CKAD Practice Question: Application Environment, Configuration and Security
A Pod is running in a namespace with a ResourceQuota that sets 'limits.memory: 2Gi'. The pod's container spec has 'resources.limits.memory: 1Gi' and 'resources.requests.memory: 512Mi'. The pod is in 'Running' state but consumes 1.5Gi of memory. What happens?
⚠ Common exam trap
Many exam-takers confuse namespace-level ResourceQuota enforcement with container-level memory limit enforcement, assuming the quota's higher value allows the container to exceed its own limit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The container will be OOMKilled because it exceeds its own memory limit of 1Gi
The container has a hard memory limit of 1Gi set in its resources.limits.memory. When the container's memory usage exceeds this limit (1.5Gi > 1Gi), the Linux kernel's OOM killer terminates the container process. The namespace ResourceQuota of 2Gi is not violated because the pod's limit (1Gi) is within the quota, so the kubelet does not evict the pod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pod will be evicted by the kubelet due to namespace quota violation
Why it's wrong here
Namespace resource quotas are enforced only during admission control when a pod is created or updated. The kubelet does not enforce quotas at runtime, and a pod that breaches its own memory limit is not evicted for quota violation; eviction for node pressure is a separate mechanism triggered by kubelet based on memory pressure at the node level, not namespace-level cumulative usage.
- ✗
The container will continue running because the namespace quota allows up to 2Gi
Why it's wrong here
A resource quota is a cumulative limit across all objects in a namespace, not a per-pod or per-container allowance. The container's own memory limit of 1Gi is enforced independently via cgroups, so even if the namespace quota has headroom, the container cannot use more than its declared limit; the kernel will take action against the container's processes, not the namespace as a whole.
- ✓
The container will be OOMKilled because it exceeds its own memory limit of 1Gi
Why this is correct
When a container has a memory limit of 1Gi, the kubelet configures a cgroup memory limit for that container. If the container's memory usage exceeds this limit, the kernel's OOM killer terminates the container's processes, and Kubernetes reports the reason as OOMKilled. This is a hard enforcement mechanism independent of any namespace quota or available node memory.
- ✗
The pod will be throttled by the kernel to stay within 1Gi
Why it's wrong here
Memory limits are not throttled; they are hard limits enforced by the kernel. Unlike CPU, which can be throttled to a specified rate, memory has no throttling mechanism—when the cgroup memory limit is exceeded, the kernel selects a process in that cgroup to kill via the OOM killer. The pod cannot be throttled to stay within its memory limit.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.