Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your team is migrating a microservices-based application to Kubernetes, but the central relational database is still hos. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- Your team is migrating a microservices-based application to Kubernetes, but the central relational database i…
- You are updating a high-availability 'order-engine' Deployment from version 'v1' to 'v2'. The Deployment curr…
- A high-availability transaction API service is currently running with 12 replicas in a production Kubernetes…
- A developer is complaining that every time they update a ConfigMap, the application Pods continue to use the…
- Your engineering team is deploying a sensitive microservice named report-exporter in the production namespace…
- A modern data analytics platform generates operational metrics in a legacy XML format. The central monitoring…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your team is migrating a microservices-based application to Kubernetes, but the central relational database is still hosted on a legacy physical server outside the cluster with a static IP address of 192.168.10.50. You want the Kubernetes-…
Answer: C. Create a Service without a selector, then manually create an Endpoints object with the same name pointing to 192.168.10.50.
Creating a selectorless Service paired with a manually created Endpoints object maps a cluster DNS name to an external IP. An ExternalName Service requires a DNS name, not an IP address.
Q2. You are updating a high-availability 'order-engine' Deployment from version 'v1' to 'v2'. The Deployment currently runs with 10 replicas. To ensure that the system's capacity never drops below 80% during the update process and that the clu…
Answer: D. Set 'maxUnavailable' to 2 and 'maxSurge' to 2 within the Deployment's rollingUpdate strategy configuration.
Setting maxUnavailable to 2 guarantees 8 Pods remain running, while maxSurge limits the total to 12 Pods during the update. Option B uses percentages that incorrectly allow 3 unavailable Pods.
Q3. A high-availability transaction API service is currently running with 12 replicas in a production Kubernetes cluster. To ensure business continuity during an upcoming software update, the management has established two strict constraints…
Answer: A. Set maxUnavailable to 2 and maxSurge to 3 in the deployment strategy
Setting maxUnavailable to 2 ensures at least 10 Pods remain available, while maxSurge limits total running Pods to 15. Options with a maxSurge of 15 or maxUnavailable of 10 violate the stated replica boundaries.
Q4. A developer is complaining that every time they update a ConfigMap, the application Pods continue to use the old configuration data. Investigation reveals that the ConfigMap is mounted as a volume. However, the application only reads its c…
Answer: B. Adding a version-specific annotation to the Pod template in the Deployment that changes when the ConfigMap changes
Adding a dynamic annotation, like a config hash, to the Pod template forces a rolling restart when the ConfigMap changes. Kubernetes does not automatically restart Pods when mounted ConfigMap volumes update.
Q5. Your engineering team is deploying a sensitive microservice named report-exporter in the production namespace. This microservice is designed to send daily PDF reports to a specific external FTP server located at the static IP address 203.0…
Answer: A. Create a NetworkPolicy with an egress rule containing an ipBlock that specifies 203.0.113.10/32 and an empty podSelector for other rules.
Using a default-deny NetworkPolicy with an egress rule for a specific ipBlock perfectly restricts outgoing traffic to the target IP. Ingress resources manage incoming traffic, while ExternalName services merely alias DNS names without restricting outbound network access.
Q6. A modern data analytics platform generates operational metrics in a legacy XML format. The central monitoring system, however, only supports JSON ingestion via a specific REST endpoint. Your team needs to implement a solution where the tra…
Answer: A. Implement an Adapter container that reads the XML output from a shared volume, converts it to JSON, and exposes it.
The adapter pattern standardizes main container output into formats external systems expect by processing shared files locally. An ambassador container proxies external network traffic, while a sidecar is a general term not specific to data translation.
Q7. Your organization is migrating a high-performance microservice to Kubernetes that uses gRPC for all internal communications. To ensure the highest level of reliability, you want to implement a liveness probe that checks the application's h…
Answer: D. Use a Liveness Probe with the grpc field, specifying the port as 9000 and leaving the service field empty or set to the appropriate service name.
Native gRPC probes use the dedicated grpc field allowing the kubelet to properly check application health without extra binaries. A TCP socket probe only verifies the connection, failing to detect deadlocks at the application layer.
Q8. You are securing a multi-tenant application where the 'frontend' pods in the 'web-system' namespace must communicate with 'backend' pods in the 'data-api' namespace. To follow the principle of least privilege, you need to create a NetworkP…
Answer: A. Configure an ingress rule with both a namespaceSelector and a podSelector as separate items in the same peer element to ensure both conditions must be met.
When you define a namespaceSelector and a podSelector within the same networkPolicyPeer block, they act as a logical AND. Placing them in separate peer blocks would act as an OR, allowing unwanted traffic from any matching pod.
Q9. You are performing a Blue-Green deployment for a high-traffic API. The current version (Blue) is managed by a Deployment named 'api-v1' and is exposed by a Service named 'api-service' using the selector 'app: api, version: v1'. You have su…
Answer: A. Update the selector of the 'api-service' Service to change the 'version' label from 'v1' to 'v2', effectively re-pointing the service to the new pods.
Updating the Service selector is the defining step of a Blue-Green deployment, allowing an instantaneous traffic switch at the networking layer. Changing DNS records or performing a rolling update defeats the purpose of maintaining both deployments for an immediate cutover.
Q10. A developer is deploying a microservice named 'auth-processor' into the 'security-prod' namespace. The namespace is governed by a ResourceQuota that limits total CPU requests to 2000m and total Memory requests to 4Gi. The deployment is con…
Answer: A. Reduce the total requested resources per pod or the replica count to fit within the 2000m CPU and 4Gi Memory limit
The cumulative resource requests of the deployment exceed the namespace quota, causing the scheduler to keep the pods pending. You must lower the requested resources per pod or reduce the replica count to fit within the hard quota limits.
Q11. In a multi-tenant cluster, you have two namespaces: 'accounting' and 'inventory'. To comply with internal security regulations, the 'accounting-db' Pod in the 'accounting' namespace must only be accessible by Pods that are located in the '…
Answer: C. Create a NetworkPolicy in the 'accounting' namespace with an ingress rule using a 'namespaceSelector' that matches the 'inventory' namespace labels.
A NetworkPolicy using a namespaceSelector is the correct approach for restricting ingress to a specific namespace. RBAC roles only restrict Kubernetes API access and do not block network traffic between pods.
Q12. Your organization operates a multi-tenant cluster where the 'secure-backend' namespace hosts a sensitive PostgreSQL database. A strict security policy dictates that this database must only accept incoming traffic on port 5432 from Pods tha…
Answer: A. Use a namespaceSelector with matchLabels for the frontend-prod namespace
To restrict traffic to a specific namespace, your NetworkPolicy ingress rule must use a namespaceSelector matching the labels of the target namespace. Standard podSelectors without namespaceSelectors apply only within the same namespace.
Q13. You are investigating a recurring issue where a memory-intensive Java application Pod is being terminated with the status 'OOMKilled'. Upon checking the Pod manifest, you see that the memory request is set to 512Mi and the limit is set to…
Answer: B. Increase the memory limit in the Pod specification to accommodate the load
An OOMKilled status indicates the container exceeded its hard memory limit, so increasing the memory limit gives the application the necessary headroom. Pod priority and CPU adjustments do not prevent the kernel from killing a process that exceeds its memory constraints.
Q14. Your team is managing a Node.js application that requires a specific environment variable named DATABASE_URL to establish a connection to the data layer. However, the organization's existing ConfigMap, named shared-db-config, stores this v…
Answer: A. Use the valueFrom field with configMapKeyRef to map the specific key connection_string from the ConfigMap to the environment variable DATABASE_URL.
The valueFrom field with configMapKeyRef provides explicit one-to-one key mapping for environment variables. This decouples the application's expected variable name from the ConfigMap key. The envFrom field imports all keys without allowing renaming.
Q15. Your organization is deploying a high-traffic API that must remain highly available during updates. The current deployment has 20 replicas. The engineering lead specifies that during a rolling update, the system must never drop below 80 pe…
Answer: C,D. Set maxUnavailable to 4 units and maxSurge to 25 percent in the strategy block. || Set maxUnavailable to 20 percent and maxSurge to 5 units in the strategy block.
Setting maxUnavailable to 4 maintains 16 pods, exactly 80 percent of the desired capacity. Setting maxSurge to 25 percent allows 5 extra pods, reaching the 125 percent maximum limit. Options using percentages incorrectly calculate the available units.
Q16. A security audit of the 'customer-portal' application revealed that the container is running with excessive privileges. Specifically, the container is running as the root user, and the entire root filesystem is writable, which could allow…
Answer: A. Set runAsNonRoot to true and configure a securityContext with readOnlyRootFilesystem set to true, while mounting an emptyDir at /var/log/app/
Setting readOnlyRootFilesystem to true secures the container, and an emptyDir allows necessary application logging. Using a hostPath volume violates security isolation, and resource quotas restrict disk usage but do not prevent root filesystem tampering.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.