Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An application pod 'order-processor' takes a long time (about 2 minutes) to initialize its internal database cache. Duri. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An application pod 'order-processor' takes a long time (about 2 minutes) to initialize its internal database…
- You are managing a sensitive financial application in the 'finance-app' namespace. The architecture includes…
- You are deploying a security-sensitive application that produces operational metrics in a legacy text format…
- A web application occasionally experiences a localized failure where the main process enters a deadlock. In t…
- A distributed processing application requires a Redis cache to be fully reachable and responding to pings bef…
- A security architect requires that a multi-container Pod in the compliance namespace, which runs as a non-roo…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An application pod 'order-processor' takes a long time (about 2 minutes) to initialize its internal database cache. During this time, the application process is running, but it cannot yet handle requests or pass a liveness check. If a live…
Answer: C. Configure a Startup Probe with a failureThreshold and periodSeconds that cover the 2-minute window
Startup probes disable liveness and readiness checks until the application fully initializes, preventing the kubelet from prematurely restarting slow-starting containers. Setting a high initialDelaySeconds on a liveness probe is a legacy workaround that fails if application startup times vary or take longer than expected.
Q2. You are managing a sensitive financial application in the 'finance-app' namespace. The architecture includes a 'frontend' deployment, a 'backend' deployment, and a 'postgres-db' deployment. To comply with security audits, you must implemen…
Answer: A. Define an Ingress policy for the 'postgres-db' pods with a podSelector matching the backend and a ports section for TCP 5432.
An ingress network policy isolating the database pods explicitly permits traffic only from the backend pods on port 5432. Defining an empty podSelector would inadvertently allow traffic from all pods in the namespace, violating the strict security requirement.
Q3. You are deploying a security-sensitive application that produces operational metrics in a legacy text format. A central monitoring system requires these metrics to be converted into a specific JSON format before transmission. You must impl…
Answer: D. Implement an Adapter container that reads the legacy log files from a shared volume and serves them in the required JSON format via a local endpoint.
The adapter pattern standardizes output by transforming a legacy application format into a required interface, like JSON. This specialized sidecar handles the translation logic without modifying the primary container image, unlike init containers which only run during startup.
Q4. A web application occasionally experiences a localized failure where the main process enters a deadlock. In this state, the container remains running and the process is visible in the task list, but it fails to respond to any incoming HTTP…
Answer: A. Define a Liveness Probe that performs an HTTP GET request against the /healthz endpoint on port 8080
An HTTP liveness probe detects application deadlocks and automatically restarts the unresponsive container to restore service. A readiness probe would only remove the pod from service endpoints, but it would not initiate a restart to fix the underlying deadlock.
Q5. A distributed processing application requires a Redis cache to be fully reachable and responding to pings before the main 'worker' container starts. If the worker starts before Redis is ready, it enters a fatal crash state and requires a m…
Answer: B. Define an InitContainer that runs a shell script to loop until the Redis service hostname is resolvable and reachable
An init container runs to completion before the main application container starts, making it perfect for blocking startup until dependencies are ready. Sidecar containers run concurrently, which would not prevent the main worker from crashing if Redis is unavailable.
Q6. A security architect requires that a multi-container Pod in the compliance namespace, which runs as a non-root user with UID 5000, must be able to write to a shared PersistentVolumeClaim. The volume is mounted at /data, but the underlying…
Answer: A. Set the fsGroup field within the Pod SecurityContext to 5000 to allow the volume to be owned by that group
Setting the fsGroup in the pod security context ensures the kubelet automatically adjusts volume ownership, allowing the non-root user to write files. Using privileged mode or temporarily running as root violates security requirements.
Q7. A microservices application consists of a web frontend and a backend API. The backend API requires a database schema migration to be completed before the application logic can safely start processing requests. The migration is handled by a…
Answer: A. Define an InitContainer in the Pod spec that runs the migration script and exits with a zero status code
Init containers run sequentially to completion before the main application container starts, ensuring database migrations finish safely. A postStart hook executes concurrently with the main application, creating a race condition if it runs at the same time.
Q8. Cross-Namespace Network Isolation. Your organization has a strict security mandate for a multi-tenant cluster. A microservice named 'billing-app' located in the 'finance' namespace must be allowed to receive incoming traffic from the 'fron…
Answer: B. Define a NetworkPolicy in the finance namespace using an ingress rule that combines a namespaceSelector for 'public-facing' and a podSelector for 'frontend-proxy'.
To allow traffic from specific pods in another namespace, combine namespaceSelector and podSelector inside the same rule element. Leaving out the namespaceSelector would incorrectly allow traffic from matching pods in any namespace.
Q9. A security audit has identified that all Pods in the public-facing namespace have a ServiceAccount token mounted by default at /var/run/secrets/kubernetes.io/serviceaccount. Your frontend application does not need to communicate with the K…
Answer: A. Set the automountServiceAccountToken field to false in the Pod spec or the ServiceAccount resource
Setting automountServiceAccountToken to false explicitly prevents the kubelet from injecting API credentials. Deleting the default ServiceAccount is not allowed, as Kubernetes automatically manages it.
Q10. A multi-tenant SaaS application uses an Ingress controller to route traffic to different customer backends. Two customers, 'Alpha' and 'Beta', require their own custom SSL certificates for alpha.saas.com and beta.saas.com respectively. You…
Answer: D. Specify a 'tls' list in the Ingress spec with two entries, each mapping the specific 'hosts' to their respective 'secretName'.
The Ingress tls field accepts an array of host and secret pairs, enabling SNI for multiple domains. Using two separate Ingress resources is unnecessary and misses the benefit of consolidating routing rules.
Q11. You are deploying an Ingress resource to manage traffic for your company's payment portal. The portal must be accessible via HTTPS at 'payments.example.com'. You have already created a Kubernetes Secret named 'tls-secret' containing the va…
Answer: A. Define a 'tls' block in the Ingress spec containing the 'hosts' list with 'payments.example.com' and the 'secretName' as 'tls-secret'
The tls section maps hosts to a specific secret containing the private key and certificate. Configuring a sidecar is unnecessary overhead since the Ingress controller is built to handle TLS termination.
Q12. A network security tool needs to be deployed as a Pod in your cluster. The container needs to run as a non-root user for security compliance, but it specifically requires the ability to capture network packets using raw sockets (NET_RAW) a…
Answer: A. Add NET_RAW and NET_ADMIN to the capabilities list within the securityContext of the container specification
The capabilities field inside securityContext grants fine-grained Linux kernel privileges, so you add only NET_RAW and NET_ADMIN without running as fully privileged. Avoid setting privileged: true, because it completely undermines the non-root compliance requirement.
Q13. Your organization uses a Kubernetes CronJob to perform financial reconciliation every Sunday at 02:00. Recently, some jobs have been failing due to external API timeouts. For forensic and auditing purposes, the finance team needs to see th…
Answer: B. Set 'failedJobsHistoryLimit' to 10 in the CronJob spec to prevent the controller from cleaning up failed Job objects too quickly.
The failedJobsHistoryLimit field explicitly controls how many failed Job objects remain before garbage collection. The successfulJobsHistoryLimit only retains successful executions, which fails the auditing requirement for failed runs.
Q14. An application pod requires access to a TLS certificate and a private key stored in a Secret named 'web-certs'. For security compliance, the certificate file 'cert.pem' from the Secret must be mounted at the path '/etc/certs/public.crt' an…
Answer: D. Use a secret volume and define the 'items' field to map the specific keys 'cert.pem' and 'key.pem' to their respective relative paths.
Using a secret volume with the items array lets you map specific keys to custom relative paths while excluding other files. Mounting the entire Secret would expose sensitive files unnecessarily, violating the strict compliance requirement.
Q15. A Java-based microservice named legacy-processor takes approximately 45 seconds to load its internal cache from a database before it can handle any traffic. If the application receives requests before this cache is loaded, it returns a 500…
Answer: D. Use a StartupProbe with a failureThreshold of 10 and a periodSeconds of 10 to cover the 45-second boot time, followed by Liveness and Readiness probes.
A StartupProbe protects slow-booting applications by disabling Liveness and Readiness checks until it succeeds. Relying only on initialDelaySeconds is brittle, because actual startup times often vary unpredictably under heavy load.
Q16. An engineering team is deploying a legacy application that needs to connect to a highly distributed Redis cluster with multiple shards. The application was originally designed to connect only to a single database endpoint and cannot handle…
Answer: B. Deploy an Ambassador container within the same Pod to act as a local proxy for the database sharding logic
An Ambassador container acts as a local proxy inside the Pod, handling complex external routing logic like database sharding. This offloads the work from the legacy application without requiring any modifications to its source code.
Q17. A batch processing Job named 'data-migration' is failing because the container image has a bug that causes a segmentation fault on startup. You notice that the cluster is repeatedly attempting to run this Job, creating new Pods every few s…
Answer: C. Configure the 'backoffLimit' field in the Job spec to 4 to define the maximum number of retries before the Job is marked as failed
The backoffLimit field defines the exact number of retries allowed before the Job controller marks it as failed. The activeDeadlineSeconds parameter restricts total execution time but fails to reliably limit the number of failed Pod attempts.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.