CKAD Application Design and Build — Timed 10 Questions

Question 1

A developer needs to expose a deployment named 'web-app' running on port 8080 to external traffic. The cluster is on-premises with no cloud load balancer. Which service type should be used?

Accepted Answer

NodePort. (NodePort) is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the 'web-app' deployment on port 8080 without requiring a cloud load balancer. In on-premises clusters, NodePort is the standard service type for external access when no cloud LB is available, as it opens a high-port (30000-32767) on every node that forwards traffic to the ClusterIP service.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 2

A developer is creating a ConfigMap from a file named 'app.properties'. The file contains key-value pairs. Which command correctly creates the ConfigMap with keys matching the file content?

Accepted Answer

kubectl create configmap my-config --from-env-file=app.properties. The file 'app.properties' contains key-value pairs. To create a ConfigMap with keys that match the keys in the file, use `kubectl create configmap my-config --from-env-file=app.properties`. This parses the file and creates one data entry per key=value line. Option A (`--from-file=app.properties`) stores the entire file content as a single value under the key 'app.properties', which does not produce keys matching the file content. Option B uses `--from-literal` incorrectly, and option C reads from stdin but still treats the input as a single file, not as key-value pairs.

Answer

kubectl create configmap my-config --from-file=app.properties

Answer

kubectl create configmap my-config --from-literal=app.properties

Answer

cat app.properties | kubectl create configmap my-config --from-file=-

Question 3

Which TWO statements are true about Kubernetes Secrets?

Accepted Answer

Secret data is base64 encoded in YAML manifests.. Kubernetes Secrets store data as base64-encoded strings in YAML manifests. This encoding is not encryption; it simply converts binary or non-printable data into an ASCII string format for safe inclusion in YAML. The base64 encoding is a standard practice for representing arbitrary data in Kubernetes resource definitions.

Answer

Secrets cannot be used as environment variables.

Answer

Secrets are always encrypted at rest by default.

Answer

Secrets are limited to 1KB in size.

Question 4

Which THREE are valid reasons to use a StatefulSet instead of a Deployment?

Accepted Answer

Each pod requires a stable, unique network identity.. StatefulSet assigns each pod a stable, unique network identity (e.g., a hostname like `web-0`, `web-1`) via a headless Service, which is critical for stateful applications like databases that rely on consistent DNS names for clustering and discovery. Deployments create pods with random, ephemeral hostnames, making them unsuitable for workloads requiring predictable network identities.

Answer

The application requires rolling updates.

Answer

The application cannot be scaled down.

Question 5

A developer is designing a Job that should run exactly once and then stop. The Job runs a batch process that is expected to complete within one hour. Which restartPolicy and backoffLimit are appropriate?

Accepted Answer

restartPolicy: OnFailure, backoffLimit: 4. A Job designed to run exactly once and stop should use `restartPolicy: OnFailure` or `Never`, and `backoffLimit: 4` provides a reasonable number of retries (up to 4) before the Job is marked as Failed, ensuring the batch process can recover from transient errors within the expected one-hour completion window. The `restartPolicy: Always` is invalid for Jobs (only `OnFailure` or `Never` are allowed), and `backoffLimit: 0` would prevent any retries, which is too restrictive for a batch process that may encounter temporary failures.

Answer

restartPolicy: Always, backoffLimit: 6

Answer

restartPolicy: Never, backoffLimit: 0

Answer

restartPolicy: Always, backoffLimit: 0

Question 6

A developer creates a Deployment with 3 replicas that uses a ConfigMap mounted as a volume. After updating the ConfigMap, the developer expects the pods to pick up the new configuration immediately, but the old configuration is still in use. What is the most likely reason?

Accepted Answer

The kubelet sync interval delays the propagation of ConfigMap changes to pods.. When a ConfigMap is mounted as a volume, updates to the ConfigMap are eventually propagated to the pods, but not instantly. The kubelet periodically syncs mounted ConfigMaps (default interval is 60 seconds), so there is a delay before pods see the new configuration. This is the most likely reason the old configuration is still in use.

Answer

ConfigMap updates are not propagated to mounted volumes.

Answer

The pods must be recreated after a ConfigMap update to see the changes.

Answer

ConfigMaps are immutable and cannot be updated.

Question 7

Arrange the steps to create a Kubernetes Deployment with a rolling update strategy.

Accepted Answer

1. Define the Deployment in YAML, 2. Apply the YAML using kubectl apply, 3. Modify the YAML for the update, 4. Re-apply the modified YAML using kubectl apply. First, define the Deployment in YAML. Then apply it. After an update, modify the YAML and re-apply; kubectl performs rolling update automatically.

Answer

1. Define the Deployment in YAML, 2. Modify the YAML for the update, 3. Apply the YAML using kubectl apply

Answer

1. Define the Deployment in YAML, 2. Apply the YAML using kubectl apply, 3. Delete the existing Pods manually, 4. Re-apply the modified YAML using kubectl apply

Answer

1. Apply an empty or placeholder YAML, 2. Define the Deployment in YAML, 3. Modify the YAML for the update, 4. Re-apply the YAML using kubectl apply

Question 8

Sequence the steps to expose a Kubernetes Service using a NodePort for external access.

Accepted Answer

Create the Deployment, define the Service (NodePort type) manifest, apply the Service manifest, retrieve the NodePort from the Service, then access externally via nodeIP:NodePort.. Deployment first, then define NodePort Service, apply, retrieve port, then access externally.

Answer

Define the Service manifest, retrieve the NodePort, create the Deployment, apply the Service, then access externally.

Answer

Create the Deployment, apply the Service manifest, define the Service manifest, retrieve the NodePort, then access externally.

Answer

Create the Deployment, define the Service manifest, retrieve the NodePort, apply the Service, then access externally.

Question 9

Match each Kubernetes resource to its primary purpose.

Accepted Answer

Pod: Runs one or more containers as a cohesive unit of compute. These are core Kubernetes resources with distinct roles. Pods are the smallest deployable units; Services provide networking abstractions; Deployments manage scaling and updates; ConfigMaps handle configuration data.

Answer

Pod: Provides load-balanced access to a set of Pods

Answer

Service: Manages rolling updates of Pods

Question 10

Match each Kubernetes Service type to its behavior.

Accepted Answer

ClusterIP: Exposes the service on a cluster-internal IP.. Common Kubernetes service types: ClusterIP (internal), NodePort (static port on nodes), LoadBalancer (cloud LB), ExternalName (DNS alias). Here, correct matches are A and C.

Answer

ClusterIP: Exposes the service externally via a cloud load balancer.

Answer

NodePort: Exposes the service on a cluster-internal IP only.