CKAD Application Design and Build Practice Test 5 — 15 Questions

Question 1

Which Dockerfile instruction is used to specify the base image for a build?

Accepted Answer

FROM. The FROM instruction initializes a new build stage and sets the base image for subsequent instructions. In Docker, every Dockerfile must start with a FROM (or ARG before FROM) to specify an existing image, such as `FROM ubuntu:22.04` or `FROM alpine:3.18`, from which the new image is built. Without FROM, the build has no foundation and will fail.

Answer

COPY

Answer

RUN

Answer

CMD

Question 2

You run the following command: 'kubectl run nginx --image=nginx --restart=Never'. What Kubernetes resource is created?

Accepted Answer

Pod. The `kubectl run nginx --image=nginx --restart=Never` command creates a Pod directly, because the `--restart=Never` flag sets the restart policy to Never, which instructs Kubernetes to run the container as a standalone Pod rather than wrapping it in a higher-level controller like a Deployment or Job. The `kubectl run` command, when used without a controller flag, defaults to creating a Pod when `--restart=Never` is specified, as per the Kubernetes API behavior.

Answer

CronJob

Answer

Deployment

Answer

Job

Question 3

You have a multi-stage Dockerfile with two stages: 'builder' and 'runtime'. You want to copy artifacts from the builder stage to the runtime stage. Which Dockerfile instruction achieves this?

Accepted Answer

COPY --from=builder /app/artifact /app/. The COPY instruction with --from=stage-name copies files from a previous build stage.

Answer

EXPORT builder /app/artifact /app/

Answer

ADD --from=builder /app/artifact /app/

Answer

COPY ../builder/artifact /app/

Question 4

A pod has two containers: a web server and a sidecar that scrapes logs. The sidecar container needs to read log files written by the web server. How should the logs be shared between the containers?

Accepted Answer

Use a shared emptyDir volume mounted into both containers at the same path. An emptyDir volume is a shared, ephemeral volume that is created when a Pod is assigned to a node and exists as long as that Pod is running. Both containers in the same Pod can mount the same emptyDir volume at the same or different paths, allowing the sidecar to read log files written by the web server without any external storage dependency. This is the standard Kubernetes pattern for inter-container log sharing within a Pod.

Answer

Use a ConfigMap to store logs

Answer

Use a hostPath volume mounted in both containers

Answer

Use a PersistentVolumeClaim

Question 5

You need to run a one-time batch job that processes 10 work items in parallel, with a maximum of 3 pods running at the same time. Which Job YAML fields should you set?

Accepted Answer

spec.parallelism: 3 and spec.completions: 10. `spec.parallelism: 3` limits the maximum number of pods running concurrently, and `spec.completions: 10` ensures the Job runs 10 work items to completion. This combination processes all 10 items in parallel batches of 3, meeting the requirement of a one-time batch job with a maximum of 3 pods at a time.

Answer

spec.template.spec.containers and spec.completions

Answer

spec.parallelism: 10 and spec.completions: 3

Answer

spec.backoffLimit: 3 and spec.completions: 10

Question 6

You have a CronJob that runs every 5 minutes. The job sometimes takes longer than 5 minutes to complete. You want to ensure that while a job is running, the next scheduled job is skipped (not started). Which concurrencyPolicy should you use?

Accepted Answer

Forbid. The `Forbid` concurrencyPolicy ensures that if a previous job instance is still running when the next scheduled time arrives, the new job is simply skipped (not created). This prevents overlapping executions, which is exactly what you need when a CronJob's duration can exceed its schedule interval.

Answer

Skip

Answer

Allow

Answer

Replace

Question 7

Which of the following best describes the purpose of an init container?

Accepted Answer

Init containers run to completion before the main containers start, and are used for setup tasks. Init containers are specialized containers that run and complete to exit before any pod's main containers start. They are ideal for performing setup tasks such as waiting for a service to be ready, populating configuration files, or running database migrations. This ensures the main application containers start in a fully prepared environment.

Answer

Init containers run in parallel with the main containers to provide auxiliary functionality

Answer

Init containers share the same lifecycle as the main containers

Answer

Init containers are restarted if they exit with a non-zero exit code

Question 8

You have a Job that should retry up to 3 times if it fails, and should be considered failed after 4 failures total (including retries). Which YAML fields should you set?

Accepted Answer

spec.backoffLimit: 3. The `spec.backoffLimit` field in a Kubernetes Job defines the number of retries before considering the Job as failed. Setting it to 3 means the Job will retry up to 3 times after the initial failure, resulting in a total of 4 failures (1 initial + 3 retries), which matches the requirement.

Answer

spec.activeDeadlineSeconds: 4

Answer

spec.backoffLimit: 4

Answer

spec.restartPolicy: OnFailure and spec.backoffLimit: 3

Question 9

Which of the following is true about the CMD instruction in a Dockerfile?

Accepted Answer

CMD provides a default command that can be overridden at runtime. The CMD instruction in a Dockerfile provides default arguments for the container's main process, which can be overridden when the container is started with a command-line argument (e.g., `docker run `). It is not executed during the image build (that's RUN), it does not expose ports (that's EXPOSE), and it can be used with ENTRYPOINT to supply default parameters that are overridable.

Answer

CMD is always executed during the image build process

Answer

CMD is used to expose ports

Answer

CMD cannot be used in conjunction with ENTRYPOINT

Question 10

You want to debug a running pod by starting a temporary container that has network access to the pod's containers. Which kubectl command should you use?

Accepted Answer

kubectl debug -it --image=debian --target=. `kubectl debug` creates an ephemeral container in the same pod, sharing the pod's network namespace (including localhost and the same IP address) with the target container. The `--target` flag specifies which existing container's namespaces (network, PID, etc.) the ephemeral container should join, enabling direct network debugging of that container without modifying its process.

Answer

kubectl attach <pod>

Answer

kubectl run debug --image=debian --restart=Never

Answer

kubectl exec -it <pod> -- /bin/bash

Question 11

Which Dockerfile instruction is used to define a mount point for a volume?

Accepted Answer

VOLUME. The VOLUME instruction in a Dockerfile creates a mount point at the specified path within the container, marking it as holding externally mounted volumes from the host or other containers. This is the correct way to declare a volume in the Dockerfile, ensuring data persistence and enabling volume sharing between containers.

Answer

ADD

Answer

EXPOSE

Answer

MOUNT

Question 12

Which TWO of the following are valid patterns for sidecar containers in Kubernetes?

Accepted Answer

Ambassador. The three common sidecar patterns are sidecar, ambassador, and adapter. However, the sidecar pattern itself is the overarching concept; the question asks for two specific patterns that are commonly implemented as sidecar containers. Ambassador and adapter are the correct choices, as they represent distinct proxy and transformation patterns, respectively, while 'sidecar' is the general term.

Answer

Singleton

Answer

DaemonSet

Answer

Sidecar

Question 13

Which THREE of the following are valid fields in a CronJob specification?

Accepted Answer

successfulJobsHistoryLimit. In a CronJob specification, `successfulJobsHistoryLimit` is a valid field that controls how many completed jobs are retained in the cluster's history. This field defaults to 3 and helps manage resource usage by automatically cleaning up old Job records after the limit is exceeded.

Answer

completions

Answer

parallelism

Question 14

Which TWO of the following are true about .dockerignore files?

Accepted Answer

They are placed in the root of the build context. The .dockerignore file must be placed in the root of the build context (the directory specified as the build context in the `docker build` command). The Docker client reads this file to determine which files and directories to exclude from the build context before sending it to the Docker daemon. Without it in the correct location, the ignore rules are not applied.

Answer

They are optional and have no effect on the build

Answer

They can be used to ignore files only for specific build stages

Answer

They can include files that are in parent directories

Question 15

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The 'OOMKilled' status indicates the container was terminated because it exceeded its memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to use more memory without being killed by the Out-Of-Memory (OOM) killer.

Answer

Increase the CPU request for the container

Answer

Delete the namespace and redeploy all workloads

Answer

Delete and recreate the pod to clear the crash loop