Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A security audit has flagged that several application pods are running as the root user, which violates the organization. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A security audit has flagged that several application pods are running as the root user, which violates the o…
- You are managing an Ingress resource that handles traffic for an internal HR portal. To secure the communicat…
- An engineering team is managing a multi-tenant cluster where the 'payment-processing' namespace handles highl…
- A distributed application consists of a 'frontend' deployment and a 'database' deployment in the same namespa…
- A deployment of 'v1.0.0' of a web application is currently running with 5 replicas. The development team want…
- In a multi-tenant cluster, the 'marketing' team is complaining that their pods are being evicted because the…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A security audit has flagged that several application pods are running as the root user, which violates the organization's hardening standards. You are tasked with updating the deployment for a Python web app to ensure that it runs with th…
Answer: C. A securityContext block at the container level defining runAsUser, runAsGroup, and allowPrivilegeEscalation: false.
The container-level securityContext is the correct block because it directly defines runAsUser, runAsGroup, and allowPrivilegeEscalation to enforce these specific runtime constraints. A NetworkPolicy or RBAC bindings cannot enforce user IDs or prevent privilege escalation inside a running container.
Q2. You are managing an Ingress resource that handles traffic for an internal HR portal. To secure the communication, you have been provided with a TLS certificate and a private key. You have already created a Secret named 'hr-tls-secret' cont…
Answer: C. Update the Ingress specification by adding a 'tls' block that specifies the hosts and references the 'hr-tls-secret' name.
Adding a TLS block to the Ingress specification referencing the existing Secret enables TLS termination for the specified host. You do not need to modify the Service or manually mount certificate volumes into the Ingress controller deployment.
Q3. An engineering team is managing a multi-tenant cluster where the 'payment-processing' namespace handles highly sensitive transactions. A new compliance rule dictates that pods with the label 'role: backend' in this namespace should only ac…
Answer: B. A NetworkPolicy with an ingress rule that selects 'role: frontend' pods and specifies port 443 under the 'role: backend' pod selector
A NetworkPolicy isolates the backend pods by selecting them and defining an ingress rule that permits traffic only from the frontend pod selector on TCP port 443. RBAC roles control API permissions rather than network access between pods.
Q4. A distributed application consists of a 'frontend' deployment and a 'database' deployment in the same namespace. To comply with internal security standards, the database must be isolated so that it only accepts incoming connections on TCP…
Answer: C. Create a NetworkPolicy with an ingress rule matching the frontend podSelector and a port 5432
A NetworkPolicy applied to the database pods with an ingress rule restricting port 5432 to the frontend pod selector effectively isolates the database. By default, NetworkPolicies allow egress traffic unless specifically restricted, so cluster DNS remains accessible.
Q5. A deployment of 'v1.0.0' of a web application is currently running with 5 replicas. The development team wants to deploy 'v2.0.0' using a strategy that ensures at least 4 replicas are always available to handle traffic, and no more than 7…
Answer: C. Set maxUnavailable to 1 and maxSurge to 2 to maintain the required availability and resource usage limits during the update.
Configuring maxUnavailable to 1 ensures 4 replicas stay available, while maxSurge set to 2 limits the maximum total replicas to 7 during the rollout. Using percentages introduces fractional replicas and unpredictable scaling limits.
Q6. In a multi-tenant cluster, the 'marketing' team is complaining that their pods are being evicted because the 'data-science' team's pods are consuming all available CPU on the nodes. You need to implement a solution in the 'data-science' na…
Answer: D. A LimitRange to set default and maximum constraints on individual pods and a ResourceQuota to limit the total namespace usage.
A LimitRange enforces the maximum CPU limit per individual pod, while a ResourceQuota caps the total aggregate CPU usage across the namespace. PodSecurityPolicies are deprecated, and NetworkPolicies do not restrict compute resource consumption.
Q7. A data science team is running intensive Python scripts in a shared cluster. Occasionally, these scripts consume all available memory on a node, causing other critical system components to fail or enter an unstable state. You must enforce…
Answer: C. Configure the memory limits field to 2Gi in the container's resource specification
Setting the container memory limits field to 2Gi triggers an Out Of Memory kill if the application attempts to exceed that threshold. A ResourceQuota caps total namespace usage rather than terminating individual offending pods.
Q8. A data science team needs to run a large-scale data transformation task consisting of 50 independent chunks of data. Each chunk takes about 5 minutes to process. To finish the entire task as quickly as possible without overwhelming the clu…
Answer: B. Set completions: 50 and parallelism: 5 in the Job specification
The correct answer uses completions for the total successful pods and parallelism for the concurrent workers. Do not confuse this with Deployments, which use replicas for steady-state services.
Q9. A high-performance computing task involves processing 100 independent data chunks. Each chunk takes about 5 minutes to process. To meet a strict deadline, the DevOps team decides to use a Kubernetes Job that can process multiple chunks in…
Answer: B. Set completions to 100 and parallelism to 10 to ensure a steady state of 10 concurrent workers
The correct answer sets completions to the total desired successes and parallelism to the concurrent worker count. Avoid swapping these values or mixing in activeDeadlineSeconds, which only sets a timeout.
Q10. A security auditor has mandated that a specific Pod named 'payment-processor' in the 'finance' namespace must be restricted at the network level. The Pod is allowed to send traffic to an internal legacy database located at the IP address 1…
Answer: D. Specify an egress rule with a to block containing an ipBlock for 10.50.0.22/32
The correct answer uses an egress rule with an ipBlock targeting the database IP. Once an egress policy applies, Kubernetes isolates the pod and blocks all unspecified outbound traffic.
Q11. A cluster is running at near-full capacity with several background data-processing Pods. A critical 'emergency-alert' Pod must be deployed immediately and guaranteed to run, even if it means terminating existing low-priority Pods to free u…
Answer: A. Assign the 'priorityClassName: high-priority' field in the Pod's spec to indicate its importance to the Kubernetes scheduler
The correct answer assigns the priorityClassName field in the pod spec. The scheduler uses this exact field to determine priority and evict lower-priority workloads, whereas labels and autoscalers do not trigger preemption.
Q12. Your organization is deploying a microservice that requires access to a sensitive database password and a shared configuration file containing API endpoints. According to the strict security policy, sensitive information must not be expose…
Answer: D. Mount the Secret and ConfigMap as separate volumes and use volumeMounts to map them to the specific directory paths
Mounting Secrets and ConfigMaps as volumes projects the data as files at the specified paths. Using envFrom would inject values as environment variables, violating the strict security policy.
Q13. A complex Java-based microservice takes approximately 90 seconds to initialize its internal cache and establish connections to backend databases. During the deployment process, the developer notices that Kubernetes restarts the container s…
Answer: C. Replace the livenessProbe with a startupProbe that has a sufficient failureThreshold and periodSeconds for the 90-second delay.
A startupProbe correctly disables liveness checks during initialization, preventing premature restarts for slow-starting apps. Relying only on livenessProbe delays risks killing the container before it fully boots.
Q14. A high-traffic e-commerce platform uses a legacy binary that outputs internal transaction logs to a local file system path /opt/app/logs/output.log. The platform team needs to stream these logs to a central Fluentd collector without alteri…
Answer: A. Deploy a sidecar container sharing an emptyDir volume with the main application to tail the log file to stdout.
A sidecar container sharing an emptyDir volume correctly tails the log file and streams it to stdout. This pattern extends the main container's functionality without modifying its source code or image.
Q15. You are investigating a performance issue in a shared development namespace. One application container is consuming an excessive amount of CPU, which is starving other critical development tools in the same namespace. To prevent this 'nois…
Answer: B. A LimitRange object defined within the namespace to set default requests and limits for CPU and Memory.
A LimitRange is the correct object to automatically enforce default CPU and memory limits for individual containers. A ResourceQuota caps total namespace usage but does not assign default limits per pod.
Q16. A data processing application needs to process a backlog of 100 files stored in an S3 bucket. To optimize performance, the team wants to run exactly 5 worker pods simultaneously until all 100 files are processed. Each pod processes one fil…
Answer: C. Define a Job with completions: 100 and parallelism: 5 to manage the lifecycle of the worker pods.
A Job specifically manages batch tasks using parallelism to limit concurrent pods and completions to set the total success count. Deployments and ReplicaSets are meant for long-running services, not tasks that terminate after processing.
Q17. A security policy requires that all Pods in the 'finance-prod' namespace must follow the 'Restricted' Pod Security Standard. Specifically, the application must run with a non-root user, must not be allowed to escalate its privileges, and m…
Answer: A. runAsNonRoot: true, allowPrivilegeEscalation: false, and readOnlyRootFilesystem: true
This combination directly enforces non-root execution, prevents privilege escalation, and makes the root filesystem immutable. Option C misses the required read-only filesystem, and Option B adds unnecessary complexity without meeting all criteria.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.