Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A data analytics company uses a Kubernetes CronJob to generate daily reports at 01:00 AM. The cluster occasionally under. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A data analytics company uses a Kubernetes CronJob to generate daily reports at 01:00 AM. The cluster occasio…
- A development team is migrating a legacy data-processing application to Kubernetes. The application was desig…
- You are updating a production Deployment named 'order-processor' from version 1 to version 2. The Deployment…
- A Java-based analytics application runs as a non-root user with UID 2000. It needs to process large datasets…
- An application named 'cache-engine' consists of 6 replicas and is deployed in a cluster with 3 nodes. To ensu…
- Your company is deploying a finance application that processes sensitive transactions. To prevent potential k…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A data analytics company uses a Kubernetes CronJob to generate daily reports at 01:00 AM. The cluster occasionally undergoes maintenance or experiences high load, which might prevent the CronJob controller from starting the Job exactly on…
Answer: D. Configure the startingDeadlineSeconds field in the CronJob spec to 1800 to limit the allowed delay.
Setting startingDeadlineSeconds limits how late a Job can start before being skipped entirely. The activeDeadlineSeconds distractor fails because it limits the execution duration of a running Job rather than its start delay.
Q2. A development team is migrating a legacy data-processing application to Kubernetes. The application was designed to run on a single server and requires a specific directory structure at '/var/lib/shared-data' that must be shared and concur…
Answer: D. A PersistentVolumeClaim with the accessModes set to ReadWriteMany.
The ReadWriteMany access mode is required to mount a volume as read-write across multiple nodes simultaneously. The ReadWriteOnce distractor fails because it strictly restricts write access to a single node.
Q3. You are updating a production Deployment named 'order-processor' from version 1 to version 2. The Deployment currently has 10 replicas. To maintain stability, you must ensure that at least 8 replicas are available at all times during the u…
Answer: B. Set maxUnavailable: 2 and maxSurge: 3 in the rollingUpdate strategy.
Using a maxUnavailable of 2 ensures 8 replicas stay available while a maxSurge of 3 strictly limits the total to 13 Pods. Option C fails because percentages round up, exceeding the specified hard limits.
Q4. A Java-based analytics application runs as a non-root user with UID 2000. It needs to process large datasets stored on a PersistentVolume mounted at /data/input. However, the application fails to start with a 'Permission Denied' error beca…
Answer: C. Set the securityContext.fsGroup field to 2000 in the Pod specification to allow Kubernetes to change the volume ownership.
Setting the fsGroup in the Pod securityContext automatically adjusts the mounted volume ownership to match the application. The initContainer distractor fails because running it as root violates strict security boundaries.
Q5. An application named 'cache-engine' consists of 6 replicas and is deployed in a cluster with 3 nodes. To ensure maximum resilience against node failure, you need to configure the Pods so that they are distributed as evenly as possible acro…
Answer: A. Use topologySpreadConstraints with a maxSkew of 1, topologyKey set to kubernetes.io/hostname, and whenUnsatisfiable set to DoNotSchedule.
The correct answer uses topology spread constraints with a maxSkew of one. Pod anti-affinity cannot guarantee even distribution and might block scheduling, while maxSkew explicitly limits the pod count difference across your topology domains.
Q6. Your company is deploying a finance application that processes sensitive transactions. To prevent potential kernel-level attacks, the security team has required that the application containers run with a restricted seccomp profile that onl…
Answer: A. Configure the 'securityContext' at the container level and set the 'seccompProfile' type to 'Localhost' with the 'localhostProfile' set to 'audit.json'
The correct answer configures the security context and sets the seccomp profile type to Localhost. The annotation method is deprecated and no longer valid in modern Kubernetes, so always use the security context for seccomp.
Q7. A high-security financial application requires periodic updates to its database credentials, which are stored in a Kubernetes Secret. The application is designed to watch for file changes and reload configurations dynamically without a pro…
Answer: B. Mount the entire Secret as a volume and ensure the application reads the data from the projected symlinks created by Kubernetes in the mount path.
The correct answer mounts the entire Secret as a volume to allow atomic updates via symlinks. Using subPath breaks this functionality because it creates a direct file mount, preventing the kubelet from injecting live updates.
Q8. CronJob Scheduling. A financial reconciliation task is scheduled to run every 10 minutes via a Kubernetes CronJob. Due to occasional cluster-wide network latency, the job controller might sometimes miss its scheduled start time. The busine…
Answer: A. Set the startingDeadlineSeconds field to 30 in the CronJob specification
The correct answer sets the starting deadline seconds to thirty. If the controller misses this window, it skips the execution, whereas concurrency policy only manages overlapping pods and does not enforce strict start times.
Q9. A financial company needs to secure their 'customer-portal' web service using HTTPS. They have already created a Kubernetes Secret named 'portal-tls-secret' containing the 'tls.crt' and 'tls.key' files. They are using an Ingress resource t…
Answer: D. Add a 'tls' section under the Ingress spec, specifying 'portal.example.com' in the hosts list and 'portal-tls-secret' as the secretName.
Adding a tls section under the Ingress spec correctly references the Secret for TLS termination at the controller. Do not mount Secrets manually into the controller or use backend sections, as the spec.tls block handles certificates natively.
Q10. A proprietary database engine is running as a containerized workload in your production cluster. The application does not provide an HTTP status endpoint or a listening TCP port for health checks; instead, it updates a timestamp in a local…
Answer: B. Configure a livenessProbe using the exec field to run a shell command that checks the modification time of the heartbeat file.
A liveness probe using the exec field correctly triggers the kubelet to restart the container based on internal file changes. TCP and HTTP probes lack arbitrary command execution, and readiness probes control traffic routing rather than restarts.
Q11. A legacy enterprise application is hardcoded to connect to a local database endpoint at 127.0.0.1:5432. However, the database has been moved to a managed cloud service with a specific external DNS endpoint. You need to implement a solution…
Answer: C. Deploy an Ambassador container in the same Pod that listens on 127.0.0.1:5432 and proxies traffic to the external database endpoint.
An ambassador container correctly proxies local loopback traffic to the external database without code changes. ExternalName services cannot bind to local IP addresses like 127.0.0.1, making sidecars the standard adapter pattern.
Q12. In a shared multi-tenant cluster, your 'production' namespace hosts a 'backend-api' deployment. Security requirements dictate that this backend must only be accessible by the 'frontend-web' pods located in the same namespace on TCP port 90…
Answer: C. Define a NetworkPolicy with a podSelector matching 'backend-api' and an ingress rule allowing 'frontend-web' on port 9000.
Defining a NetworkPolicy that targets backend-api and allows ingress from frontend-web on port 9000 correctly isolates the pod. Empty selectors or egress rules fail to secure the target destination from unauthorized callers.
Q13. You are managing a shared development namespace where a ResourceQuota is enforced to limit total CPU usage to 8 cores. A developer submits a Deployment for a high-performance API that consists of 3 replicas. Each Pod in the Deployment cont…
Answer: D. The Deployment will be accepted, but the third Pod will remain in Pending state because it exceeds the namespace's total CPU quota
The Deployment is accepted, but the third Pod stays Pending because the namespace ResourceQuota is exceeded. Quotas are checked during Pod admission by the API server, not by stripping sidecars or immediately rejecting the Deployment.
Q14. A legacy Java-based microservice is being migrated to Kubernetes. During internal testing, it was observed that the application takes approximately 180 seconds to initialize its internal cache and start the JVM before it can respond to any…
Answer: A. Implement a startupProbe with a failureThreshold and periodSeconds that cover the 180-second window before the livenessProbe takes over
A startupProbe correctly protects slow-starting applications from liveness checks killing them prematurely. Relying on initialDelaySeconds makes later deployments fragile if startup times vary, whereas startup probes adapt seamlessly.
Q15. Your security policy requires strict egress control for all Pods in the 'payment-processing' namespace. Specifically, the 'transaction-validator' Pod must be able to communicate with an external bank API at 203.0.113.5 and resolve DNS via…
Answer: C. Define an Egress policy with two rules: one with an ipBlock for 203.0.113.5 and another allowing UDP/TCP on port 53 to the kube-dns CIDR.
The correct answer works because an Egress NetworkPolicy explicitly permits traffic to the specified ipBlock and allows DNS resolution via port 53, while implicitly blocking all other outbound traffic. Remember that Kubernetes network policies are default-deny once applied, so you must explicitly allow DNS.
Q16. A security-sensitive application requires a configuration file containing dynamic API tokens. These tokens are updated every hour by an external security orchestrator that modifies the corresponding Kubernetes Secret. The application is de…
Answer: C. Mount the Secret as a volume in the Pod, as Kubernetes automatically updates the projected files when the Secret object changes
Mounting the Secret as a volume is correct because the kubelet automatically handles syncing and updating the mounted files whenever the underlying Secret object changes. Environment variables loaded from Secrets remain static after pod creation and do not support live updates without a manual restart.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.