Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A DevOps engineer is hardening a containerized Python application that processes user-uploaded images. The container mus. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A DevOps engineer is hardening a containerized Python application that processes user-uploaded images. The co…
- You are configuring an Ingress resource to route traffic for a corporate portal. The requirement is that all…
- An application requires a specific configuration file, 'extra-settings.json', to be located in the directory…
- A high-performance trading platform is deploying a new microservice called trade-validator in a production cl…
- You are configuring an Ingress resource to host a multi-service web application. Requests to 'portal.example…
- Your organization is migrating a legacy monolithic application that needs to communicate with an external clo…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A DevOps engineer is hardening a containerized Python application that processes user-uploaded images. The container must not run as the root user for security reasons. Additionally, the application requires the capability to bind to a pri…
Answer: C. Apply runAsUser: 1000, readOnlyRootFilesystem: true, and add the NET_BIND_SERVICE capability in the securityContext of the container.
Setting a non-root user and a read-only root filesystem meets baseline security requirements. Adding the NET_BIND_SERVICE capability explicitly permits the non-root process to bind to privileged ports like 443.
Q2. You are configuring an Ingress resource to route traffic for a corporate portal. The requirement is that all requests starting with '/static' must be sent to the 'assets-service', while all other requests (the catch-all) should be directed…
Answer: A. Set the path to '/static' with a pathType of 'Prefix' for the assets-service.
Prefix path type matching routes any request that begins with the defined path. Exact path type would require a perfectly matching URL, and ImplementationSpecific relies on custom controller logic.
Q3. An application requires a specific configuration file, 'extra-settings.json', to be located in the directory '/app/config/'. This directory is already populated with several other system-critical files during the image build process. You h…
Answer: B. Utilize the 'subPath' property within the 'volumeMounts' section to map the specific key from the ConfigMap to the exact file path.
Using the subPath property mounts a single file from a volume without obscuring existing files in the target directory. A standard volume mount would hide the original directory contents.
Q4. A high-performance trading platform is deploying a new microservice called trade-validator in a production cluster that hosts multiple other workloads. During periods of extreme market volatility, the nodes hosting the trade-validator pods…
Answer: B. Configure both memory and CPU requests and limits to the exact same values for every container within the pod specification.
Assigning identical CPU and memory requests and limits to every container grants the Guaranteed Quality of Service class. This provides the highest protection against eviction, while a PriorityClass only affects scheduling.
Q5. You are configuring an Ingress resource to host a multi-service web application. Requests to 'portal.example.com/shop' must be routed to the 'shopping-service' on port 80. Requests to 'portal.example.com/admin' must be directed to the 'adm…
Answer: D. Define a single Ingress with a 'tls' section referencing the secret and 'rules' containing multiple paths under the same host.
Defining a single Ingress with a tls section and multiple path rules correctly handles routing and HTTPS termination. Creating separate Ingress resources for the same host often causes controller conflicts, making a single resource the required approach.
Q6. Your organization is migrating a legacy monolithic application that needs to communicate with an external cloud-based logging service. The logging service requires a complex, custom-built authentication handshake and payload encryption tha…
Answer: A. Configure an Ambassador container that acts as a local proxy, allowing the legacy app to send logs to localhost while the proxy handles authentication.
The Ambassador container pattern acts as a local proxy, handling complex external authentication so the main app connects only to localhost. A standard sidecar simply extends functionality, whereas an Ambassador specifically brokers outside connections.
Q7. A high-performance computing task requires processing a static dataset of 500GB that is updated once a week. Because the dataset is too large to include in the container image and is shared by multiple concurrent pods, you must ensure that…
Answer: A. Provision a PersistentVolume (PV) and a PersistentVolumeClaim (PVC) with ReadWriteMany access mode to mount the volume into all pods.
PersistentVolumes and PersistentVolumeClaims provide storage with a lifecycle independent of pods, and ReadWriteMany access allows concurrent mounting. The hostPath and emptyDir options fail the persistence requirement when nodes or pods are recycled.
Q8. An engineering team is deploying a distributed data processing application in a Kubernetes cluster. The main application container requires a specific configuration schema to be present in a local directory before it can start. However, th…
Answer: D. Define an Init Container in the Pod spec to run the specialized tool and write the schema to a shared EmptyDir volume.
Init containers run sequentially and must complete successfully before the main application containers start. Using a postStart hook runs concurrently with the main container, creating a race condition, whereas an init container guarantees the dependency is met.
Q9. A legacy application writes its logs to a file located at /var/log/app.log instead of stdout. To integrate with the cluster's Fluentd-based logging system, you need to deploy a sidecar container in the same Pod that reads this file and str…
Answer: C. Use an emptyDir volume mounted at /var/log in both the application and the sidecar containers
An emptyDir volume provides a temporary shared disk that both containers in the same Pod can mount to read and write files. A persistent volume is unnecessary for temporary logs, and sharing the process namespace is less clean.
Q10. A batch processing job must handle 50 work items. To minimize processing time, the team wants to run 5 instances of the processing logic concurrently. The Job must ensure exactly 50 successful completions before it is considered finished…
Answer: D. Set completions to 50 and parallelism to 5 in the Job's spec section
The completions field defines the total successful pod finishes required, while parallelism controls the active pods at once. Replicas are used for Deployments, not run-to-completion batch Jobs.
Q11. A development team is working in a shared namespace called 'dev-sandbox'. Recently, some resource-heavy containers have been causing node pressure, leading to the eviction of smaller, critical management Pods. You have been asked to implem…
Answer: B. Create a ResourceQuota to limit total namespace usage and a LimitRange to provide default requests and limits for individual containers.
A ResourceQuota caps the total aggregate resources consumed within a namespace, while a LimitRange applies default bounds to individual containers. PriorityClasses only handle eviction order during node pressure and do not restrict total namespace limits.
Q12. A corporate security policy mandates that no container should ever run with administrative privileges or as the root user. You are deploying a web server that by default runs as UID 0. You need to modify the Pod specification to force the…
Answer: A. Add a securityContext block with runAsUser set to 1001 and allowPrivilegeEscalation set to false
The securityContext block directly enforces runtime constraints, letting you set the user ID and disable privilege escalation. Rebuilding the image fails because Kubernetes configurations must override image defaults to guarantee the security policy at runtime.
Q13. A developer is deploying a Pod that runs as a non-root user (UID 1000). The container needs to write logs to a PersistentVolume mounted at '/var/log/app'. However, the volume is provisioned with root-only write permissions by the storage p…
Answer: D. Set fsGroup: 2000 in the Pod securityContext to change the ownership of the mounted volume to a specific group.
Setting fsGroup in the pod securityContext instructs Kubernetes to modify the mounted volume ownership, granting access to the specified group. Using privileged mode or root introduces severe security risks and violates standard container hardening practices.
Q14. Your organization is migrating a legacy suite of web services to Kubernetes. You need to expose three different internal Services: 'orders-svc' on port 80, 'catalog-svc' on port 80, and 'identity-svc' on port 80. The requirement is to use…
Answer: D. An Ingress resource with path-based rules for /orders and /catalog, and a defaultBackend set to 'identity-svc'.
An Ingress resource manages Layer 7 routing, letting you map specific URL paths to different backend services. The defaultBackend property catches any traffic that does not match your explicit path rules, solving the fallback requirement perfectly.
Q15. A high-traffic web application currently runs 10 replicas under a Deployment named web-prod. You want to test a new version of the application, v2, by sending approximately 10% of the live traffic to it using a canary deployment strategy…
Answer: A. Update the labels of the web-canary pods to match the selector defined in the web-service and ensure the pod labels are identical to web-prod.
Matching pod labels to the existing service selector naturally balances traffic proportionally based on pod count. The Ingress option requires modifying routing rules and creating separate services, which violates the stated restriction.
Q16. A payment-processing microservice named 'secure-pay' in the 'finance-prod' namespace must be restricted for security reasons. Policy dictates that this microservice can only initiate outbound connections to a specific external gateway at t…
Answer: A. An Egress policy with an empty podSelector and an allow rule for the specific IP block and port
A NetworkPolicy is additive, so defining an egress rule for the specific IP and port implicitly blocks all other outbound traffic. NetworkPolicy does not support explicit deny rules, making the sequential rule option invalid.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.