CKAD Application Design and Build Practice Test 6 — 15 Questions

Question 1

Which of the following is the correct way to create a simple Pod named 'nginx' running the nginx:1.25 image using kubectl?

Accepted Answer

kubectl run nginx --image=nginx:1.25. `kubectl run nginx --image=nginx:1.25` is the imperative command to create a Pod directly without a Deployment. The `run` subcommand is specifically designed to create a Pod (or other resources like Deployments) from an image, and when no resource type is specified, it defaults to creating a Pod. This is the standard CKAD approach for quickly launching a standalone Pod.

Answer

kubectl create nginx --image=nginx:1.25

Answer

kubectl create pod nginx --image=nginx:1.25

Answer

kubectl apply nginx --image=nginx:1.25

Question 2

You have a Pod that runs a web server and you want to add a sidecar container that exposes a Prometheus metrics endpoint by scraping the web server's logs. Which sidecar pattern does this exemplify?

Accepted Answer

Adapter pattern. The adapter pattern is used to adapt the interface of a container to match what another system expects. In this case, the sidecar container scrapes the web server's logs and exposes them as Prometheus metrics, effectively adapting the web server's log output into a format Prometheus can scrape. The other patterns: generic sidecar adds functionality without transforming output; ambassador proxies external connections; init containers run before main containers start.

Answer

Sidecar pattern (generic)

Answer

Ambassador pattern

Answer

Init container pattern

Question 3

You have a CronJob that runs every 5 minutes. The previous job is still running when the next scheduled time arrives. You want the new job to be skipped if the previous one is still running. Which concurrencyPolicy should you set?

Accepted Answer

Forbid. The `Forbid` concurrency policy in Kubernetes CronJobs ensures that if a previous job instance is still running when the next scheduled time arrives, the new job is skipped entirely. This prevents overlapping executions, which is exactly the requirement in the question.

Answer

Skip

Answer

Allow

Answer

Replace

Question 4

Which of the following is NOT a valid restart policy for a Pod?

Accepted Answer

UnlessStopped. Kubernetes supports exactly three restart policies for Pods: Always, OnFailure, and Never. 'UnlessStopped' is not a valid restart policy in the Kubernetes API; it is a fabricated option designed to test your knowledge of the allowed values for the `restartPolicy` field in a Pod spec.

Answer

OnFailure

Answer

Always

Answer

Never

Question 5

You have a multi-stage Dockerfile. You want to copy artifacts from the builder stage to the final stage. Which instruction should you use in the final stage?

Accepted Answer

COPY --from=builder /app/artifact /app/. In a multi-stage Docker build, the correct instruction to copy artifacts from a previous stage (named 'builder') to the final stage is COPY --from=builder. The COPY instruction with the --from flag is specifically designed for copying files between stages. ADD also supports --from, but COPY is preferred for copying local files as it is more explicit and predictable. Therefore, option C is correct.

Answer

ADD --from=builder /app/artifact /app/

Answer

RUN --from=builder cp /app/artifact /app/

Answer

CMD --from=builder /app/artifact /app/

Question 6

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. The `backoffLimit` field in a Job spec specifies the number of retries before the Job is considered failed. In this YAML, `backoffLimit: 4` means Kubernetes will retry the Job up to 4 times after the initial failure, for a total of 5 attempts (1 initial + 4 retries). The question asks 'how many times will Kubernetes retry the job before considering it failed?', which directly corresponds to the `backoffLimit` value of 4.

Answer

1

Answer

0

Answer

5

Question 7

Which file prevents certain files from being copied into a Docker image during a build?

Accepted Answer

.dockerignore. The `.dockerignore` file is used to specify patterns for files and directories that should be excluded from the Docker build context when running `docker build`. This prevents unnecessary or sensitive files (e.g., `node_modules`, `.git`, secrets) from being sent to the Docker daemon and copied into the image, reducing build time and image size.

Answer

.kubeignore

Answer

Dockerfile.ignore

Answer

.gitignore

Question 8

You run 'kubectl apply -f pod.yaml' but the pod remains in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 Insufficient cpu'. What is the most likely cause?

Accepted Answer

The pod's CPU request exceeds the available CPU capacity on any node. The error '0/1 nodes are available: 1 Insufficient cpu' indicates that the pod's CPU request (specified in the container spec under `resources.requests.cpu`) exceeds the allocatable CPU capacity on any node in the cluster. The scheduler evaluates CPU requests, not limits, for admission decisions; if no node has enough unallocated CPU to satisfy the request, the pod remains Pending.

Answer

The pod's memory limit is too low

Answer

The container image is not found in the registry

Answer

The node is under disk pressure

Question 9

Which TWO statements about init containers are correct?

Accepted Answer

Init containers always run to completion.. Init containers are specialized containers that run to completion sequentially before any main containers start. Option B is correct because init containers always run to completion; they do not exit prematurely. Option C is correct because they are executed in the order defined in the pod spec. Option A is incorrect because init containers can have resource limits and requests. Option D is incorrect because failed init containers are automatically restarted until they succeed. Option E is incorrect because init containers run before, not concurrently with, the main containers.

Answer

Init containers cannot have resource limits.

Answer

If an init container fails, it is not restarted.

Answer

Init containers can run concurrently with the main application containers.

Question 10

Which TWO of the following are valid ways to expose a container port in a pod spec?

Accepted Answer

spec.containers[].ports[].hostPort. `spec.containers[].ports[].hostPort` is a valid field in the Pod spec that maps a container port to the host node's network interface. This allows external traffic to reach the container via the host's IP address and specified port, though it is typically used for daemon sets or host-networking scenarios rather than general service exposure.

Answer

spec.containers[].hostPort

Answer

spec.containers[].containerPort

Answer

EXPOSE 8080 in Dockerfile

Question 11

You are tasked with containerizing a Go application. The application compiles into a binary. Which Dockerfile best implements a multi-stage build to produce a minimal image?

Accepted Answer

FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM scratch
COPY --from=builder /app/myapp /myapp
CMD ["/myapp"]. It uses a multi-stage build: the first stage uses the official `golang:1.21` image to compile the Go binary, and the second stage copies only the compiled binary into a `scratch` (empty) image. This produces a minimal image containing only the binary and no build tools, reducing attack surface and image size.

Answer

FROM AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM scratch
COPY --from=builder /app/myapp /myapp
CMD ["/myapp"]

Answer

FROM ubuntu:latest
RUN apt-get update && apt-get install -y golang
COPY . /app
WORKDIR /app
RUN go build -o myapp
CMD ["./myapp"]

Answer

FROM golang:1.21
WORKDIR /app
COPY . .
RUN go build -o myapp
CMD ["./myapp"]

Question 12

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. `docker build -t myapp:v1 .` uses the `-t` flag to tag the image with the name `myapp` and tag `v1`, and the `.` specifies the build context as the current directory. This is the standard syntax for building and tagging a Docker image from a Dockerfile in the current directory.

Answer

docker build -t myapp:v1

Answer

docker build . -name myapp:v1

Answer

docker image build --tag myapp:v1

Question 13

A developer creates a pod with two containers: a main web server and a sidecar that rotates logs. The sidecar must start before the main container. Which field enforces this startup order?

Accepted Answer

initContainers. `initContainers` run sequentially before the main application containers in a Pod, ensuring the sidecar log-rotation container completes its startup tasks before the web server container starts. This enforces a strict startup order, which is not achievable with regular containers that start concurrently.

Answer

startupProbe

Answer

lifecycle.preStop

Answer

restartPolicy: Always

Question 14

You run 'kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml'. What is the output?

Accepted Answer

A Pod manifest with apiVersion: v1. The command `kubectl run nginx --image=nginx --restart=Never --dry-run=client -o yaml` creates a Pod manifest because `--restart=Never` explicitly sets the restart policy to Never, which is a Pod-level field. The `kubectl run` command without `--restart=Never` defaults to creating a Deployment, but with `--restart=Never`, it generates a standalone Pod. The output uses `apiVersion: v1`, which is the correct and stable API version for Pods.

Answer

A Pod manifest with apiVersion: v1beta1

Answer

A Job manifest with apiVersion: batch/v1

Answer

A Deployment manifest with apiVersion: apps/v1

Question 15

Which Dockerfile instruction sets a default command that can be overridden by arguments passed to 'docker run'?

Accepted Answer

CMD. The CMD instruction in a Dockerfile sets a default command that runs when a container starts. This default can be overridden by providing arguments directly to 'docker run' after the image name, making it the correct choice for a command that is intended to be easily replaced.

Answer

ENTRYPOINT

Answer

EXPOSE

Answer

RUN