CKAD Application Observability and Maintenance Practice Question
You are debugging a pod that is running but not responding to network requests on port 8080. You suspect the application inside the container is faulty. You need to run an interactive shell inside the container to inspect the process. Which command should you use?
⚠ Common exam trap
Test-takers frequently confuse `kubectl exec` (which runs a command in an existing container) with `kubectl debug` (which creates a new ephemeral container), and they may choose option C thinking it provides interactive access, but it does not attach to the original application container's process space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl exec -it pod-name -- /bin/sh
`kubectl exec -it pod-name -- /bin/sh` opens an interactive shell inside the running container, allowing you to inspect processes, check network listeners, and debug the application directly. This is the standard command for gaining shell access to a container in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl describe pod pod-name
Why it's wrong here
kubectl describe pod reads the pod's full object specification, status conditions, and recent events from the API server, but it never executes anything inside the container. It is useful for identifying configuration errors, failed probes, or image pull problems, yet it cannot provide a command prompt or inspect the live process tree. Without an interactive session, you can't run diagnostic commands like ps or netstat, so this command cannot debug a hung process from the inside.
- ✗
kubectl logs pod-name -f
Why it's wrong here
kubectl logs -f follows the container runtime's captured stdout and stderr streams, showing only what the application has printed. It does not allocate a TTY, attach to the process, or let you send input to the container, so you cannot execute commands or investigate running threads and file descriptors. It merely observes historical and newly generated output, which can indicate a problem but never allows you to actively probe the environment.
- ✗
kubectl debug -it pod-name --image=busybox
Why it's wrong here
kubectl debug -it pod-name --image=busybox starts a new, ephemeral sidecar container in the pod, not a shell inside the original container. The busybox container runs in its own process namespace (unless you also specify --target/--share-processes) and shares only the pod's network and storage volumes. This is useful for inspecting the pod network or filesystem from a separate tooling container, but it cannot modify or inspect the memory, environment variables, or process list of the original application container, so it is not the same as an interactive shell in the target container.
- ✓
kubectl exec -it pod-name -- /bin/sh
Why this is correct
kubectl exec -it pod-name -- /bin/sh attaches directly to the primary container's process namespace and starts an interactive shell there. The -i flag keeps stdin open, and -t allocates a pseudo-TTY, giving you a real terminal session. This lets you run commands such as ps, cat /proc/1/cmdline, lsof, and netstat inside the exact runtime where the application is hanging, enabling direct inspection and troubleshooting of the live process. It is the only option that provides an interactive shell within the existing, running container.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.