Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your organization is deploying a microservice that generates high volumes of temporary logs which need to be processed b. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- Your organization is deploying a microservice that generates high volumes of temporary logs which need to be…
- A legacy financial application is being migrated to Kubernetes. The application is designed to run as a singl…
- A Node.js application is experiencing intermittent crashes shortly after starting up. You suspect that the li…
- A DevOps engineer is investigating why a Java-based microservice is constantly restarting. The Pod descriptio…
- Your team is deploying a data processing application that runs as a non-root user with UID 2000. The applicat…
- A batch processing job is designed to handle video transcoding tasks. Occasionally, a malformed video file ca…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your organization is deploying a microservice that generates high volumes of temporary logs which need to be processed by a secondary 'log-aggregator' container residing in the same Pod. The logs should be stored in a way that they are acc…
Answer: C. An emptyDir volume with the medium set to Memory for high-speed access
An emptyDir volume with the medium set to Memory provides high-speed, RAM-backed ephemeral storage that is shared between containers in the same Pod. On the exam, remember that emptyDir volumes are erased when the Pod is removed from the node.
Q2. A legacy financial application is being migrated to Kubernetes. The application is designed to run as a single instance because it performs exclusive file-level locking on a shared directory. If two instances of the application attempt to…
Answer: B. Update the deployment strategy to Recreate to ensure the old Pod is terminated before the new one starts
The Recreate deployment strategy terminates all existing Pods before starting new ones, ensuring no overlap occurs during updates. RollingUpdate cannot achieve this because it inherently requires surging or tearing down Pods concurrently.
Q3. A Node.js application is experiencing intermittent crashes shortly after starting up. You suspect that the livenessProbe is killing the container before it has finished a mandatory data migration step that occurs on startup. The migration…
Answer: D. Add a startupProbe to the container that monitors the application's health and disables the livenessProbe until the startup is complete.
A startupProbe runs first and disables other probes until it succeeds, making it perfect for slow initializations. Increasing the liveness probe delay is a weaker solution because it delays detecting deadlocks later in the application lifecycle.
Q4. A DevOps engineer is investigating why a Java-based microservice is constantly restarting. The Pod description shows an Exit Code 137 and the Status is 'OOMKilled'. The container has a memory limit of 1Gi specified in the manifest, but the…
Answer: C. Adjust the container memory limit to be higher than the Java Heap Size, for example setting the limit to 2Gi.
An OOMKilled status means the container exceeded its Kubernetes memory limit, so you must increase the container limit above the JVM heap size. Reducing memory requests only changes scheduling and does not prevent the container from being killed.
Q5. Your team is deploying a data processing application that runs as a non-root user with UID 2000. The application needs to write temporary files to a PersistentVolumeClaim mounted at /var/app/data. During testing, the application fails with…
Answer: B. Use the fsGroup field in the Pod's securityContext to specify the group ID 2000 for all volumes in the Pod.
Using the fsGroup field in the Pod security context ensures Kubernetes automatically adjusts the mounted volume ownership for the specified group. This allows non-root users to write to the directory without requiring insecure privileged access.
Q6. A batch processing job is designed to handle video transcoding tasks. Occasionally, a malformed video file causes the container to exit with a non-zero status. The engineering team wants to ensure that the Job controller attempts to retry…
Answer: A. Set the backoffLimit field in the Job spec to 4, which determines the number of retries before the Job is considered failed.
The backoffLimit field defines the exact number of retries the Job controller will attempt before marking the Job as failed. The parallelism field only controls the number of Pods running simultaneously, not failure retries.
Q7. Ambassador Container Pattern. You are managing a microservice that needs to communicate with different versions of an external legacy database depending on the geographic region of the request. To avoid bloating the main application code w…
Answer: C. The Ambassador pattern, where a sidecar container acts as a specialized proxy for external communication
The Ambassador pattern acts as a dedicated proxy inside the Pod, abstracting complex external routing away from the main application. The Adapter pattern is incorrect because it transforms output data rather than routing traffic.
Q8. A multi-container Pod is designed for log processing. The 'app-container' writes its operational logs to a directory at /var/log/app, while the 'sidecar-log-shipper' container needs to read these logs in real-time to compress and upload th…
Answer: D. Define an emptyDir volume in the Pod spec and mount it at /var/log/app in both the app-container and the sidecar-log-shipper.
An emptyDir volume is explicitly designed for sharing ephemeral data between containers within the same Pod, automatically deleting its contents when the Pod is removed. On the exam, look for the keywords ephemeral and shared between containers to immediately identify emptyDir over PersistentVolumeClaims.
Q9. Your organization is hosting a multi-service web platform. You need to expose the user-portal service at the URL https://portal.example.org/dashboard. The traffic must be encrypted using a TLS certificate stored in a Secret named portal-tl…
Answer: B. Define an Ingress with a tls section specifying the host and the secretName, and a rule for host portal.example.org with the path /dashboard
An Ingress resource uses a dedicated tls block to bind a Kubernetes Secret for TLS termination, while rules route specific host and path combinations to backend services. NodePort or Service annotations do not handle layer seven path-based routing or native TLS termination.
Q10. A specialized monitoring agent is deployed as a Pod in the cluster. This agent needs to programmatically list and update all ConfigMaps within its own namespace to synchronize local settings. For security reasons, the agent should not have…
Answer: C. Create a custom ServiceAccount, a Role granting access only to ConfigMaps, and a RoleBinding to associate them with the Pod
You grant specific API permissions to a Pod by binding a custom ServiceAccount to a properly scoped Role using a RoleBinding. Using the default ServiceAccount with cluster-admin or hardcoding tokens violates the principle of least privilege and fails security best practices.
Q11. Your team needs to process a large batch of 50 work items using a Kubernetes Job. Each work item is independent and has an integer ID from 0 to 49. To optimize the process, you want to run 5 Pods in parallel. Each Pod must be able to deter…
Answer: D. Set completionMode to Indexed and specify a completions value of 50 with a parallelism of 5.
Indexed Jobs provide each Pod with a unique completion index via the JOB_COMPLETION_INDEX environment variable, allowing parallel workers to partition workloads without external coordination. Using standard Jobs or Deployments requires custom scripts or external state tracking to assign work.
Q12. You are deploying a distributed database system using a StatefulSet. Each database node needs to discover its peers by performing a DNS lookup that returns the individual IP addresses of all Pods in the set. A standard Service with a Clust…
Answer: B. Create a Headless Service by setting 'clusterIP: None' in the Service specification and ensuring the selector matches the StatefulSet pods.
A Headless Service, created by setting clusterIP to None, returns the individual Pod IP addresses via DNS instead of a single virtual IP. This behavior is essential for StatefulSet peer discovery, whereas standard Services only provide load-balanced virtual IPs.
Q13. You are deploying a new microservice that communicates via gRPC on port 50051. The application takes about 10 seconds to start and initialize its internal buffer. You want to implement a liveness probe that specifically uses the gRPC healt…
Answer: A. Configure the livenessProbe with the grpc field, specifying the port as 50051 and leaving the service field empty or as a specific string.
For clusters running v1.24 or later, you configure a native gRPC probe by specifying the grpc field and the appropriate port directly in the probe definition. The older exec method using the sidecar binary is no longer necessary and adds unnecessary operational overhead.
Q14. Your engineering team is deploying a multi-container Pod where the main application container writes its internal state to a specific file at /data/state.log. A second sidecar container is required to read this file and transmit the data t…
Answer: B. Define an emptyDir volume in the Pod spec and mount it at the required paths in both containers
An emptyDir volume is explicitly designed for sharing ephemeral data between containers within the same Pod, automatically deleting its contents when the Pod is removed. ConfigMaps or PersistentVolumeClaims are incorrect because they persist data beyond the Pod lifecycle.
Q15. A cluster has a specific set of nodes equipped with specialized hardware for machine learning. These nodes have been tainted with 'hardware=specialized:NoSchedule' to prevent general workloads from being scheduled on them. You are deployin…
Answer: B. Add a toleration to the Pod spec with the key 'hardware', operator 'Equal', value 'specialized', and effect 'NoSchedule'.
Tolerations are applied to Pods to allow them to be scheduled onto tainted nodes matching the specified key, value, and effect. Node affinity and selectors attract Pods to nodes but do not override taints that explicitly repel workloads with NoSchedule.
Q16. A security auditor has mandated that the 'payment-gateway' Pod in the 'finance' namespace must be isolated from the rest of the network. The Pod requires access from the corporate management subnet 10.50.0.0/16 to receive administrative co…
Answer: A. An ingress rule using an ipBlock with cidr: 10.50.0.0/16 and an except: [10.50.10.25/32] field
The ipBlock field in a NetworkPolicy allows you to define a broad CIDR range while using the except field to exclude specific IP addresses or subnets. Kubernetes NetworkPolicies are additive and do not support priorities, so separate deny rules will not work.
Q17. A security-hardened Pod is configured to run as a non-root user with UID 5000 for compliance reasons. The application container needs to write logs and temporary files to a volume mounted from a PersistentVolumeClaim. After deployment, the…
Answer: C. Define the fsGroup: 5000 setting within the Pod-level securityContext to ensure Kubernetes changes the ownership and permissions of the volume to the specified group.
Setting fsGroup in the Pod securityContext ensures Kubernetes recursively changes the mounted volume ownership to the specified group identifier. This allows non-root containers to write to attached storage, avoiding the need for insecure privileged init containers.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.