Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A legacy web application is being scaled to 10 replicas to handle increased traffic during a marketing campaign. The app. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A legacy web application is being scaled to 10 replicas to handle increased traffic during a marketing campai…
- A developer is creating a Pod for a static website that involves two distinct phases. First, a 'content-build…
- A high-performance data processing team is implementing a Kubernetes Job to migrate 500 legacy database recor…
- An application requires its configuration file, 'config.json', to be mounted at the path '/etc/app/config.jso…
- A stateful application named data-logger is deployed in your cluster. The application container is configured…
- A data science team needs to process a large backlog of 500 data chunks. Each chunk is independent. To optimi…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A legacy web application is being scaled to 10 replicas to handle increased traffic during a marketing campaign. The application uses in-memory session management, which is causing users to lose their shopping cart data whenever their requ…
Answer: B. Modify the Service resource to set the sessionAffinity field to ClientIP to ensure sticky sessions based on the source IP.
Setting sessionAffinity to ClientIP in the Service spec ensures requests from the same client route to the same backend pod, preserving in-memory session data. A Headless Service simply exposes pod IPs but does not enforce sticky routing like ClientIP affinity.
Q2. A developer is creating a Pod for a static website that involves two distinct phases. First, a 'content-builder' container must clone a repository and run a complex build script to generate HTML files. Once the files are ready, a 'web-serv…
Answer: A. Define the 'content-builder' as an InitContainer and use a shared volume to pass the generated HTML files
InitContainers run sequentially to completion before app containers start, making them perfect for build steps. Shared volumes pass data between the builder and web server. The sidecar pattern starts containers concurrently, which fails the sequential execution requirement.
Q3. A high-performance data processing team is implementing a Kubernetes Job to migrate 500 legacy database records. Each record takes approximately 30 seconds to process. To meet a strict maintenance window, the team requires that 10 records…
Answer: B. Configure the completions field to 500 and the parallelism field to 10 within the Job specification
The completions field defines the total successful pods needed, while parallelism dictates how many run at once. For the exam, remember that Deployments use replicas, while Jobs use parallelism and completions to manage batch workloads.
Q4. An application requires its configuration file, 'config.json', to be mounted at the path '/etc/app/config.json'. However, the directory '/etc/app/' already contains several other critical system files that were created during the image bui…
Answer: A. Utilize the subPath field within the volumeMounts section to mount only the specific key from the ConfigMap into the target file path.
The subPath field in volumeMounts lets you mount a single file without overwriting the destination directory. Avoid using InitContainers for this, as subPath declaratively solves the file masking issue directly within the pod manifest.
Q5. A stateful application named data-logger is deployed in your cluster. The application container is configured to run as a non-privileged user with UID 5000. It requires writing persistent logs to a mounted volume. However, after mounting t…
Answer: D. Set the fsGroup field in the Pod securityContext to the group ID associated with the application user to change volume ownership
Configuring the fsGroup in the pod security context automatically changes volume ownership to the specified group ID. This declaratively grants write access to non-root users, unlike InitContainers which require imperative permission tweaks.
Q6. A data science team needs to process a large backlog of 500 data chunks. Each chunk is independent. To optimize processing time, they want to run exactly 5 worker instances in parallel. The overall task is considered complete only when 500…
Answer: C. Create a Job with the completions field set to 500 and the parallelism field set to 5 to process chunks in groups of five until done
The completions field sets the total successful pods required, while parallelism controls the concurrent workers. Remember that swapping these values would either overload the cluster or fail to achieve the desired concurrency.
Q7. A financial technology company is deploying a critical transaction processing application across a multi-zone Kubernetes cluster. To ensure high availability and fault tolerance, the operations team requires that the application replicas a…
Answer: C. Configure topologySpreadConstraints with a maxSkew of 1, topologyKey set to topology.kubernetes.io/zone, and whenUnsatisfiable set to ScheduleAnyway.
Using topologySpreadConstraints with a maxSkew of 1 and ScheduleAnyway fulfills both the distribution and priority requirements. Pod anti-affinity lacks the granular control needed to prioritize scheduling without strictly blocking the pods.
Q8. An application Pod in your production namespace is frequently being terminated with a status of 'OOMKilled'. Monitoring data shows that the application has a memory leak that causes it to gradually consume all available memory on the node…
Answer: D. Configure memory limits to 512Mi in the container's resources section to trigger a restart upon exceeding the limit.
Setting memory limits forces the container to restart when it exceeds the specified threshold. The memory requests distractor fails because requests only handle scheduling and do not enforce hard restarts.
Q9. In a shared namespace named 'production-backend', you have three types of pods: 'web-frontend', 'api-server', and 'internal-db'. To meet strict security requirements, you must ensure that only pods labeled 'app: api-server' can connect to…
Answer: A. Create a NetworkPolicy targeting pods with 'app: internal-db' that includes an ingress rule allowing traffic from pods with 'app: api-server' on port 5432.
Targeting the database pods with an ingress rule restricting traffic to the api-server on port 5432 successfully isolates the workload. Egress policies only restrict outgoing traffic from the source pod, leaving the database open to other clients.
Q10. You are troubleshooting a production issue in a Pod named secure-gateway that uses a distroless container image. The image does not contain any shell, package manager, or debugging tools. The Pod is running, but you suspect a configuration…
Answer: A. Execute the kubectl debug command to create an ephemeral container with a debugging image like alpine inside the existing Pod
The kubectl debug command correctly injects an ephemeral container into a running Pod to share its namespaces. Standard kubectl exec fails on distroless images lacking a shell, and modifying the deployment requires restarts.
Q11. Deployment Stability. You are updating a high-traffic e-commerce API. To prevent service interruptions during a rolling update, you want to ensure that each new Pod is not only running but has also successfully passed its health checks for…
Answer: A. Configure the minReadySeconds field to 30 in the Deployment specification
The minReadySeconds field correctly forces the Deployment to wait before moving to the next Pod. The initialDelaySeconds parameter only delays the initial probe and does not guarantee post-ready stability during rollouts.
Q12. Ingress TLS Configuration. You are tasked with exposing a secure internal portal at 'secure-portal.company.com'. You have been provided with a TLS certificate and a private key. You need to ensure that the Nginx Ingress Controller terminat…
Answer: B. Create a Secret of type kubernetes.io/tls and reference it in the 'tls' section of the Ingress resource
Creating a Secret of type kubernetes.io/tls and referencing it in the Ingress resource is correct because it provides the standard mechanism for controllers to load certificates for SSL termination. Mounting certificates directly via ConfigMaps lacks the required key separation and native integration.
Q13. You are managing a resource-constrained Kubernetes cluster where the total number of Pods is strictly limited by a ResourceQuota. You have a Deployment named reporting-engine with 8 replicas. During a version update, you must ensure that a…
Answer: B. Apply a strategy with maxSurge set to 1 and maxUnavailable set to 2 to maintain exactly the number of required healthy instances
Applying maxSurge of 1 and maxUnavailable of 2 is correct because it respects the strict quota by creating a maximum of 9 pods, while keeping 6 available. Setting maxSurge to 0 would cap replicas at 8, dropping below the required 6 available instances during updates.
Q14. A security auditor requires that all Pods in the 'processing' namespace are strictly isolated. These Pods must only be allowed to communicate with a specific external logging server located at the IP address 192.168.10.50 on port 514. All…
Answer: A. Define an Egress policy with an ipBlock CIDR of 192.168.10.50/32 and specify the UDP/TCP port 514
Defining an Egress policy with an ipBlock CIDR and port is correct because it explicitly allows traffic to the external logging server while defaulting to deny for all other destinations. Ingress policies only control incoming traffic and cannot restrict outbound data exfiltration.
Q15. An enterprise application named legacy-app generates performance data in a proprietary binary format and writes it to a local shared volume. The central monitoring system can only ingest data formatted as JSON via an HTTP POST request. You…
Answer: C. Implement an Adapter container that exposes a standard metrics endpoint and translates internal binary data for the monitoring system
The correct answer uses the Adapter pattern to translate internal binary metrics into a standard format. A Sidecar container that polls the shared volume and pushes JSON also technically solves the stated requirements.
Q16. A legacy Java application is being migrated to Kubernetes. The application takes about 60 seconds to initialize its internal cache. During this time, the process is running and the port is open, but it cannot yet handle traffic. If traffic…
Answer: C. Use a startupProbe with a failureThreshold of 12 and a periodSeconds of 10 to cover the 120-second initialization window
A startup probe disables liveness checks during initialization, preventing unwanted restarts. Pairing it with a readiness probe ensures traffic flows only after warmup. Fixed delays are brittle because actual startup times vary.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.