Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are configuring an Ingress resource to manage external access for a corporate portal. The requirement is to route tr. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- You are configuring an Ingress resource to manage external access for a corporate portal. The requirement is…
- A security-sensitive application named 'network-analyzer' must be deployed in a cluster with strict hardening…
- A Node.js microservice takes roughly 45 seconds to initialize its internal cache and connect to a remote data…
- You are deploying a data-processing Pod that runs as a non-privileged user with UID 2000. The Pod mounts a 'P…
- Your application requires a specific configuration file named 'settings.ini' to be mounted from a ConfigMap i…
- An application container requires access to several pieces of metadata at runtime: an API key stored in a 'Se…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are configuring an Ingress resource to manage external access for a corporate portal. The requirement is to route traffic based on the requested hostname to different internal backend services. Specifically, traffic for 'api.corp.com'…
Answer: D. Create an Ingress resource with two separate entries in the 'rules' list, each specifying a 'host' and a corresponding 'http' path pointing to its respective service.
Defining multiple rules with distinct host fields in a single Ingress resource directs traffic based on the requested hostname. Wildcard hosts or path-based routing are unnecessary here since the exact internal domain names are fully specified.
Q2. A security-sensitive application named 'network-analyzer' must be deployed in a cluster with strict hardening policies. The container image is configured to run as a non-privileged user with UID 5000. However, the application requires the…
Answer: D. Define a securityContext at the container level with runAsUser: 5000 and add the NET_RAW capability under the capabilities field.
Adding NET_RAW capabilities explicitly grants packet capture privileges while runAsUser enforces the UID. Privileged containers bypass least privilege rules and violate the strict security policy demanding a non-root identity.
Q3. A Node.js microservice takes roughly 45 seconds to initialize its internal cache and connect to a remote database. During this period, it responds with a 503 error code to any incoming HTTP requests. Once initialized, the service is stable…
Answer: B. Configure a startupProbe to handle the 45-second initialization, combined with a readinessProbe for traffic and a livenessProbe for health.
A startup probe safeguards slow-booting applications by disabling liveness checks during initialization. Without a startup probe, using initialDelaySeconds forces you to guess maximum boot times, delaying actual crash detection later.
Q4. You are deploying a data-processing Pod that runs as a non-privileged user with UID 2000. The Pod mounts a 'PersistentVolumeClaim' (PVC) at '/data/output'. In many cluster environments, the mounted volume defaults to being owned by the 'ro…
Answer: C. Define 'fsGroup: 2000' within the Pod-level 'securityContext' in the manifest.
Setting fsGroup in the Pod security context dynamically changes the mounted volume's group ownership. Using privileged root containers violates security requirements, and manual chown commands fail if the user lacks root permissions.
Q5. Your application requires a specific configuration file named 'settings.ini' to be mounted from a ConfigMap into the directory '/etc/config/'. The application binary includes a strict security check: it will refuse to start if the configur…
Answer: C. Set the 'defaultMode' field to 0400 within the ConfigMap volume definition in the Pod spec.
The defaultMode field in a ConfigMap volume sets exact Unix permissions for mounted files. Setting readOnly on the volumeMount prevents writing but leaves default permissions untouched, failing the strict octal mode requirement.
Q6. An application container requires access to several pieces of metadata at runtime: an API key stored in a 'Secret', a set of feature flags in a 'ConfigMap', and the Pod's own name and namespace provided by the Downward API. You want to pre…
Answer: B. Use a 'projected' volume type that aggregates the Secret, ConfigMap, and downwardAPI into one volume.
A projected volume combines several volume sources into a single directory. While an initContainer could technically stage files, it requires unnecessary scripting and violates the direct native integration expected for the exam.
Q7. A mission-critical financial API is deployed in a cluster that spans three availability zones: us-east-1a, us-east-1b, and us-east-1c. To ensure maximum resilience during a zone-wide failure, you must guarantee that the 12 replicas of the…
Answer: C. Configure topologySpreadConstraints with the topologyKey for zones and set whenUnsatisfiable to DoNotSchedule with a maxSkew value of 1.
Topology spread constraints with a low maxSkew force the scheduler to distribute pods evenly across the specified topology domains. Pod anti-affinity lacks the granular control needed for exact proportional distribution across multiple zones.
Q8. Your mission-critical 'order-processing' Deployment currently runs with 10 replicas. To ensure high availability during updates, you have been instructed to configure a rolling update strategy where at least 8 replicas must always be avail…
Answer: C. Set maxSurge to 3 and maxUnavailable to 2 in the deployment strategy section.
Setting maxSurge to 3 permits the cluster to temporarily create up to 13 pods, and maxUnavailable to 2 guarantees 8 remain active. Using percentages fails the strict integer constraints outlined in the scenario.
Q9. A mission-critical deployment named 'stock-feeder' is currently running with 8 replicas in a cluster that is operating at 90% resource capacity. Due to these tight resource constraints, the cluster can only accommodate 1 additional Pod dur…
Answer: C. Configure the strategy with 'maxUnavailable: 1' and 'maxSurge: 1' in the Deployment spec.
Setting maxUnavailable to 1 permits exactly 7 replicas during updates, and maxSurge to 1 respects the single spare pod capacity. Option A fails because maxUnavailable zero demands higher surge capacity the cluster lacks.
Q10. You are deploying a network security tool as a Pod in your cluster. This tool needs to monitor network traffic by capturing packets on the host's network interfaces and requires the ability to change the system clock to synchronize with a…
Answer: A. Add the 'NET_RAW' and 'SYS_TIME' capabilities to the securityContext section of the container specification
Adding specific Linux capabilities like NET_RAW and SYS_TIME adheres to the principle of least privilege by granting only the exact permissions needed. Using privileged mode or root access violates this security principle unnecessarily for the monitoring tool.
Q11. A financial transaction microservice named 'secure-pay' is being deployed into a production cluster where strict network isolation is mandatory. The 'secure-pay' Pod needs to communicate with a specific database Pod named 'postgres-db' in…
Answer: C. Define a NetworkPolicy for the 'secure-pay' Pod with an egress rule targeting the 'data' namespace and a podSelector for 'postgres-db' on port 5432
An egress rule using both namespaceSelector and podSelector restricts outgoing traffic to the exact database pod. Remember that default deny requires separate policies, but this option correctly identifies the egress target components.
Q12. You are managing a multi-tier application consisting of a 'frontend' deployment and a 'database' deployment in the 'production' namespace. A security audit requires that the 'database' pods should only accept incoming traffic on port 5432…
Answer: C. An ingress policy on the 'database' pods with a 'from' rule containing a 'podSelector' matching 'role: frontend'
Applying an ingress policy to the database pods with a podSelector for the frontend implicitly denies all other traffic. Egress policies control outbound traffic, not incoming requests, making option B the wrong direction.
Q13. A legacy Python-based background worker occasionally enters a 'zombie' state where the process remains running but it stops processing tasks. When this happens, the heartbeat file located at '/tmp/heartbeat.txt' inside the container stops…
Answer: C. A livenessProbe using an exec command that runs a shell script to check the modification time of the file and returns a non-zero exit code if it exceeds the limit.
A liveness probe with an exec command checks file staleness and restarts the container upon failure. A readiness probe would only remove the pod from the service without actually restarting the frozen process.
Q14. An application container named data-processor runs as a non-root user with UID 5000 for security reasons. The application must write large amounts of temporary data to a PersistentVolumeClaim (PVC) mounted at /data/scratch. During testing…
Answer: C. Define the securityContext at the Pod level and set the fsGroup field to 5000 to ensure the volume is re-permissioned for the user.
Setting fsGroup in the pod security context automatically adjusts volume permissions for non-root users. Using a privileged container defeats the security purpose, and a chmod init container is less reliable.
Q15. A production Deployment named user-api currently runs 10 replicas of a critical microservice. During an upcoming update to version 2.0.0, the engineering lead specifies that the system must never drop below the current processing capacity…
Answer: C. Define a RollingUpdate strategy with maxSurge set to 3 and maxUnavailable set to 0 to maintain at least 10 active Pods while allowing up to 13 during the transition.
Setting maxUnavailable to zero maintains processing capacity, while maxSurge limits overhead to three pods. A strategy with maxSurge zero and maxUnavailable three would immediately drop below capacity, violating the requirement.
Q16. A batch processing system is required to handle 200 independent tasks stored in a message queue. Each task takes approximately 10 minutes to complete. To meet business deadlines, the system must process at least 5 tasks simultaneously. The…
Answer: B. Set 'completions' to 200, 'parallelism' to 5, and 'backoffLimit' to 3 in the Job specification to control execution and retries
Completions sets the required successful finishes, parallelism sets concurrent pods, and backoffLimit handles retries. The activeDeadlineSeconds parameter restricts total runtime but does not define the retry behavior.
Q17. A production Deployment named 'payment-service' currently runs 4 replicas. During an upcoming cluster maintenance, several nodes will be drained for kernel updates. You need to ensure that at least 3 replicas of this service remain availab…
Answer: D. Create a PodDisruptionBudget resource targeting the payment-service labels and set the minAvailable field to a value of 3.
A PodDisruptionBudget with minAvailable set to three protects the application during voluntary disruptions like node drains. A PriorityClass only prevents preemption by other workloads, not evictions requested by administrators.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.