CKAD Hard Questions — 25 Difficult Questions

Question 1

You have a Service that exposes a Deployment. Some pods are not receiving traffic. 'kubectl get endpoints my-service' shows only 2 out of 3 pod IPs. What is the most likely cause?

Accepted Answer

One pod is not ready (readiness probe failing). The most likely cause is that one pod is not ready because its readiness probe is failing. Services only forward traffic to pods that are in the Ready state, as reflected in the Endpoints object. If a pod fails its readiness probe, it is removed from the list of endpoints, even if it is running and has the correct labels.

Answer

The Deployment has a wrong targetPort

Answer

The Service type is NodePort

Answer

One pod has a different label than the Service selector

Question 2

You are designing a Pod that must run a diagnostic tool to collect network logs before the main application starts. The diagnostic tool should run to completion, then the main application starts. Which approach should you use?

Accepted Answer

Add the diagnostic tool as an init container in the Pod. Init containers run sequentially before the Pod's main containers start, and they must complete successfully before the main application container begins. This makes them ideal for setup tasks like running a diagnostic tool to collect network logs that must finish before the main application starts.

Answer

Add the diagnostic tool as a sidecar container in the same Pod

Answer

Add the diagnostic tool as a sidecar container with a postStart hook

Answer

Create a separate Job that runs before the Pod

Question 3

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. The `backoffLimit` field in a Job spec specifies the number of retries before the Job is considered failed. In this YAML, `backoffLimit: 4` means Kubernetes will retry the Job up to 4 times after the initial failure, for a total of 5 attempts (1 initial + 4 retries). The question asks 'how many times will Kubernetes retry the job before considering it failed?', which directly corresponds to the `backoffLimit` value of 4.

Answer

1

Answer

0

Answer

5

Question 4

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 5

An Ingress resource has the following spec. What is the effect?

spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Accepted Answer

Ingress terminates TLS using the secret and routes to the service.. The Ingress spec defines TLS termination at the ingress controller using the secret `myapp-tls` for the host `myapp.example.com`. The `tls` block configures the ingress to decrypt HTTPS traffic using the certificate and key stored in that secret, and then forward the decrypted HTTP traffic to the backend service `myapp` on port 80. This is the standard behavior for securing traffic with TLS in Kubernetes Ingress.

Answer

Ingress uses the secret for client authentication.

Answer

Ingress redirects HTTP to HTTPS automatically.

Answer

Ingress passes the TLS connection through to the service.

Question 6

A CronJob is configured with concurrencyPolicy: Replace and a job execution takes 10 minutes. The schedule is */5 * * * *. Which statement is true about job executions?

Accepted Answer

Every 5 minutes, a new job is created, and if the previous job is still running, it is killed. With `concurrencyPolicy: Replace`, if a new job is triggered by the schedule (every 5 minutes) while the previous job is still running (it takes 10 minutes), the running job is terminated and replaced by the new one. This ensures only one job runs at a time, and the new job starts immediately, even if the previous one hasn't finished.

Answer

Jobs will never overlap because the schedule is too frequent

Answer

The job will be skipped if the previous one hasn't finished

Answer

Jobs will overlap, with up to two jobs running concurrently

Question 7

You need to create a Secret of type 'kubernetes.io/tls' for ingress. Which command is correct?

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. `kubectl create secret tls` is the dedicated command for creating a TLS secret, and it uses the `--cert` and `--key` flags to specify the certificate and private key files respectively. This creates a Secret of type `kubernetes.io/tls`, which is required for Ingress resources to terminate HTTPS traffic.

Answer

kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem

Answer

kubectl create secret tls my-tls --certificate=cert.pem --private-key=key.pem

Answer

kubectl create secret tls my-tls --from-file=tls.crt=cert.pem --from-file=tls.key=key.pem

Question 8

You want to perform a rolling update of a Deployment. The Deployment has a maxSurge=1 and maxUnavailable=0. How many extra pods can be created above the desired count during the update?

Accepted Answer

1. In a rolling update with `maxSurge=1` and `maxUnavailable=0`, Kubernetes ensures that at most one extra pod can be created above the desired replica count during the update. This is controlled by the `maxSurge` field, which defines the maximum number of pods that can be created over the desired number, and here it is set to 1 (either an absolute number or a percentage, defaulting to 25%). Since `maxUnavailable=0`, no pods can be taken down before new ones are ready, so the surge allows exactly one additional pod to be created temporarily.

Answer

Unlimited

Answer

0

Answer

Desired replicas

Question 9

Which TWO statements about Kubernetes DNS are correct?

Accepted Answer

A service named 'api' in namespace 'prod' has DNS name 'api.prod.svc.cluster.local'. Kubernetes DNS assigns a fully qualified domain name (FQDN) to services following the pattern `..svc.cluster.local`. For a service named 'api' in the 'prod' namespace, the DNS name is `api.prod.svc.cluster.local`, enabling cluster-internal service discovery via CoreDNS or kube-dns.

Answer

The kube-dns service is responsible for DNS resolution

Answer

Pods with hostNetwork: true automatically get DNS entries

Answer

A pod's DNS name is always 'pod-ip.namespace.pod.cluster.local'

Question 10

Which THREE configurations are part of Pod Security Admission's 'restricted' profile? (Select THREE.)

Accepted Answer

runAsNonRoot: true. The 'restricted' profile in Pod Security Admission enforces the most stringent security standards. Option A is correct because `runAsNonRoot: true` is a required field in the restricted profile, ensuring containers cannot run as the root user, which mitigates privilege escalation risks.

Answer

allowPrivilegeEscalation: true

Answer

Privileged containers allowed

Question 11

An Ingress resource routes traffic to a Service 'web' on port 80. The Service has multiple endpoints but all return 503. What should be checked first?

Accepted Answer

Check the readiness probe of the Pods. A 503 Service Unavailable error from the Ingress indicates the upstream Service is not ready to serve traffic. The most common cause is Pods failing their readiness probes, which removes them from the Service's endpoint list. Checking the readiness probe status directly addresses why the Service has endpoints but returns 503.

Answer

Ensure that the Service type is ClusterIP

Answer

Verify that the Service port matches the Pod's container port

Answer

Check the Ingress controller logs

Question 12

You have a Deployment named 'frontend' with 3 replicas. You run 'kubectl rollout history deployment/frontend' and see revision 1 and revision 2. You want to rollback to revision 1. What command should you use?

Accepted Answer

kubectl rollout undo deployment/frontend --to-revision=1. The 'kubectl rollout undo' command with the --to-revision flag rolls back to a specific revision. Option A is correct.

Answer

kubectl set image deployment/frontend app=nginx:1.19

Answer

kubectl rollout undo deployment/frontend revision=1

Answer

kubectl rollout history deployment/frontend --revision=1

Question 13

A pod is failing to start. The 'kubectl describe pod' output shows: 'container has runAsNonRoot and image will run as root'. The Dockerfile of the container image does not specify a USER directive. Which action will fix the issue?

Accepted Answer

Add 'runAsUser: 1000' to the container's securityContext. The error 'container has runAsNonRoot and image will run as root' indicates the pod's securityContext enforces runAsNonRoot: true, but the container image runs as root (default user). Adding runAsUser: 1000 explicitly sets the container's user to a non-root UID, satisfying the runAsNonRoot constraint and allowing the pod to start.

Answer

Set 'runAsGroup: 1000' in the securityContext

Answer

Add capability 'CAP_SYS_ADMIN' to the container

Answer

Remove the 'runAsNonRoot: true' line from the pod spec

Question 14

An administrator creates a Role and RoleBinding in the 'dev' namespace to allow a ServiceAccount 'sa-dev' to list Pods. Which YAML snippet correctly defines the Role?

Accepted Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. It uses the empty string `""` for `apiGroups`, which represents the core API group where Pods reside, and specifies the `list` verb to allow listing Pods. This matches the requirement to allow the ServiceAccount 'sa-dev' to list Pods in the 'dev' namespace.

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["v1"]
  resources: ["pods"]
  verbs: ["list"]

Answer

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: dev}
rules:
- apiGroups: ["apps/v1"]
  resources: ["pods"]
  verbs: ["get"]

Question 15

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 16

An Ingress resource is defined as:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
What must exist in the cluster for TLS termination to work?

Accepted Answer

A Secret named tls-secret of type kubernetes.io/tls in the same namespace. C is correct because TLS termination requires the actual TLS certificate and key to be stored in a Kubernetes Secret of type `kubernetes.io/tls`. The Ingress controller reads this Secret to terminate HTTPS connections, decrypting traffic before forwarding it to the backend service. Without this Secret, the Ingress controller cannot present a valid certificate to clients.

Answer

An IngressClass annotation specifying the ingress controller

Answer

A ServiceAccount named tls-secret

Answer

A ConfigMap named tls-secret with certificate data

Question 17

An ingress resource is created with the following spec. Which request will be routed to the 'green' service?

```yaml
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: blue
            port:
              number: 80
      - path: /api/v1
        pathType: Exact
        backend:
          service:
            name: green
            port:
              number: 80
```

Accepted Answer

http://example.com/api/v1. The request to http://example.com/api/v1 matches the Exact path /api/v1, which routes to the green service. In Kubernetes ingress, Exact pathType requires the request path to be identical to the specified path, and /api/v1 matches exactly.

Answer

http://example.com/api/v1/

Answer

http://example.com/api

Answer

http://example.com/

Question 18

Your Deployment is stuck during rollout, and you want to investigate. Which command pauses the rollout and allows you to check the current state?

Accepted Answer

kubectl rollout pause deployment my-deployment. The correct command to pause a deployment rollout is `kubectl rollout pause deployment my-deployment`. While paused, you can inspect the current state with `kubectl rollout status` or other diagnostic commands. Option A (`kubectl rollout resume`) resumes a paused rollout, not pauses it. Option B (`kubectl rollout status`) shows the rollout state but does not pause it. Option D (`kubectl rollout stop`) is not a valid kubectl command; the correct command to stop a rollout is `kubectl rollout undo`. Therefore, only option C pauses the rollout as required.

Answer

kubectl rollout resume deployment my-deployment

Answer

kubectl rollout status deployment my-deployment

Answer

kubectl rollout stop deployment my-deployment

Question 19

Which THREE components are essential for setting up Horizontal Pod Autoscaling (HPA) based on CPU utilization? (Select three)

Accepted Answer

An HPA resource targeting the Deployment. HPA requires metrics-server to collect CPU metrics, CPU resource requests set on containers so HPA can calculate utilization, and the HPA resource itself targeting the Deployment. Therefore, options C, D, and E are correct.

Answer

A readiness probe on the pod

Answer

A Service of type LoadBalancer

Question 20

Which THREE of the following are valid fields in a LimitRange resource to enforce resource constraints at the container level? (Choose three.)

Accepted Answer

min. The three valid fields in a LimitRange resource that enforce resource constraints at the container level are `min`, `defaultRequest`, and `maxLimitRequestRatio`. `min` sets the minimum resource request or limit per container. `defaultRequest` sets the default resource request if not specified, ensuring a minimum request is applied. `maxLimitRequestRatio` enforces a maximum ratio between limit and request, constraining the relationship. While `default` is a valid field, it sets a default limit rather than enforcing a constraint directly, so it is not among the three asked.

Answer

default