=3, .spec.backoffLimit=2

Question 2

Which of the following is the correct apiVersion for a CronJob in Kubernetes v1.29?

Accepted Answer

batch/v1. In Kubernetes v1.29, the correct apiVersion for a CronJob is batch/v1, as CronJob has been stable since v1.21. Option D is correct because batch/v1 is the stable API version for CronJob resources in this release.

Answer

v1

Answer

cronjob/v1

Answer

batch/v1beta1

Question 3

You have a multi-container pod with a main container and a sidecar container that collects logs. The sidecar container must start before the main container and must keep running. Which type of container is the sidecar?

Accepted Answer

Regular container (in the pod spec). Although Kubernetes does not guarantee startup order for regular containers in a pod, the sidecar container must be a regular container because it needs to keep running continuously. Init containers run to completion and then stop, so they cannot serve as a sidecar. The 'start before' requirement can be achieved by having the main container wait for the sidecar (e.g., via a readiness probe or a shared volume where the sidecar creates a file). Regular containers are the only type that can both start before (through explicit dependency logic) and remain running. Thus, a regular container is the correct answer.

Answer

Static container

Answer

Ephemeral container

Answer

Init container

Question 4

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/4 nodes are available: 4 Insufficient memory'. Which action will resolve the issue?

Accepted Answer

Scale down other pods in the cluster to free memory. The pod is stuck in 'Pending' because no node has enough allocatable memory to satisfy its memory request. Scaling down other pods frees memory on existing nodes, allowing the scheduler to place the pod. This directly resolves the 'Insufficient memory' condition without changing the pod's specification or cluster topology.

Answer

Add a nodeSelector to target a specific node

Answer

Increase the memory request in the pod spec

Answer

Scale up the Deployment to create more pod replicas

Question 5

You have a Dockerfile that uses a multi-stage build. Which of the following statements about multi-stage builds is correct?

Accepted Answer

Artifacts from earlier stages can be copied to later stages using COPY --from. Multi-stage builds allow you to copy artifacts from a previous stage using the `COPY --from=<stage_name_or_index>` instruction. This enables you to keep only the necessary runtime artifacts in the final image, significantly reducing image size by discarding build-time dependencies and intermediate layers.

Answer

Multi-stage builds require a single FROM statement

Answer

Multi-stage builds increase the final image size

Answer

Each stage must have a unique name

Question 6

A CronJob is configured with concurrencyPolicy: Forbid. The scheduled job takes longer than the interval between schedules to complete. What happens when the next scheduled time arrives while the previous job is still running?

Accepted Answer

The CronJob controller skips the new execution and logs a warning. When `concurrencyPolicy: Forbid` is set, the CronJob controller ensures that only one instance of the job runs at a time. If the previous job is still running when the next scheduled time arrives, the controller skips the new execution entirely and logs a warning (e.g., 'job already running'). This prevents overlapping executions, which is critical for workloads that must not run concurrently.

Answer

The running job is killed to make room for the new one

Answer

The new job starts immediately, overriding the running one

Answer

The new job is queued and starts after the running job completes

Question 7

You need to ensure that a Pod always runs on a node with an SSD. Which node selector mechanism should you use?

Accepted Answer

nodeSelector with a label matching nodes with SSD. `nodeSelector` is the simplest and most direct mechanism for scheduling a Pod onto nodes that possess a specific label, such as `ssd=true`. By labeling nodes that have SSDs and adding the corresponding `nodeSelector` in the Pod spec, Kubernetes ensures the Pod is only scheduled on those nodes. This approach is declarative, requires no additional controllers, and is the recommended method for simple node-level constraints.

Answer

Tolerations

Answer

Pod affinity

Answer

nodeName

Question 8

Which TWO of the following are valid uses of init containers? (Select 2)

Accepted Answer

Setting ownership and permissions on a shared volume before the main container uses it. Init containers run to completion before any pod containers start, making them ideal for filesystem setup tasks like changing ownership (chown) or permissions (chmod) on a shared volume. This ensures the main container can access the volume without requiring privileged mode or extra security context settings.

Answer

Running a log collection agent continuously

Answer

Performing health checks on the main container

Answer

Serving HTTP traffic to the main container

Question 9

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 10

Which TWO of the following are valid fields in a CronJob spec? (Select 2)

Accepted Answer

concurrencyPolicy. B is correct because `concurrencyPolicy` is a valid field in a CronJob spec that controls how concurrent executions of the job are handled. It can be set to `Allow`, `Forbid`, or `Replace`, which determines whether a new job can start while a previous one is still running.

Answer

restartPolicy

Answer

completions

Answer

parallelism

Question 11

Which TWO of the following commands can be used to create a Pod in Kubernetes? (Select 2)

Accepted Answer

kubectl create deployment mydeploy --image=nginx. The question asks for commands that can create a Pod. `kubectl apply -f pod.yaml` is a standard way to create a Pod from a manifest. Therefore, options B, C, and D all satisfy the condition. The question needs to specify 'imperative commands' or 'without a YAML file' to make B and C the unique correct pair. With the current wording, the correct answer set is not unique.

Answer

kubectl create service my-svc --image=nginx

Answer

kubectl create cronjob myjob --image=nginx

Question 12

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' message indicates the container was terminated because it exceeded its memory limit. Increasing the memory limit in the container's resource specification directly addresses the root cause by allowing the container to use more memory before being killed by the Out-Of-Memory (OOM) killer.

Answer

Increase the CPU request for the container

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Question 13

A team is deploying a microservice that requires initialization of a database schema before the main application starts. The init container must run a script that writes to a shared volume. Which configuration correctly ensures the init container completes before the main container runs?

Accepted Answer

Define an init container with the script and mount the shared volume to both init and main containers.. An init container runs to completion before any main container in the Pod starts, ensuring the database schema script finishes. By mounting the shared volume to both the init container and the main container, the script's output (e.g., schema files) is available to the main application when it launches.

Answer

Run the script as a sidecar container that shares the volume with the main container.

Answer

Use a postStart lifecycle hook on the main container to run the script.

Answer

Add a readiness probe to the main container that checks the shared volume.

Question 14

You are tasked with deploying a stateless web application on a Kubernetes cluster. The application is containerized and listens on port 8080. You have created a Deployment named 'webapp' with 3 replicas, and a ClusterIP Service named 'webapp-svc' exposing port 80 targeting the application's port 8080. During testing, you notice that some requests to the service return errors while others succeed. You have verified that all Pods are running and ready. The application logs show no errors. What is the most likely cause of the intermittent failures?

Accepted Answer

The Deployment lacks a readiness probe, causing the Service to route traffic to Pods that are not ready.. The intermittent failures are most likely caused by the absence of a readiness probe in the Deployment. Without a readiness probe, the Service's EndpointSlice controller considers all Pods with a matching label selector as ready endpoints, even if the application inside the container has not finished initializing or is temporarily unable to serve traffic. This results in the ClusterIP Service load-balancing requests to Pods that are not actually ready, causing some requests to fail while others succeed.

Answer

The ClusterIP Service type does not support load balancing.

Answer

The Service is not configured with enough endpoints.

Answer

The Service's targetPort is set incorrectly, causing traffic to be misrouted.

Question 15

A DevOps engineer wants to deploy a logging sidecar container that reads log files from the main application container. Which volume type should be used to share files between the two containers?

Accepted Answer

emptyDir. An emptyDir volume is the correct choice because it provides a shared, ephemeral storage space that is created when a Pod is assigned to a node and exists as long as that Pod is running. Both the main application container and the sidecar container can mount the same emptyDir volume at different mount paths, allowing the sidecar to read log files written by the main container. This volume type is ideal for sharing files between containers in the same Pod without requiring persistent storage.

Answer

persistentVolumeClaim

Answer

configMap

Answer

hostPath