CKAD · topic practice

Application Environment, Configuration and Security practice questions

Q: How should I use these Application Environment, Configuration and Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Q: Can I practise just Application Environment, Configuration and Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Application Environment, Configuration and Security domain.

Practise Certified Kubernetes Application Developer CKAD Application Environment, Configuration and Security practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Application Environment, Configuration and Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Application Environment, Configuration and Security

Application Environment, Configuration and Security questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Application Environment, Configuration and Security exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Application Environment, Configuration and Security questions

20 questions · select your answer, then reveal the explanation

Question 1easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

A pod named 'web-app' is running but has no environment variables. The developer wants to inject a variable 'DB_URL=postgres://db:5432' from a ConfigMap named 'db-config'. Which pod spec snippet correctly achieves this?

Trap 1: env: - name: DB_URL value: "postgres://db:5432"

This sets a literal value, not from ConfigMap.

Trap 2: envFrom: - configMapRef: name: db-config key: DB_URL

envFrom imports all keys, not a specific one; syntax also wrong.

Trap 3: env: - name: DB_URL valueFrom: secretKeyRef: name:…

secretKeyRef is for Secrets, not ConfigMaps.

Study all Application Environment, Configuration and Security common traps →

A
env: - name: DB_URL value: "postgres://db:5432"
Why wrong: This sets a literal value, not from ConfigMap.
B
envFrom: - configMapRef: name: db-config key: DB_URL
Why wrong: envFrom imports all keys, not a specific one; syntax also wrong.
C
env: - name: DB_URL valueFrom: secretKeyRef: name: db-config key: DB_URL
Why wrong: secretKeyRef is for Secrets, not ConfigMaps.
D
env: - name: DB_URL valueFrom: configMapKeyRef: name: db-config key: DB_URL
Correctly references ConfigMap key.

Full breakdown with real-world context →

Question 2mediummultiple choice

Read the full NAT/PAT explanation →

A deployment runs a container that needs to read a file from a host path '/var/log/app' on the node. The file must be available to all pods on that node. Which volume type should be used?

Trap 1: emptyDir

Ephemeral and not shared across pods.

Trap 2: persistentVolumeClaim

PVCs are for persistent storage, but not tied to a specific node path.

Trap 3: configMap

ConfigMaps are for configuration data, not file access.

Study all Application Environment, Configuration and Security common traps →

A
emptyDir
Why wrong: Ephemeral and not shared across pods.
B
hostPath
Correctly mounts host node path.
C
persistentVolumeClaim
Why wrong: PVCs are for persistent storage, but not tied to a specific node path.
D
configMap
Why wrong: ConfigMaps are for configuration data, not file access.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Application Environment, Configuration and Security explanation →

A pod uses a service account 'my-sa' with a RoleBinding that grants get and list on pods in namespace 'app'. The pod runs a process that calls the Kubernetes API to list pods. However, the API call returns 403. What is the most likely cause?

Trap 1: The API server is not running.

If API server were down, the error would be connection error, not 403.

Trap 2: The RoleBinding is in the wrong namespace.

RoleBinding is in 'app' namespace, correct.

Trap 3: The Role does not include list permission.

Role includes list, so that is not the issue.

Study all Application Environment, Configuration and Security common traps →

A
The API server is not running.
Why wrong: If API server were down, the error would be connection error, not 403.
B
The RoleBinding is in the wrong namespace.
Why wrong: RoleBinding is in 'app' namespace, correct.
C
The pod does not have the service account token mounted.
If automountServiceAccountToken is false, no token is available.
D
The Role does not include list permission.
Why wrong: Role includes list, so that is not the issue.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Application Environment, Configuration and Security explanation →

A developer wants to restrict network traffic so that only pods with label 'app: frontend' can communicate with pods labeled 'app: backend' on port 8080. Which Kubernetes resource should be used?

Trap 1: ResourceQuota

ResourceQuota limits resource consumption, not network traffic.

Trap 2: PodSecurityPolicy

PodSecurityPolicy is for security context constraints, not network traffic.

Trap 3: RoleBinding

RoleBinding is for RBAC access to API resources.

Study all Application Environment, Configuration and Security common traps →

A
NetworkPolicy
NetworkPolicy defines ingress/egress rules based on pod labels.
B
ResourceQuota
Why wrong: ResourceQuota limits resource consumption, not network traffic.
C
PodSecurityPolicy
Why wrong: PodSecurityPolicy is for security context constraints, not network traffic.
D
RoleBinding
Why wrong: RoleBinding is for RBAC access to API resources.

Full breakdown with real-world context →

Question 5easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?

Trap 1: runAsNonRoot: true

Prevents root but does not specify UID; container might still run as arbitrary non-root.

Trap 2: fsGroup: 1000

fsGroup sets the group for volume mounts, not the user.

Trap 3: privileged: false

Disables privileged mode but does not change the user.

Study all Application Environment, Configuration and Security common traps →

A
runAsNonRoot: true
Why wrong: Prevents root but does not specify UID; container might still run as arbitrary non-root.
B
runAsUser: 1000
Directly sets the container's user ID to 1000.
C
fsGroup: 1000
Why wrong: fsGroup sets the group for volume mounts, not the user.
D
privileged: false
Why wrong: Disables privileged mode but does not change the user.

Full breakdown with real-world context →

Question 6hardmulti select

Read the full Application Environment, Configuration and Security explanation →

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Trap 1: env: - name: SECRET_KEY valueFrom: configMapKeyRef:…

configMapKeyRef is for ConfigMaps, not Secrets.

Trap 2: env: - name: SECRET_KEY valueFrom: secretEnvRef: name:…

secretEnvRef is not a valid Kubernetes field.

Trap 3: envFrom: - configMapRef: name: my-secret

configMapRef is for ConfigMaps, not Secrets.

Study all Application Environment, Configuration and Security common traps →

A
env: - name: SECRET_KEY valueFrom: configMapKeyRef: name: my-secret key: key
Why wrong: configMapKeyRef is for ConfigMaps, not Secrets.
B
env: - name: SECRET_KEY valueFrom: secretEnvRef: name: my-secret key: key
Why wrong: secretEnvRef is not a valid Kubernetes field.
C
envFrom: - configMapRef: name: my-secret
Why wrong: configMapRef is for ConfigMaps, not Secrets.
D
env: - name: SECRET_KEY valueFrom: secretKeyRef: name: my-secret key: key
Correct: references a specific key from a Secret.
E
envFrom: - secretRef: name: my-secret
Correct: imports all keys as env vars.

Full breakdown with real-world context →

Question 7mediummulti select

Read the full Application Environment, Configuration and Security explanation →

Which THREE of the following are valid fields in a PodSecurityPolicy (PSP) that control Linux capabilities? (Select exactly 3)

Trap 1: privileged

Controls whether privileged containers are allowed, not specific capabilities.

Trap 2: readOnlyRootFilesystem

Makes root filesystem read-only, unrelated to capabilities.

Study all Application Environment, Configuration and Security common traps →

A
privileged
Why wrong: Controls whether privileged containers are allowed, not specific capabilities.
B
defaultAddCapabilities
Capabilities added by default to containers.
C
readOnlyRootFilesystem
Why wrong: Makes root filesystem read-only, unrelated to capabilities.
D
requiredDropCapabilities
Capabilities that must be dropped from containers.
E
allowedCapabilities
Lists capabilities that can be added.

Full breakdown with real-world context →

Question 8mediummultiple choice

Read the full Application Environment, Configuration and Security explanation →

You are designing a Pod that runs a legacy application requiring a specific configuration file mounted at /etc/config/app.conf. The configuration is stored in a Kubernetes ConfigMap named 'app-config' with key 'config.yaml'. Which approach ensures the configuration is mounted correctly and the container automatically receives updates when the ConfigMap changes?

Trap 1: Create a hostPath volume at /etc/config and copy the ConfigMap…

hostPath volumes bypass ConfigMap mechanisms, require manual updates, and are not recommended for configuration management.

Trap 2: Use the ConfigMap to set an environment variable CONFIG and have…

Environment variables from ConfigMaps are not automatically updated when the ConfigMap changes; the Pod must be restarted.

Trap 3: Create a ConfigMap volume mount at /etc/config/app.conf using…

subPath mounts prevent automatic updates; the file content is static after initial mount.

Study all Application Environment, Configuration and Security common traps →

A
Create a ConfigMap volume mount at /etc/config, mounting the entire ConfigMap, and ensure the application reads /etc/config/config.yaml.
This mounts all keys as files; the app reads config.yaml. Changes to the ConfigMap are reflected automatically (with a delay).
B
Create a hostPath volume at /etc/config and copy the ConfigMap content to the node.
Why wrong: hostPath volumes bypass ConfigMap mechanisms, require manual updates, and are not recommended for configuration management.
C
Use the ConfigMap to set an environment variable CONFIG and have the application read it from the environment.
Why wrong: Environment variables from ConfigMaps are not automatically updated when the ConfigMap changes; the Pod must be restarted.
D
Create a ConfigMap volume mount at /etc/config/app.conf using subPath: config.yaml.
Why wrong: subPath mounts prevent automatic updates; the file content is static after initial mount.

Full breakdown with real-world context →

Question 9easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

A developer creates a Secret named 'db-secret' with key 'password'. They want to expose the password as an environment variable DB_PASSWORD in a Pod. Which of the following is the correct way to achieve this?

Trap 1: Set env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name:…

configMapKeyRef is for ConfigMaps, not Secrets.

Trap 2: Use envFrom: - secretRef: name: db-secret

This creates an environment variable named 'password' (the key name), not DB_PASSWORD.

Trap 3: Set env: - name: DB_PASSWORD secretRef: name: db-secret key:…

Invalid syntax; env expects valueFrom with secretKeyRef, not secretRef directly.

Study all Application Environment, Configuration and Security common traps →

A
Set env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-secret key: password
Correctly maps the secret key to the desired environment variable name.
B
Set env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name: db-secret key: password
Why wrong: configMapKeyRef is for ConfigMaps, not Secrets.
C
Use envFrom: - secretRef: name: db-secret
Why wrong: This creates an environment variable named 'password' (the key name), not DB_PASSWORD.
D
Set env: - name: DB_PASSWORD secretRef: name: db-secret key: password
Why wrong: Invalid syntax; env expects valueFrom with secretKeyRef, not secretRef directly.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Application Environment, Configuration and Security explanation →

Which TWO of the following are valid ways to inject configuration data into a Kubernetes Pod?

Trap 1: Mounting a ServiceAccount token as a volume.

ServiceAccount tokens are for authentication, not configuration data injection.

Trap 2: Using a PersistentVolumeClaim to store configuration files.

PersistentVolumeClaims are for persistent storage, not for injecting configuration into Pods.

Trap 3: Referencing a NetworkPolicy in the Pod spec.

NetworkPolicies define network rules and are not used for configuration injection.

Study all Application Environment, Configuration and Security common traps →

A
Mounting a ServiceAccount token as a volume.
Why wrong: ServiceAccount tokens are for authentication, not configuration data injection.
B
Using a ConfigMap to set environment variables in the Pod spec.
ConfigMaps are designed to hold configuration data and can be exposed as environment variables.
C
Using a PersistentVolumeClaim to store configuration files.
Why wrong: PersistentVolumeClaims are for persistent storage, not for injecting configuration into Pods.
D
Referencing a NetworkPolicy in the Pod spec.
Why wrong: NetworkPolicies define network rules and are not used for configuration injection.
E
Mounting a Secret as a volume in the Pod.
Secrets can be mounted as volumes to inject sensitive configuration data.

Full breakdown with real-world context →

Question 11hardmultiple choice

Read the full Application Environment, Configuration and Security explanation →

Refer to the exhibit. A Pod is defined with security contexts at both the container and Pod level. Which of the following statements accurately describes the effective security configuration?

Exhibit

Refer to the exhibit.

```
apiVersion: v1
kind: Pod
metadata:
  name: secured-pod
spec:
  containers:
  - name: app
    image: nginx
    securityContext:
      runAsUser: 1000
      runAsGroup: 2000
      capabilities:
        add: ["NET_ADMIN"]
        drop: ["ALL"]
  securityContext:
    runAsNonRoot: true
```

Trap 1: The Pod will fail to start because runAsNonRoot conflicts with the…

runAsNonRoot: true only requires that the container user is not 0, which is satisfied by user 1000.

Trap 2: The container runs as user 1000, but the Pod-level runAsNonRoot…

Pod-level runAsNonRoot does not override container runAsUser; both must be satisfied.

Trap 3: The container runs as root because the Pod-level runAsNonRoot is…

Pod-level runAsNonRoot is not ignored; it is a separate constraint.

Study all Application Environment, Configuration and Security common traps →

A
The Pod will fail to start because runAsNonRoot conflicts with the container's runAsUser.
Why wrong: runAsNonRoot: true only requires that the container user is not 0, which is satisfied by user 1000.
B
The container runs as user 1000, but the Pod-level runAsNonRoot overrides the container's runAsUser to enforce non-root.
Why wrong: Pod-level runAsNonRoot does not override container runAsUser; both must be satisfied.
C
The container runs as user 1000, group 2000, with NET_ADMIN capability added, and the Pod-level runAsNonRoot: true is also enforced.
Container-level securityContext merges with Pod-level, but Pod-level runAsNonRoot is an additional constraint.
D
The container runs as root because the Pod-level runAsNonRoot is ignored when container-level capabilities are set.
Why wrong: Pod-level runAsNonRoot is not ignored; it is a separate constraint.

Full breakdown with real-world context →

Question 12easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

You are a Kubernetes administrator responsible for a production cluster. A development team has deployed a Pod named 'app-pod' that runs a container with a PostgreSQL database. The team reports that the Pod is failing to start with an error: 'Error: container has runAsNonRoot and image will run as root (runtime error)'. The Pod YAML is as follows:

```yaml apiVersion: v1 kind: Pod metadata: name: app-pod spec: containers: - name: db image: postgres:latest securityContext: runAsNonRoot: true ```

The team wants to ensure the container runs securely without running as root. What is the BEST course of action?

Trap 1: Remove `runAsNonRoot: true` from the securityContext to allow the…

This would run the container as root, which is insecure and not recommended.

Trap 2: Increase the Pod's resource limits because the error is due to…

The error is about security context, not resources.

Trap 3: Create a PodSecurityPolicy that allows running as root.

This is a cluster-wide change and not the best immediate fix for this single Pod.

Study all Application Environment, Configuration and Security common traps →

A
Add `runAsUser: 999` to the container's securityContext to run the container as the postgres user.
This explicitly sets the user to a non-root user, satisfying runAsNonRoot.
B
Remove `runAsNonRoot: true` from the securityContext to allow the container to run as root.
Why wrong: This would run the container as root, which is insecure and not recommended.
C
Increase the Pod's resource limits because the error is due to insufficient memory.
Why wrong: The error is about security context, not resources.
D
Create a PodSecurityPolicy that allows running as root.
Why wrong: This is a cluster-wide change and not the best immediate fix for this single Pod.

Full breakdown with real-world context →

Question 13mediumdrag order

Read the full Application Environment, Configuration and Security explanation →

Arrange the steps to create a ConfigMap from a file and mount it as a volume in a Pod.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 14mediumdrag order

Read the full Application Environment, Configuration and Security explanation →

Sequence the steps to scale a Deployment to 5 replicas and verify.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 15mediummatching

Read the full Application Environment, Configuration and Security explanation →

Match each Kubernetes concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Virtual cluster for resource isolation

Runs one pod per node for system services

Runs a pod to completion; for batch processing

Automatically scales pods based on CPU/memory

Controls traffic flow between pods

Question 16mediummatching

Read the full Application Environment, Configuration and Security explanation →

Match each Kubernetes probe to its check behavior.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Runs a command inside the container; success if exit 0

Performs an HTTP GET request; success if 2xx-3xx

Attempts to open a TCP socket; success if connection established

Performs a gRPC health check (alpha)

Indicates whether the application has started successfully

Question 17easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

You need to create a ConfigMap named 'app-config' with key 'APP_COLOR' and value 'blue'. Which command creates this ConfigMap?

Trap 1: kubectl create configmap app-config --from-env-file=APP_COLOR=blue

--from-env-file expects a file containing environment variables.

Trap 2: kubectl create configmap app-config --from-literal=APP_COLOR:blue

The correct format uses an equals sign (=), not a colon (:).

Trap 3: kubectl create configmap app-config --from-file=APP_COLOR=blue

--from-file expects a file path, not a literal value.

Study all Application Environment, Configuration and Security common traps →

A
kubectl create configmap app-config --from-env-file=APP_COLOR=blue
Why wrong: --from-env-file expects a file containing environment variables.
B
kubectl create configmap app-config --from-literal=APP_COLOR=blue
Correct. --from-literal is used for inline key-value pairs.
C
kubectl create configmap app-config --from-literal=APP_COLOR:blue
Why wrong: The correct format uses an equals sign (=), not a colon (:).
D
kubectl create configmap app-config --from-file=APP_COLOR=blue
Why wrong: --from-file expects a file path, not a literal value.

Full breakdown with real-world context →

Question 18mediummultiple choice

Read the full Application Environment, Configuration and Security explanation →

A pod is running with the following SecurityContext: securityContext: runAsUser: 1000 runAsGroup: 2000 fsGroup: 3000 What UID and GID does the process inside the container use?

Trap 1: UID 1000, GID 3000

fsGroup sets the group for volumes, not the process primary GID.

Trap 2: UID 0, GID 2000

runAsUser is specified as 1000, so UID is not 0.

Trap 3: UID 3000, GID 2000

fsGroup does not affect the UID of the container process.

Study all Application Environment, Configuration and Security common traps →

A
UID 1000, GID 3000
Why wrong: fsGroup sets the group for volumes, not the process primary GID.
B
UID 1000, GID 2000
runAsUser sets UID, runAsGroup sets GID. Both apply to the container process.
C
UID 0, GID 2000
Why wrong: runAsUser is specified as 1000, so UID is not 0.
D
UID 3000, GID 2000
Why wrong: fsGroup does not affect the UID of the container process.

Full breakdown with real-world context →

Question 19hardmultiple choice

Read the full Application Environment, Configuration and Security explanation →

You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?

Trap 1: env: - name: SECRET_DATA valueFrom: configMapKeyRef:…

This uses configMapKeyRef, but the resource is a Secret, not a ConfigMap.

Trap 2: env: - name: SECRET_DATA valueFrom: secretKeyRef: name:…

The name field should reference the secret name, not the key. The key field specifies the key within the secret.

Trap 3: volumeMounts: - name: secret-volume mountPath:…

This mounts the secret as a file, not as an environment variable.

Study all Application Environment, Configuration and Security common traps →

A
env: - name: SECRET_DATA valueFrom: configMapKeyRef: name: mysecret key: password
Why wrong: This uses configMapKeyRef, but the resource is a Secret, not a ConfigMap.
B
env: - name: SECRET_DATA valueFrom: secretKeyRef: name: mysecret key: password
Correct. secretKeyRef uses name for the secret and key for the key within the secret.
C
env: - name: SECRET_DATA valueFrom: secretKeyRef: name: password key: mysecret
Why wrong: The name field should reference the secret name, not the key. The key field specifies the key within the secret.
D
volumeMounts: - name: secret-volume mountPath: /etc/secret volumes: - name: secret-volume secret: secretName: mysecret items: - key: password path: secret.txt
Why wrong: This mounts the secret as a file, not as an environment variable.

Full breakdown with real-world context →

Question 20easymultiple choice

Read the full Application Environment, Configuration and Security explanation →

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Trap 1: resources: requests: cpu: 250 limits: memory: 512M

'250' without 'm' is interpreted as 250 cores, not 250 millicores. '512M' is not standard.

Trap 2: resources: requests: cpu: 250 limits: memory: 512MB

'250' without 'm' is 250 cores. '512MB' is not standard.

Trap 3: resources: requests: cpu: 0.25 limits: memory: 512MB

While '0.25' is valid, '512MB' is not a standard Kubernetes resource suffix; use 'Mi' for mebibytes.

Study all Application Environment, Configuration and Security common traps →

A
resources: requests: cpu: 250 limits: memory: 512M
Why wrong: '250' without 'm' is interpreted as 250 cores, not 250 millicores. '512M' is not standard.
B
resources: requests: cpu: 250 limits: memory: 512MB
Why wrong: '250' without 'm' is 250 cores. '512MB' is not standard.
C
resources: requests: cpu: 0.25 limits: memory: 512MB
Why wrong: While '0.25' is valid, '512MB' is not a standard Kubernetes resource suffix; use 'Mi' for mebibytes.
D
resources: requests: cpu: 250m limits: memory: 512Mi
Correct. '250m' means 250 millicores, and '512Mi' means 512 mebibytes.

Full breakdown with real-world context →

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Application Environment, Configuration and Security sessions

Start a Application Environment, Configuration and Security only practice session

Every question in these sessions is drawn from the Application Environment, Configuration and Security domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Application Environment, Configuration and Security questions →Mixed CKAD session

Frequently asked questions

What does the CKAD exam test about Application Environment, Configuration and Security?: Application Environment, Configuration and Security questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Application Environment, Configuration and Security questions in a focused session?: Yes — the session launcher on this page draws every question from the Application Environment, Configuration and Security domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other CKAD topics?: Use the topic links above to move to related areas, or go back to the CKAD question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the CKAD exam covers. They are not copied from any real exam or dump site.

Application Environment, Configuration and Security only

10 questions 20 questions 30 questions 50 questions

Mixed CKAD session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All CKAD questions Application Environment, Configuration and Security domain overview CKAD exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Application Environment, Configuration and Security practice questions

What to know about Application Environment, Configuration and Security

Common Application Environment, Configuration and Security exam traps

Application Environment, Configuration and Security questions

A pod named 'web-app' is running but has no environment variables. The developer wants to inject a variable 'DB_URL=postgres://db:5432' from a ConfigMap named 'db-config'. Which pod spec snippet correctly achieves this?

A deployment runs a container that needs to read a file from a host path '/var/log/app' on the node. The file must be available to all pods on that node. Which volume type should be used?

A pod uses a service account 'my-sa' with a RoleBinding that grants get and list on pods in namespace 'app'. The pod runs a process that calls the Kubernetes API to list pods. However, the API call returns 403. What is the most likely cause?

A developer wants to restrict network traffic so that only pods with label 'app: frontend' can communicate with pods labeled 'app: backend' on port 8080. Which Kubernetes resource should be used?

A container runs as root (UID 0) but the security policy requires the container to run as non-root user 1000. Which pod security context setting should be added?

Which TWO of the following are valid ways to mount a Secret into a pod as environment variables? (Select exactly 2)

Which THREE of the following are valid fields in a PodSecurityPolicy (PSP) that control Linux capabilities? (Select exactly 3)

A developer creates a Secret named 'db-secret' with key 'password'. They want to expose the password as an environment variable DB_PASSWORD in a Pod. Which of the following is the correct way to achieve this?

Which TWO of the following are valid ways to inject configuration data into a Kubernetes Pod?

Refer to the exhibit. A Pod is defined with security contexts at both the container and Pod level. Which of the following statements accurately describes the effective security configuration?

Exhibit

Arrange the steps to create a ConfigMap from a file and mount it as a volume in a Pod.

Sequence the steps to scale a Deployment to 5 replicas and verify.

Match each Kubernetes concept to its definition.

Match each Kubernetes probe to its check behavior.

You need to create a ConfigMap named 'app-config' with key 'APP_COLOR' and value 'blue'. Which command creates this ConfigMap?

A pod is running with the following SecurityContext: securityContext: runAsUser: 1000 runAsGroup: 2000 fsGroup: 3000 What UID and GID does the process inside the container use?

You need to create a Pod that mounts a Secret named 'mysecret' as an environment variable 'SECRET_DATA'. The secret has a key 'password'. Which YAML snippet correctly achieves this?

Which of the following is the correct way to set a CPU request of 250 millicores and a memory limit of 512 Mi in a container?

Track your progress over time

Start a Application Environment, Configuration and Security only practice session

Related CKAD topic practice pages

Application Design and Build practice questions

Application Deployment practice questions