CKAD Multiple Select — 40 Questions

Question 1

Which FOUR of the following are valid probe handlers in Kubernetes?

Accepted Answer

exec. In Kubernetes, the kubelet supports exactly four probe handler mechanisms for liveness, readiness, and startup probes. Option A (exec) is correct because it runs a command inside the container and uses the exit code to determine success. Option B (gRPC) is correct because Kubernetes supports gRPC health checking (GA since v1.24) via the gRPC Health Checking Protocol. Option C (httpGet) is correct because it performs an HTTP GET request against the container's IP and port, treating 200-399 status codes as success. Option D (tcpSocket) is correct because it attempts a TCP connection to the specified port, succeeding if the connection is established. Option E (udpSocket) is not a valid handler, as Kubernetes does not provide a UDP-based probe type; probes use exec, httpGet, tcpSocket, or gRPC only.

Answer

udpSocket

Question 2

Which THREE are valid patterns for multi-container Pods?

Accepted Answer

Ambassador. (Ambassador) is correct because the Ambassador pattern uses a proxy container that mediates network traffic between the main application container and external services, allowing the main container to connect to localhost while the ambassador handles protocol translation or service discovery. This is a valid multi-container Pod design pattern in Kubernetes, commonly implemented with tools like Envoy or a custom sidecar proxy.

Answer

Init

Answer

Replicator

Question 3

Which THREE of the following are correct about init containers? (Select THREE.)

Accepted Answer

They run to completion before the main application containers start. Init containers are designed to run sequentially to completion before any of the pod's regular application containers start. This ensures that prerequisites, such as database schema migrations or configuration file generation, are completed before the main application begins execution.

Answer

They cannot have resource limits set

Answer

They run after the main application containers have started

Question 4

Which THREE commands can be used to get detailed information about a pod named 'my-pod'? (Choose three.)

Accepted Answer

kubectl get pod my-pod -o json. `kubectl get pod my-pod -o json` retrieves the full object representation of the pod in JSON format, which includes all fields such as metadata, spec, status, and annotations. This provides detailed, machine-readable information about the pod's current state and configuration.

Answer

kubectl logs my-pod

Answer

kubectl exec my-pod -- env

Question 5

Which TWO statements about readiness probes are correct? (Choose two.)

Accepted Answer

Readiness probes run continuously after the container starts. Readiness probes are designed to run continuously throughout the lifecycle of a container, not just during startup. They are periodically executed by the kubelet to determine whether the container is ready to accept traffic, and their success or failure directly controls the pod's inclusion in Service endpoints.

Answer

Readiness probes are only used during initial startup

Answer

Readiness probes can only be of type httpGet

Answer

Readiness probes restart the container if they fail

Question 6

Which TWO statements about init containers are true? (Select 2)

Accepted Answer

Init containers run sequentially in the order they are defined.. Init containers in a Kubernetes Pod are executed sequentially in the exact order they are defined in the `initContainers` array. Each init container must exit successfully (return code 0) before the next one starts, ensuring a strict dependency chain for initialization tasks.

Answer

Init containers support liveness and readiness probes.

Answer

Init containers share the same filesystem as the application containers by default.

Answer

Init containers have a restart policy of Always.

Question 7

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.

Question 8

Which THREE of the following are valid fields for configuring a probe in Kubernetes? (Select 3)

Accepted Answer

initialDelaySeconds. `initialDelaySeconds` is a valid field in a Kubernetes probe configuration (e.g., livenessProbe, readinessProbe, startupProbe). It defines the number of seconds after the container has started before the probe is initiated, allowing the application time to initialize before health checks begin.

Answer

retrySeconds

Answer

intervalSeconds

Question 9

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 10

Which TWO approaches can be used to expose a Secret's value as an environment variable in a pod?

Accepted Answer

env:
  - name: MY_SECRET
    valueFrom:
      secretKeyRef:
        name: my-secret
        key: my-key. The `valueFrom.secretKeyRef` field in a container's `env` definition directly references a specific key from a Kubernetes Secret and injects its value as an environment variable. This is the standard method for exposing a single secret key as an environment variable, as defined in the Kubernetes API.

Answer

volumeMounts:
  - name: secret-volume
    mountPath: /etc/secret

Answer

env:
  - name: MY_SECRET
    value: "$(MY_SECRET)"

Answer

env:
  - name: MY_SECRET
    valueFrom:
      configMapKeyRef:
        name: my-secret
        key: my-key

Question 11

Which TWO statements about NetworkPolicy are correct? (Choose two.)

Accepted Answer

NetworkPolicy uses labels to select pods within a namespace. NetworkPolicy uses label selectors in its `spec.podSelector` field to identify which pods within a namespace the policy applies to. This allows fine-grained control over traffic to and from specific sets of pods based on their labels, without needing to reference pod names or IPs.

Answer

If no NetworkPolicy selects a pod, then that pod is isolated and traffic is denied

Answer

NetworkPolicy is only applicable to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 12

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Accepted Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretKeyRef:
      name: my-secret
      key: key. `secretKeyRef` is the standard Kubernetes API field for referencing a specific key from a Secret object and injecting its value as an environment variable. Option E is correct because `envFrom` with `secretRef` allows you to load all key-value pairs from a Secret as environment variables into the pod, which is a valid and common pattern.

Answer

env:
- name: SECRET_KEY
  valueFrom:
    configMapKeyRef:
      name: my-secret
      key: key

Answer

env:
- name: SECRET_KEY
  valueFrom:
    secretEnvRef:
      name: my-secret
      key: key

Answer

envFrom:
- configMapRef:
    name: my-secret

Question 13

Which THREE of the following are valid parameters for configuring probes? (Select 3)

Accepted Answer

timeoutSeconds. In Kubernetes, probe configuration parameters are defined in the container spec within a Pod. `timeoutSeconds` is a valid parameter that specifies the number of seconds after which the probe times out, defaulting to 1 second if not set. It is used in liveness, readiness, and startup probes to control how long kubelet waits for a probe response before considering it failed.

Answer

retryIntervalSeconds

Answer

cooldownSeconds

Question 14

Which TWO of the following are valid types for a Kubernetes Secret? (Choose two.)

Accepted Answer

kubernetes.io/tls. Option A, kubernetes.io/tls, is a valid built-in Secret type used to store a TLS certificate and its associated private key, typically consumed by Ingress controllers for HTTPS termination. Option B, kubernetes.io/basic-auth, is also a valid built-in Secret type designed to hold a username and password for basic authentication, with the required keys being 'username' and 'password'. Option C, kubernetes.io/configmap, is not a valid Secret type because ConfigMaps are a separate Kubernetes API object with their own kind and are not represented as a Secret type. Option D, kubernetes.io/tls-key, is not a recognized built-in Secret type; the TLS private key is instead stored as the 'tls.key' data key within a kubernetes.io/tls Secret. Option E, kubernetes.io/ssh-key, is not a built-in Secret type in Kubernetes, as SSH keys would typically be stored using the generic Opaque type or a custom type.

Answer

kubernetes.io/configmap

Answer

kubernetes.io/tls-key

Answer

kubernetes.io/ssh-key

Question 15

Which TWO of the following are valid ways to consume a Secret named 'db-secret' in a Pod? (Choose two.)

Accepted Answer

As environment variables using envFrom with secretRef. `envFrom` with `secretRef` allows a Pod to consume all key-value pairs from a Secret named 'db-secret' as environment variables. This is a standard Kubernetes feature for injecting Secret data into containers without needing to specify each key individually.

Answer

As environment variables using env with valueFrom.configMapKeyRef

Answer

As a command-line argument using $(DB_PASSWORD)

Answer

As an imagePullSecrets entry

Question 16

Which TWO statements about labels and selectors are correct? (Select TWO.)

Accepted Answer

Services use selectors to determine which pods receive traffic.. A is correct because Services use label selectors in their spec.selector field to determine which Pods receive traffic. B is correct because labels are key-value pairs that can be attached to Kubernetes objects for identification and grouping. C is incorrect because selectors return a set of objects matching the given labels, not a single object. D is false because selectors are not required to be defined in the resource definition itself; they are used in controllers and Services to select objects. E is false because labels can be added or modified after creation.

Answer

Selectors are used to identify a single object based on its labels.

Answer

Selectors must be defined in the resource definition itself.

Answer

Labels cannot be added after an object is created.

Question 17

Which TWO of the following are valid non-interactive methods to update a Deployment's image?

Accepted Answer

kubectl replace -f deployment.yaml. Option A (kubectl replace -f deployment.yaml) is correct because replace applies a full manifest non-interactively, so if the YAML file already contains the updated image, the Deployment's Pod template is replaced and a rollout is triggered without opening an editor. Option D (kubectl set image deployment/myapp mycontainer=nginx:1.21) is correct because kubectl set image is a purpose-built, non-interactive command that directly patches the named container's image in the Deployment spec, causing a new ReplicaSet rollout. Option B is not valid here because kubectl edit opens an interactive text editor, which contradicts the non-interactive requirement. Option C is not valid because kubectl rollout does not have an 'image' subcommand; the correct subcommands are status, history, undo, restart, pause, and resume. Option E is not valid because kubectl create fails when the Deployment already exists and is not an update method.

Answer

kubectl edit deployment/myapp and change the image field

Answer

kubectl rollout image deployment/myapp mycontainer=nginx:1.21

Answer

kubectl create -f deployment.yaml

Question 18

Which two statements about ConfigMaps and Secrets are correct? (Select TWO.)

Accepted Answer

Secrets store data in base64-encoded form, while ConfigMaps store plaintext. Secrets store data as base64-encoded strings, which is not encryption but a simple encoding that obscures the data. ConfigMaps store data in plaintext (UTF-8) without any encoding. This distinction is fundamental: base64 encoding is reversible and provides no security, while plaintext is human-readable.

Answer

ConfigMaps are immutable and cannot be updated after creation

Answer

ConfigMaps are suitable for storing sensitive data like passwords

Answer

Secrets are encrypted at rest by default in Kubernetes

Question 19

Which TWO statements about init containers are true?

Accepted Answer

Init containers run to completion before any regular containers start.. Init containers are designed to run to completion before any regular containers in the Pod start. This ensures that prerequisites (e.g., database schema migrations, configuration file generation, or waiting for a service to become available) are satisfied before the main application containers begin execution.

Answer

Init containers run in parallel with regular containers.

Answer

Init containers must use the same image as the main container.

Answer

Init containers cannot access volumes shared with regular containers.

Question 20

Which TWO statements about Kubernetes DNS are correct?

Accepted Answer

A service named 'api' in namespace 'prod' has DNS name 'api.prod.svc.cluster.local'. Kubernetes DNS assigns a fully qualified domain name (FQDN) to services following the pattern `..svc.cluster.local`. For a service named 'api' in the 'prod' namespace, the DNS name is `api.prod.svc.cluster.local`, enabling cluster-internal service discovery via CoreDNS or kube-dns.

Answer

The kube-dns service is responsible for DNS resolution

Answer

Pods with hostNetwork: true automatically get DNS entries

Answer

A pod's DNS name is always 'pod-ip.namespace.pod.cluster.local'