Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A payment-gateway microservice must be considered ready to receive traffic only if it can successfully connect to both a. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A payment-gateway microservice must be considered ready to receive traffic only if it can successfully connec…
- Your team is implementing a Blue-Green deployment strategy for the 'checkout-api' service. Version 1 (Blue) i…
- You are deploying a distributed database where each instance (replica) needs to be uniquely identifiable and…
- A security audit has flagged that your main application container contains several heavy-duty diagnostic and…
- A legacy inventory-service application is being migrated to a Kubernetes cluster. The application is known to…
- A production Deployment named web-portal currently runs 10 replicas. You are planning to update the container…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A payment-gateway microservice must be considered ready to receive traffic only if it can successfully connect to both a local Redis cache and an external credit card processing API. A simple HTTP check on the /health endpoint is insuffici…
Answer: B. Define a Readiness Probe using the exec handler to run the /usr/bin/verify-dependencies.sh script to control the Pod's inclusion in Service endpoints.
A Readiness Probe evaluates if an application can serve requests, removing it from Service endpoints if checks fail. A Liveness Probe would restart the Pod unnecessarily when external dependencies become temporarily unavailable.
Q2. Your team is implementing a Blue-Green deployment strategy for the 'checkout-api' service. Version 1 (Blue) is currently active and receiving traffic through a Service named 'checkout-service'. You have successfully deployed Version 2 (Gre…
Answer: C. Modify the label selector of the 'checkout-service' to match the unique labels of the Version 2 Deployment pods.
Updating the Service selector instantly changes traffic routing to match the new deployment pods. Deleting the old deployment removes rollback capability, and Ingress canary rules apply proxy traffic splitting, not standard Kubernetes service routing.
Q3. You are deploying a distributed database where each instance (replica) needs to be uniquely identifiable and addressable by its own DNS name (e.g., db-0, db-1, db-2) for clustering and synchronization purposes. You are using a StatefulSet…
Answer: C. A Headless Service with the 'clusterIP' set to 'None' and matching the 'serviceName' of the StatefulSet
A Headless Service with clusterIP set to None provides stable DNS records for individual StatefulSet pods. Standard ClusterIP services balance traffic across random pods, destroying direct addressability, while Ingress and LoadBalancers manage external routing.
Q4. A security audit has flagged that your main application container contains several heavy-duty diagnostic and encryption tools that are only needed once during the initial configuration phase. To minimize the attack surface and reduce image…
Answer: B. Implement an initContainer that uses a specialized image containing the tools to generate the key and save it into an emptyDir volume shared with the main container.
Init containers run sequentially before the main app, securely passing data via an emptyDir volume. Granting elevated runtime capabilities or relying on lifecycle hooks leaves heavy diagnostic tools exposed inside the primary production image.
Q5. A legacy inventory-service application is being migrated to a Kubernetes cluster. The application is known to be fragile during its startup phase; it will immediately crash if the backend database is reachable but the required SQL schema v…
Answer: B. Define an Init Container that runs the SQL validation script and only exits successfully when the database schema version is confirmed as 2.4.
Init containers block application startup until prerequisite checks successfully complete. PostStart hooks execute concurrently with the main app, and readiness probes only prevent service routing without stopping the main process from crashing.
Q6. A production Deployment named web-portal currently runs 10 replicas. You are planning to update the container image to version 2.0.0. Due to resource constraints on the cluster nodes, you cannot have more than 12 Pods running at any point…
Answer: B. Set maxSurge to 20% and maxUnavailable to 20%
A twenty percent surge permits exactly two extra pods, staying safely under the twelve pod limit. Concurrently, twenty percent unavailable ensures at least eight pods remain active, perfectly meeting the strict availability requirements.
Q7. A financial application Pod named 'transaction-handler' in the 'finance' namespace must be restricted for security reasons. It should be allowed to send outgoing requests only to a specific internal database Service at IP 10.0.0.55 on port…
Answer: D. Apply a NetworkPolicy with an 'egress' section that includes a CIDR rule for 10.0.0.55/32 and a rule for the DNS port.
A NetworkPolicy with an egress section explicitly allows traffic to the database IP and DNS port while blocking everything else. RBAC controls API access rather than network traffic, and Ingress only manages incoming connections.
Q8. Your organization recently added specialized nodes equipped with NVIDIA A100 GPUs to the Kubernetes cluster to support a new real-time fraud detection engine. These nodes are labeled with accelerator=nvidia-a100. Due to the high operationa…
Answer: D. Apply a Taint with the NoSchedule effect to the GPU nodes and add a matching Toleration and NodeAffinity to the fraud-detection Pod specification.
Taints repel standard Pods from the GPU nodes, while Tolerations and NodeAffinity ensure the fraud-detection Pods are specifically scheduled there. Using NodeAffinity guarantees the workload lands on the correct hardware.
Q9. A complex data-processing application takes approximately 180 seconds to initialize its internal cache and verify database connections upon startup. During this initialization phase, the application is unable to respond to health checks. Y…
Answer: A. Add a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to allow the container up to 300 seconds to initialize before Liveness probes take over.
A Startup probe disables Liveness and Readiness checks until it succeeds, protecting slow-starting applications. Just increasing the Liveness delay leaves the container unmonitored during steady-state, defeating the probe's purpose.
Q10. You are modernizing a legacy billing-calc application that is hardcoded to connect to a MySQL database located at localhost:3306. In your Kubernetes cluster, the database is actually a managed service reachable via a cluster-internal DNS n…
Answer: B. Deploy a sidecar container running a proxy (like HAProxy or Socat) that listens on localhost:3306 and forwards traffic to the remote database address.
The Ambassador pattern uses a sidecar to act as a local proxy, making remote services appear local without code changes. Modifying Pod hosts or synchronizing databases adds unnecessary complexity and fails the proxy requirement.
Q11. You are deploying a legacy monolithic application that requires a complex set of configuration files to be present in the /app/config directory. However, one specific file, 'license.key', must be mounted from a Secret, while the rest of th…
Answer: A. Use the 'subPath' field in the volumeMounts section for each file to mount them individually into the target directory.
Using subPath mounts individual files without overwriting the destination directory. However, using a projected volume is also a valid, modern solution for merging multiple volume sources into a single directory.
Q12. A security-sensitive application needs to write persistent data to a volume mounted at '/data/secure-storage'. The application container is configured to run as a non-privileged user with UID 2005. However, the volume mounted from the stor…
Answer: B. Set the 'fsGroup' field within the Pod's securityContext to 2005 to ensure Kubernetes changes the group ownership of the volume.
Setting fsGroup in the Pod securityContext tells Kubernetes to change the mounted volume's group ownership to that ID. This grants the non-privileged container write access without requiring risky privileged escalations.
Q13. You are managing a mission-critical web application where you need to perform a Blue/Green deployment to minimize downtime. You have version 1.0 (Blue) running and have just deployed version 2.0 (Green) with its own set of Pods. Both sets…
Answer: A. Update the selector labels in the Service manifest to match the version 2.0 Pod labels
A Kubernetes Service routes traffic using label selectors. Updating the selector to match the new labels instantly shifts all traffic to the Green environment without deploying a new Service or modifying Deployment strategies.
Q14. A security audit requires that all containers in the 'payment-processing' namespace run with a read-only root filesystem to prevent unauthorized modifications or persistent malware. However, the application inside the container requires a…
Answer: A. Set readOnlyRootFilesystem to true in the securityContext and mount an emptyDir volume at /tmp/app-cache.
Setting readOnlyRootFilesystem to true secures the container image. Mounting an emptyDir at the specific path provides a writable scratch space that remains isolated to the Pod's lifecycle.
Q15. You are managing a shared cluster where security is a top priority. A new compliance mandate requires that all Pods in the 'secure-finance' namespace must run with the 'Restricted' Pod Security Standard. This means they cannot run as root…
Answer: B. Apply labels to the namespace that configure the Pod Security Admission controller to enforce the restricted profile
Pod Security Admission is the modern replacement for PodSecurityPolicies. Applying namespace labels like pod-security.kubernetes.io/enforce: restricted automatically enforces the baseline security standard natively.
Q16. Your application pod requires a clean shutdown to ensure that all in-flight transactions are saved to a persistent disk when the pod is terminated (e.g., during a scaling event or update). The application listens for a SIGTERM signal, but…
Answer: C. Set the 'terminationGracePeriodSeconds' field in the Pod specification to 60 to allow the application enough time to shut down.
The terminationGracePeriodSeconds defines the duration Kubernetes waits after sending SIGTERM before issuing SIGKILL. Increasing this value ensures the application has the necessary window to finish cleanup tasks safely.
Q17. Your engineering team is performing a Blue-Green deployment for a mission-critical payment processing microservice. Version 1.0 (Blue) is currently serving production traffic through a Service named 'payment-service'. Version 2.0 (Green) h…
Answer: A. Update the selector labels of the 'payment-service' Service to match the labels unique to the Version 2.0 Deployment pods.
Updating the Service selector implements an atomic Blue-Green switch by redirecting internal load balancing to the new Pods. Rolling updates risk mixing traffic, whereas deleting deployments causes downtime.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.