CKAD Timed Practice Test 1 — 10 Questions

Question 1

You are designing a Pod that must run a diagnostic tool to collect network logs before the main application starts. The diagnostic tool should run to completion, then the main application starts. Which approach should you use?

10 minute time limit — choose an answer to begin.

Accepted Answer

Add the diagnostic tool as an init container in the Pod. Init containers run sequentially before the Pod's main containers start, and they must complete successfully before the main application container begins. This makes them ideal for setup tasks like running a diagnostic tool to collect network logs that must finish before the main application starts.

Answer

Add the diagnostic tool as a sidecar container in the same Pod

Answer

Add the diagnostic tool as a sidecar container with a postStart hook

Answer

Create a separate Job that runs before the Pod

Question 2

A Pod named `my-pod` in namespace `ns1` tries to resolve `svc-a.ns2.svc.cluster.local`. The DNS query fails. The Service `svc-a` exists in namespace `ns2`. What is the most likely cause?

Accepted Answer

The DNS add-on (e.g., CoreDNS) is not deployed or is misconfigured. The DNS query for `svc-a.ns2.svc.cluster.local` fails despite the Service existing, which points to a cluster-wide DNS resolution issue. CoreDNS is the default DNS add-on in Kubernetes that translates service names to IP addresses; if it is not deployed or misconfigured, all DNS queries (including cross-namespace ones) will fail. The fact that the Service exists and the Pod is in a different namespace does not inherently prevent resolution—CoreDNS handles cross-namespace lookups by default.

Answer

The Service `svc-a` does not have any endpoints

Answer

The Pod cannot resolve names from other namespaces

Answer

The Service type is NodePort

Question 3

Which FOUR of the following are valid probe handlers in Kubernetes?

Accepted Answer

exec. In Kubernetes, the kubelet supports exactly four probe handler mechanisms for liveness, readiness, and startup probes. Option A (exec) is correct because it runs a command inside the container and uses the exit code to determine success. Option B (gRPC) is correct because Kubernetes supports gRPC health checking (GA since v1.24) via the gRPC Health Checking Protocol. Option C (httpGet) is correct because it performs an HTTP GET request against the container's IP and port, treating 200-399 status codes as success. Option D (tcpSocket) is correct because it attempts a TCP connection to the specified port, succeeding if the connection is established. Option E (udpSocket) is not a valid handler, as Kubernetes does not provide a UDP-based probe type; probes use exec, httpGet, tcpSocket, or gRPC only.

Answer

udpSocket

Question 4

Which THREE are valid patterns for multi-container Pods?

Accepted Answer

Ambassador. (Ambassador) is correct because the Ambassador pattern uses a proxy container that mediates network traffic between the main application container and external services, allowing the main container to connect to localhost while the ambassador handles protocol translation or service discovery. This is a valid multi-container Pod design pattern in Kubernetes, commonly implemented with tools like Envoy or a custom sidecar proxy.

Answer

Init

Answer

Replicator

Question 5

A ClusterRole named 'pod-reader' allows get, list, and watch on pods. A RoleBinding 'read-pods' in namespace 'default' binds this ClusterRole to user 'jane'. Which statement is true?

Accepted Answer

User 'jane' can read pods only in the 'default' namespace. A RoleBinding in a specific namespace binds a ClusterRole to a subject only within that namespace. Since the RoleBinding 'read-pods' is in the 'default' namespace, user 'jane' receives the permissions defined in the 'pod-reader' ClusterRole (get, list, watch on pods) only within the 'default' namespace, not across all namespaces.

Answer

User 'jane' can read pods in all namespaces because ClusterRole is cluster-scoped

Answer

The RoleBinding must be changed to a ClusterRoleBinding for it to work

Answer

User 'jane' can read pods and also delete them because ClusterRole gives full access

Question 6

A developer needs to view the logs of a pod named 'web-app-84b7f6f5b6-abcde' that crashed and has been restarted. Which kubectl command should they use to see the logs from the previous (crashed) instance?

Accepted Answer

kubectl logs --previous web-app-84b7f6f5b6-abcde. The `--previous` flag in `kubectl logs` retrieves logs from the previous instance of a container that has been restarted. This is essential for debugging a crashed pod, as the current container's logs only reflect the new instance after the restart.

Answer

kubectl logs web-app-84b7f6f5b6-abcde

Answer

kubectl logs --all-containers web-app-84b7f6f5b6-abcde

Answer

kubectl logs -f web-app-84b7f6f5b6-abcde

Question 7

An Ingress resource has the following spec. What is the effect?

spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Accepted Answer

Ingress terminates TLS using the secret and routes to the service.. The Ingress spec defines TLS termination at the ingress controller using the secret `myapp-tls` for the host `myapp.example.com`. The `tls` block configures the ingress to decrypt HTTPS traffic using the certificate and key stored in that secret, and then forward the decrypted HTTP traffic to the backend service `myapp` on port 80. This is the standard behavior for securing traffic with TLS in Kubernetes Ingress.

Answer

Ingress uses the secret for client authentication.

Answer

Ingress redirects HTTP to HTTPS automatically.

Answer

Ingress passes the TLS connection through to the service.

Question 8

A developer wants to view the resource usage of all containers in a specific pod. Which command should they use?

Accepted Answer

kubectl top pod --containers. `kubectl top pod --containers` displays per-container CPU and memory metrics for a specific pod, which is exactly what the developer needs to view resource usage of all containers within that pod. The `--containers` flag is essential to break down the pod-level metrics into individual container-level metrics.

Answer

kubectl top pods --all-namespaces

Answer

kubectl top pods

Answer

kubectl top pod <pod>

Question 9

Which Dockerfile instruction is used to specify the base image for a container image?

Accepted Answer

FROM. The FROM instruction initializes a new build stage and sets the base image for subsequent instructions. It must be the first non-comment instruction in a Dockerfile, pulling a specified image from a registry (e.g., Docker Hub) to provide the filesystem and runtime environment for the container.

Answer

COPY

Answer

CMD

Answer

RUN

Question 10

You need to access a database pod 'db-pod' on port 5432 from your local machine. Which command forwards local port 15432 to the pod's port 5432?

Accepted Answer

kubectl port-forward pod/db-pod 15432:5432. `kubectl port-forward` creates a direct tunnel from a local port to a port on a specific pod. The syntax `kubectl port-forward pod/db-pod 15432:5432` forwards local port 15432 to the pod's port 5432, allowing you to access the database as if it were running locally.

Answer

kubectl proxy --port=15432 db-pod:5432

Answer

kubectl expose pod db-pod --port=15432 --target-port=5432

Answer

kubectl port-forward db-pod 5432:15432