Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A developer needs to inject 50 different configuration parameters from a ConfigMap named 'app-settings' into a container. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A developer needs to inject 50 different configuration parameters from a ConfigMap named 'app-settings' into…
- Your team is building a client-side microservice that must communicate with a remote legacy banking API. The…
- An enterprise legacy application is being containerized. It is designed to listen only on the loopback interf…
- A batch processing system needs to handle 100 independent work items. Each item takes about 30 seconds to pro…
- A security-sensitive application requires two specific TLS certificate files, 'tls.crt' and 'tls.key', to be…
- An analytics company needs to process a batch of 100 historical data files. Each file takes roughly 5 minutes…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A developer needs to inject 50 different configuration parameters from a ConfigMap named 'app-settings' into a container. The developer wants to ensure that if new parameters are added to the ConfigMap in the future, they are automatically…
Answer: D. Use the envFrom field in the container specification and reference the app-settings ConfigMap via configMapRef.
Using envFrom with configMapRef populates the environment with all current ConfigMap keys. Listing individual keys is tedious and requires manifest updates whenever new configuration parameters are introduced.
Q2. Your team is building a client-side microservice that must communicate with a remote legacy banking API. The remote API requires every request to be authenticated via a mutual TLS (mTLS) handshake with a unique certificate. To avoid embedd…
Answer: A. Deploy an Ambassador container in the same Pod that accepts plain HTTP traffic from the main container on localhost and proxies it to the API using mTLS.
The Ambassador pattern uses a helper container to proxy outbound requests and offload complex configurations. Because containers share a network namespace, the application sends plain local traffic, which the Ambassador secures.
Q3. An enterprise legacy application is being containerized. It is designed to listen only on the loopback interface (127.0.0.1) for security reasons and cannot be reconfigured to listen on all interfaces (0.0.0.0). However, the application mu…
Answer: D. Containers in the same Pod share the same Network namespace, allowing them to communicate via 'localhost' and share the same IP address
Containers within a Pod share the same network namespace and IP address. This allows the sidecar to listen on external interfaces and forward incoming cluster traffic to the loopback application locally.
Q4. A batch processing system needs to handle 100 independent work items. Each item takes about 30 seconds to process. To finish the work quickly without overwhelming the cluster, the system should process 10 items at a time. If a specific tas…
Answer: B. Set completions to 100, parallelism to 10, and backoffLimit to 5 in the Job specification.
Setting completions to 100 and parallelism to 10 properly distributes the workload, while backoffLimit handles the retries. Avoid using Deployments for batch processing, as they lack native completion tracking.
Q5. A security-sensitive application requires two specific TLS certificate files, 'tls.crt' and 'tls.key', to be present in the /etc/certs directory. These files are stored in a Kubernetes Secret named 'api-certs'. The application is designed…
Answer: D. Mount the Secret using a volume with a defaultMode of 0400 and specify the mountPath as /etc/certs in the volumeMounts section.
Using defaultMode 0400 restricts file access to the owning user, satisfying the strict security requirement. Environment variables do not mount as files, and hostPath volumes are not recommended for secrets.
Q6. An analytics company needs to process a batch of 100 historical data files. Each file takes roughly 5 minutes to process, and the entire task must be completed as quickly as possible. The processing script is packaged in a container that t…
Answer: B. Set the completions field to 100 and the parallelism field to 10 to control the total work and the number of concurrent pods.
The completions field defines the total successful pods needed, and parallelism dictates how many run concurrently. Swapping the values would create ten completions running one hundred pods at once.
Q7. A data-processing Pod that writes temporary files to a volume. The container runs as a non-root user with UID 1001. The volume being mounted requires the files to be owned by a specific Group ID (GID 2000) for the storage backend to permit…
Answer: A. Set fsGroup to 2000 and runAsUser to 1001 in the Pod's securityContext, and set allowPrivilegeEscalation to false in the container's securityContext.
Setting fsGroup ensures the mounted storage is writable by the specified group, while allowPrivilegeEscalation blocks setuid exploits. Init containers are less ideal because they require manual permission changes.
Q8. A microservice named inventory-api is experiencing intermittent failures where it remains in a Running state but stops responding to HTTP requests because of an internal deadlock. The application exposes a health check endpoint at /healthz…
Answer: D. Configure a Liveness Probe with periodSeconds set to 10 and failureThreshold set to 3
A Liveness Probe detects deadlocks and triggers a container restart after three failed attempts. A Readiness Probe only removes the Pod from service endpoints, but it does not restart the stuck container.
Q9. Your organization is moving a web application to Kubernetes, but the SQL database remains on a legacy on-premises server with the static IP 10.50.10.25. You want the application to use the hostname 'db-service' so that when the database is…
Answer: A. Define a Service with no selector and manually create an Endpoints object pointing to the IP 10.50.10.25
Creating a selectorless Service with a manual Endpoints object provides a stable internal DNS record for external IPs. Ingress resources are intended for HTTP routing to cluster services, not proxying external databases.
Q10. You are managing a multi-tenant cluster where the 'payment-prod' namespace contains sensitive transaction APIs and the 'frontend-prod' namespace contains the web interface. To follow the principle of least privilege, you need to ensure tha…
Answer: C. A NetworkPolicy in the payment-prod namespace with an Ingress rule combining a namespaceSelector for frontend-prod and a podSelector for role: web-ui.
Applying an Ingress NetworkPolicy in the target namespace isolates those Pods, and combining selectors restricts access precisely. A podSelector alone would allow traffic from any namespace matching the labels.
Q11. A high-performance analytics application needs to register its unique Pod IP with an external legacy monitoring system immediately after the container starts. The development team wants to ensure this registration script runs as soon as th…
Answer: A. Configure a postStart lifecycle hook within the container specification to execute the registration script.
The postStart hook executes immediately after the container is created, handling registration without modifying the image. Init containers run before the main container starts, so they cannot access its environment.
Q12. A legacy Java application is known to experience occasional internal deadlocks. During these deadlocks, the process continues to run and the TCP port remains open, but the application stops responding to functional requests at the '/health…
Answer: B. Define a Startup Probe targeting the /health endpoint and a Liveness Probe that starts only after the Startup Probe succeeds
A Startup Probe protects slow-starting applications by disabling Liveness checks until the container is ready. Relying on initialDelaySeconds requires guessing the exact startup time, risking premature container restarts.
Q13. A data analytics application requires a large static lookup dataset of approximately 2GB to be downloaded from a secure remote storage and unpacked into a shared directory before the main compute engine starts. The main container is a high…
Answer: D. Define an initContainer that uses a utility-rich image to download and unpack the data into an emptyDir volume shared with the main application container.
Init containers run sequentially before the main application, making them perfect for preparing shared volumes with required tools. Sidecars run concurrently, risking application crashes if the data is not yet available.
Q14. A developer is attempting to deploy a new microservice in the 'development' namespace. The Deployment manifest requests 2 CPU cores and 4Gi of memory for each of its 3 replicas. However, the Pods remain in a 'Pending' state. Upon inspectio…
Answer: A. The total memory request (12Gi) plus existing usage (2Gi) exceeds the namespace quota of 10Gi. You should reduce the replicas or the memory requests per Pod.
The Deployment requests 12Gi of memory, which exceeds the 10Gi namespace quota when combined with the 2Gi already in use. ResourceQuotas strictly enforce total namespace consumption. Increasing node capacity does not override namespace quotas.
Q15. You are managing a critical web application and need to restrict network traffic for a specific Pod named 'api-server' in the 'prod' namespace. The Pod should only be allowed to communicate with the CoreDNS service in the 'kube-system' nam…
Answer: B. Define an egress NetworkPolicy with two rules: one matching the kube-system namespace and DNS port, and another matching the data namespace and database port.
Defining an egress network policy with specific namespace and port selectors restricts outbound traffic precisely to DNS and database endpoints. Any egress traffic not explicitly matched by these rules is automatically blocked, ensuring strict network isolation.
Q16. A legacy stateful application is being deployed via a Deployment controller and uses a PersistentVolumeClaim (PVC) backed by a storage class that only supports the ReadWriteOnce (RWO) access mode. During a rolling update, the new Pods are…
Answer: D. Configure the strategy type of the Deployment to Recreate to ensure all old Pods are terminated before the new version is scheduled.
The Recreate strategy terminates all existing Pods before starting the new ones, ensuring the RWO volume is fully released. Remember that RollingUpdate is the default, but it fails here because it tries to run the new Pod concurrently.
Q17. A data analytics application requires a 2GB lookup table to be present on the local disk before the main process starts. This file must be downloaded from a remote HTTPS server. To keep the production container image lightweight, you decid…
Answer: B. Add an InitContainer with a lightweight image containing 'wget' to download the file into a shared EmptyDir volume that is also mounted by the main container.
Init containers run to completion before the main application container starts, making them perfect for setup tasks. By saving the file to a shared EmptyDir volume, the main container immediately accesses the required data.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.