Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are deploying a distributed stateful application that requires each instance to have a stable network identity. Spec. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- You are deploying a distributed stateful application that requires each instance to have a stable network ide…
- You are migrating a legacy application to Kubernetes. The application is hardcoded to connect to a database a…
- A network security tool needs to be deployed as a Pod to monitor packet headers and perform diagnostic traces…
- Your organization is hosting a web application through a Service named 'frontend-svc'. You need to implement…
- An application is generally healthy but occasionally becomes extremely slow while performing heavy background…
- An enterprise resource planning system written in Java experiences a heavy startup phase where it initializes…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are deploying a distributed stateful application that requires each instance to have a stable network identity. Specifically, each pod must be addressable by a unique DNS name (e.g., 'data-node-0.data-svc') so they can form a cluster a…
Answer: B. Deploy the application as a StatefulSet and create a Headless Service by setting 'clusterIP: None' in the Service spec.
A StatefulSet paired with a Headless Service provides stable pod identities like data-node-0, returning individual pod IPs via DNS. Standard ClusterIP Services load balance across pods, destroying direct pod-to-pod routing required for clustered stateful apps.
Q2. You are migrating a legacy application to Kubernetes. The application is hardcoded to connect to a database at 'localhost:5432'. However, the database is now running as an external managed service outside the cluster. You cannot modify the…
Answer: C. Deploy an ambassador container in the same Pod that listens on localhost:5432 and proxies traffic to the external database's address.
An ambassador container runs in the same pod network namespace, allowing it to listen on localhost and proxy traffic to the external database. Kubernetes Services and HostAliases cannot bind external traffic to the localhost loopback address.
Q3. A network security tool needs to be deployed as a Pod to monitor packet headers and perform diagnostic traces. To function correctly, the container's process requires the 'NET_ADMIN' capability to modify network interfaces and 'NET_RAW' to…
Answer: B. Define a securityContext at the container level and add 'NET_ADMIN' and 'NET_RAW' to the capabilities list.
Adding specific capabilities like NET_ADMIN and NET_RAW via the container securityContext follows the principle of least privilege. Enabling privileged mode grants excessive unwanted root access, while PodSecurityPolicies are deprecated and removed.
Q4. Your organization is hosting a web application through a Service named 'frontend-svc'. You need to implement a Blue-Green deployment strategy where you have two identical Deployments, 'app-blue' (v1) and 'app-green' (v2), running simultane…
Answer: B. Modify the selector in the 'frontend-svc' Service definition to match the labels of the 'app-green' Pods
Modifying the Service selector immediately shifts traffic to the new deployment pods based on their updated labels. Deleting the old deployment causes unintended downtime, violating the instantaneous traffic shift requirement of a blue-green deployment.
Q5. An application is generally healthy but occasionally becomes extremely slow while performing heavy background data migrations. During these specific latency spikes, the application should stop receiving new user requests to avoid timeout e…
Answer: D. Configure a Readiness probe to detect the latency and fail when the app is slow, while keeping the Liveness probe configured to check only the basic process existence.
A failing Readiness probe removes the pod from Service endpoints, stopping traffic during latency spikes without restarting it. A Liveness probe failure triggers a restart, which would corrupt the ongoing background data migration and cause data loss.
Q6. An enterprise resource planning system written in Java experiences a heavy startup phase where it initializes a local cache and validates remote database connections. This process typically takes between 60 and 120 seconds. During this tim…
Answer: C. Configure a startupProbe with a sufficient failureThreshold and periodSeconds to cover the initialization period.
A startupProbe disables liveness and readiness checks until it succeeds, protecting slow-starting applications from premature termination. Using initialDelaySeconds forces you to guess maximum startup times, leaving the application unprotected if it hangs later.
Q7. Your e-commerce platform uses an Ingress resource to manage traffic to various microservices. For the checkout service, it is critical that once a user starts a session, all subsequent requests from that specific user are routed to the sam…
Answer: D. Add the annotation nginx.ingress.kubernetes.io/affinity set to cookie and specify the cookie name using the session-cookie-name annotation.
NGINX Ingress controllers handle sticky sessions via specific annotations rather than standard Kubernetes object fields. Do not choose the native serviceAffinity option, as that applies strictly to Layer 4 Service routing, not Layer 7 Ingress configurations.
Q8. An engineering team is deploying a memory-intensive data processing tool called data-cruncher in the analytics namespace. During peak hours, this application has a tendency to consume all available memory on the worker node, leading to the…
Answer: C. Omit both the requests and limits fields in the container specification to categorize the Pod into the BestEffort Quality of Service class.
Omitting requests and limits assigns the BestEffort QoS class, making these pods the first evicted during node memory pressure. Avoid the Burstable option, as setting explicit limits restricts the pod from utilizing spare memory.
Q9. A production Pod running a critical API is based on a distroless image, meaning it contains no shell (like bash or sh) and no package manager. You are observing intermittent 500 errors and need to inspect the network connections and local…
Answer: C. Use 'kubectl debug' to create an ephemeral container inside the existing Pod that shares the same network and process namespaces
The kubectl debug command injects an ephemeral container into a running pod to share its namespaces for troubleshooting. You cannot kubectl exec into a distroless image lacking a shell, nor can you modify a running pod's containers.
Q10. A DevOps engineer is hardening a Pod for a sensitive data-processing application. For security compliance, the container must run as a non-root user with UID 2000. However, the application needs to write logs to a volume mounted at /var/lo…
Answer: B. Configure the fsGroup field within the Pod-level SecurityContext to manage volume ownership
Setting the fsGroup field in the pod-level security context automatically adjusts mounted volume ownership for the specified group. Simply using runAsUser changes the executing user but does not fix the underlying volume ownership problem.
Q11. You are managing an Ingress resource for a company's API platform. The platform is currently transitioning from an older version of the API to a newer one. You need to configure the Ingress so that requests to 'api.company.com/v1' are rout…
Answer: D. Define a single Ingress resource with multiple paths under the same host rule, each pointing to its respective service
A single Ingress resource can route traffic to different backend services based on multiple URL path definitions. Avoid creating separate Ingress objects for this, as combining them under one host rule cleanly manages path-based routing.
Q12. Advanced Liveness Probes: A Java application is known to suffer from heap exhaustion that doesn't immediately crash the JVM but makes the application completely unresponsive to requests. A standard TCP check on the application port still s…
Answer: B. Configure an HTTP Liveness Probe that targets a specific /health endpoint returning a 200 OK status
An HTTP liveness probe validates actual application health by checking a dedicated endpoint. TCP probes are inadequate here because the network socket remains open even when the application is frozen and cannot process traffic.
Q13. Your application needs to connect to several external third-party APIs that require complex authentication, retry logic, and circuit breaking. To simplify the application code, the development team wants to offload these networking concern…
Answer: D. The Ambassador pattern where a proxy container manages and simplifies the connection between the application and external services.
The Ambassador pattern acts as a local proxy to shield the main application from complex external networking duties. The Sidecar pattern is the strongest distractor, but it focuses on local enhancements rather than proxying external traffic.
Q14. A retail company wants to test version 2 of their search engine with a small subset of production traffic. They do not have an Ingress controller that supports traffic splitting or weighting. The team decides to use a single Service and tw…
Answer: B. Apply a common label like 'app: search-engine' to both Deployments, then set version 1 to 3 replicas and version 2 to 1 replica, and point the Service selector to 'app: search-engine'.
A Service load balances randomly across all matching Pods, so matching four total Pods sends roughly twenty five percent of traffic to the single version two Pod. Option D fails because it requires a specific Ingress controller.
Q15. A developer has deployed a Node.js application that performs a heavy initialization of its cache. During this period, which lasts about 45 seconds, the application is technically running and passing TCP health checks, but it cannot yet pro…
Answer: A. Add a ReadinessProbe that performs an HTTP GET request to a specific /health/ready endpoint in the application.
A ReadinessProbe controls when a Pod joins a Service endpoint list to receive traffic. The LivenessProbe distractor fails because it only restarts unhealthy containers and does not manage traffic routing.
Q16. Your organization is deploying a legacy data transformation tool that requires exclusive access to a persistent disk. This disk is mounted via a PersistentVolumeClaim with the ReadWriteOnce access mode. When you update the Deployment to a…
Answer: A. Change the deployment strategy type to Recreate to ensure all existing Pods are terminated before any new Pods are created.
The Recreate strategy ensures old Pods terminate before new ones start, preventing attachment conflicts with ReadWriteOnce volumes. The RollingUpdate option fails because it still attempts to create new Pods before old ones fully terminate.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.