CKAD Timed Practice Test 4 — 10 Questions

Question 1

A cluster administrator wants to enforce that no pod in namespace 'prod' uses more than 4Gi of memory. Which Kubernetes resource should be created?

Accepted Answer

LimitRange. Option C is correct because a LimitRange resource in the 'prod' namespace can set a default memory limit and a maximum memory limit per container or pod, enforcing that no pod exceeds 4Gi of memory. This is the appropriate Kubernetes primitive for per-pod resource constraints within a namespace, as it applies to all pods that do not specify their own limits.

Answer

PodDisruptionBudget

Answer

NetworkPolicy

Answer

ResourceQuota

Question 2

A developer creates a Role and RoleBinding in the namespace 'development' to grant list pods permission to a service account. Which manifest snippet correctly defines the Role?

Accepted Answer

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["list"]. Option C is correct because pods belong to the core API group, which is represented by an empty string `""` in the `apiGroups` field. The `list` verb is sufficient to list pods, and the `resources` field correctly specifies `pods`. This Role grants the service account permission to list pods in the `development` namespace.

Answer

rules:
- apiGroups: ["pods"]
  resources: ["pods"]
  verbs: ["get", "list"]

Answer

rules:
- apiGroups: ["apps"]
  resources: ["pods"]
  verbs: ["list"]

Answer

rules:
- apiGroups: ["*"]
  resources: ["pods"]
  verbs: ["list"]

Question 3

A LimitRange in namespace 'limits' sets default memory request to 256Mi and default memory limit to 512Mi. A pod is created without specifying any resources. What are the pod's effective memory request and limit?

Accepted Answer

request: 256Mi, limit: 512Mi. When a LimitRange exists in a namespace, it automatically applies default resource requests and limits to any pod that does not specify them. In this case, the LimitRange sets the default memory request to 256Mi and the default memory limit to 512Mi, so the pod inherits those values. This ensures the pod has a guaranteed QoS class (Guaranteed) because request equals limit, but only if both are set; here they differ, so the pod will be Burstable.

Answer

request: 512Mi, limit: 256Mi

Answer

No request or limit; the pod will be scheduled with best-effort QoS

Answer

request: 0, limit: unlimited

Question 4

You have a pod that needs to mount a Secret as a volume. The Secret has keys 'username' and 'password'. How should the volumes and volumeMounts be configured to mount the secret at /etc/secret with each key as a file?

Accepted Answer

volumes:
- name: secret-vol
  secret:
    secretName: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret. Option D is correct because it uses the `secret` volume type with `secretName: my-secret`, which mounts the specified Kubernetes Secret as a volume. When mounted at `/etc/secret`, each key in the Secret (e.g., 'username' and 'password') becomes a file in that directory, with the file name matching the key and the file content being the decoded value of the key. This is the standard method for exposing Secret data as files in a pod.

Answer

volumes:
- name: secret-vol
  hostPath:
    path: /etc/secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  configMap:
    name: my-secret
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Answer

volumes:
- name: secret-vol
  emptyDir: {}
containers:
- volumeMounts:
  - name: secret-vol
    mountPath: /etc/secret

Question 5

You want to apply a Pod Security Admission (PSA) policy that enforces the 'restricted' profile in the 'dev' namespace, but only for Pods that are not exempt. Which TWO steps are required? (Select TWO)

Accepted Answer

Set the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace. Option A is correct because setting the label 'pod-security.kubernetes.io/enforce=restricted' on the namespace instructs the Pod Security Admission controller to reject any Pod that does not meet the restricted profile, unless the Pod is exempt (e.g., system-critical Pods or those with specific exemptions). This label directly enforces the policy at admission time, ensuring only compliant Pods are created in the 'dev' namespace.

Answer

Add a 'securityContext' field to the Pod template with 'runAsUser: 1000'

Answer

Set the label 'pod-security.kubernetes.io/enforce=baseline' on the namespace

Answer

Set the label 'pod-security.kubernetes.io/warn=restricted' on the namespace

Question 6

A pod is using a Secret to authenticate to a private registry. The Secret type must be 'kubernetes.io/dockerconfigjson'. Which of the following is the correct way to create such a Secret using kubectl?

Accepted Answer

kubectl create secret docker-registry regcred --docker-server=my-registry.example.com --docker-username=myuser --docker-password=mypassword --docker-email=myemail@example.com. Option D is correct because `kubectl create secret docker-registry` is the dedicated command to create a Secret of type `kubernetes.io/dockerconfigjson`. It automatically generates the required `.dockerconfigjson` field with the base64-encoded Docker credentials in the correct JSON format, which the kubelet uses to authenticate to a private registry when pulling images.

Answer

kubectl create secret generic regcred --type=kubernetes.io/dockercfg --from-literal=.dockercfg=...

Answer

kubectl create secret generic regcred --from-file=.dockerconfigjson=/root/.docker/config.json

Answer

kubectl create secret tls regcred --cert=cert.crt --key=key.key

Question 7

Which kubectl command creates a Secret named 'db-secret' with key 'password' and value 'mypwd'?

Accepted Answer

kubectl create secret generic db-secret --from-literal=password=mypwd. Option C is correct because `kubectl create secret generic` with `--from-literal` allows you to specify key-value pairs directly on the command line. The syntax `--from-literal=password=mypwd` creates a secret with key 'password' and value 'mypwd', which is the exact requirement.

Answer

kubectl create secret generic db-secret password=mypwd

Answer

kubectl create secret generic db-secret --from-file=password=mypwd

Answer

kubectl create secret generic db-secret --from-env-file=password=mypwd

Question 8

A container image requires a seccomp profile that is not the default. The cluster supports the RuntimeDefault seccomp profile. Which Pod securityContext field should be configured to use the RuntimeDefault seccomp profile?

Accepted Answer

seccompProfile:
  type: RuntimeDefault. Option A is correct because the `seccompProfile` field under the Pod's `securityContext` is the proper way to specify a seccomp profile in Kubernetes. Setting `type: RuntimeDefault` tells the container runtime (e.g., containerd or CRI-O) to use the default seccomp profile provided by the runtime, which is a secure baseline that blocks around 44 system calls while allowing common ones like `read`, `write`, and `exit`. This field was introduced in Kubernetes 1.19 (GA in 1.22) and is the standard approach for configuring seccomp at the Pod or container level.

Answer

seccomp:
  type: RuntimeDefault

Answer

capabilities:
  add: [SECCOMP]

Answer

securityContext:
  seccomp:
    type: Unconfined

Question 9

Which TWO of the following are valid ways to consume a ConfigMap in a pod?

Accepted Answer

envFrom:
  - configMapRef:
      name: my-config. Option C is correct because `envFrom` with a `configMapRef` is a valid method to consume a ConfigMap as environment variables in a pod. This injects all key-value pairs from the ConfigMap named `my-config` as environment variables into the container. Option E is also correct as it demonstrates mounting a ConfigMap as a volume using the `configMap` volume source with the correct `name` field and then mounting that volume into the container at `/etc/config`.

Answer

envFrom:
  - secretRef:
      name: my-config

Answer

volumes:
  - name: config-vol
    configMap:
      configMapName: my-config

Answer

env:
  - name: MY_VAR
    valueFrom:
      configMapKeyRef:
        name: my-config
        key: my-key

Question 10

A namespace 'dev' has a ResourceQuota that sets 'requests.cpu: 4' and 'limits.cpu: 8'. A pod is created with a container that has 'resources.requests.cpu: 1' and 'resources.limits.cpu: 3'. However, the pod remains in Pending state. The output of 'kubectl describe quota -n dev' shows 'used requests.cpu: 3.5' and 'used limits.cpu: 7'. What is the most likely reason the pod is pending?

Accepted Answer

The pod's CPU limit exceeds the remaining quota.. The ResourceQuota in namespace 'dev' has a limit of 8 CPUs for limits.cpu, with 7 already used, leaving only 1 CPU remaining. The pod's container requests a limit of 3 CPUs, which exceeds the available 1 CPU, causing the scheduler to reject the pod and leave it in Pending state. ResourceQuota enforcement occurs at admission time, and the scheduler will not schedule a pod that would cause the namespace to exceed its quota limits.

Answer

The pod's CPU request exceeds the remaining quota.

Answer

The pod's memory request is not set.

Answer

The namespace does not have a LimitRange set.