Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A retail company uses a legacy inventory management application that outputs log files in a proprietary binary format to. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A retail company uses a legacy inventory management application that outputs log files in a proprietary binar…
- An engineering team is attempting to deploy a suite of resource-intensive microservices into a dedicated name…
- A complex data-processing application requires a specific configuration directory to be populated with a larg…
- A high-availability web portal named portal-web is being deployed into a production cluster that spans three…
- A production deployment currently running 10 replicas needs to be updated to a new version. The cluster has l…
- A microservices architecture consists of a 'frontend' application in the 'web-dev' namespace and a 'catalog-d…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A retail company uses a legacy inventory management application that outputs log files in a proprietary binary format to a local volume. The company monitoring stack only supports JSON format via a centralized collector. You are tasked wit…
Answer: C. Deploy an Adapter container that reads the binary logs and exports them in JSON format
The Adapter container pattern standardizes or translates application output, converting proprietary logs into JSON format for monitoring tools. An init container runs only once before the app starts, so it cannot handle continuous, real-time log transformation during the application lifecycle.
Q2. An engineering team is attempting to deploy a suite of resource-intensive microservices into a dedicated namespace called accounting-prod. During the rollout, several Pods remain in a Pending state. An inspection of the events reveals a me…
Answer: A. Create a LimitRange object in the accounting-prod namespace to define default requests and limits
A LimitRange sets default request and limit values for containers, automatically injecting them if a pod lacks explicit resource definitions. This ensures pods comply with namespace ResourceQuotas, resolving the pending state without manually adjusting individual deployments.
Q3. A complex data-processing application requires a specific configuration directory to be populated with a large dataset from an external S3 bucket before the main application starts. The main application image is stripped of all utilities f…
Answer: A. Utilize an InitContainer with an image that includes the AWS CLI to download the data into a shared emptyDir volume.
Init containers run to completion before the main application starts, preparing shared volumes safely using specialized tools. A postStart hook executes concurrently with the main container, creating a race condition where the app might access the directory before the download finishes.
Q4. A high-availability web portal named portal-web is being deployed into a production cluster that spans three distinct availability zones (zone-a, zone-b, and zone-c). The deployment consists of 12 replicas. To maintain service continuity d…
Answer: C. Set topologySpreadConstraints with maxSkew: 1, topologyKey: topology.kubernetes.io/zone, and whenUnsatisfiable: ScheduleAnyway.
Setting whenUnsatisfiable to ScheduleAnyway within topologySpreadConstraints creates a soft rule, prioritizing even spread while guaranteeing the pod schedules during resource constraints. Using DoNotSchedule acts as a hard constraint, leaving the pod pending if exact distribution fails.
Q5. A production deployment currently running 10 replicas needs to be updated to a new version. The cluster has limited available resources, and you cannot exceed 12 total pods at any time during the transition to avoid node pressure. However…
Answer: A. Define the maxSurge as 2 and the maxUnavailable as 1 in the deployment specification
A maxSurge of 2 permits scaling up to 12 pods maximum, preventing node pressure during the update. A maxUnavailable of 1 guarantees at least 9 replicas remain ready, satisfying the minimum capacity requirement throughout the rollout process.
Q6. A microservices architecture consists of a 'frontend' application in the 'web-dev' namespace and a 'catalog-db' service in the 'data-services' namespace. The developers are reporting that the frontend cannot reach the database using the sh…
Answer: C. catalog-db.data-services.svc.cluster.local
The standard Kubernetes service FQDN format is service-name.namespace.svc.cluster.local, which allows cross-namespace resolution via CoreDNS. Watch the domain word order carefully, as reversing the service and namespace parts is a common trap.
Q7. Your cluster is running at maximum capacity, and you cannot provision additional nodes. You need to update a Deployment named 'order-service' that currently has 10 replicas. The update must ensure that at no point there are more than 10 po…
Answer: B. Set maxSurge to 0 and maxUnavailable to 2 in the RollingUpdate strategy specification.
Setting maxSurge to 0 prevents any new pods beyond the desired count, while maxUnavailable to 2 maintains the minimum required availability. Choosing a non-zero maxSurge would violate the hard cluster capacity limit.
Q8. You are managing a microservice that processes messages from a RabbitMQ queue. You notice that occasionally the application enters a deadlock state where the HTTP health check endpoint still responds with 200 OK, but the internal message c…
Answer: A. Configure an 'livenessProbe' that uses an 'exec' command to run a script checking the age of the last processed message file.
A liveness probe using an exec command directly checks internal application health and triggers a restart if the script fails. A readiness probe would only stop traffic routing, leaving the deadlocked consumer unhealed.
Q9. A security-sensitive application requires access to an API key stored in a Kubernetes Secret named 'provider-credentials'. The application is designed to look for this key at a specific file path: '/var/secrets/api/token'. However, the Sec…
Answer: C. Use the secret volume with the 'items' field to map the specific key to a path
Using the items field in a secret volume projection selectively exposes specific keys at designated file paths. Environment variables cannot easily map to required file paths, and mounting the entire secret overwrites the directory.
Q10. A data processing application needs to run a specific maintenance script every night at 2:00 AM. The script performs a cleanup of a shared persistent volume and then terminates. The operation must be guaranteed to run to completion at leas…
Answer: A. A CronJob resource that defines the schedule and contains a Job template for the maintenance task.
A CronJob schedules time-based tasks and wraps them in a Job template to ensure finite execution with retries. Deployments are for perpetual services, while StatefulSets and DaemonSets do not guarantee task completion.
Q11. During a routine update of the 'order-api' deployment, a new container image version (v2.5) was rolled out. Immediately after the update, the support team reported a 100% error rate on the order submission endpoint. You checked the rollout…
Answer: B. kubectl rollout undo deployment order-api –to-revision=12
The kubectl rollout undo command with the to-revision flag immediately restores a deployment to its exact previous state. The pause command simply halts a rollout, and set image pushes a new update forward.
Q12. A critical Java-based microservice takes a significant amount of time to warm up its internal cache after the process starts. During this warm-up period, the application process is running, but it cannot yet handle incoming traffic efficie…
Answer: A. A readinessProbe configured to check the cache status via an exec command
A readiness probe checks if an application is ready to accept traffic and removes the pod from endpoints until it passes. A liveness probe restarts unhealthy containers, and a startup probe only gates other probes during initialization.
Q13. An application pod needs to read and write data to a PersistentVolume (PV) mounted at /data/storage. The application runs inside the container as a non-privileged user with UID 1005. However, the external storage provider provisions the vo…
Answer: A. Configure the Pod's securityContext with the fsGroup field set to 1005 to allow the volume to be owned by that group
Setting fsGroup in the pod securityContext automatically changes the mounted volume ownership to the specified group. Running privileged containers or using hostPath volumes violates basic security best practices.
Q14. A multi-tier application consists of a 'frontend' and a 'database' in the same namespace. To improve security, you must implement a policy that prevents all incoming traffic to the 'database' Pod except for connections on port 5432 origina…
Answer: A. A NetworkPolicy with an ingress rule that selects the backend pods and specifies the target port for the database pods.
A NetworkPolicy applied to the database pods uses an ingress rule to explicitly allow traffic only from pods matching the backend label on port 5432. Services and Ingress resources handle traffic routing and discovery but do not block unauthorized pod-to-pod traffic.
Q15. An API microservice depends on an external legacy database hosted on-premises. If the database becomes unreachable, the microservice can no longer process requests, but the container process itself remains healthy. The operations team want…
Answer: A. Configure a Readiness probe to check database connectivity while keeping the Liveness probe focused only on the local process health.
Failing a Readiness probe removes the Pod from Service endpoints without restarting the container, fulfilling the requirement to stop traffic during an external database outage. A Liveness probe failure would force a restart, which is the exact behavior to avoid here.
Q16. A web platform needs to host three different services (Marketing, Sales, and Support) under a single external IP address. The routing must be handled based on the URL path: '/marketing' should go to the marketing-service, '/sales' to the s…
Answer: A. An Ingress resource with a set of rules defining path-based backend targets for each service.
An Ingress resource configured with path-based routing rules maps distinct HTTP paths to different backend Services behind a single IP. ClusterIP services lack Layer 7 routing capabilities, and custom sidecars introduce unnecessary operational complexity.
Q17. A financial services company is deploying a highly sensitive payment processing application. The application requires access to an API key and a database password. For security reasons, the security team mandates that these sensitive crede…
Answer: D. Store the credentials in a Kubernetes Secret and mount that Secret as a volume at a specific path in the container.
The correct answer uses a Kubernetes Secret mounted as a volume to project credentials as files. ConfigMaps lack security features for sensitive data, and environment variables risk exposure via logs.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.