CKAD Practice Questions

Question 1

Which TWO of the following are valid uses of Kubernetes Annotations? (Select two.)

Accepted Answer

Configuring ingress controllers with specific settings like rewrite rules.. Kubernetes annotations are key-value pairs used to attach arbitrary non-identifying metadata to objects, and Ingress controllers commonly use specific annotations (e.g., nginx.ingress.kubernetes.io/rewrite-target) to configure behavior like URL rewriting. This allows operators to customize controller functionality without altering the core resource definition.

Answer

Defining the name of a Kubernetes resource.

Answer

Identifying which pods a Service should route traffic to.

Answer

Enabling service discovery between microservices.

Question 2

When performing a rolling update of a Deployment, which field in the Deployment spec controls the maximum number of Pods that can be created above the desired replicas during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxSurge. maxSurge defines how many Pods can be created above the desired replica count during a rolling update.

Answer

spec.strategy.type

Answer

spec.strategy.rollingUpdate.maxUnavailable

Answer

spec.replicas

Question 3

You run 'kubectl rollout undo deployment/app'. What happens?

Accepted Answer

It rolls back the Deployment to the previous revision. The 'kubectl rollout undo' command rolls back a Deployment to the previous revision. By default, it reverts to the immediate prior revision (revision 1 less than current).

Answer

It pauses the rollout

Answer

It shows the rollout history

Answer

It deletes the Deployment

Question 4

A pod is stuck in 'Pending' state. You run 'kubectl describe pod mypod' and see the event: '0/4 nodes are available: 4 Insufficient memory'. Which action will resolve the issue?

Accepted Answer

Scale down other pods in the cluster to free memory. The pod is stuck in 'Pending' because no node has enough allocatable memory to satisfy its memory request. Scaling down other pods frees memory on existing nodes, allowing the scheduler to place the pod. This directly resolves the 'Insufficient memory' condition without changing the pod's specification or cluster topology.

Answer

Add a nodeSelector to target a specific node

Answer

Increase the memory request in the pod spec

Answer

Scale up the Deployment to create more pod replicas

Question 5

A Job has the following spec:
apiVersion: batch/v1
kind: Job
metadata:
  name: pi
spec:
  template:
    spec:
      containers:
      - name: pi
        image: perl
        command: ["perl", "-Mbignum=bpi", "-wle", "print bpi(2000)"]
      restartPolicy: Never
  backoffLimit: 4
If the pod fails, how many times will Kubernetes retry the job before considering it failed?

Accepted Answer

4. The `backoffLimit` field in a Job spec specifies the number of retries before the Job is considered failed. In this YAML, `backoffLimit: 4` means Kubernetes will retry the Job up to 4 times after the initial failure, for a total of 5 attempts (1 initial + 4 retries). The question asks 'how many times will Kubernetes retry the job before considering it failed?', which directly corresponds to the `backoffLimit` value of 4.

Answer

1

Answer

0

Answer

5

Question 6

Which THREE of the following are correct about the .dockerignore file? (Select 3)

Accepted Answer

It supports wildcard patterns to exclude files. The .dockerignore file supports wildcard patterns (e.g., *, ?, []) to exclude files and directories from the build context, similar to .gitignore. This allows you to define patterns like *.log or temp/* to skip unwanted files during the Docker build process.

Answer

It is a replacement for .gitignore

Answer

It affects the files available in the running container

Question 7

A NetworkPolicy allows egress traffic to pods with label 'db: mysql' in the same namespace. Which egress rule is correct?

Accepted Answer

egress:
  - to:
    - podSelector:
        matchLabels:
          db: mysql. A NetworkPolicy egress rule uses the `to` field to specify destination pods, and a `podSelector` within the same namespace selects pods with the label `db: mysql`. This allows outbound traffic from any pod in the namespace to pods matching that label, which directly satisfies the requirement.

Answer

egress:
  - to:
    - namespaceSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - from:
    - podSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8

Question 8

Which instruction in a Dockerfile sets the default command to run when the container starts, but allows overriding?

Accepted Answer

CMD. The CMD instruction in a Dockerfile defines the default command to execute when a container starts from the image. It can be overridden by providing a command at the end of the `docker run` command, making it the correct choice for a default command that allows user override.

Answer

START

Answer

RUN

Answer

ENTRYPOINT

Question 9

You need to create a NetworkPolicy that denies all ingress traffic to pods with label 'app: db' in namespace 'prod'. Which YAML snippet correctly implements this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress: []. It defines a NetworkPolicy that selects pods with label 'app: db' in namespace 'prod', specifies 'policyTypes: [Ingress]', and sets 'ingress: []'. An empty ingress rule list means no ingress traffic is allowed, effectively denying all ingress to the selected pods. This is the standard Kubernetes pattern for creating a deny-all ingress policy for a specific set of pods.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-db
  namespace: prod
spec:
  podSelector:
    matchLabels:
      app: db
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: prod
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from: []

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []

Question 10

An Ingress resource has the following spec. What is the effect?

spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Accepted Answer

Ingress terminates TLS using the secret and routes to the service.. The Ingress spec defines TLS termination at the ingress controller using the secret `myapp-tls` for the host `myapp.example.com`. The `tls` block configures the ingress to decrypt HTTPS traffic using the certificate and key stored in that secret, and then forward the decrypted HTTP traffic to the backend service `myapp` on port 80. This is the standard behavior for securing traffic with TLS in Kubernetes Ingress.

Answer

Ingress uses the secret for client authentication.

Answer

Ingress redirects HTTP to HTTPS automatically.

Answer

Ingress passes the TLS connection through to the service.

Question 11

A CronJob is configured with concurrencyPolicy: Replace and a job execution takes 10 minutes. The schedule is */5 * * * *. Which statement is true about job executions?

Accepted Answer

Every 5 minutes, a new job is created, and if the previous job is still running, it is killed. With `concurrencyPolicy: Replace`, if a new job is triggered by the schedule (every 5 minutes) while the previous job is still running (it takes 10 minutes), the running job is terminated and replaced by the new one. This ensures only one job runs at a time, and the new job starts immediately, even if the previous one hasn't finished.

Answer

Jobs will never overlap because the schedule is too frequent

Answer

The job will be skipped if the previous one hasn't finished

Answer

Jobs will overlap, with up to two jobs running concurrently

Question 12

A developer wants to ensure a container runs as a non-root user with user ID 1000 and group ID 2000. Which SecurityContext fields should be set?

Accepted Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: true. Setting `runAsUser: 1000` and `runAsGroup: 2000` ensures the container's processes run with user ID 1000 and group ID 2000, while `runAsNonRoot: true` enforces that the container cannot run as root (UID 0), providing a security best practice for non-root execution.

Answer

runAsUser: 1000, runAsGroup: 2000, runAsNonRoot: false

Answer

runAsUser: 1000, runAsGroup: 2000, allowPrivilegeEscalation: false

Answer

runAsUser: 1000, fsGroup: 2000, runAsNonRoot: true

Question 13

You need to create a Secret of type 'kubernetes.io/tls' for ingress. Which command is correct?

Accepted Answer

kubectl create secret tls my-tls --cert=cert.pem --key=key.pem. `kubectl create secret tls` is the dedicated command for creating a TLS secret, and it uses the `--cert` and `--key` flags to specify the certificate and private key files respectively. This creates a Secret of type `kubernetes.io/tls`, which is required for Ingress resources to terminate HTTPS traffic.

Answer

kubectl create secret generic my-tls --from-file=cert.pem --from-file=key.pem

Answer

kubectl create secret tls my-tls --certificate=cert.pem --private-key=key.pem

Answer

kubectl create secret tls my-tls --from-file=tls.crt=cert.pem --from-file=tls.key=key.pem

Question 14

Which command lists all Helm releases in the current namespace?

Accepted Answer

helm list. The `helm list` command is the correct way to list all Helm releases in the current namespace. It queries the Helm release storage (typically Secrets in the cluster) and returns the release names, status, chart versions, and other metadata for the namespace set in the current kubeconfig context.

Answer

helm get all

Answer

helm status

Answer

helm show

Question 15

You want to perform a rolling update of a Deployment. The Deployment has a maxSurge=1 and maxUnavailable=0. How many extra pods can be created above the desired count during the update?

Accepted Answer

1. In a rolling update with `maxSurge=1` and `maxUnavailable=0`, Kubernetes ensures that at most one extra pod can be created above the desired replica count during the update. This is controlled by the `maxSurge` field, which defines the maximum number of pods that can be created over the desired number, and here it is set to 1 (either an absolute number or a percentage, defaulting to 25%). Since `maxUnavailable=0`, no pods can be taken down before new ones are ready, so the surge allows exactly one additional pod to be created temporarily.

Answer

Unlimited

Answer

0

Answer

Desired replicas

Certified Kubernetes Application Developer CKAD practice test

Three ways to study

Study CKAD by domain

Study CKAD by topic

Application Design and Build practice questions

Application Deployment practice questions

Application Environment, Configuration and Security practice questions

Application Observability and Maintenance practice questions

Services and Networking practice questions

CKAD fundamentals practice questions

CKAD scenario practice questions

CKAD troubleshooting practice questions

Top CKAD questions

Certified Kubernetes Application Developer CKAD practice questions

How to use these CKAD questions

Quick answer