Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are deploying a stateful application that runs as a non-root user with UID 1000. The application needs to write logs. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- You are deploying a stateful application that runs as a non-root user with UID 1000. The application needs to…
- You are migrating a legacy web portal to Kubernetes that was not designed for stateless operation. The portal…
- A sophisticated Java-based microservice takes approximately 45 seconds to initialize its internal cache and v…
- You are managing a mission-critical web application that currently runs with 10 replicas. During the deployme…
- A legacy microservice named legacy-client is being migrated to a Kubernetes cluster. The application needs to…
- A Python-based backend application is frequently losing in-flight data when the Deployment is scaled down or…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are deploying a stateful application that runs as a non-root user with UID 1000. The application needs to write logs and data to a PersistentVolume mounted at /data. During initial testing, the application fails to start with a 'Permis…
Answer: B. Specify the fsGroup: 2000 in the Pod-level SecurityContext to allow Kubernetes to change the ownership of the volume.
The fsGroup setting in the pod security context instructs Kubernetes to change the ownership of mounted volumes to the specified group ID. This directly grants the non-root application process the required write permissions without using privileged mode or init containers.
Q2. You are migrating a legacy web portal to Kubernetes that was not designed for stateless operation. The portal stores active user sessions in its local memory. If a user is routed to Pod-A for their first request and Pod-B for their second…
Answer: D. Set 'spec.sessionAffinity: ClientIP' in the Service manifest to enable session persistence based on the source IP.
Setting sessionAffinity to ClientIP on the Service ensures requests from the same source IP are routed to the same backend Pod. This provides the required session stickiness for legacy applications, unlike standard round-robin load balancing.
Q3. A sophisticated Java-based microservice takes approximately 45 seconds to initialize its internal cache and verify connections to a database. If the main 'app-server' container starts and begins accepting traffic before the database is rea…
Answer: A. Add an InitContainer to the Pod specification that runs a shell loop script to check database connectivity before exiting successfully.
Init containers run to completion before any regular containers in a Pod are started, making them the perfect place for dependency checks. Readiness probes only prevent traffic routing and do not delay the main container's startup process.
Q4. You are managing a mission-critical web application that currently runs with 10 replicas. During the deployment of a new version, your team has a strict requirement that at least 8 Pods must remain available at all times to handle the inco…
Answer: B. Set maxSurge to 2 and set maxUnavailable to 2 in the deployment strategy section
Setting maxUnavailable to 2 ensures at least 8 pods remain available during the rollout, meeting the traffic requirement. Setting maxSurge to 2 restricts the total number of pods to 12, successfully preventing node resource overload.
Q5. A legacy microservice named legacy-client is being migrated to a Kubernetes cluster. The application needs to communicate with an external third-party API that strictly requires mutual TLS (mTLS) for every connection. However, the legacy a…
Answer: A. Deploy an Ambassador container within the same Pod to act as a local proxy that manages the mTLS handshake with the external API.
The Ambassador pattern abstracts external service complexity by running a proxy container in the same network namespace. The legacy application connects locally while the proxy transparently handles the complex mTLS handshake.
Q6. A Python-based backend application is frequently losing in-flight data when the Deployment is scaled down or during a rolling update. The application needs approximately 15 seconds to finish processing current requests and close database c…
Answer: A. Set the terminationGracePeriodSeconds in the Pod specification to 30 and implement a preStop hook that executes a sleep command for 15 seconds.
A preStop hook delays container shutdown while an extended terminationGracePeriodSeconds provides ample time for cleanup. Relying solely on readiness probes does not guarantee the application enough time to process in-flight requests before termination.
Q7. You are deploying a distributed database system where each individual Pod must have a stable, unique network identity (hostname) that can be reached by other Pods in the cluster. The application logic requires Pods to discover each other d…
Answer: C. Create a Headless Service by setting the clusterIP field to None and ensuring the service name matches the serviceName of the StatefulSet.
A Headless Service sets clusterIP to None, which creates individual DNS A records for each Pod managed by the StatefulSet. This allows applications to discover specific peers directly via DNS instead of routing through a load balancer.
Q8. A legacy auditing microservice in your production environment generates system logs in a proprietary XML format and saves them to a local shared volume at the path /var/log/audit.xml. Your organization's central logging server has recently…
Answer: D. Deploy an Adapter container within the Pod that monitors the /var/log/audit.xml file, transforms the data to JSON, and forwards it to the central logging server.
The Adapter pattern transforms primary container output to match external system standards without modifying the original image. Using a shared volume, the adapter container reads the XML logs, translates them to JSON, and forwards them successfully.
Q9. A Python-based application named batch-job frequently crashes due to memory exhaustion, but the standard container logs do not capture the final error code or the reason for the crash because the process terminates too quickly for the logg…
Answer: C. Set the terminationMessagePath field in the container specification to /dev/termination-log to capture the specific exit data.
Setting the terminationMessagePath directs Kubernetes to capture specific exit data from a designated file. This diagnostic message is then easily retrieved later using standard kubectl describe pod commands when troubleshooting crashes.
Q10. A multi-tenant cluster contains a namespace 'db-layer' hosting sensitive PostgreSQL pods and a namespace 'web-layer' hosting public-facing Nginx pods. You must implement a security policy that allows the PostgreSQL pods to only accept inco…
Answer: B. An ingress rule in the 'db-layer' namespace using both a namespaceSelector matching the 'web-layer' namespace and a podSelector matching 'role=frontend'.
Combining namespaceSelector and podSelector inside a single ingress rule restricts traffic to the specified pods. Applying the rule to a service is invalid because network policies target pods directly.
Q11. You are performing a canary release for a service named 'order-service'. You have the stable version (v1) running with 10 replicas and a label 'app=order-service,version=v1'. You deploy the canary version (v2) with 1 replica and a label 'a…
Answer: B. Approximately 9% of the traffic will be routed to the v2 canary pod, while 91% will continue to be routed to the v1 stable pods.
The Service load balances equally across all matching Pods, so the single v2 Pod receives roughly nine percent of the traffic. Remember that Services route based on selectors, not Deployment objects, avoiding the trap of assuming fifty-fifty traffic splits.
Q12. A legacy billing microservice is being migrated to a Kubernetes cluster. This application was originally designed to write its internal transaction logs directly to a local disk file at /data/logs/transaction.log. The company requires thes…
Answer: B. Implement an adapter container that shares a volume with the main application, reads the binary logs, converts them to JSON, and exposes them via its own standard output.
An adapter container modifies files or output from the main application to meet external requirements without changing the core code. Do not use a basic sidecar, because it typically forwards logs untouched rather than converting the proprietary binary format.
Q13. You are designing a solution for a company that has multiple heterogeneous applications (one in Go, one in Java, and one in Ruby) all running in a single Pod for performance reasons. Each application produces logs in a different format (JS…
Answer: D. Implement the Adapter pattern by adding a container that reads the logs from a shared volume and converts them to the required XML format.
The Adapter container pattern translates heterogeneous outputs into a unified format before sending them to external systems. A standard sidecar container usually forwards raw logs untouched, whereas an adapter specifically performs the required XML transformation.
Q14. A sophisticated data-processing Java application requires a long initialization period to load large machine learning models into memory before it can handle any requests. This process takes approximately 180 seconds. You have configured a…
Answer: D. Configure a startupProbe with a failureThreshold of 30 and a periodSeconds of 10 to protect the container during boot
A startup probe disables liveness checks until it succeeds, perfectly protecting slow-starting applications during initialization. Relying heavily on high initialDelaySeconds values is less efficient because fast-booting pods will wait unnecessarily before receiving traffic.
Q15. A security-auditing Pod named 'secret-checker' is deployed in the 'security-ops' namespace. This Pod needs to list and inspect the content of all Secrets within the 'customer-data' namespace to ensure compliance with encryption policies. F…
Answer: D. Create a Role in the 'customer-data' namespace and a RoleBinding in the same namespace that associates the Role with the ServiceAccount from 'security-ops'.
Creating a Role and RoleBinding in the target namespace allows you to securely grant cross-namespace access to a specific ServiceAccount. ClusterRoles grant access across the entire cluster, which violates the principle of least privilege required for security compliance.
Q16. An application named 'data-analyzer' requires a large configuration file (approx. 50MB) that is generated dynamically and stored in a central S3 bucket. The main application container cannot start until this file is successfully downloaded…
Answer: C. Use an initContainer to execute the download script and store the result in an emptyDir volume shared with the main container.
InitContainers run sequentially to completion before any application containers start. Use an initContainer to fetch dependencies into a shared volume, ensuring the main container only starts once its required files are present.
Q17. Your organization is deploying a high-traffic web application using a Deployment named web-v2 with 20 replicas. During the update process from version 2.1 to 2.2, you must ensure that the cluster always maintains at least 80 percent of the…
Answer: D. Set the RollingUpdate strategy with maxUnavailable: 4 and maxSurge: 5 to maintain capacity and limit total Pod count.
Setting maxUnavailable to 4 and maxSurge to 5 maintains 16 available pods and limits total pods to 25. During the exam, calculate these values using the exact replica count rather than defaulting to standard percentages.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.