Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An application requires a configuration file named app-config.yaml to be present in the directory /etc/myapp/. However, . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An application requires a configuration file named app-config.yaml to be present in the directory /etc/myapp/…
- A legacy monitoring agent is deployed as a container within a Pod. This agent communicates using an unencrypt…
- You are configuring an Ingress resource to manage traffic for a SaaS platform. The requirement is that traffi…
- An application pod named 'report-worker' in the 'analytics' namespace needs to be able to list all other pods…
- A security administrator requires that the processor container in the compliance namespace is hardened to mit…
- A data processing task is implemented as a Kubernetes Job. This task is prone to occasional network timeouts…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An application requires a configuration file named app-config.yaml to be present in the directory /etc/myapp/. However, this directory already contains other critical files generated at runtime. When you try to mount a ConfigMap to this pa…
Answer: B. Use the subPath property within the volumeMounts section to mount only the specific key from the ConfigMap to the desired file path.
The subPath property mounts a single file from a volume without masking the existing files in the target directory. Standard volume mounts always overlay the entire directory, which is why your runtime files disappear.
Q2. A legacy monitoring agent is deployed as a container within a Pod. This agent communicates using an unencrypted protocol on port 8080 and cannot be modified to support encryption. For compliance reasons, all traffic leaving the Pod must be…
Answer: D. Set the legacy agent to send traffic to localhost on port 443 where the sidecar container is listening and encrypting
Containers in the same pod share a network namespace, so routing localhost traffic to the proxy port works seamlessly. This intercepts the payload locally, allowing the sidecar to encrypt the outbound traffic.
Q3. You are configuring an Ingress resource to manage traffic for a SaaS platform. The requirement is that traffic sent to 'app.example.com/api' must be routed to a Service named api-service on port 8080, while traffic sent to 'app.example.com…
Answer: D. Use a single Ingress resource with a host 'app.example.com' and a list of paths under the 'http' section, each mapping to its respective service.
A single Ingress resource efficiently handles multiple paths for a single host by mapping each path to a specific backend. Creating multiple Ingress resources for the same host often causes controller conflicts and unnecessary routing complexity.
Q4. An application pod named 'report-worker' in the 'analytics' namespace needs to be able to list all other pods in the same namespace to coordinate a distributed task. When the application starts, it receives a '403 Forbidden' error from the…
Answer: C. Create a Role with 'list' permissions for 'pods', a ServiceAccount for the worker, and a RoleBinding to link them.
Creating a dedicated ServiceAccount bound to a namespace Role via a RoleBinding grants strictly scoped API access. Assigning cluster-admin grants excessive permissions, violating security best practices and creating dangerous cluster-wide risks.
Q5. A security administrator requires that the processor container in the compliance namespace is hardened to mitigate potential privilege escalation. The application must run with a specific non-root user ID 1001, and the container should be…
Answer: C. Define a securityContext with runAsUser 1001, allowPrivilegeEscalation set to false, and readOnlyRootFilesystem set to true
The securityContext configures runtime security at the pod or container level, directly enforcing the required user ID, blocking privilege escalation, and mounting the root filesystem as read-only. PodSecurityPolicy was removed and is no longer valid.
Q6. A data processing task is implemented as a Kubernetes Job. This task is prone to occasional network timeouts, but it is idempotent and can be safely retried. Your management wants to ensure that the Job is not abandoned after the first fai…
Answer: D. Configure 'backoffLimit: 4' in the Job specification to allow for 4 retries (total of 5 attempts) before the Job is considered failed.
The backoffLimit specifies the number of retries before a Job fails. Setting it to 4 allows the initial attempt plus four retries, resulting in exactly five total attempts. The activeDeadlineSeconds limits duration, not attempt counts.
Q7. A data processing company uses a Kubernetes Job to run heavy extract-transform-load (ETL) tasks. The Job is configured to process 100 data chunks in total. To optimize performance, the team wants to ensure that 10 chunks are being processe…
Answer: A. Set completions: 100, parallelism: 10, and backoffLimit: 5.
The completions, parallelism, and backoffLimit fields directly map to total chunks, simultaneous workers, and failure retries. Other options confuse these parameters or introduce unrelated concepts like CronJobs and active deadlines.
Q8. A financial institution is deploying a high-security transaction processing application. The infrastructure team has designated a specific set of worker nodes with hardware-level encryption as dedicated resources for this application. Thes…
Answer: A. Add a Toleration for the security taint and implement a nodeAffinity rule with a requiredDuringSchedulingIgnoredDuringExecution constraint.
Tolerations allow pods to be scheduled on tainted nodes, while nodeAffinity enforces placement based on specific hardware labels. This combination ensures strict targeting compared to the more basic nodeSelector.
Q9. An engineering lead requires that during the update of the web-portal deployment, which currently runs 10 replicas, the update process must be strictly controlled. The total number of pods during the transition must never exceed 12 to avoi…
Answer: D. Specify a strategy with maxSurge set to 2 and maxUnavailable set to 1 in the RollingUpdate configuration block
MaxSurge controls how many pods exceed the desired count, so two allows exactly twelve. MaxUnavailable dictates the drop ceiling, so one keeps nine pods available. Other percentages or values violate the stated resource constraints.
Q10. An engineering team is deploying a clustered database using a Kubernetes StatefulSet. Each member of the cluster requires a stable, predictable network identity (e.g., mongodb-0.mongodb-service) to perform internal synchronization and lead…
Answer: C. Create a Headless Service by setting the clusterIP field to None in the Service specification.
A Headless Service, created by setting clusterIP to None, skips assigning a virtual IP. DNS returns individual Pod IPs instead, enabling direct peer discovery required for StatefulSet databases. Standard Services blindly load-balance traffic.
Q11. A financial services company is migrating its client-portal frontend application to a Kubernetes cluster. The application must interact with an on-premises legacy SOAP backend that requires strict MTLS authentication and utilizes a proprie…
Answer: B. Utilizing an ambassador container that acts as a local proxy to handle complex communication with the external legacy system
The ambassador pattern is specifically designed to provide a local proxy for the main container to reach external services. This abstracts the complexity of mutual TLS and proprietary encryption away from the primary application code.
Q12. Your company uses an Ingress controller to expose several services. You need to configure a single Ingress resource that routes traffic coming to 'api.example.com/v1' to a service named 'api-v1-service' and traffic coming to 'api.example.c…
Answer: D. Use a single rule with the host 'api.example.com' and a list of two paths under the 'http' section, each pointing to their respective service.
An Ingress rule for a specific host can contain multiple paths under the paths section. Each path specifies a path type and a backend, which is the standard for path-based routing.
Q13. You are managing a microservices-based application where a 'payment-service' and a 'logger-service' reside in the same namespace. Corporate security policy dictates that the 'payment-service' should only be able to receive traffic from the…
Answer: A. Apply a NetworkPolicy that selects the payment-service pods and defines an ingress rule allowing only pods with the label 'app=frontend'.
Network policies act as a firewall for pods. By creating a policy that selects the payment service and only allows traffic from pods labeled app=frontend, all other internal traffic is implicitly denied.
Q14. Your organization wants to implement a Blue-Green deployment strategy for a stateless API. Version blue is currently receiving traffic via a Service named api-service using the label version: blue. You have deployed version green and verif…
Answer: A. Update the selector in the Service manifest to match the labels of the green deployment
Changing the service selector is the standard way to perform a blue-green switch in Kubernetes. Traffic is immediately routed to the new pods without changing the service IP.
Q15. An application named 'secure-processor' needs to access two different types of sensitive information: a static API key that rarely changes and a temporary session token that is rotated every 15 minutes by an external security vault. The se…
Answer: A. Store the API key in a Secret and mount it as a volume, and use a CSI driver (like HashiCorp Vault) to mount the session token as an in-memory volume.
Secrets are intended for sensitive data and are backed by temporary storage in modern Kubernetes. Using a specialized driver for the rapidly rotating token ensures it is fetched directly from the vault and never touches the disk.
Q16. Your team is managing a production Deployment named 'api-gateway' which currently runs 10 replicas. Due to strict Service Level Objectives (SLOs), the application must always have at least 80% of its desired capacity available during a rol…
Answer: D. Set maxUnavailable to 2 and maxSurge to 2 in the strategy section.
Setting max unavailable to 2 ensures at least 8 pods are running, meeting the 80% availability requirement. Setting max surge to 2 allows up to 12 pods total, perfectly matching the resource constraints.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.