Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A legacy monitoring tool deployed in your cluster outputs raw metrics via UDP packets to a local destination. Your compa. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A legacy monitoring tool deployed in your cluster outputs raw metrics via UDP packets to a local destination…
- A legacy enterprise application is being migrated to a Kubernetes cluster but requires a complex sharding log…
- A legacy web application is being migrated to Kubernetes. The application was designed to work only with stic…
- A complex Java-based microservice named report-engine takes approximately 120 seconds to fully initialize its…
- An e-commerce platform is transitioning from a monolithic architecture to microservices. The marketing team r…
- A Pod named file-manager runs a container as a non-privileged user with UID 3000. This Pod mounts a Persisten…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A legacy monitoring tool deployed in your cluster outputs raw metrics via UDP packets to a local destination. Your company requires these metrics to be forwarded to an external cloud-based analytics platform that only accepts encrypted HTT…
Answer: D. Deploy an Ambassador container that listens for UDP traffic on localhost and proxies it to the external HTTPS endpoint.
An Ambassador container acts as a local proxy representing an external service, handling protocol translation securely. The Adapter pattern modifies outbound data formatting, while a Sidecar typically augments the main container without proxying external connections.
Q2. A legacy enterprise application is being migrated to a Kubernetes cluster but requires a complex sharding logic to communicate with an external database. The development team does not want to modify the application's source code to include…
Answer: D. Deploy an Ambassador container within the Pod to act as a local proxy for external service discovery and routing.
The Ambassador pattern deploys a local proxy container managing complex external routing for the main app. The Adapter pattern transforms standard application output, whereas Init containers only execute during startup before the app runs.
Q3. A legacy web application is being migrated to Kubernetes. The application was designed to work only with sticky sessions because it stores user session data in local memory rather than a distributed cache. When the application is scaled to…
Answer: B. Configure sessionAffinity to ClientIP within the Service manifest specification
Setting sessionAffinity to ClientIP in the Service manifest ensures requests from the same IP reach the same Pod. While Ingress controllers offer external hashing, native Service configuration is the direct Kubernetes way to handle this traffic steering.
Q4. A complex Java-based microservice named report-engine takes approximately 120 seconds to fully initialize its internal cache and start listening for connections on port 8080. If the standard liveness probe starts checking the application t…
Answer: C. Add a startupProbe that checks port 8080 and has a sufficient failureThreshold and periodSeconds
A startup probe disables liveness and readiness checks until it succeeds, which is perfect for slow-starting applications. Relying solely on a high liveness probe failure threshold delays deadlock detection after the application finally starts.
Q5. An e-commerce platform is transitioning from a monolithic architecture to microservices. The marketing team requires that requests to 'api.example.com/v1/orders' are routed to a stable legacy service, while requests to 'api.example.com/v2/…
Answer: C. Configure one Ingress resource with multiple paths under the same host rule
A single Ingress resource can define multiple paths under one host, routing traffic to different backend Services based on the URL. Deploying multiple Ingress controllers is unnecessary and overly complex for simple path-based routing.
Q6. A Pod named file-manager runs a container as a non-privileged user with UID 3000. This Pod mounts a PersistentVolume (PV) at the path /data to store application logs and user uploads. During testing, the application fails to start because…
Answer: B. Add a securityContext to the Pod spec and set the fsGroup field to 3000 to automatically change the ownership of the mounted volume.
Setting fsGroup in the Pod securityContext automatically adjusts mounted volume ownership to match the container's group. Using an init container to change permissions is unnecessarily complex compared to this native Kubernetes feature.
Q7. Your engineering team is migrating an application that is hardcoded to connect to a database using the internal DNS name 'db-prod.internal'. Currently, the database is being moved to an external cloud-managed service that provides a long…
Answer: A. A Service of type ExternalName with the AWS FQDN as the value
An ExternalName Service acts as a DNS alias, cleanly mapping an internal Kubernetes name to an external FQDN. Headless Services with manual endpoints are better suited for static IP addresses rather than dynamic cloud FQDNs.
Q8. An image processing team needs to process a batch of 20 high-resolution images stored in an object storage bucket. Each image takes approximately 5 minutes to process, and each task is handled by a single Pod that exits once the work is do…
Answer: A. Configure a Job with completions set to 20 and parallelism set to 4 to ensure the work is distributed according to the team's performance goals.
Setting completions to 20 ensures all files process, and parallelism dictates running 4 concurrent Pods to handle the workload efficiently. Deployments are designed for long-running services, not batch tasks that exit upon completion.
Q9. A retail company uses a legacy inventory management system that outputs application logs in a proprietary XML format. The DevOps team has recently implemented a centralized monitoring solution based on Prometheus and Grafana, which exclusi…
Answer: A. Deploy an Adapter container that reads the XML logs and exports them in JSON
An Adapter container translates the primary application's output into a format the monitoring system expects, standardizing the logs without altering the legacy code. A Sidecar merely forwards raw logs without performing the required translation.
Q10. A data processing team has a Kubernetes Job that processes 50 large files. Occasionally, the processing of a specific file takes much longer than expected due to external network latency, causing the Job to hang for hours and block subsequ…
Answer: A. Set 'activeDeadlineSeconds' to 1800 in the Job specification (spec) block.
The activeDeadlineSeconds field sets a hard time limit for the entire Job, terminating active Pods once it expires. The ttlSecondsAfterFinished parameter only controls how long a completed Job lingers before automatic deletion.
Q11. A data processing team uses a Kubernetes Job to run a complex simulation that usually takes 20 minutes to complete. Occasionally, due to an external API hang, the simulation process enters an infinite loop, consuming CPU resources indefini…
Answer: A. Set the activeDeadlineSeconds field to 2700 in the Job specification.
The activeDeadlineSeconds field sets the absolute duration limit for a Job, terminating its Pods automatically if exceeded. Avoid using livenessProbe for this, as probes check container health rather than total Job execution time.
Q12. A web application 'frontend-service' is exposed via a ClusterIP Service on port 80. Despite the Pods being in a 'Running' state and the Deployment showing the desired number of replicas, users are experiencing 503 errors when trying to rea…
Answer: A. Check the 'Endpoints' object associated with the Service to confirm that it contains the IP addresses of the running Pods.
The Endpoints object tracks which Pod IPs are eligible to receive traffic from a Service. If this list is empty, your Service selector is not matching the Pod labels, which explains the connection failures.
Q13. You are hosting a production web application on a Kubernetes cluster with an Ingress controller. The security team has mandated that all HTTP traffic must be automatically redirected to HTTPS to ensure data encryption in transit. You need…
Answer: A. Add an annotation such as 'nginx.ingress.kubernetes.io/ssl-redirect: true' to the metadata of the Ingress resource.
Ingress controllers rely on specific metadata annotations to enable features like SSL redirection on a per-resource basis. Changing the backend protocol or Service ports will not configure the controller to issue redirects.
Q14. An old stateful application named 'user-session-store' is being scaled to 3 replicas to handle increased traffic. However, users report that they are being logged out intermittently. Investigation reveals that the application stores sessio…
Answer: A. Configure the Service with sessionAffinity set to ClientIP to ensure sticky sessions based on the user's IP address
Setting sessionAffinity to ClientIP on a Service ensures requests from the same IP route consistently to the same backing Pod. While Ingress annotations offer cookies, native Service stickiness requires this setting.
Q15. A security policy mandates that a data-processing container must run with a strictly enforced read-only root filesystem to prevent unauthorized modifications or persistent malware. However, the application requires a single directory at '/…
Answer: C. Set the securityContext 'readOnlyRootFilesystem' to true and mount an 'emptyDir' volume specifically at '/var/app/cache'.
Setting readOnlyRootFilesystem to true secures the container, while an emptyDir volume mount provides the necessary writable scratch space. Never use privileged mode, as it entirely bypasses container security boundaries.
Q16. Your organization is hosting a suite of microservices where the 'inventory-service' pods are frequently scaled up and down based on demand. You need to expose these pods to other internal services within the cluster using a stable hostname…
Answer: A. A Service of type ClusterIP with a label selector matching the inventory pods, which automatically manages an Endpoints object based on readiness probes.
A ClusterIP Service provides a stable IP and automatically routes traffic only to Pods passing their readiness probes. A Headless Service bypasses this load balancing, returning all Pod IPs directly.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.