Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An e-commerce platform's frontend deployment, 'web-shop', currently runs 10 replicas in a production environment. To imp. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An e-commerce platform's frontend deployment, 'web-shop', currently runs 10 replicas in a production environm…
- Your team is deploying a high-performance microservice that communicates exclusively via the gRPC protocol on…
- Your team is running 'app-v1' with 10 replicas managed by a Deployment. You want to perform a manual canary r…
- A legacy financial application named legacy-proxy is designed to connect to a local database instance hardcod…
- A development team is migrating a microservice that depends on a legacy database hosted on a static IP addres…
- You are configuring a Pod named 'log-aggregator' that contains two containers: 'app-engine' and 'log-shipper'…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An e-commerce platform's frontend deployment, 'web-shop', currently runs 10 replicas in a production environment. To improve update reliability, the engineering team wants to ensure that during a rolling update, the cluster always maintain…
Answer: D. Set the maxSurge parameter to 3 and the maxUnavailable parameter to 2 to maintain capacity while limiting the maximum number of concurrent pods
Setting maxSurge to 3 allows up to 13 total pods, while maxUnavailable 2 keeps at least 8 pods available during the rollout. Do not confuse absolute integer values with percentages, as percentages would yield different pod counts here.
Q2. Your team is deploying a high-performance microservice that communicates exclusively via the gRPC protocol on port 50051. Standard HTTP-based liveness probes are not feasible because the application does not expose a REST interface. To ens…
Answer: A. Implement a livenessProbe using the grpc field, specifying the port as 50051 and leaving the service field empty or set to a specific gRPC service name.
Native gRPC probes use the grpc protocol field to directly check the gRPC Health Checking Protocol. An exec probe requires bundling a separate binary, which the scenario explicitly prohibits.
Q3. Your team is running 'app-v1' with 10 replicas managed by a Deployment. You want to perform a manual canary release of 'app-v2'. You need to route approximately 10% of the traffic to the new version using the existing Service named 'app-se…
Answer: D. Create a second Deployment for 'app-v2' with 1 replica, and ensure both Deployments have the same labels that match the Service's selector.
Services balance traffic across all Pods matching their selector regardless of the managing Deployment. Creating one new replica alongside nine existing replicas achieves the exact ten percent traffic split.
Q4. A legacy financial application named legacy-proxy is designed to connect to a local database instance hardcoded at 127.0.0.1:5432. However, the organization has recently moved its database to a managed cloud service with a dynamic external…
Answer: C. Implement an ambassador container running a lightweight TCP proxy like HAProxy or Envoy to forward traffic from localhost:5432 to the external cloud database address.
The ambassador pattern uses a local proxy container to broker connections to external services. This allows the legacy application to connect to localhost while the proxy handles the complex external routing.
Q5. A development team is migrating a microservice that depends on a legacy database hosted on a static IP address outside the Kubernetes cluster. To ensure the application remains portable and to avoid hardcoding external IP addresses in the…
Answer: A. Define a Service of type ExternalName with the externalName field set to 'db.corporate-legacy.net'.
An ExternalName Service returns a CNAME record pointing to the specified external DNS name. This cleanly abstracts external dependencies without creating unnecessary proxy pods or manual endpoint management.
Q6. You are configuring a Pod named 'log-aggregator' that contains two containers: 'app-engine' and 'log-shipper'. The 'app-engine' container writes its operational logs to a local directory at '/var/log/app/'. The 'log-shipper' container must…
Answer: C. An EmptyDir volume mounted at '/var/log/app/' in both containers, providing a shared temporary storage space that exists only for the life of the Pod
An emptyDir volume provides shared temporary storage tied directly to the Pod's lifecycle for multiple containers. HostPath volumes violate the security requirement by exposing the node filesystem.
Q7. A high-performance microservice written in C++ occasionally experiences a thread deadlock where the main process remains running but stops processing the incoming message queue effectively. The application does not expose an HTTP health en…
Answer: A. Configure a LivenessProbe using the exec field to run the /usr/local/bin/check-health.sh script periodically.
A LivenessProbe using the exec action runs the diagnostic script and restarts the container upon failure. A ReadinessProbe only removes the Pod from Service endpoints without triggering a restart.
Q8. A financial data processing team uses a CronJob to run a heavy reconciliation script every 15 minutes. They have noticed that on several occasions, the Job failed, and the cluster is now cluttered with a large number of failed Pods from pr…
Answer: A. Set 'successfulJobsHistoryLimit: 3' and 'failedJobsHistoryLimit: 2' in the CronJob spec section
The successfulJobsHistoryLimit and failedJobsHistoryLimit fields directly control automatic cleanup of old Job objects. The concurrencyPolicy only manages overlapping schedules, not historical retention.
Q9. An engineering team is managing a mission-critical deployment named 'inventory-api' that currently has 10 replicas. To maintain high availability during updates, the team requires that at least 10 replicas must always be available to handl…
Answer: A. Configure a RollingUpdate strategy with maxSurge set to 3 and maxUnavailable set to 0 to ensure capacity is never reduced below the desired count.
A RollingUpdate strategy with maxSurge of three and maxUnavailable of zero keeps the active replica count at ten while temporarily allowing up to thirteen total pods. Avoid using the Recreate strategy, as it immediately terminates all pods.
Q10. Your team is deploying a sensitive application that requires both a database password and a complex configuration file containing 50 environment-specific parameters. The password must be stored securely and not exposed in plain text in the…
Answer: A. Store the password in a Secret and the configuration in a ConfigMap, then mount the ConfigMap as a volume and the Secret as an environment variable
Using a Secret for the password and a ConfigMap for the configuration keeps sensitive data secure while allowing easy updates. Injecting large files via environment variables is not recommended because it increases the risk of exposing sensitive values in logs.
Q11. You are managing a multi-tier financial application where the 'transaction-db' Pod handles sensitive ledger data in the 'finance' namespace. To meet regulatory compliance, you must implement a network isolation strategy where only Pods tha…
Answer: A. Create a NetworkPolicy that selects the 'transaction-db' pod, defines a single ingress rule for port 5432 from pods matching 'app: backend', and includes an empty podSelector policy elsewhere to deny all other traffic.
A NetworkPolicy applied to the database pod restricts incoming traffic exclusively to the specified backend pods while blocking all other connections. LoadBalancer source ranges restrict external access, whereas NetworkPolicies are required to isolate internal pod traffic.
Q12. You are managing a microservice named payment-processor in the finance namespace. For compliance reasons, this microservice is only allowed to communicate with the internal database service in the same namespace and a specific external aud…
Answer: D. Define an egress policy with a rule allowing traffic to the database service name and a second rule with an ipBlock for 192.168.10.50/32.
NetworkPolicies are additive and deny all non-matching egress traffic once applied. Defining specific rules using a podSelector for the database and an ipBlock for the external service restricts egress to only the approved destinations.
Q13. You are managing a critical 'checkout-service' Deployment with 10 replicas in a cluster that is running near its resource limits. You need to perform a RollingUpdate to a new version. The infrastructure can only tolerate a maximum of 12 to…
Answer: A. Set maxSurge to 2 and maxUnavailable to 2 to ensure the total Pod count never exceeds 12 and the available Pod count never drops below 8.
Setting maxSurge to two and maxUnavailable to two strictly guarantees that total pods never exceed twelve and available pods never drop below eight. Options using percentages should be avoided here because they can result in unpredictable rounding that violates hard limits.
Q14. An engineering team is deploying a data-intensive batch Job named 'record-validator' that processes 50 independent chunks of data. Each execution of the Job is resource-heavy and takes roughly 10 minutes to complete. The team has observed…
Answer: A. Set the backoffLimit field to 3 in the Job specification to limit the number of retries before the Job is considered failed.
The backoffLimit field specifies the maximum number of failed Pod retries before the Job is marked as failed. For the exam, remember that parallelism and completions control scaling, while activeDeadlineSeconds restricts total execution time.
Q15. Your security policy requires that the 'frontend' microservice in the 'production' namespace must only be able to send outgoing (egress) traffic to a specific on-premises subnet with the CIDR range 192.168.10.0/24. All other outgoing traff…
Answer: C. Create an egress policy with a single rule containing to: ipBlock: cidr: 192.168.10.0/24.
Defining an egress policy with a specific ipBlock creates an implicit deny rule for all other traffic. Remember that podSelector chooses destinations, whereas ipBlock is required for external subnets.
Q16. You are tasked with configuring an Ingress resource to host multiple microservices for a company portal. Traffic arriving at 'company.com/orders' must be routed to the 'orders-svc' Service on port 8080, while traffic for 'company.com/inven…
Answer: A. Create a single Ingress with a 'rules' section containing the 'host', and a 'http' section with two entries under 'paths', each specifying the path, pathType, and backend.
Path-based routing is configured under a single host rule with multiple backend paths. For the exam, recall that each path requires a path type, such as Prefix or Exact, along with the backend service and port.
Q17. A security audit of your Kubernetes cluster has revealed that several containers are running with excessive privileges. One specific requirement is to ensure that no process within a container can gain more privileges than its parent proce…
Answer: B. Configure the securityContext of the container to set allowPrivilegeEscalation to false within the container specification.
Setting allowPrivilegeEscalation to false prevents child processes from gaining more privileges than their parent. Remember that runAsNonRoot only prevents root execution, while privilege escalation controls setuid behavior.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.