Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An enterprise is migrating a legacy database to a cloud-managed service outside of the Kubernetes cluster. The applicati. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An enterprise is migrating a legacy database to a cloud-managed service outside of the Kubernetes cluster. Th…
- A Python-based data processing application is experiencing intermittent freezes where the process remains run…
- A data processing Job named 'nightly-reconciliation' is configured to process 100 shards of data. The team ha…
- Your monitoring and observability strategy requires that each instance of a distributed microservice identifi…
- You are managing a critical web deployment named 'frontend-v2' which is currently running with 6 healthy repl…
- Your engineering team has provided a ConfigMap named 'app-settings' containing various environment-specific f…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An enterprise is migrating a legacy database to a cloud-managed service outside of the Kubernetes cluster. The application code is hardcoded to connect to 'db-internal.production.svc.cluster.local'. To avoid code changes, you need to creat…
Answer: C. Create a Service of type ExternalName with the externalName field set to 'prod-db-99.provider.com'.
An ExternalName Service creates a DNS CNAME record, perfectly mapping an internal cluster domain to an external FQDN without code changes. Modifying CoreDNS directly is an anti-pattern and a poor distractor, whereas Ingress only manages HTTP traffic routing.
Q2. A Python-based data processing application is experiencing intermittent freezes where the process remains running but stops responding to internal health checks. You need to implement a health check that specifically checks for the existen…
Answer: D. Define a livenessProbe using an exec command that evaluates the file's modification time
A liveness probe determines when a container needs a restart due to deadlock or failure. Using an exec handler runs a custom script to validate complex conditions, such as file modification times, which readiness probes or startup delays do not manage.
Q3. A data processing Job named 'nightly-reconciliation' is configured to process 100 shards of data. The team has observed that occasionally a specific shard causes the container to crash due to malformed data. They want the Job to attempt to…
Answer: B. Set completions to 100, parallelism to 10, backoffLimit to 4, and activeDeadlineSeconds to 1800
In Kubernetes Jobs, backoffLimit governs the maximum pod retries before failing. The activeDeadlineSeconds parameter enforces a strict time limit for the entire job execution. Avoid sidecar workarounds and use native API fields during the exam.
Q4. Your monitoring and observability strategy requires that each instance of a distributed microservice identifies itself using its own Pod name and the name of the Node it is currently scheduled on. This metadata is essential for correlating…
Answer: D. Configure the Pod specification to use the Downward API to map fieldRef values like metadata.name and spec.nodeName into environment variables.
The Downward API exposes pod metadata directly to containers without using the Kubernetes API client. Use fieldRef for environment variables to pass the pod name and node name dynamically. Static ConfigMaps fail when pods are rescheduled.
Q5. You are managing a critical web deployment named 'frontend-v2' which is currently running with 6 healthy replicas. To ensure high availability during a rolling update to 'frontend-v3', the infrastructure team has dictated that the number o…
Answer: B. Define the strategy with maxUnavailable set to 0 and maxSurge set to 2 to maintain at least 6 pods while allowing a maximum of 8 pods during the transition.
Setting maxUnavailable to zero keeps all desired replicas running during updates. Configuring maxSurge to two allows only two extra pods to be created, keeping the maximum total within the required limit. The Recreate strategy causes downtime.
Q6. Your engineering team has provided a ConfigMap named 'app-settings' containing various environment-specific files. One of these files, 'database.yaml', needs to be injected into a container at the path '/etc/config/database.yaml'. However…
Answer: B. Apply a volumeMount with the subPath property to map the specific key from the ConfigMap volume directly to the desired file path in the container.
The subPath property mounts a single file from a volume into an existing directory without obscuring other files. This is the exact Kubernetes feature for injecting specific ConfigMap keys safely. Using init containers is an unnecessary workaround.
Q7. You are deploying a security-hardened Pod that runs as a non-root user with UID 2000. The container needs to process files located in a PersistentVolume mounted at '/app/data'. However, the underlying storage system initializes the volume…
Answer: A. Specify fsGroup: 2000 within the Pod-level securityContext to automatically change the ownership of the mounted volume to be owned by group 2000.
Specifying fsGroup in the Pod securityContext automatically adjusts the group ownership of mounted volumes. This built-in kubelet feature handles permissions cleanly, avoiding the need for insecure privileged containers or application modifications.
Q8. A distributed application depends on a database service named 'db-backend' located in the same namespace. If the application starts before the database is ready to accept connections, it crashes and enters a CrashLoopBackOff state, causing…
Answer: B. Define an Init container that runs a script to check for the availability of the 'db-backend' service using a tool like netcat or nslookup.
Init containers run sequentially and must complete successfully before the main application containers start. This makes them the perfect tool for blocking startup until external network dependencies are fully reachable and ready.
Q9. Your microservice architecture includes a 'reporting-api' that occasionally experiences internal deadlocks. When this happens, the process continues to run, and the HTTP port remains open, but all subsequent requests return a 504 Gateway T…
Answer: B. Implement a LivenessProbe using an HTTP GET request with an initialDelaySeconds of 30 and a failureThreshold of 3.
A LivenessProbe detects application deadlocks and restarts the unresponsive container to restore functionality. The initialDelaySeconds parameter ensures the probe does not prematurely kill the container during its 30-second startup routine.
Q10. A data analytics Pod named log-processor in your production cluster performs heavy temporary calculations by writing intermediate files to its local filesystem at /tmp. During peak hours, these temporary files can grow rapidly and consume…
Answer: B. Set an ephemeral-storage resource limit of 500Mi within the container specification
Setting an ephemeral-storage limit triggers pod eviction when container writes exceed the specified threshold, protecting the node. ResourceQuotas only cap total namespace usage rather than enforcing strict limits on individual pod consumption.
Q11. Your organization is deploying a microservice that requires access to a shared certificate file, a database configuration ConfigMap, and the Pod's own IP address injected into the filesystem. To maintain a clean container environment, you…
Answer: D. Implement a projected volume that includes secret, configMap, and downwardAPI sources
A projected volume maps several volume sources like secrets and downwardAPI data into a single unified directory tree. This provides a clean aggregation method, whereas overlapping standard volume mounts will simply overwrite each other.
Q12. Your engineering team is deploying a complex Java-based microservice that exposes its main application on port 8080. However, the application's internal health-check logic and metrics are exposed on a dedicated management port 9090. A Read…
Answer: C. Define a readinessProbe using httpGet specifying port 9090 and the appropriate path for health checks.
A readinessProbe using httpGet on the management port accurately validates application readiness before routing traffic. Liveness or startup probes do not control traffic routing, making them unsuitable for this specific Service requirement.
Q13. A financial technology firm is hardening its Kubernetes clusters to meet strict compliance standards. During a security review, the DevSecOps team identified that many application Pods in the transaction-processing namespace have a default…
Answer: D. Set the boolean field automountServiceAccountToken to false in the Pod specification to prevent the automatic mount.
Setting automountServiceAccountToken to false explicitly stops the kubelet from injecting the API credentials into the pod. Overriding the mount path with an emptyDir is a dangerous hack that does not properly secure the environment.
Q14. You are deploying a distributed database system using a StatefulSet named db-cluster. Each instance in the cluster must be addressable by its own unique and stable DNS hostname (e.g., db-cluster-0.db-service, db-cluster-1.db-service) so th…
Answer: B. A Headless Service with the clusterIP field set to None and a selector that matches the labels defined in the StatefulSet's pod template.
A Headless Service returns individual pod IP addresses instead of providing a single virtual IP for load balancing. This behavior is required for StatefulSets to provide stable network identities for distributed data replication.
Q15. A high-volume batch processing system uses Kubernetes Jobs to process large data files. Occasionally, a malformed data file causes the processing container to crash repeatedly. You want to ensure that if a specific Job fails more than 4 ti…
Answer: C. Define backoffLimit set to 4 and activeDeadlineSeconds set to 300
The backoffLimit field specifies the number of retries before a Job is marked as failed, while activeDeadlineSeconds enforces a hard time limit. Use activeDeadlineSeconds rather than a grace period when you need an absolute cap on Job duration.
Q16. Your engineering team is deploying a legacy inventory application named inv-singleton. This application relies on an older database engine that does not support concurrent connections from multiple application instances. When performing an…
Answer: C. Change the Deployment strategy type to Recreate in the spec section
The Recreate deployment strategy terminates all existing Pods before creating new ones, which is required for singleton applications. A RollingUpdate will temporarily run both versions simultaneously, risking database locks.
Q17. Your organization's e-commerce API must be highly available and resilient to datacenter failures. The Kubernetes cluster is distributed across three availability zones (zone-a, zone-b, and zone-c). You need to ensure that the 9 replicas of…
Answer: A. Configure topologySpreadConstraints in the Pod spec with a topologyKey set to 'topology.kubernetes.io/zone' and a maxSkew of 1.
TopologySpreadConstraints give the scheduler explicit rules for distributing Pods evenly across designated topology domains like zones. NodeSelectors or anti-affinity rules cannot mathematically enforce an even spread across multiple failure domains.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.