Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A developer is attempting to deploy a new Pod in the 'research-dev' namespace. Although the cluster has plenty of free C. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A developer is attempting to deploy a new Pod in the 'research-dev' namespace. Although the cluster has plent…
- ConfigMap Immutability. A large-scale web application uses a ConfigMap containing 200 parameters. The operati…
- Your organization has a strict network isolation policy. You are deploying a three-tier application where the…
- InitContainer Patterns. You are deploying a mission-critical web application that depends on a database being…
- You are containerizing a legacy application that writes its logs to a local file at '/mnt/logs/app.log' in a…
- You are managing an Ingress resource for a global SaaS platform. The requirement is to route all traffic for…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A developer is attempting to deploy a new Pod in the 'research-dev' namespace. Although the cluster has plenty of free CPU and memory across its nodes, the Pod remains in a 'Pending' state indefinitely. When running 'kubectl describe pod'…
Answer: D. The namespace has a ResourceQuota enabled, and because the Pod does not define resource requests/limits, it is being rejected by the admission controller.
A ResourceQuota tracking CPU and memory forces every Pod to define those values before admission. Remember that LimitRanges set default requests, whereas ResourceQuotas hard-block any Pod missing them.
Q2. ConfigMap Immutability. A large-scale web application uses a ConfigMap containing 200 parameters. The operations team has noticed that whenever the ConfigMap is updated, the Kubelet on various nodes consumes significant CPU resources to wa…
Answer: D. Set the 'immutable' field to true in the ConfigMap metadata to stop the Kubelet from watching for updates
Setting the immutable field to true disables kubelet polling, dropping unnecessary API server load. Secrets and ConfigMaps behave identically here, so swapping object types won't help.
Q3. Your organization has a strict network isolation policy. You are deploying a three-tier application where the 'database' Pods are located in the 'data' namespace. These database Pods should only accept incoming traffic on port 5432 from Po…
Answer: A. Define an Ingress rule with a podSelector for 'role: backend' and a namespaceSelector that matches the 'app' namespace label
Combining namespaceSelector and podSelector within a single ingress rule creates the required logical AND condition. Using CIDR ranges is brittle because Pod IPs are ephemeral and dynamic.
Q4. InitContainer Patterns. You are deploying a mission-critical web application that depends on a database being fully initialized and reachable. If the application starts before the database is ready, it enters a failed state and requires a…
Answer: D. Add an InitContainer with a script that uses nc or a similar tool to loop until port 5432 is open
Init containers run sequentially and must complete before the main app starts. Probes only act after startup, so they cannot delay the initial container boot process.
Q5. You are containerizing a legacy application that writes its logs to a local file at '/mnt/logs/app.log' in a proprietary binary format. A requirements document states that these logs must be converted to JSON and printed to the standard ou…
Answer: D. Add an Adapter container to the Pod that reads the binary log file, converts it to JSON, and writes it to its own stdout.
The Adapter pattern transforms the primary application output into a standardized format like JSON. A standard sidecar merely tails logs without modifying their underlying format.
Q6. You are managing an Ingress resource for a global SaaS platform. The requirement is to route all traffic for 'example.com/api/v1' to the 'api-v1-service' and all traffic for 'example.com/api/v2' to the 'api-v2-service'. You must ensure tha…
Answer: C. Use the Prefix pathType for the paths '/api/v1' and '/api/v2' to match based on the URL path components.
The Prefix pathType separates URL elements by slashes, preventing accidental matches. Exact matching would block legitimate sub-paths, breaking standard API endpoint routing.
Q7. A distributed data-processing system uses a Kubernetes Job to process 100 independent work items. Each item takes about 30 seconds to complete. You have noticed that if a few items fail, the entire Job retries too many times, delaying the…
Answer: B. Set completions to 100, parallelism to 5, and backoffLimit to 4 in the Job specification template.
Setting parallelism and completions distributes the workload while backoffLimit halts execution after failures. Use the backoffLimit instead of activeDeadlineSeconds to stop based on error counts.
Q8. Hardening Pod Security. Your DevOps team is deploying a Python-based web scraper that interacts with the local filesystem for temporary storage. To minimize the attack surface, the security policy mandates that the container must not be al…
Answer: D. Set allowPrivilegeEscalation to false and readOnlyRootFilesystem to true in the container securityContext
Setting allowPrivilegeEscalation to false blocks setuid exploits while a read-only root filesystem protects the base image. PodSecurityPolicies were removed in version 1.25, making them an invalid distractor.
Q9. A developer is building a microservice that needs to communicate with a legacy key-value store. The store requires complex request signing and a specific authentication protocol that is difficult to implement in the main application langua…
Answer: B. The Ambassador pattern, implemented by adding a second container to the Pod that handles the signing logic and listens on localhost
The Ambassador pattern acts as an outbound proxy managing complex connections to external services. Unlike an Adapter, it brokers outbound traffic rather than normalizing application output.
Q10. A critical payment-gateway application must perform a cleanup operation and notify an external monitoring service whenever its Pod is about to be terminated. The notification must include the final status of internal transactions to preven…
Answer: C. Add a preStop hook that executes the cleanup command and set the terminationGracePeriodSeconds for the Pod to a value like 60.
The preStop hook executes cleanup logic before the SIGTERM signal reaches the container. Pairing it with a longer terminationGracePeriodSeconds ensures the pod avoids a premature SIGKILL. PostStart hooks run immediately at startup, making them useless for termination.
Q11. Your company uses a set of nodes equipped with ultra-fast NVMe storage labeled with 'disktype=ssd-nvme'. These nodes are reserved for high-I/O database workloads only. You need to ensure that regular web application Pods are never schedule…
Answer: D. Apply a Taint to the NVMe nodes and add a matching Toleration and NodeAffinity to the database Pods
The correct answer applies a Taint to repel standard workloads while using Toleration and NodeAffinity to specifically attract the database Pods. NodeSelector alone cannot repel unwanted pods from the NVMe nodes.
Q12. Your engineering team is deploying a specialized data-crunching Job that must process 10 distinct data partitions. Each execution of the container needs to know its unique index (from 0 to 9) to determine which data partition to fetch from…
Answer: A. Set the Job completionMode to Indexed and access the JOB_COMPLETION_INDEX environment variable inside the container
The correct answer uses an indexed completion mode to automatically expose the job completion index. This is the native Kubernetes feature for parallel processing, preventing the need for complex API queries to identify partitions.
Q13. An engineering team is migrating a legacy on-premises application suite to Kubernetes. One of the microservices is hardcoded to connect to a database using the hostname 'db.internal.production'. However, the actual database has been moved…
Answer: C. A Service of type ExternalName with the externalName field set to db-cluster-xyz.provider.com and the metadata name db.internal.production
The correct answer creates an ExternalName Service. This acts as a CNAME record in cluster DNS, seamlessly redirecting the hardcoded internal hostname to the external cloud database without requiring application changes.
Q14. A financial services application needs to be exposed externally via the domain 'transactions.secure-bank.com'. Corporate security mandates that all external traffic must be encrypted using TLS. You have been provided with a TLS certificate…
Answer: C. Create a Kubernetes Secret of type kubernetes.io/tls and reference it in the 'tls' section of the Ingress resource manifest.
Creating a Secret of type kubernetes.io/tls and referencing it in the Ingress spec correctly terminates TLS at the controller. Avoid base64 encoding certificates directly in annotations, as standard manifests use the tls block.
Q15. A custom database container does not have an HTTP health check endpoint but instead indicates its health by maintaining a specific lock file at '/var/lib/db/active.lock'. If the database process crashes or hangs, it stops updating this fil…
Answer: A. An exec probe that runs the command 'test -f /var/lib/db/active.lock' to check for the existence of the file.
An exec probe runs a command directly inside the container, making it perfect for checking file existence. Using tcpSocket would only check if the port is open, which fails to verify if the underlying process is actually healthy or hung.
Q16. A security audit requires that a high-risk financial processing Pod in the production namespace must have its system calls restricted using a custom Seccomp profile named 'audit-policy.json'. This profile has been pre-distributed to the /v…
Answer: B. Add a securityContext to the container with seccompProfile set to type 'Localhost' and localhostProfile set to 'audit-policy.json'.
Setting the seccompProfile to Localhost with the specific profile name applies the custom security profile at the container level. The annotation-based method is completely deprecated and replaced by the modern securityContext fields.
Q17. Your organization has implemented a strict security policy requiring all applications to follow the principle of least privilege. You are deploying a Python-based web scraper that only needs to write temporary data to /tmp and listen on po…
Answer: A. Configure allowPrivilegeEscalation to false and set readOnlyRootFilesystem to true, while providing an EmptyDir volume for the /tmp directory.
Setting readOnlyRootFilesystem to true blocks writes across the entire container, while mounting an emptyDir to /tmp explicitly allows necessary temporary logging. Disabling privilege escalation ensures compromised processes cannot gain root.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.