Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An application pod named 'auth-service' needs to access several different pieces of metadata and configuration at runtim. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An application pod named 'auth-service' needs to access several different pieces of metadata and configuratio…
- A critical Python-based microservice in your production environment occasionally suffers from internal thread…
- A security-sensitive application Pod must run as a specific non-root user with UID 1000. Additionally, the ap…
- A DevOps team is performing a manual canary deployment for a new version of a user-profile service. They have…
- A batch processing system requires a Kubernetes Job to process exactly 20 work items from a queue. To optimiz…
- A developer needs to configure a Deployment for a legacy application that requires 25 different environment v…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An application pod named 'auth-service' needs to access several different pieces of metadata and configuration at runtime. Specifically, it requires a TLS certificate stored in a Secret, a set of environment-specific flags stored in a Conf…
Answer: B. Use a projected volume that includes secret, configMap, and downwardAPI sources.
A projected volume maps several volume sources like Secrets, ConfigMaps, and Downward API into a single directory. This avoids mounting multiple separate volumes and provides a clean, unified filesystem structure.
Q2. A critical Python-based microservice in your production environment occasionally suffers from internal thread locking. When this happens, the process continues to run, and the container remains 'Running' from a Kubernetes perspective, but…
Answer: A. A LivenessProbe configured with an appropriate failureThreshold to trigger a container restart upon repeated failures.
A liveness probe checks if an application is stuck or deadlocked, and failing it triggers the kubelet to restart the container. A readiness probe only routes traffic, meaning a frozen container would stay offline indefinitely without being replaced.
Q3. A security-sensitive application Pod must run as a specific non-root user with UID 1000. Additionally, the application needs to read and write files to a PersistentVolume that is mounted at '/data'. The storage provider identifies the file…
Answer: A. Set fsGroup to 5000 in the Pod's securityContext specification
Setting fsGroup to 5000 in the pod security context automatically grants the mounted volume group ownership so your user can read and write files. Running privileged containers or applying broad permissions creates unnecessary security risks on the certification exam.
Q4. A DevOps team is performing a manual canary deployment for a new version of a user-profile service. They have created a second Deployment named 'user-profile-v2' alongside the existing 'user-profile-v1'. They want a single Service named 'u…
Answer: C. Point the Service selector to a common label shared by both Deployments
A service routes traffic by matching pod labels, so pointing it to a common label shared by both deployments adds them to the pool. The control plane dynamically manages endpoints, making manual edits unreliable and temporary.
Q5. A batch processing system requires a Kubernetes Job to process exactly 20 work items from a queue. To optimize the processing time, the team wants to ensure that at least 4 worker Pods are running simultaneously at any given time until the…
Answer: A. Set parallelism to 4 and completions to 20 in the Job spec
The parallelism field dictates concurrent worker pods, and completions dictates total successful finishes required. Using activeDeadlineSeconds sets timeout limits rather than concurrency, completely failing to match workload requirements.
Q6. A developer needs to configure a Deployment for a legacy application that requires 25 different environment variables to function. These variables are currently stored in a ConfigMap named 'app-env-vars'. To avoid a long and error-prone Po…
Answer: A. Use the envFrom field in the container spec and reference the ConfigMap via configMapRef
The envFrom field bulk injects all ConfigMap or Secret keys as environment variables into a container. Mapping individual keys manually using configMapKeyRef is tedious and inefficient for large configurations.
Q7. Your team uses a CronJob to perform a database cleanup every night at 2:00 AM. Over time, you have noticed that the namespace is becoming cluttered with hundreds of 'Completed' Pods from past executions, making it difficult to find active…
Answer: B. Set 'successfulJobsHistoryLimit' to 3 and 'failedJobsHistoryLimit' to 1 in the CronJob spec.
The successfulJobsHistoryLimit and failedJobsHistoryLimit fields restrict how many finished jobs and pods remain for auditing. Configuring ttlSecondsAfterFinished on the job template controls deletion timing rather than strict retention counts.
Q8. A financial data processing CronJob is scheduled to run every day at midnight to generate reports. However, the cluster is often heavily loaded at that time, which can cause delays in scheduling the Pod. The business requires that if the j…
Answer: A. Set the 'startingDeadlineSeconds' field in the CronJob specification to 1800 seconds to define the allowed scheduling window.
Setting startingDeadlineSeconds dictates the grace period before a delayed job is skipped entirely by the controller. The activeDeadlineSeconds field sets the maximum duration a job runs once started, not scheduling delay tolerances.
Q9. A data-processing application requires a specific configuration directory at '/etc/config/app' to be populated with several decrypted security keys before the main container starts. These keys are fetched from an external vault via a secur…
Answer: A. Use an Init container with curl to fetch keys into a shared emptyDir volume
Init containers run sequentially before the main application starts and can share an emptyDir volume. This approach securely passes data to minimal distroless images that lack standard shell utilities. Sidecars run concurrently, making them unsuitable.
Q10. An enterprise financial application named secure-vault must be deployed with strict security constraints. The security team requires that the application container runs as a specific non-root user with UID 5000. Additionally, the applicati…
Answer: B. Configure securityContext with runAsUser 5000 and allowPrivilegeEscalation set to false
Setting runAsUser enforces a specific UID while allowPrivilegeEscalation prevents a process from gaining more privileges than its parent. Configuring these in the security context meets the requirement. PodSecurityPolicy is deprecated and a strong distractor.
Q11. Your organization is hosting a legacy web application that was not designed for stateless cloud environments. The application stores user session data in local memory rather than a shared database. As a result, if a user's subsequent reque…
Answer: C. Set the service property sessionAffinity to ClientIP in the Service manifest.
Setting sessionAffinity to ClientIP ensures requests from a specific IP route to the same pod during the session timeout window. This is the native service configuration for legacy applications. Avoid manual pod selectors or complex Ingress rules.
Q12. An API service named 'order-sync' written in Go occasionally suffers from a deadlock where the HTTP server remains responsive (returning 200 OK), but the internal background worker responsible for processing database transactions stops fun…
Answer: A. Configure a LivenessProbe using an 'exec' command that runs a custom script to check the status of the internal worker
A liveness probe triggers a container restart when it detects an application deadlock. Using an exec handler allows you to run custom logic that verifies the background worker status directly. Readiness probes only manage traffic routing.
Q13. A company uses a Kubernetes CronJob to perform a daily data synchronization task scheduled for 02:00 AM. In some instances, due to high data volume, the task takes longer than 24 hours to complete, leading to the next day's job starting wh…
Answer: A. Assign the concurrencyPolicy to Forbid to prevent the CronJob controller from starting a new job if the previous instance has not yet finished its execution.
The Forbid policy prevents concurrent executions, ensuring a new job is skipped if the previous one is still running. Replace would terminate the existing job, which violates the requirement to skip the new execution entirely.
Q14. You are migrating a microservice named payment-api to Kubernetes. The application is hardcoded to connect to a database using the hostname db-prod.internal.corp. For architectural reasons, this database will remain hosted on an external on…
Answer: C. Create a Service of type ExternalName and set the externalName field to the database DNS name
An ExternalName service creates a CNAME record that maps an internal service name to an external DNS name. While Option C matches the official answer, an ExternalName service technically accepts IP addresses directly in modern Kubernetes clusters.
Q15. You are configuring an Ingress resource to manage traffic for a corporate portal. The platform hosts a frontend application and a search service. You need to ensure that all traffic coming to portal.example.com is routed to the service nam…
Answer: B. Configure a single Ingress with a host rule and two paths under the paths list
A single Ingress resource can define a host alongside a list of paths, allowing traffic routing to different backend services based on the URL. NodePort or multiple Ingresses are not needed for basic path-based routing.
Q16. Your engineering team is developing a microservice that requires a local cache file to be continuously updated from a remote legacy file server. The application code itself cannot be modified to include this synchronization logic. You deci…
Answer: D. Utilizing a Sidecar container pattern with an emptyDir volume type
The Sidecar pattern is the standard way to extend the main container without modifying its code, and an emptyDir provides temporary shared storage. Other volume types like a PVC would persist data across Pod restarts.
Q17. You are managing a data-intensive application that runs as a non-root user (UID 1005) for security hardening. The application needs to write large temporary files to a PersistentVolume mounted at /data/scratch. Even though the volume is su…
Answer: A. Configure 'fsGroup: 1005' in the Pod-level securityContext to change the group ownership of the mounted volume.
Setting fsGroup in the Pod security context automatically changes the group ownership of mounted volumes to the specified ID. This allows the non-root user to write to the storage without requiring privileged access or insecure chmod commands.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.