Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A data reconciliation CronJob is scheduled to run every day at midnight. Occasionally, the cluster is under heavy load o. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A data reconciliation CronJob is scheduled to run every day at midnight. Occasionally, the cluster is under h…
- A security-sensitive application in your production cluster needs to authenticate with an external cloud prov…
- Your organization is preparing to release a significant version update (v2.0) of a critical booking engine. T…
- Your organization is hosting a multi-tenant platform where internal services are exposed via an Ingress resou…
- A data-intensive application requires a specific configuration manifest and several binary assets to be downl…
- Your organization is migrating a legacy application that is hardcoded to connect to a database only on localh…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A data reconciliation CronJob is scheduled to run every day at midnight. Occasionally, the cluster is under heavy load or the control plane is busy, causing delays in Job creation. If the Job cannot be started within 1 minute of its schedu…
Answer: B. Set the startingDeadlineSeconds field in the CronJob spec to 60 to limit the window for starting missed jobs.
Setting startingDeadlineSeconds to 60 is correct because it dictates the maximum deadline window for a CronJob to start after its scheduled time, skipping missed executions. The activeDeadlineSeconds field limits how long a started Job runs, not its creation delay window.
Q2. A security-sensitive application in your production cluster needs to authenticate with an external cloud provider's API using OIDC. The cloud provider requires a short-lived, audience-bound ServiceAccount token to be present at a specific…
Answer: C. Use a projected volume with a serviceAccountToken source, specifying the target path, expirationSeconds, and audience
Using a projected volume with a serviceAccountToken source is correct because it safely injects short-lived, audience-bound tokens directly into the pod, handling rotation automatically. ConfigMaps store static data and lack native expiration handling, failing security requirements.
Q3. Your organization is preparing to release a significant version update (v2.0) of a critical booking engine. The stakeholders have mandated a Blue-Green deployment strategy because the application does not support session sharing between di…
Answer: C. Deploy version 2.0 with a new selector and update the existing Service selector to point to the new version only after validation
Deploying version 2.0 with a new selector and updating the existing Service selector is correct because it instantly shifts all traffic to the new pods once validated. This allows an immediate rollback by simply reverting the Service selector if issues arise.
Q4. Your organization is hosting a multi-tenant platform where internal services are exposed via an Ingress resource. You have two distinct backend services: 'inventory-svc' which handles general requests, and 'inventory-v2-svc' which handles…
Answer: B. Define the '/api/v2' path with pathType: Exact and the '/api' path with pathType: Prefix in the Ingress rules
Using pathType: Exact for the specific route and pathType: Prefix for the broader route is correct because it prevents overlapping matches and ensures traffic routes predictably. Relying on physical YAML ordering or ImplementationSpecific behavior fails the consistency requirement.
Q5. A data-intensive application requires a specific configuration manifest and several binary assets to be downloaded from a remote Git repository before the main application container starts. If the download fails or the assets are corrupted…
Answer: D. Define an InitContainer with the necessary tools to download the assets into a shared volume accessible by the main container.
Defining an InitContainer is correct because it runs to completion and blocks the main container from starting until the shared assets are successfully downloaded. Sidecars run concurrently, risking an inconsistent application state if the required files are missing.
Q6. Your organization is migrating a legacy application that is hardcoded to connect to a database only on localhost:5432. To modernize the infrastructure, the database has been moved to a managed cloud service with a dynamic endpoint. Since y…
Answer: B. Implement an Ambassador container as a sidecar that runs a proxy like HAProxy or Nginx to forward localhost:5432 traffic to the external database endpoint.
An Ambassador container acts as a proxy, letting the legacy application connect to localhost while the sidecar forwards traffic to the external endpoint. Remember that init containers or modifying /etc/hosts cannot redirect localhost traffic dynamically.
Q7. You are managing a critical Deployment named 'order-processor' that currently has 10 replicas running version v1. To ensure high availability during an update to version v2, you must satisfy two conditions: first, there should never be mor…
Answer: D. Configure maxSurge to 2 and maxUnavailable to 1 in the rollingUpdate section of the Deployment strategy specification.
Setting maxSurge to 2 allows up to 12 pods during the rollout. Setting maxUnavailable to 1 ensures at least 9 pods remain available. Absolute integer values strictly enforce these operational limits.
Q8. Your organization has a strict network security policy in the production cluster. You are deploying a new microservice named 'secure-processor' in the 'finance' namespace. This service must be configured to only accept incoming connections…
Answer: A. Apply a NetworkPolicy with an Ingress rule that matches the podSelector with the label role: frontend.
A NetworkPolicy controls traffic flow at the pod level. By using a podSelector in the ingress rule, you specifically allow connections only from frontend pods. Services or Ingress cannot enforce this strict IP-level zero-trust security.
Q9. Your team is managing a critical microservice called stock-analyzer that periodically fetches data from a third-party legacy provider. If the provider goes offline for maintenance, the stock-analyzer can no longer process requests, but it…
Answer: C. Implement a Readiness Probe that verifies the connectivity to the third-party provider and reports failure when the service is unreachable
A Readiness Probe controls traffic routing by removing the pod from Service endpoints when it fails. This isolates the application without restarting it. A Liveness Probe would incorrectly trigger a restart during external outages.
Q10. Your application deployment named 'order-processor' currently runs 4 replicas. The cluster is operating near full capacity, and the scheduler cannot find room for even one extra pod. However, you need to update the application to a new ver…
Answer: A. Set maxSurge to 0 and maxUnavailable to 1 to ensure a pod is deleted first, creating space for the new version.
Setting maxSurge to 0 prevents creating extra pods during the rollout. Setting maxUnavailable to 1 allows terminating one old pod first, freeing cluster resources for the replacement. This guarantees continuous availability under tight constraints.
Q11. Your team is migrating an application from a local on-premises environment to a Kubernetes cluster. The application is hardcoded to connect to a database using the hostname 'db-service.internal'. In the cloud environment, the database is n…
Answer: D. Deploy a Service of type ExternalName with the externalName field set to the cloud database DNS string
A Service of type ExternalName creates a DNS alias by returning a CNAME record to an external domain. This transparently maps your internal service name to the cloud database. Manual endpoints require static IPs.
Q12. Your e-commerce platform uses an Ingress controller to manage traffic. You need to configure an Ingress resource that routes traffic for the host 'shop.example.com'. Requests directed to the path '/products' must be sent to the 'product-ca…
Answer: C. Define a single rule for the host with a list of paths, each specifying a pathType and a backend service with a service name and port.
An Ingress resource defines a host with multiple path entries. Each path maps a specific URI to a distinct backend service and port. Using separate resources risks routing conflicts depending on controller merging behavior.
Q13. You are managing a cluster distributed across three availability zones (us-east-1a, us-east-1b, us-east-1c). A mission-critical deployment named 'high-availability-api' must ensure that its 9 replicas are distributed as evenly as possible…
Answer: D. Utilize topologySpreadConstraints in the Pod spec with the topologyKey set to topology.kubernetes.io/zone.
TopologySpreadConstraints automatically distribute pods across defined topology domains like availability zones. Setting the maxSkew ensures even balancing during scheduling. Node selectors require manual management and lack dynamic scaling.
Q14. Your organization is migrating a legacy on-premises database to a managed cloud SQL instance. The internal application microservices, currently running in a Kubernetes cluster, are hardcoded to connect to the hostname 'legacy-db-svc'. You…
Answer: C. Create a Service of type ExternalName with the externalName field set to the cloud database FQDN
A Service of type ExternalName creates a DNS alias by returning a CNAME record to the external database address. This lets internal pods resolve the local service name seamlessly. Other service types cannot handle dynamic external DNS.
Q15. You are managing a high-traffic retail website and need to test a new checkout workflow. You want to direct exactly 10% of the incoming traffic to a new version of the application (v2) while the remaining 90% stays on the stable version (v…
Answer: B. Create two Ingress resources and set the service weights manually using the 'nginx.ingress.kubernetes.io/canary-weight' annotation set to '10'
The NGINX Ingress controller shifts traffic percentages when you add a second Ingress annotated with canary-weight. Standard Kubernetes Services do not support percentage-based routing natively.
Q16. An enterprise-level e-commerce company is migrating its monolithic inventory management system into a Kubernetes-based microservices architecture. The application core, written in a legacy framework, is hardcoded to resolve its database co…
Answer: B. Define a Kubernetes Service of type ClusterIP named db-inventory-legacy without a label selector and manually create an Endpoints resource with the same name that specifies the external database IP address and port.
A selectorless Service combined with manually created Endpoints correctly maps an internal DNS name to an external IP. This abstraction lets you update the database IP later without touching application code. ExternalName only handles DNS CNAMEs, not local port remapping.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.