Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A complex analytics application requires a specific configuration file to be available in a shared volume before the mai. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A complex analytics application requires a specific configuration file to be available in a shared volume bef…
- Your application deployment named 'transaction-manager' must ensure that no more than one instance of the pod…
- An application is known to experience occasional internal deadlocks where the main process remains active but…
- An organization is deploying an application that requires access to a sensitive API key stored in a Secret na…
- A Python-based data processing application occasionally enters a deadlock state due to resource contention. I…
- A legacy enterprise application writes its operational logs directly to a static file located at /opt/app/log…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A complex analytics application requires a specific configuration file to be available in a shared volume before the main application container starts. This file is generated by a legacy script that requires a different base image and spec…
Answer: D. Use an InitContainer to run the legacy script and write the file to a shared volume
An InitContainer runs to completion before the main container starts, blocking startup if it fails. Sidecars and lifecycle hooks run concurrently with the app, meaning they cannot guarantee the file exists before the main process begins.
Q2. Your application deployment named 'transaction-manager' must ensure that no more than one instance of the pod is running at any given time because it uses an exclusive file lock on a shared network storage volume. When updating the applica…
Answer: A. Set the 'strategy' type to 'Recreate' to ensure all existing pods are killed before any new pods are created during the update.
The Recreate strategy terminates all existing pods before creating new ones, preventing concurrent access. RollingUpdate attempts to scale new pods while old ones are still terminating, which would cause lock contention.
Q3. An application is known to experience occasional internal deadlocks where the main process remains active but fails to process any further incoming requests. The container runtime does not detect this as a crash because the PID 1 process i…
Answer: A. Implement a LivenessProbe that checks an internal health endpoint for responsiveness
A LivenessProbe detects unrecoverable states like deadlocks and triggers the kubelet to restart the container. A ReadinessProbe would only remove the pod from service, but it would not restart the deadlocked process.
Q4. An organization is deploying an application that requires access to a sensitive API key stored in a Secret named 'api-credentials'. The security policy dictates that the secret must not be exposed as an environment variable to prevent it f…
Answer: C. Configure a volume of type 'secret' in the Pod spec and mount it as a volumeMount at the specified path in the container.
Mounting a Secret as a volume writes the data to a memory-backed filesystem at the exact target path. This avoids accidental exposure via environment variables in process listings or application crash logs.
Q5. A Python-based data processing application occasionally enters a deadlock state due to resource contention. In this state, the process remains running, so the container does not exit, but it stops consuming messages from the internal queue…
Answer: C. Configure a LivenessProbe that executes a script checking for recent activity in the application processing logs.
A LivenessProbe using an exec action checks application activity and restarts the container if the probe fails. A ReadinessProbe only removes the pod from the service endpoints without restarting the deadlocked process.
Q6. A legacy enterprise application writes its operational logs directly to a static file located at /opt/app/logs/server.log inside the container. The corporate logging policy requires these logs to be streamed to stdout so they can be captur…
Answer: A. Add a sidecar container to the Pod that shares a volume with the main container and runs a command to tail the log file to its own stdout.
A sidecar container shares a volume with the main app and tails the log file to its own standard output. This streams the logs to the Kubernetes infrastructure without modifying the original application image.
Q7. A development team is preparing to update a critical data-migration application from version 2.0 to 3.0. The update includes a non-backward compatible database schema change. If version 2.0 and version 3.0 run simultaneously, the older ver…
Answer: C. Set the strategy type to Recreate to ensure all existing Pods are killed before new ones are created
Setting the strategy type to Recreate guarantees all old pods are killed before new ones are created. A RollingUpdate would temporarily run both versions concurrently, crashing the older pods accessing the new schema.
Q8. An external legacy monitoring system needs to collect metrics from a Prometheus exporter running as a Service inside your Kubernetes cluster. The monitoring system is located on the same physical network as the cluster nodes but cannot use…
Answer: B. Configure a Service of type NodePort and specify a value in the nodePort field between 30000 and 32767.
A NodePort service exposes the application on a static port across all cluster nodes. ClusterIP is internal only, while LoadBalancer relies on cloud provider integration rather than direct node access.
Q9. A data engineer is managing a stateful workload that stores critical logs on a PersistentVolume (PV) backed by cloud-specific block storage. The engineer is concerned that if the PersistentVolumeClaim (PVC) is accidentally deleted by an au…
Answer: C. Update the persistentVolumeReclaimPolicy of the PV to the value Retain
The Retain reclaim policy ensures the underlying storage asset and data are preserved when the PersistentVolumeClaim is deleted. On the exam, recall that the default policy for dynamically provisioned cloud volumes is Delete, so you must explicitly patch the PersistentVolume to Retain.
Q10. The development team is working in a shared Kubernetes namespace that has a ResourceQuota enforced. This quota requires every Pod to have explicit CPU and memory requests and limits defined. You are deploying a resource-intensive data proc…
Answer: D. Kubernetes will automatically set the requests to match the defined limits
In a restricted namespace, Kubernetes automatically sets the CPU and memory requests to match the defined limits if limits are omitted. The default request of zero is incorrect because ResourceQuota validation requires explicit values, which it derives from the limits.
Q11. Your company manages a web platform where the main site is hosted at example.com, and a separate search service is hosted at example.com/search. Each is managed by a different Deployment and Service. You need to configure a single entry po…
Answer: C. An Ingress resource with path-based rules mapping / and /search to their respective backend services.
An Ingress resource handles Layer 7 routing based on URL paths, efficiently mapping different routes to backend services. Using a LoadBalancer service is incorrect because it lacks native HTTP path-awareness, and manually updating endpoints is not a standard Kubernetes pattern.
Q12. A stateful database application needs to be deployed in a Kubernetes cluster. The database requires high-performance disk access and the data must persist even if the Pod is rescheduled to a different node. The cluster uses an external clo…
Answer: C. Use ReadWriteOnce (RWO) access mode with a PersistentVolumeClaim to ensure exclusive access for the single database Pod.
ReadWriteOnce allows a single node to mount the cloud block storage for exclusive read-write access, protecting the database. ReadWriteMany is incorrect because cloud block storage typically does not support multi-node simultaneous writing.
Q13. Your team needs to schedule a recurring data validation task that runs every hour. A critical requirement is that if a task instance takes longer than 60 minutes to complete, the next scheduled instance must not start until the current one…
Answer: C. Configure 'concurrencyPolicy' to 'Forbid' to prevent the controller from starting a new Job if the previous one is still running.
Setting concurrencyPolicy to Forbid prevents overlapping Job executions by skipping new runs if a previous one is active. backoffLimit is incorrect because it limits failure retries rather than controlling concurrent schedules.
Q14. Your team is preparing to launch a new version of the 'order-processor' application. To minimize risk, you want to perform a canary deployment where only 10% of the production traffic is directed to the new version (v2), while the remainin…
Answer: D. Create two separate Deployments (v1 and v2) with the same labels used by the Service's selector, and adjust the replica counts to a 9:1 ratio.
A Kubernetes Service load-balances across all Pods matching its label selector. Creating two Deployments with identical labels and a 9:1 replica ratio achieves the 10% traffic split. Setting an image list is invalid because Deployments only run a single image per container template.
Q15. A network security audit has identified that several Pods in the 'internal-services' namespace have unrestricted access to the public internet. The corporate policy mandates that all Pods in this namespace must be prohibited from making an…
Answer: C. Define an egress rule with a 'to' block containing an 'ipBlock' for 10.10.10.53/32 and a 'ports' block for UDP port 53.
Specifying an ipBlock destination and specific port creates an explicit allow-list for egress traffic, denying everything else by default. An empty or undefined egress list blocks all outbound traffic entirely, breaking DNS resolution and violating the functional requirement.
Q16. A team is migrating a microservices architecture to Kubernetes. One of the internal services needs to communicate with an Oracle database that is currently hosted on a physical server outside the cluster. To keep the application configurat…
Answer: C. A Service of type ExternalName that points to the external database FQDN
The ExternalName service type maps a service to a DNS name by returning a CNAME record with the external address. Other options like ClusterIP or LoadBalancer are intended for routing traffic to cluster pods rather than providing lightweight aliasing to external FQDNs.
Q17. Your team is deploying a microservice that needs to connect to an external database. Due to a recent network security audit, you are required to restrict egress traffic from the microservice Pod so that it can only communicate with the spe…
Answer: A. Create a NetworkPolicy in the finance namespace with an egress rule specifying the target CIDR and an empty podSelector.
A NetworkPolicy with an egress section allows you to define white-listed destinations based on CIDR blocks and labels. Defining allowed egress CIDRs isolates traffic, as all other outbound paths are automatically denied once the policy applies.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.