CKAD Application Design and Build Practice Test 6 — 15 Questions

Question 1

A multi-stage build has two stages named 'builder' and 'final'. Which instruction copies artifacts from the builder stage to the final stage?

Accepted Answer

COPY --from=builder /app /app. In a multi-stage Docker build, the COPY instruction with the --from flag allows you to copy files from a named previous stage (here 'builder') into the current stage ('final'). This is the correct syntax to selectively transfer build artifacts without carrying over intermediate layers or dependencies.

Answer

FROM builder /app /app

Answer

COPY builder /app /app

Answer

ADD --from=builder /app /app

Question 2

A pod named 'webapp' is stuck in 'Pending' state. 'kubectl describe pod webapp' shows '0/1 nodes are available: 1 Insufficient memory'. What is the most likely cause?

Accepted Answer

The pod's memory request exceeds available node memory. The error message '0/1 nodes are available: 1 Insufficient memory' directly indicates that the pod's memory request exceeds the allocatable memory on the node. The scheduler cannot place the pod because no node has enough unallocated memory to satisfy the pod's memory request. This is a scheduling failure, not a runtime issue.

Answer

The node has insufficient CPU

Answer

The container was killed due to out-of-memory

Answer

The container image does not exist

Question 3

Which command attaches an ephemeral container to a running pod for debugging?

Accepted Answer

kubectl debug -it mypod --image=busybox --target=mycontainer. `kubectl debug` with `-it` and `--image=busybox` creates an ephemeral container in the target pod for interactive debugging, while `--target=mycontainer` attaches the ephemeral container to the same network and process namespace as the specified container. This is the only command that adds a new, temporary container to a running pod without restarting it, which is essential when the existing container lacks debugging tools or is in a crash loop.

Answer

kubectl attach mypod

Answer

kubectl exec -it mypod -- sh

Answer

kubectl logs mypod -c mycontainer

Question 4

Which TWO practices optimize Docker image size? (Select 2)

Accepted Answer

Including a .dockerignore file to exclude unnecessary files. A `.dockerignore` file prevents unnecessary files (e.g., local logs, node_modules, .git) from being sent to the Docker daemon during the `docker build` context, reducing the build context size and avoiding bloating the image with irrelevant data. Option D is correct because multi-stage builds allow you to compile or install dependencies in a temporary stage and then copy only the final runtime artifacts (e.g., compiled binaries) into a minimal final image, discarding build tools and intermediate layers.

Answer

Running 'apt-get upgrade' in the Dockerfile

Answer

Using a full OS base image like ubuntu:latest

Answer

Installing all packages in one layer without cleanup

Question 5

Which THREE statements are true about init containers? (Select 3)

Accepted Answer

Init containers must complete successfully before any main container starts. Init containers are specialized containers that run to completion before any main application containers in the pod start. They must exit with a zero status (success) for the pod to proceed to the next init container or to start the main containers. This ensures prerequisite setup tasks are completed before the application runs.

Answer

Init containers support liveness and readiness probes

Answer

Init containers cannot have resource limits

Question 6

Which TWO fields are required in a CronJob manifest? (Select 2)

Accepted Answer

schedule. The `schedule` field defines the cron expression that determines when the CronJob runs (e.g., `*/5 * * * *`). This is a mandatory field in a CronJob manifest as per the Kubernetes API specification, without which the controller cannot determine the execution timing.

Answer

startingDeadlineSeconds

Answer

successfulJobsHistoryLimit

Answer

concurrencyPolicy

Question 7

A pod in the 'production' namespace is in a CrashLoopBackOff state. The pod has been running successfully for several days. You run 'kubectl describe pod app-pod -n production' and see the message: 'OOMKilled'. What is the MOST appropriate action to resolve this issue?

Accepted Answer

Increase the memory limit in the pod's container resource specification. The pod is in CrashLoopBackOff due to OOMKilled, which means the container's memory usage exceeded its configured memory limit. The most appropriate action is to increase the memory limit in the pod's container resource specification, allowing the container to allocate more memory without being terminated by the Out-of-Memory (OOM) killer.

Answer

Delete and recreate the pod to clear the crash loop

Answer

Delete the namespace and redeploy all workloads

Answer

Increase the CPU request for the container

Question 8

A Kubernetes Job with parallelism=3 and completions=6 is created. How many pods will run concurrently at most?

Accepted Answer

3. The `parallelism` field in a Kubernetes Job specifies the maximum number of pods that can run concurrently. With `parallelism=3`, at most 3 pods will run at the same time, regardless of the total number of completions required.

Answer

9

Answer

6

Answer

1

Question 9

Which field in a CronJob spec specifies the maximum number of successful jobs that should be retained?

Accepted Answer

.spec.successfulJobsHistoryLimit. The `.spec.successfulJobsHistoryLimit` field in a CronJob spec explicitly controls the number of successful jobs that are retained after completion. This field defaults to 3 and, when set to 0, suppresses the retention of any successful job history, directly managing cluster resource usage by limiting the accumulation of completed Pods.

Answer

.spec.jobTemplate.spec.backoffLimit

Answer

.spec.jobHistory.succeeded

Answer

.spec.history.successfulJobsLimit

Question 10

You have a pod with two containers: one runs a web server, and the other is a sidecar that logs the web server's output to a central logging system. Which pattern does this represent?

Accepted Answer

Sidecar pattern. The sidecar pattern involves deploying a helper container alongside the main application container within the same pod. In this scenario, the sidecar container consumes the web server's logs (e.g., by tailing a shared volume or reading stdout/stderr) and forwards them to a central logging system, such as Elasticsearch or Fluentd. This pattern is a core Kubernetes design principle for extending or enhancing the main container without modifying its code.

Answer

Decorator pattern

Answer

Ambassador pattern

Answer

Adapter pattern

Question 11

You need to debug a pod that has no shell installed. You want to add a temporary container with debugging tools to the pod. Which command should you use?

Accepted Answer

kubectl debug mypod -it --image=busybox -- /bin/sh. `kubectl debug mypod -it --image=busybox -- /bin/sh` creates an ephemeral container in the existing pod `mypod`, attaching it interactively with a shell. This allows you to debug a pod that lacks a shell or debugging tools without modifying the original container's image or restarting the pod.

Answer

kubectl run debug --image=busybox -it -- /bin/sh

Answer

kubectl debug mypod --image=busybox --target=debug -n default

Answer

kubectl exec -it mypod -- /bin/sh

Question 12

What is the purpose of an init container in a pod?

Accepted Answer

To run to completion before the main containers start, often for initialization tasks. Init containers run to completion sequentially before any main containers in the pod start. They are designed for initialization tasks such as setting up databases, waiting for external services, or populating configuration files. Unlike sidecar containers, they do not run alongside the main containers and must exit successfully before the pod transitions to the Running phase.

Answer

To check the health of the main container and restart it if necessary

Answer

To run alongside the main container and provide additional services

Answer

To run a command after the main container starts

Question 13

A CronJob has concurrencyPolicy set to 'Forbid'. At the scheduled time, if the previous job is still running, what happens?

Accepted Answer

The new job is skipped (does not run). When a CronJob has `concurrencyPolicy: Forbid`, Kubernetes ensures that if a previous job instance is still running at the next scheduled time, the new job is simply skipped (does not run). This prevents overlapping executions, which is critical for workloads that must not run concurrently, such as database migrations or batch processing that would cause data corruption.

Answer

The new job is delayed until the previous job completes

Answer

Both jobs run concurrently

Answer

The previous job is terminated and the new job starts

Question 14

Which of the following is the correct way to set a memory limit of 512Mi for a container in a pod spec?

Accepted Answer

resources.limits.memory: 512Mi. `resources.limits.memory` is the Kubernetes field used to set the maximum amount of memory a container is allowed to use. When a container exceeds this limit, it may be terminated or OOM-killed. The value `512Mi` specifies 512 mebibytes, which is a binary-based unit commonly used in Kubernetes resource specifications.

Answer

resources.requests.memory: 512Mi

Answer

resources.requests.limits.memory: 512Mi

Answer

resources.limits.cpu: 512Mi

Question 15

You have a multi-container pod with two containers: container-A and container-B. container-B needs to access the network of container-A. Which configuration is required?

Accepted Answer

No additional configuration is needed; they share the same network namespace. In Kubernetes, containers within the same pod share the same network namespace by default, including the same IP address and port space. This means container-B can reach container-A via localhost and the port that container-A is listening on, without any additional configuration. The shared network namespace is a fundamental property of pod design, enabling direct inter-container communication.

Answer

Define a ServiceAccount for container-B to access container-A

Answer

Set hostNetwork: true in the pod spec

Answer

Expose the port in container-A and map it in container-B