CKAD Multiple Select — 60 Questions

Question 1

A developer is creating a Deployment with 4 replicas. The application requires a rolling update with zero downtime. Which TWO strategies ensure zero downtime during an update?

Accepted Answer

Set maxSurge=1. Option A is correct because setting maxSurge=1 allows Kubernetes to spin up one new Pod before terminating any old Pod during a rolling update. This ensures that the total number of available Pods never drops below the desired replica count, maintaining service capacity and achieving zero downtime.

Answer

Set maxUnavailable=1

Answer

Use Recreate strategy

Answer

Set maxSurge=0

Question 2

Which TWO statements about Kustomize are true?

Accepted Answer

Kustomize supports overlays that allow different configurations for different environments.. Kustomize supports overlays, which are layered patches applied on top of a base configuration. This allows you to define a common base set of Kubernetes resources and then use different overlay directories (e.g., dev, staging, prod) to customize settings like replicas, image tags, or namespaces for each environment without duplicating the entire manifest.

Answer

Kustomize can be used to perform canary deployments.

Answer

Kustomize requires Helm to manage dependencies.

Answer

Kustomize can only be used with kubectl apply -k.

Question 3

A developer wants to mount a ConfigMap as a volume in a Pod so that updates to the ConfigMap are reflected in the Pod without restarting. Which two statements are correct? (Choose two.)

Accepted Answer

Using subPath in the volume mount prevents automatic updates.. Option C is correct because when a ConfigMap is mounted using `subPath`, Kubernetes treats the mount as a single file rather than a directory of symlinks. This means the atomic update mechanism (which uses symlinks to swap the directory contents) is bypassed, and updates to the ConfigMap are not reflected in the Pod without a restart or remount.

Answer

Using envFrom to inject ConfigMap data as environment variables will update automatically.

Answer

ConfigMap updates are reflected immediately in the volume mount.

Answer

The Pod must be restarted for any ConfigMap change to take effect.

Question 4

Which THREE of the following are benefits of using a ResourceQuota in a namespace? (Select THREE)

Accepted Answer

It can enforce that every Pod has resource limits set. Option B is correct because a ResourceQuota can enforce that every Pod in the namespace has resource limits set by specifying the `limits.cpu` and `limits.memory` fields in the quota's `hard` spec. If a Pod is created without those limits, the API server will reject it, ensuring no Pod runs unbounded. This is distinct from setting default values, which is done by a LimitRange, not a ResourceQuota.

Answer

It sets default resource requests and limits for Pods that don't specify them

Answer

It restricts which users can create Pods in the namespace

Question 5

You want to apply a Pod Security Admission (PSA) policy that enforces the 'restricted' profile in the 'dev' namespace, but only for Pods that are not exempt. Which TWO steps are required? (Select TWO)

Accepted Answer

Set the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace. Option A is correct because setting the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace instructs the Pod Security Admission controller to reject any Pod that does not meet the restricted profile, unless the Pod is exempt (e.g., system-critical Pods or those with specific exemptions). This label directly enforces the policy at admission time, ensuring only compliant Pods are created in the 'dev' namespace.

Answer

Add a 'securityContext' field to the Pod template with 'runAsUser: 1000'

Answer

Set the label 'pod-security.kubernetes.io/enforce=baseline' on the namespace

Answer

Set the label 'pod-security.kubernetes.io/warn=restricted' on the namespace

Question 6

Which TWO of the following are valid ways to consume a ConfigMap in a pod?

Accepted Answer

envFrom:
  - configMapRef:
      name: my-config. Option C is correct because `envFrom` with a `configMapRef` is a valid method to consume a ConfigMap as environment variables in a pod. This injects all key-value pairs from the ConfigMap named `my-config` as environment variables into the container. Option E is also correct as it demonstrates mounting a ConfigMap as a volume using the `configMap` volume source with the correct `name` field and then mounting that volume into the container at `/etc/config`.

Answer

envFrom:
  - secretRef:
      name: my-config

Answer

volumes:
  - name: config-vol
    configMap:
      configMapName: my-config

Answer

env:
  - name: MY_VAR
    valueFrom:
      configMapKeyRef:
        name: my-config
        key: my-key

Question 7

Which TWO statements about Kubernetes Secrets are correct? (Select 2)

Accepted Answer

A Secret can be mounted as a volume or exposed as environment variables. A is correct because Kubernetes Secrets are designed to be consumed by Pods either as files mounted into a volume (via `volumes` and `volumeMounts`) or as environment variables (via `env` or `envFrom`). This flexibility allows applications to access sensitive data like passwords or tokens without hardcoding them into the container image or pod spec.

Answer

Secrets are always encrypted in etcd

Answer

The maximum size of a Secret is 1 MB

Answer

Secrets can only be used by pods in the same namespace as the Secret

Question 8

Which TWO of the following are valid ways to consume a ConfigMap in a pod? (Select 2)

Accepted Answer

Mounting the ConfigMap as a volume. Option A is correct because a ConfigMap can be mounted as a volume in a Pod, allowing files or directories to be created from the ConfigMap's data. This is done by specifying a volume of type `configMap` in the Pod spec and mounting it into the container's filesystem, which makes the key-value pairs available as files.

Answer

Using configMapRef in env.valueFrom

Answer

Using secretKeyRef in env.valueFrom

Answer

Using envFrom with configMapRef

Question 9

Which TWO of the following are valid types of probes in Kubernetes? (Select 2)

Accepted Answer

Readiness probe. A is correct because a Readiness probe determines whether a Pod is ready to serve traffic. If the probe fails, the Pod is removed from the Service's endpoints, preventing traffic from being routed to an unready container. This is essential for rolling updates and graceful shutdowns.

Answer

HTTP probe

Answer

Exec probe

Answer

TCP probe

Question 10

Which TWO are valid ways to debug a pod using ephemeral containers?

Accepted Answer

kubectl debug -it --image=busybox -- sh. Option A is correct because `kubectl debug -it --image=busybox -- sh` creates an ephemeral container in the target pod and attaches an interactive terminal to it. This is the standard Kubernetes mechanism for debugging a running pod without modifying its original container spec, using the ephemeral container feature (alpha in v1.16, stable in v1.23).

Answer

kubectl run debug --image=busybox -- sh

Answer

kubectl exec -it <pod> -- sh

Answer

kubectl attach to the pod

Question 11

Which TWO of the following are valid reasons to use a readiness probe? (Select 2)

Accepted Answer

To prevent traffic from being sent to a pod that is not ready due to a dependency. A readiness probe is used to determine whether a pod is ready to serve traffic. Option A is correct because it prevents traffic from being sent to a pod that is not ready due to a dependency, such as a database or cache that hasn't fully initialized. The kubelet uses the probe's success or failure to control whether the pod's IP address is added to the endpoints of a Service, ensuring only ready pods receive requests.

Answer

To monitor resource usage and scale the pod

Answer

To delay the start of the application until a database is available

Answer

To restart the container if it becomes unresponsive

Question 12

Which THREE of the following are correct statements about the terminationGracePeriodSeconds field? (Select 3)

Accepted Answer

The default value is 30 seconds. Option A is correct because the Kubernetes documentation specifies that the default value for terminationGracePeriodSeconds is 30 seconds. This field is part of the PodSpec and controls the duration between sending SIGTERM to the container and forcefully killing it with SIGKILL. If not set, Kubernetes applies this default to ensure a reasonable window for graceful shutdown.

Answer

The default value is 0 seconds

Answer

It is used to configure the readiness probe timeout

Question 13

Which TWO actions can you perform using 'kubectl describe'? (Select two.)

Accepted Answer

View the conditions and status of a node. 'kubectl describe' provides detailed information about Kubernetes resources, including events and conditions. It can show the current state and recent events. It does not modify resources or show logs.

Answer

Execute a command inside a container

Answer

View the logs of a container

Answer

View the YAML manifest of a resource

Question 14

Which TWO of the following commands can be used to view events related to a specific pod? (Select TWO.)

Accepted Answer

kubectl get events --field-selector involvedObject.name=. Correct answers: B and D. kubectl describe pod shows events for that pod. kubectl get events --field-selector involvedObject.name= filters events by pod name. Option A shows all events without filtering. Option C does not show events. Option E is not a valid command.

Answer

kubectl events --pod=<pod>

Answer

kubectl logs <pod>

Answer

kubectl get events

Question 15

Which TWO of the following are valid liveness probe types in Kubernetes?

Accepted Answer

tcpSocket. The valid liveness probe types are httpGet, tcpSocket, exec, and grpc. gRPC is also valid since v1.24.

Answer

command

Answer

portCheck

Answer

grpc

Question 16

Which THREE of the following are valid ways to debug a pod that is not responding? (Select three.)

Accepted Answer

Run 'kubectl debug -it pod-name --image=busybox --target=container-name' to start an ephemeral debug container. Multiple methods exist: exec for interactive shell, logs for output, debug for ephemeral containers. Option B is not a valid command; Option D is for configuration files, not runtime debugging.

Answer

Run 'kubectl attach pod-name' to attach to the container's main process

Answer

Run 'kubectl get pod pod-name -o yaml' to examine the pod's current YAML definition

Question 17

Which TWO of the following are valid types of probes in Kubernetes? (Select 2)

Accepted Answer

Liveness probe. Liveness, readiness, and startup are the three probe types. Option D is not a probe type. Option E is not a standard probe type.

Answer

Survival probe

Answer

Health probe

Answer

Startup probe

Question 18

Which TWO statements are true about readiness probes? (Select two.)

Accepted Answer

Readiness probes can be configured as httpGet, exec, tcpSocket, or gRPC. Readiness probes determine if a container is ready to serve traffic. If failing, the pod is removed from Service endpoints. They are independent of liveness probes.

Answer

Readiness probes are only executed when the pod is first started

Answer

A failing readiness probe causes the pod to be restarted

Answer

Readiness probes are defined in the pod spec under 'startupProbe'

Question 19

Which THREE of the following are valid parameters for configuring probes? (Select 3)

Accepted Answer

timeoutSeconds. initialDelaySeconds, periodSeconds, timeoutSeconds, failureThreshold, and successThreshold are all valid. The correct three are A, B, C.

Answer

retryIntervalSeconds

Answer

cooldownSeconds

Question 20

Which TWO of the following are valid types of probes in Kubernetes?

Accepted Answer

Liveness probe. The three standard probe types are liveness, readiness, and startup. Health is not a probe type, and survival is not a Kubernetes probe.

Answer

Survival probe

Answer

Startup probe

Answer

Health probe