CKAD Application Design and Build Practice Test 11 — 15 Questions

Question 1

A Pod has two containers: one with a liveness probe that fails after 30 seconds. The restartPolicy is 'Never'. What state will the Pod be in after the liveness probe fails?

Accepted Answer

Failed. When a liveness probe fails, Kubernetes terminates the container and, because the restartPolicy is 'Never', does not restart it. The Pod transitions to the 'Failed' phase, as the container has exited with a non-zero exit code and will not be recreated. This is the expected behavior for a Pod with a single container that fails its health check under a 'Never' restart policy.

Answer

Running

Answer

Unknown

Answer

CrashLoopBackOff

Question 2

Which TWO of the following are valid concurrencyPolicy values for a CronJob?

Accepted Answer

Forbid. In Kubernetes, a CronJob's concurrencyPolicy controls how to handle overlapping job executions. The valid values are Allow (default, allowing concurrent runs) and Forbid (skips new run if previous is still running). Among the options given, the two correct answers are Allow and Forbid. Replace is not a valid concurrencyPolicy value; it is a distractor.

Answer

Parallel

Answer

Serial

Answer

Replace

Question 3

A developer wants to containerize a Node.js application. The Dockerfile should first copy only package.json and package-lock.json, run npm install, then copy the rest of the source code. Which Dockerfile best achieves this?

Accepted Answer

COPY package*.json /app/
RUN npm install
COPY . /app/. It first copies only package.json and package-lock.json (using a wildcard pattern), runs `npm install` to leverage Docker's layer caching, and then copies the rest of the source code. This ensures that subsequent builds only re-run `npm install` when the dependency files change, not on every source code modification, which is a best practice for efficient Docker builds.

Answer

COPY . /app
RUN npm install

Answer

ADD package*.json /app/
RUN npm install
ADD . /app/

Answer

ADD . /app
RUN npm install

Question 4

Which kubectl command creates a pod named 'nginx' from the image 'nginx:latest'?

Accepted Answer

kubectl run nginx --image=nginx:latest. `kubectl run nginx --image=nginx:latest` creates a Pod named 'nginx' by default in recent Kubernetes versions (1.18+). Option C is also correct: adding `--restart=Never` explicitly creates a Pod and is a common practice to ensure a Pod is created rather than a Deployment. Option B is wrong because `kubectl apply -f` requires a YAML file. Option D is wrong because `kubectl create pod` is not a valid subcommand; the correct imperative command is `kubectl run`.

Answer

kubectl apply -f pod.yaml

Answer

kubectl create pod nginx --image=nginx:latest

Question 5

A CronJob is configured with concurrencyPolicy: Forbid and schedule: '*/5 * * * *'. The first job takes 7 minutes. What happens when the next scheduled time arrives?

Accepted Answer

The new job is skipped. C is correct because when `concurrencyPolicy: Forbid` is set, the CronJob controller skips creating a new job if the previous job is still running at the next scheduled time. Since the first job takes 7 minutes and the schedule is every 5 minutes, the new job is skipped to prevent overlapping executions.

Answer

The previous job is terminated

Answer

The new job waits until the previous job completes

Answer

A new job is created immediately

Question 6

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, which means the container's memory usage exceeded its configured memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to allocate more memory without being terminated by the Out-of-Memory (OOM) killer.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Question 7

You have a pod with two containers: one runs a web server, and the other is a sidecar that logs the web server's output to a central logging system. Which pattern does this represent?

Accepted Answer

Sidecar pattern. The sidecar pattern involves deploying a helper container alongside the main application container within the same pod. In this scenario, the sidecar container consumes the web server's logs (e.g., by tailing a shared volume or reading stdout/stderr) and forwards them to a central logging system, such as Elasticsearch or Fluentd. This pattern is a core Kubernetes design principle for extending or enhancing the main container without modifying its code.

Answer

Decorator pattern

Answer

Ambassador pattern

Answer

Adapter pattern

Question 8

You have a multi-container pod with two containers: container-A and container-B. container-B needs to access the network of container-A. Which configuration is required?

Accepted Answer

No additional configuration is needed; they share the same network namespace. In Kubernetes, containers within the same pod share the same network namespace by default, including the same IP address and port space. This means container-B can reach container-A via localhost and the port that container-A is listening on, without any additional configuration. The shared network namespace is a fundamental property of pod design, enabling direct inter-container communication.

Answer

Define a ServiceAccount for container-B to access container-A

Answer

Set hostNetwork: true in the pod spec

Answer

Expose the port in container-A and map it in container-B

Question 9

Which of the following are valid concurrencyPolicy values for a CronJob? (Select all that apply.)

Accepted Answer

Replace. Within a Kubernetes CronJob, the concurrencyPolicy field accepts three valid values: Allow, Forbid, and Replace. Allow permits multiple concurrent executions of the same job. Forbid prevents new executions while a previous one is still running. Replace cancels the currently running job and starts a new one in its place. Options C (Parallel) and E (Serial) are not valid values. Therefore, the correct answers are Replace, Allow, and Forbid.

Answer

Parallel

Answer

Serial

Question 10

You want to create a Deployment that runs 5 replicas of a web application. Which kubectl command should you use?

Accepted Answer

kubectl create deployment webapp --image=nginx --replicas=5. To create a Deployment with 5 replicas using a single imperative command, use `kubectl create deployment webapp --image=nginx --replicas=5`. This command directly creates a Deployment and sets the desired replicas. Option A (`kubectl run`) no longer creates a Deployment by default in current Kubernetes versions (1.18+); it creates a single Pod and does not support the `--replicas` flag. Option B (`kubectl create pod`) does not exist and is incorrect. Option C (`kubectl apply -f deployment.yaml`) would also create a Deployment but requires an existing YAML file and is not a single imperative command.

Answer

kubectl run webapp --image=nginx --replicas=5

Answer

kubectl create pod webapp --image=nginx --replicas=5

Answer

kubectl apply -f deployment.yaml

Question 11

A developer creates a Dockerfile with the following content:
FROM alpine:3.18
COPY app.sh /app.sh
RUN chmod +x /app.sh
CMD ["/app.sh"]
They want to override the command to run '/app.sh --debug' when deploying the container in Kubernetes. Which of the following pod spec fields should they use?

Accepted Answer

spec.containers[].args. In Kubernetes, the `args` field overrides the CMD instruction from the Docker image. The Dockerfile's `CMD ["/app.sh"]` is replaced by `args: ["--debug"]`, which is appended to the ENTRYPOINT (defaulting to `/bin/sh -c` if not set, but here the ENTRYPOINT is `/app.sh` from the image's implicit ENTRYPOINT? Actually, the image has no explicit ENTRYPOINT, so the default is `/app.sh` from CMD? Wait — the Dockerfile has no ENTRYPOINT, so the container's entrypoint is the default `/bin/sh -c`? No, in Kubernetes, if no `command` is set, the image's ENTRYPOINT is used; if no ENTRYPOINT, then the image's CMD is used as the command. Here, the image has CMD `["/app.sh"]` and no ENTRYPOINT, so the container's command is `/app.sh`. Setting `args: ["--debug"]` will append `--debug` to that command, resulting in `/app.sh --debug`.

Answer

spec.containers[].entrypoint

Answer

spec.containers[].command

Answer

spec.command

Question 12

You need to run a batch job that processes 100 items. The job should be considered complete when all items are processed successfully. You want to run up to 10 pods concurrently. Which job configuration is correct?

Accepted Answer

.spec.completions: 100, .spec.parallelism: 10. It sets `.spec.completions` to 100 (the total number of items to process) and `.spec.parallelism` to 10 (the maximum number of pods running concurrently). This ensures the Job runs pods in parallel up to the specified limit until all 100 completions are achieved, matching the requirement of processing 100 items with up to 10 concurrent pods.

Answer

.spec.completions: 10, .spec.parallelism: 100

Answer

.spec.backoffLimit: 100, .spec.parallelism: 10

Answer

.spec.completions: 100, .spec.parallelism: 1

Question 13

You need to debug a running pod that does not have a shell installed. Which kubectl command allows you to start an ephemeral container with a shell?

Accepted Answer

kubectl debug <pod> --image=busybox --stdin --tty. `kubectl debug` is specifically designed to add an ephemeral container to a running pod for troubleshooting purposes, even when the original container lacks a shell. The `--image=busybox` flag provides a lightweight image with common debugging tools, and `--stdin --tty` allocates an interactive terminal, allowing you to run commands like `/bin/sh` inside the ephemeral container without modifying the original pod's containers.

Answer

kubectl create pod debug --image=busybox --attach

Answer

kubectl exec -it <pod> -- /bin/sh

Answer

kubectl run debug --image=busybox --attach

Question 14

You have a Pod with two containers: a main application and a sidecar that handles logging. The sidecar needs access to the same log files as the main application. Which volume type allows both containers to share files?

Accepted Answer

emptyDir. An `emptyDir` volume is created when a Pod is assigned to a node and exists as long as the Pod runs, allowing both containers in the same Pod to mount and share the same directory. This is the simplest and most appropriate volume type for sharing ephemeral data, such as log files, between a main application and a sidecar container within the same Pod.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

configMap

Question 15

You need to debug a pod that is not responding. Which command attaches an ephemeral debug container to a running pod named 'web-pod'?

Accepted Answer

kubectl debug -it web-pod --image=busybox --target=web-container. `kubectl debug` with the `--image` flag creates an ephemeral container in the specified pod for interactive debugging. The `-it` flag provides an interactive TTY, and `--target=web-container` attaches the ephemeral container to the same Linux namespace as the target container, allowing direct troubleshooting of the unresponsive pod without modifying its original containers.

Answer

kubectl debug web-pod --copy-to=debug-pod --image=busybox

Answer

kubectl attach web-pod

Answer

kubectl run debug --image=busybox -it