CKAD Application Design and Build Practice Test 12 — 15 Questions

Question 1

Which TWO commands can be used to create a resource from a YAML file?

Accepted Answer

kubectl create -f pod.yaml. The `kubectl create -f pod.yaml` command is correct because it instructs Kubernetes to create a resource (in this case, a Pod) defined in the specified YAML file. This is a declarative command that submits the resource manifest to the API server, which validates and stores it in etcd, resulting in the resource being created in the cluster.

Answer

kubectl delete -f pod.yaml

Answer

kubectl get -f pod.yaml

Answer

kubectl run -f pod.yaml

Question 2

Which THREE statements about Dockerfile CMD and ENTRYPOINT are correct?

Accepted Answer

CMD can be overridden at container runtime by specifying a command after the image name.. Only three statements are correct. Option A is false because CMD is not ignored when ENTRYPOINT is defined; CMD provides default arguments to ENTRYPOINT. Option B is correct: specifying a command after the image name at runtime overrides CMD. Option C is correct: ENTRYPOINT can be overridden with `--entrypoint` flag. Option D is correct: CMD provides default arguments to ENTRYPOINT when both are present. Option E is incorrect because if neither CMD nor ENTRYPOINT is specified, the container inherits the base image's default command, which may keep it running (e.g., a shell) or cause it to exit; it does not always run and exit immediately.

Answer

CMD is always ignored if ENTRYPOINT is defined.

Answer

If neither CMD nor ENTRYPOINT is specified, the container will run but exit immediately.

Question 3

You are tasked with building a container image for a Node.js application. The Dockerfile must first install system dependencies, then copy application code, and finally run the app. Which of the following Dockerfiles is correct?

Accepted Answer

FROM node:14
RUN apt-get update && apt-get install -y build-essential
COPY . /app
CMD ["node","app.js"]. It follows the required order: first installs system dependencies using RUN (which executes at build time), then copies application code with COPY, and finally uses CMD to define the default command that runs the Node.js app at container runtime. CMD is the appropriate instruction for specifying the executable when the container starts, as opposed to RUN which would execute during image build and fail to run the app.

Answer

FROM node:14
CMD apt-get update && apt-get install -y build-essential
COPY . /app
CMD ["node","app.js"]

Answer

FROM node:14
RUN apt-get update && apt-get install -y build-essential
COPY . /app
RUN ["node","app.js"]

Answer

FROM node:14
RUN apt-get update && apt-get install -y build-essential
COPY . /app
ENTRYPOINT ["node","app.js"]

Question 4

Which of the following is the correct apiVersion for a CronJob in Kubernetes v1.29?

Accepted Answer

batch/v1. In Kubernetes v1.29, the correct apiVersion for a CronJob is batch/v1, as CronJob has been stable since v1.21. Option D is correct because batch/v1 is the stable API version for CronJob resources in this release.

Answer

v1

Answer

cronjob/v1

Answer

batch/v1beta1

Question 5

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/4 nodes are available: 4 Insufficient memory'. Which action will resolve the issue?

Accepted Answer

Scale down other pods in the cluster to free memory. The pod is stuck in 'Pending' because no node has enough allocatable memory to satisfy its memory request. Scaling down other pods frees memory on existing nodes, allowing the scheduler to place the pod. This directly resolves the 'Insufficient memory' condition without changing the pod's specification or cluster topology.

Answer

Add a nodeSelector to target a specific node

Answer

Increase the memory request in the pod spec

Answer

Scale up the Deployment to create more pod replicas

Question 6

You need to debug a pod that is running but not serving traffic. You want to add a temporary container with networking tools to the pod. Which command should you use?

Accepted Answer

kubectl debug mypod --image=busybox -it. `kubectl debug` allows you to add an ephemeral container (a temporary container with networking tools) to an existing running pod without restarting it. This is the only command that directly injects a new container into the pod's network namespace, enabling debugging of network issues while the original container continues running.

Answer

kubectl run debug --image=busybox -it --restart=Never -- /bin/sh

Answer

kubectl attach mypod

Answer

kubectl exec -it mypod -- /bin/sh

Question 7

An init container in a pod runs a database migration script. The init container fails and exits with a non-zero exit code. What will happen to the pod?

Accepted Answer

The init container will be restarted until it succeeds. Init containers run to completion before any app containers start, and Kubernetes treats a non-zero exit as a failure of that init container. The kubelet will restart the failed init container according to the pod's restartPolicy (default Always), retrying until it succeeds. Only after all init containers exit 0 will the main containers be started.

Answer

The main containers will start anyway

Answer

The pod will enter CrashLoopBackOff

Answer

The pod will be deleted and recreated

Question 8

You have a Dockerfile that uses a multi-stage build. Which of the following statements about multi-stage builds is correct?

Accepted Answer

Artifacts from earlier stages can be copied to later stages using COPY --from. Multi-stage builds allow you to copy artifacts from a previous stage using the `COPY --from=<stage_name_or_index>` instruction. This enables you to keep only the necessary runtime artifacts in the final image, significantly reducing image size by discarding build-time dependencies and intermediate layers.

Answer

Multi-stage builds require a single FROM statement

Answer

Multi-stage builds increase the final image size

Answer

Each stage must have a unique name

Question 9

A CronJob is configured with concurrencyPolicy: Forbid. The scheduled job takes longer than the interval between schedules to complete. What happens when the next scheduled time arrives while the previous job is still running?

Accepted Answer

The CronJob controller skips the new execution and logs a warning. When `concurrencyPolicy: Forbid` is set, the CronJob controller ensures that only one instance of the job runs at a time. If the previous job is still running when the next scheduled time arrives, the controller skips the new execution entirely and logs a warning (e.g., 'job already running'). This prevents overlapping executions, which is critical for workloads that must not run concurrently.

Answer

The running job is killed to make room for the new one

Answer

The new job starts immediately, overriding the running one

Answer

The new job is queued and starts after the running job completes

Question 10

You need to ensure that a Pod always runs on a node with an SSD. Which node selector mechanism should you use?

Accepted Answer

nodeSelector with a label matching nodes with SSD. `nodeSelector` is the simplest and most direct mechanism for scheduling a Pod onto nodes that possess a specific label, such as `ssd=true`. By labeling nodes that have SSDs and adding the corresponding `nodeSelector` in the Pod spec, Kubernetes ensures the Pod is only scheduled on those nodes. This approach is declarative, requires no additional controllers, and is the recommended method for simple node-level constraints.

Answer

Tolerations

Answer

Pod affinity

Answer

nodeName

Question 11

Which TWO of the following are valid uses of init containers? (Select 2)

Accepted Answer

Setting ownership and permissions on a shared volume before the main container uses it. Init containers run to completion before any pod containers start, making them ideal for filesystem setup tasks like changing ownership (chown) or permissions (chmod) on a shared volume. This ensures the main container can access the volume without requiring privileged mode or extra security context settings.

Answer

Running a log collection agent continuously

Answer

Performing health checks on the main container

Answer

Serving HTTP traffic to the main container

Question 12

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 13

Which TWO of the following are valid fields in a CronJob spec? (Select 2)

Accepted Answer

concurrencyPolicy. B is correct because `concurrencyPolicy` is a valid field in a CronJob spec that controls how concurrent executions of the job are handled. It can be set to `Allow`, `Forbid`, or `Replace`, which determines whether a new job can start while a previous one is still running.

Answer

restartPolicy

Answer

completions

Answer

parallelism

Question 14

A developer is building an image for a Node.js application. The Dockerfile currently copies package.json and package-lock.json, runs npm ci, then copies the rest of the source code. They want to ensure that rebuilding the image after only editing application source files does not re-run npm ci. Which statement about Docker layer caching explains why this Dockerfile ordering achieves that goal?

Accepted Answer

Each Dockerfile instruction creates a layer; a layer is reused from cache if its instruction and the contents of files it references are unchanged, so npm ci is only invalidated when the dependency manifests change.. Docker layer caching reuses a layer when its instruction and referenced file contents match the previous build. Copying dependency manifests first and running npm ci before copying source code means source edits do not invalidate the dependency layer, so npm ci is skipped and rebuilds are faster.

Answer

Docker caches the result of every RUN instruction globally in the local image store keyed by the command string, so npm ci is skipped whenever the same command appears in any Dockerfile on the host.

Answer

The COPY instruction always invalidates all subsequent layers, so placing COPY package.json before npm ci forces npm ci to run only when the source code changes.

Answer

Docker automatically detects that npm ci is a dependency installation step and caches its output separately from the image layers, independent of Dockerfile instruction order.

Question 15

A team wants a Pod to expose two containers: a web server container listening on port 8080 and a metrics exporter container listening on port 9100. The Pod manifest must give each container its own containerPort so that monitoring tools can discover them. Which YAML snippet correctly declares both container ports in a single Pod?

Accepted Answer

spec:
  containers:
  - name: web
    image: nginx
    ports:
    - containerPort: 8080
  - name: metrics
    image: exporter
    ports:
    - containerPort: 9100. Container ports belong inside each container's ports list under the Pod spec. Declaring containerPort 8080 for the web container and 9100 for the metrics container correctly describes two separate listeners in one Pod, matching the requirement for per-container port declarations.

Answer

spec:
  containers:
  - name: web
    image: nginx
    ports:
    - name: web
      port: 8080
  - name: metrics
    image: exporter
    ports:
    - name: metrics
      port: 9100

Answer

spec:
  containers:
  - name: web
    image: nginx
    ports:
    - containerPort: 8080
    - containerPort: 9100
  - name: metrics
    image: exporter

Answer

spec:
  containers:
  - name: web
    image: nginx
  - name: metrics
    image: exporter
  ports:
  - containerPort: 8080
  - containerPort: 9100