Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization has a strict security policy that allows the 'order-api' pods in the 'sales' namespace to communicate . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- Your organization has a strict security policy that allows the 'order-api' pods in the 'sales' namespace to c…
- A data-intensive microservice in your production environment requires a specific database schema to be initia…
- The platform engineering team is managing a multi-tenant cluster where the 'dev-team-a' namespace has been co…
- Your engineering team is deploying a stateful application that runs as a non-root user with UID 1001 for secu…
- You are managing a deployment where the Pod needs to access only two specific configuration files: 'api-keys…
- An enterprise is migrating a microservice to a Kubernetes cluster while the primary database remains on an on…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization has a strict security policy that allows the 'order-api' pods in the 'sales' namespace to communicate with an external third-party payment gateway at the specific IP address 203.0.113.10. However, for security compliance…
Answer: C. Create a NetworkPolicy with an egress rule using an ipBlock that defines the CIDR 203.0.113.10/32.
Using an ipBlock set to 203.0.113.10/32 permits traffic only to that single IP address. A default deny egress policy then blocks all other subnet traffic, fulfilling the strict security compliance requirements.
Q2. A data-intensive microservice in your production environment requires a specific database schema to be initialized and verified before the primary application process can safely start. If the main process starts before the schema is ready…
Answer: D. Define an Init Container in the Pod specification that runs the verification script and completes before the main container starts
Init containers run sequentially and must complete successfully before the main application containers ever start. Probes do not prevent startup, and sidecars run concurrently, making init containers the correct choice.
Q3. The platform engineering team is managing a multi-tenant cluster where the 'dev-team-a' namespace has been consuming excessive cloud resources by creating an uncontrolled number of Services of type LoadBalancer, leading to significant cost…
Answer: B. Apply a ResourceQuota to the namespace with the 'services.loadbalancers' field set to a value of 3.
ResourceQuotas are used to limit the total number of specific objects within a namespace. LimitRanges constrain individual resource defaults, whereas Network Policies strictly govern pod traffic.
Q4. Your engineering team is deploying a stateful application that runs as a non-root user with UID 1001 for security compliance. This application needs to write data to a PersistentVolume mounted at /data/db. After deployment, the Pod logs sh…
Answer: A. Configure the pod-level securityContext with the fsGroup field set to 1001 to automatically change the ownership of the volume's contents.
Setting fsGroup in the pod security context automatically alters the mounted volume ownership to match the specified group ID. This grants the non-root application user the necessary write permissions without requiring image changes.
Q5. You are managing a deployment where the Pod needs to access only two specific configuration files: 'api-keys.json' and 'runtime-opts.conf'. These values are stored in a ConfigMap named 'app-config-data' which contains over 50 other unrelat…
Answer: A. Mount the ConfigMap as a volume and use the 'items' field to specify only the 'api-keys.json' and 'runtime-opts.conf' keys and their paths
Using the items field within a ConfigMap volume projection specifically filters and mounts only the designated keys. This cleanly prevents unrelated ConfigMap data from cluttering the application filesystem.
Q6. An enterprise is migrating a microservice to a Kubernetes cluster while the primary database remains on an on-premises physical server with the DNS record 'db.internal.company.com'. You need to provide the Pods in the cluster with a consis…
Answer: A. Create a Service of type ExternalName in the same namespace and set the externalName field to 'db.internal.company.com'.
An ExternalName service acts as a DNS alias, seamlessly routing internal cluster requests to an external domain name. This avoids the manual endpoint maintenance required by headless services.
Q7. Your organization has a strict isolation policy. A sensitive database application is running in the 'secure-db' namespace. You must ensure that only Pods located in the 'frontend-apps' namespace are allowed to initiate connections to the d…
Answer: A. A policy in the 'secure-db' namespace with an ingress rule that uses a namespaceSelector matching the 'frontend-apps' labels
NetworkPolicies are applied in the target namespace to control incoming traffic. A namespaceSelector in the ingress rule restricts access so only pods from frontend-apps can connect. Options using podSelector across namespaces fail without exact labels.
Q8. You are conducting a canary deployment for a new version of the 'user-profile' service. You want to route approximately 10% of the traffic to the new version (v2) while keeping 90% on the stable version (v1). Both versions are managed by s…
Answer: C. Label both sets of Pods with 'app=user-profile' and set the v1 Deployment to 9 replicas and the v2 Deployment to 1 replica
Standard Kubernetes Services balance traffic randomly across all matching pods. Matching labels with a nine-to-one replica ratio naturally yields the desired ten percent split. Services do not support assigning custom weights to multiple selectors.
Q9. You are managing a microservice named order-api in the production namespace. The security team has requested a NetworkPolicy that restricts all outbound (egress) traffic. The Pods must only be allowed to communicate with the internal CoreD…
Answer: B. Define an egress rule with an ipBlock allowing 203.0.113.15/32 on port 443, and another rule allowing traffic to the kube-system namespace on port 53.
Egress policies require explicit allowances for all destination IP addresses and ports. Defining an ipBlock for the external gateway and a namespace selector for DNS traffic enforces the required boundaries. Broad allowances violate the strict security request.
Q10. gRPC Health Probes. A specialized microservice uses gRPC for high-performance communication. During peak hours, the application occasionally experiences an internal thread starvation issue where the gRPC server stops responding to new requ…
Answer: D. Define a livenessProbe using the grpc field to specify the port and service name for the built-in Kubernetes gRPC health checking protocol.
A liveness probe configured with the native grpc field detects unresponsive services and triggers a container restart. Startup probes only safeguard the initialization phase, while readiness probes merely remove pods from service endpoints without restarting them.
Q11. A specialized microservice requires a specific API key to be passed in an HTTP header for its health check endpoint '/healthz'. If the header 'X-Health-Check-Key' is missing or contains an incorrect value, the application returns a 403 For…
Answer: D. Use the 'httpGet' handler in the readinessProbe and define the 'httpHeaders' field with the required name and value.
The httpGet probe natively supports custom headers via the httpHeaders field, passing the required authentication key during checks. A TCP socket probe cannot send HTTP headers, making it unsuitable for an endpoint requiring specific authentication values.
Q12. Your team is deploying a secure database client Pod that requires a specific TLS certificate to communicate with a remote database. This certificate is stored in a Kubernetes Secret named db-certs. Additionally, the application requires an…
Answer: C. Mount the Secret as a volume, use valueFrom for the environment variable, and set runAsUser to 1001 in the securityContext
Mounting sensitive files as volumes and injecting non-sensitive variables via valueFrom follows core configuration principles. Setting runAsUser inside the securityContext correctly enforces the required user ID constraint. Hardcoding secrets or running privileged containers violates security standards.
Q13. A legacy application is migrating to Kubernetes but lacks the ability to handle modern mutual TLS (mTLS) or complex retry logic for its connection to an external payment gateway. You decide to implement a pattern where the main container c…
Answer: B. The Ambassador pattern used to provide a specialized network proxy for connecting the application to external services
The Ambassador pattern acts as a local proxy to manage complex external connections like mutual TLS. The Adapter pattern transforms internal output for external systems, while a Sidecar typically provides auxiliary services like centralized logging for the application.
Q14. A mission-critical 'inventory-manager' service is being updated to a new version. The current infrastructure has very limited extra capacity, so the cluster can only handle a maximum of 2 extra pods during the rollout. However, the busines…
Answer: B. Set maxSurge to 2 and maxUnavailable to 0 in the rollingUpdate strategy of the Deployment.
Setting maxSurge to 2 permits two extra pods during the rollout, while maxUnavailable set to 0 maintains all existing replicas. If maxUnavailable were set higher, it would violate the strict requirement for continuous availability.
Q15. Batch Job Deadlines. You are managing a data processing pipeline that uses Kubernetes Jobs to process large video files. Occasionally, the processing logic enters an infinite loop or stalls due to corrupted input data, causing the Job to c…
Answer: D. Set the activeDeadlineSeconds field to 1800 in the Job's spec section to limit the total duration of the Job regardless of how many pods it creates.
The activeDeadlineSeconds field enforces a hard timeout on the entire Job duration. When this limit is reached, Kubernetes terminates all running pods and marks the Job as failed. Other options fail to stop runaway processes reliably.
Q16. A Kubernetes Job is configured to process a large dataset. Due to intermittent network instability in the cluster environment, the Pods frequently fail during their first few attempts. You want the Job to keep retrying the execution, but i…
Answer: D. Specify the 'backoffLimit' field in the Job specification and set its value to 8.
The backoffLimit field specifies the number of retries allowed before a Job is marked as failed. Setting it to 8 ensures the task gives up after eight unsuccessful attempts. The completions field controls parallelism rather than failure retries.
Q17. A high-traffic microservice named order-processor is running in your production cluster with a Deployment and a Service. You have been asked to implement a basic canary deployment where approximately 10% of the traffic is routed to a new v…
Answer: B. Create a second Deployment for v2.0.0 with the same labels as the v1.0.0 pods and scale the v1.0.0 Deployment to 9 replicas and the v2.0.0 Deployment to 1 replica.
Kubernetes Services load balance randomly across matching Pod endpoints. Deploying the v2 version with identical labels and scaling it to a 1:9 ratio with v1 guarantees roughly ten percent of traffic. Other strategies cannot guarantee exact traffic ratios.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.