Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An Ingress resource is being used to route traffic to a collection of microservices. One service, 'legacy-api', expects . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An Ingress resource is being used to route traffic to a collection of microservices. One service, 'legacy-api…
- Your company has recently purchased a set of nodes equipped with high-performance GPU hardware intended speci…
- An application developer needs to ensure that every log entry produced by their 'order-processor' Pod contain…
- You are managing an Ingress resource for a global SaaS platform. You need to route traffic based on the URL p…
- You are deploying a network diagnostic tool as a Pod in your Kubernetes cluster. The container needs to perfo…
- A corporate security audit requires that all logs generated by a legacy application be encrypted before they…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An Ingress resource is being used to route traffic to a collection of microservices. One service, 'legacy-api', expects all incoming traffic to arrive at its root path ('/'). However, the Ingress is configured to route traffic based on the…
Answer: C. nginx.ingress.kubernetes.io/rewrite-target: /
The nginx rewrite-target annotation instructs the Ingress controller to replace the matched URL path with the specified value before forwarding the request. The backend-protocol annotation only changes the transport layer and does not alter the URI.
Q2. Your company has recently purchased a set of nodes equipped with high-performance GPU hardware intended specifically for the 'data-science' team's workloads. You want to ensure that regular application Pods from other teams are never sched…
Answer: B. Taints on the specialized nodes and Tolerations on the data science Pods
Applying taints to nodes repels all Pods unless they possess a matching toleration. While node selectors help target specific nodes, only taints strictly prevent standard Pods from scheduling there.
Q3. An application developer needs to ensure that every log entry produced by their 'order-processor' Pod contains the Pod's own IP address and the name of the Node it is running on. This is required for advanced correlation in a centralized l…
Answer: C. The Downward API, mapping fieldRef paths like status.podIP and spec.nodeName to environment variables.
The Downward API exposes Pod metadata like IP and Node name directly to containers as environment variables or files. Avoid using init containers or the Kubernetes API for this, as the Downward API provides this data natively without extra RBAC permissions.
Q4. You are managing an Ingress resource for a global SaaS platform. You need to route traffic based on the URL path: requests to 'saas.com/app' should go to the 'web-frontend' service, and 'saas.com/api' should go to the 'api-backend' service…
Answer: D. Define the 'maintenance-page' service as the defaultBackend at the top level of the Ingress resource specification
The defaultBackend field is explicitly designed to handle requests that do not match any defined host or path rules. Using a wildcard path is less reliable because evaluation order and priority can vary between different Ingress controller implementations.
Q5. You are deploying a network diagnostic tool as a Pod in your Kubernetes cluster. The container needs to perform low-level network operations, such as capturing raw packets and modifying network interfaces, which are typically restricted by…
Answer: D. Add the NET_ADMIN and NET_RAW capabilities to the capabilities block within the container's securityContext.
Adding capabilities like NET_ADMIN and NET_RAW within the container securityContext grants the exact privileges needed for network tools. Setting privileged to true violates the principle of least privilege by granting all capabilities rather than the specific ones required.
Q6. A corporate security audit requires that all logs generated by a legacy application be encrypted before they are transmitted to a centralized logging server. The legacy application, currently containerized, only supports writing raw text l…
Answer: B. Deploy a sidecar container in the same Pod that shares a volume with the main container to read, encrypt, and forward the log data.
Deploying a sidecar container that shares a volume with the main application cleanly separates log encryption from the legacy business logic. The sidecar reads the raw files and securely forwards them, fully adhering to the single container per concern design.
Q7. A shared development namespace has a ResourceQuota that limits the total CPU and Memory requests for all Pods. A developer is attempting to deploy a new microservice, but the Pod remains in a 'Pending' state indefinitely. Upon investigatio…
Answer: C. The Pod is stuck because Kubernetes requires all Pods in a quota-restricted namespace to have explicit resource requests defined.
When a ResourceQuota restricts CPU or Memory, Kubernetes requires every Pod to explicitly define resource requests so usage can be tracked. Adding explicit requests to the manifest solves this, or a LimitRange could be added to provide defaults.
Q8. An engineering team is migrating a Node.js web application that requires a complex configuration file to be generated at runtime before the main process starts. The generation script is written in Python and requires specific libraries tha…
Answer: B. Use an initContainer with the Python image to generate the file into an emptyDir volume shared with the main container
Init containers run to completion before the main application container starts. Sharing an emptyDir volume lets the init container generate the configuration file securely. Sidecars run concurrently, so the app might start before the file exists.
Q9. A development team is migrating a microservice named order-processor to a Kubernetes cluster. The service needs to connect to an external legacy Oracle database located on-premises. This database requires a complex, proprietary authenticat…
Answer: C. Deploy a sidecar container running a specialized proxy that handles the authentication and tunnel, allowing the application to connect via localhost.
The ambassador pattern uses a sidecar proxy to handle complex external connections. Containers in the same pod share the network namespace, allowing the app to connect via localhost. Init containers cannot maintain long-running network tunnels.
Q10. Your organization has a strict network security policy. A Pod named 'payment-api' in the 'finance' namespace needs to communicate with an external PostgreSQL database at the IP address 192.168.1.100 on port 5432. All other outbound traffic…
Answer: B. Define an Egress NetworkPolicy with a CIDR selector for 192.168.1.100/32 and the specific port 5432
An egress network policy whitelists specific destination IP ranges and ports. Creating a rule for the database IP automatically blocks all other non-matching outbound traffic. Ingress rules only control incoming traffic, not outbound.
Q11. You need to process 100 independent data chunks using a batch processing tool. Each chunk takes about 2 minutes to process. To meet your deadline, you want to process 5 chunks simultaneously at any given time. The process should continue u…
Answer: C. Define a Job with 'completions: 100' and 'parallelism: 5' to manage the execution and retries of the tasks.
A Kubernetes Job handles batch processing tasks by running pods to completion. Setting completions to 100 and parallelism to 5 runs five tasks simultaneously until all finish. Deployments and StatefulSets are for long-running services, not finite tasks.
Q12. A legacy application in your production environment outputs critical performance metrics in a specialized XML format to its standard output. Your centralized monitoring platform only accepts metrics in a specific JSON schema via a REST API…
Answer: B. Deploy an adapter container within the same Pod that reads the XML output from a shared volume or standard stream and converts it into the JSON format required by the monitoring platform.
The adapter pattern standardizes output by transforming data within a sidecar container. Reading from a shared volume lets the adapter translate XML logs into the required JSON format. This decouples the legacy app from the monitoring platform.
Q13. A Python-based microservice responsible for processing heavy financial data occasionally encounters a localized deadlock in its processing thread. Although the main process remains alive and the container status is marked as 'Running', the…
Answer: C. Define a Liveness probe using an HTTP GET check against a health endpoint
A liveness probe checks if an application is responsive and restarts the container if it fails. Since the process is deadlocked but running, only a liveness probe triggers a restart. Readiness probes only remove pods from service endpoints.
Q14. You are deploying a Java-based microservice that requires a complex set of database schema migrations to be performed before the application starts. The migration tool is a standalone binary that is not included in the main application con…
Answer: B. Use an InitContainer with the migration tool image to run the schema update script before the main container starts.
Init containers run to completion before the main application container starts. If the migration fails, the init container errors out and prevents the main application from starting. PostStart hooks run concurrently with the main app, causing race conditions.
Q15. You are managing a multi-tenant cluster with two namespaces: 'frontend-apps' and 'backend-services'. A strict security policy requires that Pods in the 'backend-services' namespace should only accept incoming traffic from specific Pods in…
Answer: B. An ingress policy with a from section containing both a namespaceSelector matching 'frontend-apps' and a podSelector matching 'app: web-portal'.
A network policy isolates pods by selecting specific sources for traffic. Using both a namespaceSelector and podSelector inside the from block restricts traffic precisely to the frontend pods. Without a namespaceSelector, traffic would be allowed from any namespace.
Q16. Your application requires a database password to be injected as an environment variable. The password is stored in a Secret named db-secrets under the key 'DB_PASS'. Additionally, the application needs to read a shared configuration file f…
Answer: C. Use secretKeyRef for the environment variable and volumeMounts with subPath for the file
The secretKeyRef correctly targets a specific key for the environment variable, while subPath cleanly mounts just the target file from the ConfigMap. Using envFrom would incorrectly inject all Secret keys, violating the principle of least privilege required for strict configuration.
Q17. A critical customer-facing dashboard is managed via a Kubernetes Deployment with 5 replicas. The business requirement states that during any update to the application, the service must never drop below its current capacity of 5 replicas to…
Answer: D. Set maxUnavailable to 0 and maxSurge to a value greater than 0 such as 25%.
Setting maxUnavailable to 0 ensures no healthy pods are terminated during the rollout. The maxSurge setting allows creating extra pods first, whereas setting maxUnavailable higher risks dropping below the required replica capacity.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.