Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A distributed database system is being deployed using a StatefulSet named data-node. Each replica in the StatefulSet nee. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A distributed database system is being deployed using a StatefulSet named data-node. Each replica in the Stat…
- Ingress Traffic Weighting. You are managing a web application exposed via an Ingress resource using an NGINX…
- A batch processing application must process exactly 50 independent work items. Each item takes about 1 minute…
- A developer needs to provide a large set of configuration parameters to a container via a ConfigMap. Instead…
- Namespace Resource Constraints: A development team is unable to create new Pods in the 'staging' namespace. W…
- You are managing an Ingress resource for a global corporate portal. Traffic to 'portal.example.com/api' must…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A distributed database system is being deployed using a StatefulSet named data-node. Each replica in the StatefulSet needs to be able to communicate directly with other specific replicas to synchronize data and maintain cluster quorum. The…
Answer: B. Define a Headless Service by setting the clusterIP field to None in the Service specification
Defining a Headless Service by setting clusterIP to None returns the individual Pod IP addresses via DNS instead of load-balancing them. This mechanism provides StatefulSet pods with the stable network identities required for peer discovery.
Q2. Ingress Traffic Weighting. You are managing a web application exposed via an Ingress resource using an NGINX Ingress Controller. You have a stable production service named 'web-prod' and you have just deployed a new version as 'web-canary'…
Answer: B. Create a second Ingress resource for the canary service and use the nginx.ingress.kubernetes.io/canary-weight annotation set to '10'.
Creating a secondary Ingress with the NGINX canary-weight annotation accurately routes a specific percentage of traffic to the new service. This is a controller-specific feature rather than standard upstream Kubernetes functionality.
Q3. A batch processing application must process exactly 50 independent work items. Each item takes about 1 minute. The team wants to run up to 5 items in parallel to save time. If a single task fails, it should be retried, but if more than 4 t…
Answer: A. Set completions: 50, parallelism: 5, and backoffLimit: 4
The completions field sets the total successful work items required, while parallelism controls concurrent execution. The backoffLimit specifically dictates the allowed retries before the entire Job is marked as failed.
Q4. A developer needs to provide a large set of configuration parameters to a container via a ConfigMap. Instead of using dozens of individual environment variables, they want to mount the ConfigMap as a volume. They must ensure that the appli…
Answer: A. The volume will be mounted as read-only by default, and any attempt by the application to write to it will result in a filesystem error.
ConfigMap-backed volumes are projected as read-only filesystems by the kubelet, preventing applications from modifying them. While using readOnly: true in volumeMounts is a valid explicit practice, the default projection behavior makes it inherently read-only.
Q5. Namespace Resource Constraints: A development team is unable to create new Pods in the 'staging' namespace. When they attempt to run a simple Nginx Pod, they receive an error message: 'Forbidden: exceeded quota: pods-quota, requested: pods…
Answer: B. Edit the ResourceQuota to increase the pods limit from 10 to 15 to accommodate the presence of terminal Pods that are still consuming quota.
Increasing the ResourceQuota is the most direct way to resolve the immediate Forbidden error while preserving terminal Pods for auditing. A LimitRange cannot bypass a strict pods quota, and deleting the quota removes necessary guardrails.
Q6. You are managing an Ingress resource for a global corporate portal. Traffic to 'portal.example.com/api' must be routed to the 'api-service', and traffic to 'portal.example.com/static' must be routed to the 'static-service'. You also need t…
Answer: A. Add a path with the value '/' at the end of the paths list for the host 'portal.example.com' pointing to the 'maintenance-service'.
Adding a path with the value slash at the end of the paths list for the host acts as a catch-all for unmatched requests. Option D would catch unmatched traffic across all hosts rather than just portal.example.com.
Q7. You are managing a critical Deployment named 'web-server' that currently runs 5 replicas. You need to update the container image to a newer version. The business requirement states that you must ensure 100% of the service capacity is maint…
Answer: A. Set maxUnavailable to 0 and maxSurge to 2 to ensure no pods are removed before new ones are ready and allow up to 7 pods total.
Setting maxUnavailable to 0 and maxSurge to 2 maintains full capacity while strictly limiting extra resource consumption. Option D fails the 100% capacity requirement because it allows one Pod to be unavailable.
Q8. CronJob execution windows. A business-critical CronJob is scheduled to run every day at 02:00 AM to generate financial reports. Due to high cluster utilization or potential node maintenance, there is a risk that the Job might not start exa…
Answer: A. Configure the startingDeadlineSeconds field to 1800 in the CronJob specification to limit the window for starting a missed or delayed job.
The startingDeadlineSeconds field limits how long after the scheduled time a missed Job can start. Option C controls total Job execution time rather than the startup delay window.
Q9. An organization is hosting a multi-service platform. You need to configure an Ingress resource that routes traffic for two different domains: 'orders.example.com' and 'shipments.example.com'. Both domains must use TLS encryption with separ…
Answer: A. Define two separate entries in the tls list, each specifying its own hosts and secretName, and include a rule for each host in the rules list with a fallback backend.
Defining two TLS entries and using a defaultBackend ensures correct routing and security for multiple domains. Option B fails because using a shared secret will not serve the correct individual certificates.
Q10. A web application 'frontend-prod' needs to be exposed to the internet. The cluster uses an Ingress Controller. You are tasked with creating an Ingress resource that routes all traffic coming to 'www.example.com' to a service named 'fronten…
Answer: A. Define two separate path entries under the same host: one for '/assets' with pathType Prefix and one for '/' with pathType ImplementationSpecific
Defining multiple paths under a single host in an Ingress resource routes traffic to different services based on the URI. The longest matching path is typically chosen by the controller, correctly directing requests to the appropriate backend.
Q11. You are investigating why a newly created Pod named 'worker-nodes-only' is stuck in the Pending state. The 'kubectl describe pod' command shows the message: '0/5 nodes are available: 5 node(s) had untolerated taint {type: gpu}'. The cluste…
Answer: A. The Pod manifest needs a toleration block that matches the key 'type', operator 'Equal', and value 'gpu' with the effect 'NoSchedule'.
Adding a matching toleration to the pod manifest allows it to be scheduled onto nodes with corresponding taints. Without this toleration, the scheduler prevents the pod from running on the tainted nodes.
Q12. A complex Java application performs a heavy data cache pre-loading process that takes approximately 2 minutes. During this time, the application process is running and the port is open, but it cannot yet handle incoming API requests. If tr…
Answer: B. A ReadinessProbe configured with an initialDelaySeconds of 120 to delay traffic until the application is ready
Readiness probes prevent services from routing traffic to unready pods. By delaying the initial probe, the application has time to load its cache before accepting requests, avoiding client errors.
Q13. A legacy application generates massive text-based log files at a rate of 500MB per hour, quickly filling up the node's local storage. The application is hardcoded to write logs to a volume mounted at /var/logs/app. You need to implement a…
Answer: A. Implement a Sidecar container in the Pod that shares an emptyDir volume with the main container at /var/logs/app and runs a continuous loop to compress old files.
Implementing a sidecar container that shares an emptyDir volume is the correct architectural pattern for augmenting legacy applications. Shared volumes allow the primary container to write logs while the sidecar independently processes them without altering the main application.
Q14. You are migrating a complex Node.js application that requires over 40 different environment variables to function, including database URLs, API endpoints, and feature flags. All these variables are stored in a ConfigMap named 'app-env-vars…
Answer: C. Utilize the envFrom field under the container specification and provide a configMapRef pointing to the app-env-vars ConfigMap.
The envFrom field is designed to populate environment variables automatically from an entire ConfigMap or Secret. This approach saves time compared to specifying individual env entries using configMapKeyRef for every single key.
Q15. An automated CI/CD pipeline recently deployed a new version of the shipping-api deployment. After the deployment reached a ready state, users started reporting intermittent 503 errors and high latency. The operations team needs to roll bac…
Answer: C. Run kubectl rollout undo deployment/shipping-api and update the manifest with the kubernetes.io/change-cause annotation.
Running the rollout undo command immediately reverts the Deployment to its previous working revision. Adding the kubernetes.io/change-cause annotation during future rollouts ensures the history controller properly populates the audit trail.
Q16. An engineering team is managing a high-traffic web service deployed via a Deployment named web-portal. To ensure stability during updates, they require that during a rolling update, the total number of replicas never exceeds 125% of the de…
Answer: C. Set maxSurge to 25% and set maxUnavailable to 25% in the Deployment rollingUpdate strategy
A maxSurge of 25% allows up to 5 extra pods, matching the 125% maximum requirement. However, setting maxSurge and maxUnavailable to the integer 5 is mathematically identical for a 20-replica deployment. Both options effectively fulfill the stated requirements.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.