Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An analytics application requires a large configuration file to be downloaded from an external secure server and decrypt. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An analytics application requires a large configuration file to be downloaded from an external secure server…
- You are designing a Pod for a web application that has a hard dependency on an external legacy database and a…
- A high-performance data processing application is experiencing high latency when fetching large static assets…
- An analytics namespace named 'data-prod' contains multiple Pods that are experiencing frequent restarts. You…
- Your organization is adopting a Blue-Green deployment strategy. You have a Deployment named 'web-v1' (Blue) c…
- You are configuring an Ingress resource to manage traffic for a corporate website. The requirement is to rout…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An analytics application requires a large configuration file to be downloaded from an external secure server and decrypted before the main application starts. The decryption process requires a specific utility that is not included in the m…
Answer: C. Use an initContainer with the decryption utility image to download and process the file, saving the result into a shared emptyDir volume.
InitContainers run to completion before the main application starts, making them perfect for preparing data. By saving the decrypted file into a shared volume, the main container securely accesses the prepared data without needing the utility.
Q2. You are designing a Pod for a web application that has a hard dependency on an external legacy database and a configuration service. Both dependencies are exposed as Kubernetes Services ('db-service' and 'config-service'). If the main appl…
Answer: C. Add an 'initContainer' that runs a script using 'nslookup' in a loop to check the resolution of both service names.
InitContainers block the main container from starting until they complete successfully. This pattern guarantees your application will not crash loop if it relies on external services that need time to register in DNS.
Q3. A high-performance data processing application is experiencing high latency when fetching large static assets from a remote storage bucket. To optimize performance, the architecture team decides to implement a local caching sidecar using N…
Answer: C. No special configuration is needed because containers within the same Pod automatically share the same network namespace.
Containers within the same Pod share the exact same network namespace, meaning they communicate via localhost. You do not need a Service or host networking for inter-container traffic on the same loopback interface.
Q4. An analytics namespace named 'data-prod' contains multiple Pods that are experiencing frequent restarts. You are required to generate a report using kubectl that lists the Pod name, the restart count of the container named 'engine-worker'…
Answer: A. jsonpath='{range .items[*]}{.metadata.name}{" "}{.status.containerStatuses[?(@.name=="engine-worker")].restartCount}{" "}{.spec.containers[?(@.name=="engine-worker")].image}{"\n"}{end}'
It uses the range operator to iterate over items, then applies filters inside brackets to target the specific container by name for both the restart count and the image. Remember that restart counts live under status containerStatuses, while the image is under spec containers.
Q5. Your organization is adopting a Blue-Green deployment strategy. You have a Deployment named 'web-v1' (Blue) currently receiving all production traffic through a Service named 'web-prod-svc' which selects pods using 'app: web, version: v1'…
Answer: A. Modify the 'web-prod-svc' Service selector to point to 'version: v2' instead of 'version: v1' to reroute the traffic
Changing the Service label selector instantly routes production traffic to the new version v2 pods. Do not delete the old deployment immediately, as you need it for a quick rollback if the green deployment fails.
Q6. You are configuring an Ingress resource to manage traffic for a corporate website. The requirement is to route all traffic for 'example.com/shop' to a Service named 'shopping-svc' on port 8080, and all traffic for 'example.com/checkout' to…
Answer: C. Use a single Ingress with path '/shop' (Prefix), path '/checkout' (Prefix), and path '/' (Prefix) for the frontend
A single Ingress using Prefix path types handles all routing needs efficiently. The Ingress controller automatically evaluates the longest, most specific paths first, so the slash prefix safely acts as a catch-all backend.
Q7. You are managing a specialized data-crunching application called 'analytics-worker' that performs heavy file I/O operations. The application is designed to process data from a shared directory that must be initialized with a specific datas…
Answer: B. Implement an InitContainer with a base utility image to download the dataset into a shared volume before the main container starts
An init container runs to completion before the main application starts, using a separate utility image to fetch the data. Sidecars run concurrently, which risks race conditions if the main container needs the data immediately upon starting.
Q8. You are securing a backend microservice in the 'internal-api' namespace. A strict security mandate requires that the microservice only accept incoming traffic from the corporate subnet '10.50.0.0/16'. Within that subnet, there is a specifi…
Answer: C. Configure an 'ingress' rule with 'ipBlock' specifying 'cidr: 10.50.0.0/16' and 'except: [10.50.20.0/24]'.
The ipBlock selector natively supports a comma-separated except field to exclude untrusted subnets from an allowed range. NetworkPolicies are allow-lists by default, so defining allowed traffic inherently blocks everything else.
Q9. Your engineering team is troubleshooting a custom proprietary message broker deployed as a Pod. The broker does not support HTTP or gRPC; it uses a custom binary protocol on TCP port 9000. You need to implement a liveness probe to ensure t…
Answer: D. Define a livenessProbe using the tcpSocket field targeting port 9000 to perform a simple TCP connection check.
The tcpSocket probe verifies basic network connectivity by attempting to open a TCP connection to the designated port. It avoids the processing overhead and security risks associated with running shell commands inside the container.
Q10. An analytics application uses a 'PersistentVolumeClaim' (PVC) named 'data-log' which is bound to a 'PersistentVolume' (PV) from a dynamic provisioner. The current volume size is 10Gi, but the logs are growing rapidly and the volume is near…
Answer: B. Update the 'spec.resources.requests.storage' field of the existing PVC to 50Gi and apply the change.
Patching the storage request on the PVC triggers the dynamic provisioner to expand the volume seamlessly. Directly modifying the PersistentVolume is discouraged because Kubernetes manages the lifecycle and reconciliation of the bound claim.
Q11. To comply with new corporate security standards, all pods in the 'finance-prod' namespace must run with restricted privileges. Specifically, the 'transaction-logger' container must not run as the root user, must not be able to escalate pri…
Answer: D. Apply a securityContext at the container level setting runAsNonRoot to true, allowPrivilegeEscalation to false, and readOnlyRootFilesystem to true.
A container-level security context directly applies required restrictions like read-only filesystems and non-root execution. Resource quotas only limit resource consumption across namespaces, while environment variables lack actual enforcement capabilities.
Q12. A distributed order-processing application consists of a main container that requires a specific directory structure and several configuration files to be present on a shared volume before the application starts. These files are generated…
Answer: C. Use an initContainer to execute the setup script. Ensure the script returns a non-zero exit code on failure and mounts the same volume as the main container.
Init containers block the main container from starting until they complete successfully, guaranteeing the environment is fully prepared. If the setup script fails, the init container aborts, safely preventing the main pod from crashing.
Q13. Your legacy e-commerce application produces log files in a proprietary text format at /opt/app/logs/server.log. Your organization's central logging system requires logs to be transmitted via an HTTP POST request in JSON format. To avoid mo…
Answer: C. Implement an adapter container that reads the local log file and exports it to the external monitoring system format
The adapter container pattern transforms the main application's output into a format required by an external system. While a sidecar shares the same lifecycle, an adapter specifically standardizes logs or metrics without altering the core application code.
Q14. Your development team has provided a ConfigMap named 'global-config' that contains 50 different application settings required for a Node.js microservice. Instead of manually mapping each key to a specific environment variable in the Pod ma…
Answer: B. Use the envFrom field with the configMapRef attribute pointing to the 'global-config' ConfigMap name.
The envFrom field populates all ConfigMap keys as environment variables automatically. Manual mapping using env with configMapKeyRef is tedious and fails the requirement to dynamically include future additions without manifest edits.
Q15. You are deploying a security-hardened 'vault-sync' Pod that must access a sensitive API token and a certificate file. These items are stored in a Kubernetes Secret named 'auth-materials'. The application code is hardcoded to look for the A…
Answer: C. Create a Volume of type 'secret' referencing 'auth-materials' and add a volumeMount in the container to mount it at '/mnt/secrets/'.
Mounting a Secret as a volume projects its keys as individual files into the specified directory path. Environment variables expose values in process logs, violating the strict security requirement to keep them strictly on the filesystem.
Q16. A web application named catalog-api is being deployed into a production cluster where the external traffic is managed by an Ingress controller. The application takes a long time to boot and depends on an external cache being fully populate…
Answer: B. Define readinessGates in the Pod spec to specify additional conditions that must be met before the Pod is considered ready.
Readiness gates allow external services to inject custom readiness conditions directly into a Pod's status. Startup probes only delay traffic until the application boots, whereas readiness gates hold traffic until external verification passes.
Q17. A developer needs to configure a Node.js microservice that requires 50 different environment variables. These variables are already defined as key-value pairs in a ConfigMap named 'service-env-vars'. Instead of manually mapping each key to…
Answer: C. Use the envFrom field in the container specification and provide a configMapRef that points to the 'service-env-vars' ConfigMap.
The envFrom field automatically populates the container environment with all keys from a referenced ConfigMap. Manual mounting requires custom scripts, which fails the requirement for efficient, native Kubernetes manifest syntax.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.