CKAD Application Design and Build Practice Test 7 — 15 Questions

Question 1

A developer creates a Dockerfile with the following content:
FROM alpine:3.18
COPY app.sh /app.sh
RUN chmod +x /app.sh
CMD ["/app.sh"]
They want to override the command to run '/app.sh --debug' when deploying the container in Kubernetes. Which of the following pod spec fields should they use?

Accepted Answer

spec.containers[].args. Option B is correct. The command field in the pod spec overrides the ENTRYPOINT in the Dockerfile, while args overrides CMD. To override CMD, you set args. If they wanted to override both, they'd use command.

Answer

spec.containers[].entrypoint

Answer

spec.containers[].command

Answer

spec.command

Question 2

You need to run a batch job that processes 100 items. The job should be considered complete when all items are processed successfully. You want to run up to 10 pods concurrently. Which job configuration is correct?

Accepted Answer

.spec.completions: 100, .spec.parallelism: 10. Option A is correct. With .spec.completions=100, the job is complete when 100 successful pods finish. .spec.parallelism=10 allows up to 10 pods running concurrently. Option B would run 10 pods total, not 100 completions. Option C would run 10 pods sequentially (parallelism=1). Option D is not valid for batch/v1.

Answer

.spec.completions: 10, .spec.parallelism: 100

Answer

.spec.backoffLimit: 100, .spec.parallelism: 10

Answer

.spec.completions: 100, .spec.parallelism: 1

Question 3

You have a CronJob that runs every 5 minutes. The previous job is still running when the next scheduled time arrives. You want the new job to be skipped if the previous one is still running. Which concurrencyPolicy should you set?

Accepted Answer

Forbid. Option B is correct. concurrencyPolicy: Forbid prevents a new job from starting if the previous one hasn't finished. Allow would start another instance concurrently; Replace would terminate the running job and start a new one.

Answer

Skip

Answer

Allow

Answer

Replace

Question 4

Which of the following is NOT a valid restart policy for a Pod?

Accepted Answer

UnlessStopped. Option C is correct. Pod restartPolicy only supports Always, OnFailure, and Never. 'UnlessStopped' is not a valid Kubernetes restart policy.

Answer

OnFailure

Answer

Always

Answer

Never

Question 5

You have a multi-stage Dockerfile. You want to copy artifacts from the builder stage to the final stage. Which instruction should you use in the final stage?

Accepted Answer

COPY --from=builder /app/artifact /app/. Option B is correct. COPY --from=builder copies files from a previous stage named 'builder'. ADD is similar but also supports remote URLs and tar extraction, but --from is not typically used with ADD. CMD and RUN are not for copying files.

Answer

ADD --from=builder /app/artifact /app/

Answer

RUN --from=builder cp /app/artifact /app/

Answer

CMD --from=builder /app/artifact /app/

Question 6

You need to debug a running pod that does not have a shell installed. Which kubectl command allows you to start an ephemeral container with a shell?

Accepted Answer

kubectl debug <pod> --image=busybox --stdin --tty. Option C is correct. 'kubectl debug' is used to create ephemeral containers for debugging. Option A is wrong because kubectl exec requires a shell in the container. Option B is invalid. Option D creates a new pod, not an ephemeral container.

Answer

kubectl create pod debug --image=busybox --attach

Answer

kubectl exec -it <pod> -- /bin/sh

Answer

kubectl run debug --image=busybox --attach

Question 7

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. Option C is correct. backoffLimit specifies the number of retries before marking the job as failed. The default is 6. Here, backoffLimit: 4 means the job will be retried up to 4 times after the initial failure, so a total of 5 attempts (1 initial + 4 retries). However, the question asks 'before considering it failed' — after the backoffLimit is exhausted, the job is marked as failed. So the number of retries is exactly the backoffLimit value.

Answer

1

Answer

0

Answer

5

Question 8

Which file prevents certain files from being copied into a Docker image during a build?

Accepted Answer

.dockerignore. Option C is correct. A .dockerignore file in the build context tells Docker which files to ignore when sending the context to the Docker daemon.

Answer

.kubeignore

Answer

Dockerfile.ignore

Answer

.gitignore

Question 9

You have a Pod with two containers: a main application and a sidecar that handles logging. The sidecar needs access to the same log files as the main application. Which volume type allows both containers to share files?

Accepted Answer

emptyDir. Option B is correct. An emptyDir volume is shared between containers in the same pod and is useful for sharing files. HostPath mounts a host directory, but it's not specifically for sharing between containers. ConfigMap is for configuration data, not for sharing dynamic files. PersistentVolumeClaim is for persistent storage, but not necessary for sharing within a pod.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

configMap

Question 10

You run 'kubectl apply -f pod.yaml' but the pod remains in 'Pending' state. 'kubectl describe pod' shows '0/1 nodes are available: 1 Insufficient cpu'. What is the most likely cause?

Accepted Answer

The pod's CPU request exceeds the available CPU capacity on any node. Option D is correct. The error indicates that no node has enough CPU capacity to satisfy the pod's CPU request. Option A would cause a different error (ImagePullBackOff). Option B is unrelated to CPU. Option C is not a typical cause of Insufficient CPU; node pressure is a symptom, not a cause.

Answer

The pod's memory limit is too low

Answer

The container image is not found in the registry

Answer

The node is under disk pressure

Question 11

Which TWO statements about init containers are correct?

Accepted Answer

Init containers always run to completion.. Init containers run sequentially before the main containers start. They can have different images and settings than the main containers. They run to completion and then terminate. Options A, B, and C are correct. D is false: init containers can have their own resource limits. E is false: the pod restarts if an init container fails, not the container itself.

Answer

Init containers cannot have resource limits.

Answer

If an init container fails, it is not restarted.

Question 12

Which TWO of the following are valid ways to expose a container port in a pod spec?

Accepted Answer

spec.containers[].ports[].hostPort. Option A and E are correct. The 'containerPort' field under 'ports' defines which container ports to expose. 'hostPort' is also valid but less common. Option B is not a valid field (hostPort is a subfield of ports). Option C is not valid (ports is a list). Option D is a Dockerfile instruction, not a pod spec field.

Answer

spec.containers[].hostPort

Answer

spec.containers[].containerPort

Answer

EXPOSE 8080 in Dockerfile

Question 13

You are tasked with containerizing a Go application. The application compiles into a binary. Which Dockerfile best implements a multi-stage build to produce a minimal image?

Accepted Answer

FROM golang:1.21 AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM scratch
COPY --from=builder /app/myapp /myapp
CMD ["/myapp"]. Option C is correct: multi-stage build with a first stage for compilation using a Go image, and a second stage using scratch that only contains the compiled binary. Option A uses a single stage with a full Go runtime. Option B also uses a single stage. Option D is incorrect because it uses invalid syntax (FROM AS builder without specifying a base image).

Answer

FROM AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp
FROM scratch
COPY --from=builder /app/myapp /myapp
CMD ["/myapp"]

Answer

FROM ubuntu:latest
RUN apt-get update && apt-get install -y golang
COPY . /app
WORKDIR /app
RUN go build -o myapp
CMD ["./myapp"]

Answer

FROM golang:1.21
WORKDIR /app
COPY . .
RUN go build -o myapp
CMD ["./myapp"]

Question 14

Which command builds a Docker image from the current directory and tags it as 'myapp:v1'?

Accepted Answer

docker build -t myapp:v1 .. Option B is correct: docker build -t myapp:v1 . builds and tags the image. Option A is missing the dot. Option C tags after build but syntax is wrong. Option D uses incorrect flag (--name).

Answer

docker build -t myapp:v1

Answer

docker build . -name myapp:v1

Answer

docker image build --tag myapp:v1

Question 15

A developer creates a pod with two containers: a main web server and a sidecar that rotates logs. The sidecar must start before the main container. Which field enforces this startup order?

Accepted Answer

initContainers. Option D is correct: Init containers run sequentially before app containers. Sidecars in a regular container list do not guarantee order. Option A is about lifecycle hooks. Option B is about restart policy. Option C does not exist.

Answer

startupProbe

Answer

lifecycle.preStop

Answer

restartPolicy: Always