CKAD Multiple Select — 20 Questions

Question 1

Which THREE configurations are part of Pod Security Admission's 'restricted' profile? (Select THREE.)

Accepted Answer

runAsNonRoot: true. The 'restricted' profile in Pod Security Admission enforces the most stringent security standards. Option A is correct because `runAsNonRoot: true` is a required field in the restricted profile, ensuring containers cannot run as the root user, which mitigates privilege escalation risks.

Answer

allowPrivilegeEscalation: true

Answer

Privileged containers allowed

Question 2

Which THREE components are essential for setting up Horizontal Pod Autoscaling (HPA) based on CPU utilization? (Select three)

Accepted Answer

An HPA resource targeting the Deployment. HPA requires metrics-server to collect CPU metrics, CPU resource requests set on containers so HPA can calculate utilization, and the HPA resource itself targeting the Deployment. Therefore, options C, D, and E are correct.

Answer

A readiness probe on the pod

Answer

A Service of type LoadBalancer

Question 3

Which THREE of the following are valid fields in a LimitRange resource to enforce resource constraints at the container level? (Choose three.)

Accepted Answer

min. The three valid fields in a LimitRange resource that enforce resource constraints at the container level are `min`, `defaultRequest`, and `maxLimitRequestRatio`. `min` sets the minimum resource request or limit per container. `defaultRequest` sets the default resource request if not specified, ensuring a minimum request is applied. `maxLimitRequestRatio` enforces a maximum ratio between limit and request, constraining the relationship. While `default` is a valid field, it sets a default limit rather than enforcing a constraint directly, so it is not among the three asked.

Answer

default

Question 4

A Deployment named 'api' has 6 replicas. You want to perform a rolling update with the following constraints: at most 2 pods can be unavailable during the update, and at most 1 extra pod can be created above the desired 6. Which strategy configurations achieve this? (Choose TWO)

Accepted Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 2. Uses absolute numbers: maxSurge=1 and maxUnavailable=2, directly matching the constraints. Option B uses percentages: 16% of 6 = 0.96 rounded up to 1, and 33% of 6 = 1.98 rounded up to 2, so it also yields maxSurge=1 and maxUnavailable=2. Option C has maxSurge=2, exceeding the surge limit. Option D has maxUnavailable=3, exceeding the unavailable limit. Option E has maxUnavailable=1, which is more restrictive than the allowed maximum of 2; while it technically satisfies the constraint, it is not the intended configuration. Therefore, the correct answers are A and B.

Answer

strategy:
  rollingUpdate:
    maxSurge: 2
    maxUnavailable: 2

Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 3

Answer

strategy:
  rollingUpdate:
    maxSurge: 1
    maxUnavailable: 1

Question 5

Which TWO Service types allow external access to pods from outside the Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. NodePort is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the service by targeting any node's IP and that port. This works by opening a high-range port (30000-32767) on all nodes, which forwards traffic to the ClusterIP service and then to the pods.

Answer

Headless

Answer

ClusterIP

Answer

ExternalName

Question 6

Which TWO of the following are true about Kustomize overlays? (Select 2)

Accepted Answer

Overlays are used to customize resources for different environments.. Overlays are used to customize resources for different environments, and they can patch resources defined in bases.

Answer

Overlays can only add labels, not modify existing ones.

Answer

Overlays must be stored in the same directory as the base.

Answer

Overlays can only be used with Helm charts.

Question 7

Which THREE of the following are valid reasons to use an annotation in Kubernetes?

Accepted Answer

To store the name of the CI/CD tool that deployed the resource. Annotations are key-value metadata used for non-identifying information. Option A is incorrect because selection of Pods by a Service is done using labels, not annotations. Option B is correct: annotations can store tooling metadata like CI/CD tool name. Option C is correct: build versions and commit hashes are typical audit information stored in annotations. Option D is incorrect because resource limits are set in the container spec, not in annotations. Option E is correct: annotations are designed for arbitrary non-identifying metadata.

Answer

To enable a Service to select Pods based on the annotation value

Answer

To set resource limits for a container

Question 8

You need to perform a canary deployment using a Service and two Deployments (stable and canary). Which TWO resources or configurations are typically used to route a percentage of traffic to the canary? (Select TWO)

Accepted Answer

Service Mesh (e.g., Istio VirtualService). A Service Mesh like Istio uses a VirtualService resource to define traffic routing rules based on weights (e.g., `weight: 90` for stable and `weight: 10` for canary). This allows fine-grained, percentage-based traffic splitting between two different Kubernetes Services or subsets, which is a core requirement for canary deployments.

Answer

A single Service with multiple label selectors

Answer

NetworkPolicy

Answer

HorizontalPodAutoscaler

Question 9

Which TWO commands can be used to create a Secret from a file? (Select 2)

Accepted Answer

kubectl create secret generic mysecret --from-file=key=file.txt. Both options A and E are valid commands to create a Secret from a file. Option A uses `--from-file` to read file contents and store them under a specified key. Option E uses `--from-env-file` to parse a file with key=value pairs and create a Secret for environment variables. Option C is incorrect for this question because `kubectl apply -f secret.yaml` applies a YAML manifest that defines a Secret, but it does not create a Secret directly from a file's contents in the same way as the `kubectl create secret` commands. The question asks for two commands that create a Secret from a file, and both A and E meet that criterion.

Answer

kubectl create configmap mysecret --from-file=file.txt

Answer

kubectl apply -f secret.yaml where secret.yaml contains data fields

Answer

kubectl create secret tls mysecret --cert=file.txt

Question 10

Which TWO of the following are valid Kubernetes Secret types? (Select two.)

Accepted Answer

kubernetes.io/ssh-auth. kubectl create secret tls, kubectl create secret ssh-auth, and kubectl create secret generic (which creates an Opaque secret) are all valid Kubernetes Secret types. The type kubernetes.io/ssh-auth is used for SSH credentials, kubernetes.io/tls is used for TLS certificates, and Opaque is the default type for arbitrary user-defined data. Options A (kubernetes.io/password) and C (kubernetes.io/configmap) are not valid Secret types.

Answer

kubernetes.io/password

Answer

kubernetes.io/configmap

Question 11

Which TWO of the following are valid methods to create a Service in Kubernetes? (Select 2)

Accepted Answer

kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates a Service from a YAML manifest. Option B is correct because `kubectl expose deployment my-deploy --port=80` imperatively creates a Service that exposes the deployment's pods. Option E is not considered a standard method for creating a Service in the context of this exam; the commonly taught imperative commands are `kubectl apply -f` and `kubectl expose`. Options C and D are incorrect: `kubectl port-forward` does not create a Service, and `kubectl run` creates a Pod or Deployment, not a Service.

Answer

kubectl port-forward svc/my-svc 8080:80

Answer

kubectl run my-svc --image=nginx --port=80

Answer

kubectl create service clusterip my-svc --tcp=80:80

Question 12

Which TWO of the following are valid ways to consume a ConfigMap in a pod? (Select 2)

Accepted Answer

Mounting the ConfigMap as a volume. Although the question instructs to select two, all three options A, B, and E are actually valid ways to consume a ConfigMap in a pod. Option A is correct because a ConfigMap can be mounted as a volume, making each key a file in the container's filesystem. Option B is correct because `configMapKeyRef` in `env.valueFrom` allows loading a specific key from a ConfigMap as an environment variable. Option E is correct because `envFrom` with `configMapRef` loads all keys from a ConfigMap as environment variables. Options C and D are incorrect: `configMapRef` in `env.valueFrom` is not a valid construct (the correct syntax is `configMapKeyRef`), and `secretKeyRef` is used for Secrets, not ConfigMaps.

Answer

Using configMapRef in env.valueFrom

Answer

Using secretKeyRef in env.valueFrom

Question 13

Which of the following are valid concurrencyPolicy values for a CronJob? (Select all that apply.)

Accepted Answer

Replace. Within a Kubernetes CronJob, the concurrencyPolicy field accepts three valid values: Allow, Forbid, and Replace. Allow permits multiple concurrent executions of the same job. Forbid prevents new executions while a previous one is still running. Replace cancels the currently running job and starts a new one in its place. Options C (Parallel) and E (Serial) are not valid values. Therefore, the correct answers are Replace, Allow, and Forbid.

Answer

Parallel

Answer

Serial

Question 14

Which TWO of the following are valid concurrencyPolicy values for a CronJob?

Accepted Answer

Forbid. In Kubernetes, a CronJob's concurrencyPolicy controls how to handle overlapping job executions. The valid values are Allow (default, allowing concurrent runs) and Forbid (skips new run if previous is still running). Among the options given, the two correct answers are Allow and Forbid. Replace is not a valid concurrencyPolicy value; it is a distractor.

Answer

Parallel

Answer

Serial

Answer

Replace

Question 15

Which of the following are valid methods to perform a blue-green deployment? (Choose TWO)

Accepted Answer

Create two Deployments for blue and green, and update the Service selector to point to the new version. Blue-green deployment in Kubernetes typically involves running two environments (blue and green) side-by-side and switching traffic from one to the other. Option A directly implements this by maintaining two separate Deployments (blue and green) and updating the Service selector to point to the new version. Option D uses an Ingress resource that can route traffic to different Services, each pointing to a different version of the application; by updating the Ingress rules, traffic can be switched from blue to green. Option B describes a rolling update, not blue-green. Option C is a rolling update using a single Deployment and changing the container image. Option E is a delete/recreate strategy, not blue-green.

Answer

Create a single Deployment and update the pod labels to match the Service selector

Answer

Use a single Deployment and change the container image, then perform a rolling update

Answer

Delete the old Deployment and create a new one

Question 16

An administrator wants to implement Pod Security Admission (PSA) to enforce the 'restricted' policy for pods in the 'secure' namespace, but allow certain pods to use privileged containers by applying an exemption label. Which three steps are required? (Choose three.)

Accepted Answer

Use 'pod-security.kubernetes.io/audit=restricted' to log violations without enforcement.. Setting the audit label to 'restricted' logs violations, which is a common initial step to assess compliance before enforcing the policy. Option C is correct because creating a ServiceAccount and labeling it with 'pod-security.kubernetes.io/enforce=privileged' exempts pods using that ServiceAccount from the restricted policy, allowing them to run privileged containers. Option E is correct because setting the namespace label 'pod-security.kubernetes.io/enforce=restricted' enforces the restricted policy on all pods in that namespace that are not exempted. Option B is not required because the PodSecurity feature gate is enabled by default in Kubernetes v1.23+. Option D is incorrect because PSA uses security context validation, not a custom runtime.

Answer

Enable the PodSecurity feature gate on the API server and kubelet.

Answer

Install a custom container runtime that supports privilege escalation.

Question 17

Which TWO statements about kubectl apply vs kubectl create are correct? (Select two)

Accepted Answer

kubectl apply can update existing resources; kubectl create cannot.. The correct options are the statement about kubectl apply storing the last applied configuration in an annotation (the first option) and option C. The annotation `kubectl.kubernetes.io/last-applied-configuration` enables declarative updates with `kubectl apply`. Option C is correct because `kubectl apply` can update existing resources declaratively, while `kubectl create` will fail if the resource already exists. Option A is incorrect because `kubectl create` does not support `--dry-run=client`; only `kubectl apply` does. Options B, D, and E are incorrect as explained.

Answer

Both commands support the --dry-run=client flag.

Answer

Both commands require a full YAML manifest file.

Answer

kubectl create is the recommended way to manage production resources.

Answer

Both commands can only be used to create resources, not update.

Question 18

Which TWO of the following are valid ways to create a ConfigMap from a file named 'app.properties'? (Select two.)

Accepted Answer

kubectl create configmap app-config --from-file=app.properties. `--from-file=app.properties` creates a ConfigMap with a single key-value pair, where the key defaults to the filename (app.properties) and the value is the entire file content. Option E is correct because `--from-env-file=app.properties` imports each line of the file as a separate key-value pair, treating the file as an environment variable definition file (key=value format).

Answer

kubectl create configmap app-config --from-literal=app.properties

Answer

kubectl create configmap app-config --from-env=app.properties

Answer

kubectl create configmap app-config --from-file=app.properties=app.properties

Question 19

Which TWO of the following are valid methods to create a Service in Kubernetes? (Select 2)

Accepted Answer

kubectl create service clusterip my-svc --tcp=80:80. Options A, B, and E are all valid methods to create a Service. Option A uses `kubectl create service clusterip` to directly create a ClusterIP Service. Option B uses the declarative approach with `kubectl apply -f service.yaml` to create a Service from a YAML definition. Option E (`kubectl expose deployment`) creates a Service that exposes an existing deployment. Although the question asks for two answers, in fact three of the options are valid methods.

Answer

kubectl create deployment my-svc --image=nginx

Answer

kubectl run my-svc --image=nginx --port=80

Question 20

Which TWO are valid Service types? (Choose two.)

Accepted Answer

NodePort. A is correct because NodePort is a standard Kubernetes Service type that exposes a Service on a static port (30000-32767) on each Node's IP address, allowing external traffic to reach the Service. It works by opening that port on every node and routing traffic to the ClusterIP Service, which then forwards to the Pods.

Answer

Headless

Answer

Ingress

Answer

Pod