Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization is implementing a Blue-Green deployment strategy for a critical stateless web service. You have alread. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- Your organization is implementing a Blue-Green deployment strategy for a critical stateless web service. You…
- A complex data processing application consists of multiple containers. The main application container should…
- A mission-critical Deployment named payment-processor currently runs with 20 replicas. To ensure service stab…
- You are configuring an Ingress resource to expose two different services, 'inventory-svc' and 'billing-svc'…
- Your team is deploying a mission-critical banking API that must maintain 100% availability during updates. Th…
- A machine learning engineering team is deploying a heavy inference workload in a production namespace. The ma…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization is implementing a Blue-Green deployment strategy for a critical stateless web service. You have already deployed the new version (Green) as a separate Deployment with the label version: v2, while the current version (Blue…
Answer: C. Modify the selector of the web-service Service to match the labels of the Green deployment
Switching the Service selector is the standard method for Blue-Green deployments because it instantly redirects traffic to the new Pods. Deleting the Blue deployment defeats the purpose of maintaining a quick rollback path.
Q2. A complex data processing application consists of multiple containers. The main application container should only start its execution after a backend database service named 'db-service' is fully reachable on port 5432. You want to implemen…
Answer: A. Add an initContainer with a script that uses a tool like 'nc' or 'pg_isready' to loop until the database port is reachable.
Init containers run sequentially to completion before the main application containers start. A livenessProbe fails if the database is down, but it needlessly restarts the entire Pod instead of waiting gracefully.
Q3. A mission-critical Deployment named payment-processor currently runs with 20 replicas. To ensure service stability during a version upgrade, the business requires that at least 80% of the desired replicas remain available at all times. Fur…
Answer: B. Set maxUnavailable to 20% and maxSurge to 25% within the rollingUpdate strategy section of the Deployment specification.
Using percentages directly fulfills the requirement and scales appropriately if the replica count changes. Hardcoding the numbers works today but breaks the requirement if the deployment later scales.
Q4. You are configuring an Ingress resource to expose two different services, 'inventory-svc' and 'billing-svc', under the domain 'internal.example.com'. The security policy requires that all traffic be encrypted using TLS. You have a single S…
Answer: A. Add a 'tls' block in the Ingress spec with a list containing the 'example-tls' secret name and the 'internal.example.com' host, and define both paths in the rules section.
A single Ingress can secure multiple paths under the same hostname by referencing the TLS secret once. Splitting the configuration into separate Ingress resources is unnecessary and adds management overhead.
Q5. Your team is deploying a mission-critical banking API that must maintain 100% availability during updates. The cluster is currently at 95% resource utilization, meaning you cannot spawn additional Pods during the rollout due to node capaci…
Answer: A. Configure a RollingUpdate strategy with maxSurge set to 0 and maxUnavailable set to 1
Setting maxSurge to zero prevents Kubernetes from creating any extra Pods during the rollout, respecting the strict capacity limits. Configuring maxUnavailable to one allows the strategy to terminate an old Pod first, freeing resources for the new one.
Q6. A machine learning engineering team is deploying a heavy inference workload in a production namespace. The main application container requires 8 CPU cores and 16GB of RAM to process requests efficiently. However, before it can start, an in…
Answer: D. Set lower resource requests for the init container as Kubernetes calculates Pod scheduling based on the highest of init vs. main containers.
Kubernetes calculates Pod scheduling based on the maximum of either the init containers or the sum of the app containers. Lowering the init container requests means the main app container dictates the resources, preventing artificial scheduling delays.
Q7. Controlled Deployment readiness. You are deploying a critical update to a service named 'order-processor'. The application has a complex internal caching mechanism that takes about 45 seconds to warm up after the process starts. If the Dep…
Answer: C. Set the minReadySeconds field in the Deployment spec to 60 to specify the minimum time a new Pod must stay in the Ready state before it is considered available.
The minReadySeconds field ensures a Pod remains ready for a specified duration before the Deployment proceeds. Option B delays health checks but does not guarantee a wait after readiness is achieved.
Q8. Shared Storage Security. A stateful application consists of three replicas that must all read from and write to a shared persistent volume mounted at /data/shared. The application runs as a non-root user with UID 1050. During testing, you…
Answer: B. Configure fsGroup to 1050 in the PodSpec's securityContext to allow Kubernetes to change the ownership of the volume to be accessible by that group ID.
Setting fsGroup in the pod security context automatically changes the ownership of mounted volumes to the specified group ID. This allows non-root containers to read and write files without escalating privileges or running as root.
Q9. A web application has a tendency to occasionally enter a state where it still responds to TCP connections on port 8080, but its internal processing logic is deadlocked, causing it to return a 500 Internal Server Error for every request. A…
Answer: A. An httpGet probe targeting port 8080 and path /healthz, with a timeoutSeconds value set to 3.
An httpGet probe specifically inspects HTTP response codes to determine application health. The timeoutSeconds field ensures that deadlocked applications failing to respond within the required timeframe are correctly marked as unhealthy.
Q10. A microservice experiences intermittent memory leaks that cause it to slow down significantly after 24 hours of operation. When this happens, the application still responds to HTTP health checks on the '/healthz' endpoint with a 200 OK sta…
Answer: C. A readinessProbe with a timeoutSeconds value set to 2, which will remove the Pod from the Service's Endpoints if the response takes longer than 2 seconds.
Readiness probes control whether a pod receives traffic from a service. Setting a low timeout value removes struggling pods from endpoints, preventing application slow-downs without forcing unnecessary restarts.
Q11. A security-sensitive application needs to access an API token stored in a Kubernetes Secret named auth-token. The security policy mandates that the token must be provided as a file at the path /var/run/secrets/api/key.txt. The file must be…
Answer: C. Mount the Secret using a volume with a secretName and an items list specifying the key and path, while setting the defaultMode to 0400.
Using an items list in the secret volume projection ensures only specific keys are mounted. Setting defaultMode to 0400 restricts file permissions, making it readable only by the assigned user ID.
Q12. A nightly data cleanup Job is scheduled to run in your cluster. Under normal conditions, it finishes in 10 minutes. However, due to a known bug in the cleanup script, it occasionally enters an infinite loop, consuming CPU resources indefin…
Answer: C. Set the activeDeadlineSeconds field in the Job specification to 1800
The activeDeadlineSeconds field limits the total duration a job can run. Once reached, Kubernetes terminates the pods and marks the job as failed, preventing stuck processes from wasting cluster resources.
Q13. An application expects its configuration file 'settings.json' to be located in the directory '/etc/config/'. This directory already contains several critical system-generated files that must not be deleted or hidden. You need to mount a Co…
Answer: D. Specify the subPath field in the volumeMounts section to map the specific ConfigMap key to the desired file path
Specifying the subPath field in the volumeMounts section mounts a single file from a volume into a directory without masking existing files. This prevents the mount from overwriting the target directory's contents, which is a critical detail for config injection.
Q14. A corporate legacy application is being containerized and deployed into a Kubernetes cluster. The application is hardcoded to look for a specific configuration file at the path /etc/app/config.yaml. However, the DevOps team has stored this…
Answer: D. Mount the ConfigMap to /etc/app/ and use the subPath property to map production-settings to config.yaml
Mounting the ConfigMap to the directory and using the subPath property correctly maps a specific key to a specific file path. Without subPath, mounting a volume overwrites or hides all pre-existing files in that target directory, breaking the application.
Q15. A legacy enterprise application is being containerized. It writes its security audit logs to a local file at /var/log/app/audit.log instead of stdout or stderr. The existing cluster-level logging solution only collects logs from the contai…
Answer: B. Add a sidecar container that shares an emptyDir volume with the application container and runs the command 'tail -f /var/log/app/audit.log'.
Adding a sidecar container that shares an emptyDir volume and tails the application log correctly forwards logs to standard output. This classic sidecar pattern bridges legacy file logging with cluster-level container logging agents without altering application code.
Q16. Your engineering team is performing a manual canary release for a stateless web application. You currently have a Deployment named 'web-v1' with the label 'version: v1' and a Service named 'web-service' targeting that label. You have deplo…
Answer: B. Remove the version label from the Service selector and ensure both Deployments share a common identifying label targeted by the Service
Removing the version label from the Service selector correctly allows it to target pods across multiple Deployments via a common label. Kubernetes Service routing does not support logical OR operations, so a shared generic label is required.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.