Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A mission-critical 'auth-engine' application uses a Secret named 'api-keys' mounted as a volume at '/etc/keys'. The appl. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A mission-critical 'auth-engine' application uses a Secret named 'api-keys' mounted as a volume at '/etc/keys…
- A development team has reported that their Java-based microservice, 'order-api', is frequently restarting in…
- A microservices application consists of a web frontend in the 'public' namespace and a sensitive database bac…
- In a high-security environment, you have a 'database' Pod running in the 'backend' namespace. You need to imp…
- A data analysis team uses a Kubernetes CronJob to run a heavy reconciliation script every night at 2:00 AM. O…
- Your application deployment consists of a main container that requires a specific external configuration data…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A mission-critical 'auth-engine' application uses a Secret named 'api-keys' mounted as a volume at '/etc/keys'. The application is designed to dynamically watch for file changes and reload its configuration without needing a restart. You n…
Answer: C. The mounted files in /etc/keys will be updated eventually by the kubelet, and the application's file watcher will trigger a reload of the new keys.
When a Secret is mounted as a volume, the kubelet eventually updates the symlinks for the mounted files. Remember that Secrets injected as environment variables are not updated automatically and require a pod restart.
Q2. A development team has reported that their Java-based microservice, 'order-api', is frequently restarting in the production environment. Upon investigation, you find that the Pod is being terminated with an 'OOMKilled' status. The Deployme…
Answer: A. Increase the memory limit in the Deployment to at least 768Mi to account for the JVM's non-heap memory and stack overhead
Increasing the limit provides room for the JVM heap plus overhead like Metaspace and thread stacks, preventing the OS from killing the process. A Kubernetes OOMKilled error means the container exceeded its limit, not the physical node memory.
Q3. A microservices application consists of a web frontend in the 'public' namespace and a sensitive database backend in the 'secure-data' namespace. A strict network security policy is required: the database Pods (labeled app=pi-db) must only…
Answer: C. Create a NetworkPolicy in the 'secure-data' namespace with a podSelector for app=pi-db, an ingress rule with a namespaceSelector for 'public' and a podSelector for app=frontend.
This policy correctly targets the database pods in their own namespace. By defining an ingress rule with both namespaceSelector and podSelector, it restricts access precisely to the authorized frontend pods.
Q4. In a high-security environment, you have a 'database' Pod running in the 'backend' namespace. You need to implement a NetworkPolicy that restricts traffic so that only Pods with the label 'role: web-server' located in the 'frontend' namesp…
Answer: C. An ingress rule with a namespaceSelector for 'frontend' combined with a podSelector for 'role: web-server', and an egress rule to the 'kube-system' namespace on UDP port 53.
For cross-namespace ingress, you must use both namespaceSelector and podSelector within the same rule. For DNS, you need an egress rule specifically targeting UDP port 53 in the kube-system namespace.
Q5. A data analysis team uses a Kubernetes CronJob to run a heavy reconciliation script every night at 2:00 AM. Occasionally, the script fails due to transient database connectivity issues. The team needs to keep a history of the last 5 succes…
Answer: B. Set 'successfulJobsHistoryLimit: 5', 'failedJobsHistoryLimit: 2', and 'concurrencyPolicy: Forbid' in the CronJob's spec section.
This configuration precisely meets all requirements: it manages the cleanup of old jobs and prevents concurrent runs. The concurrencyPolicy Forbid specifically skips new runs if an existing one is still active.
Q6. Your application deployment consists of a main container that requires a specific external configuration database to be reachable before it can start successfully. If the database is not ready, the application crashes immediately. To make…
Answer: A. Define an initContainer in the Pod that executes a 'while' loop checking for network connectivity to the database service
InitContainers must complete successfully before the main application container starts. A script in an initContainer can effectively block the startup sequence until the external database is completely ready. Avoid using liveness probes for startup dependencies.
Q7. A security audit has mandated that all containers in the 'processing' namespace must adhere to strict hardening guidelines. Specifically, containers must not be allowed to gain more privileges than their parent process, and they must run a…
Answer: C. Define 'allowPrivilegeEscalation: false' and 'runAsUser: 10001' within the securityContext section of the specific container's definition.
The allowPrivilegeEscalation false setting specifically prevents a process from gaining more privileges than its parent. The runAsUser field enforces that the container process starts with the exact specified non-root UID.
Q8. Your engineering team is deploying a data-processing workload that consists of 10 identical tasks. Each task needs to know its specific rank or index to determine which partition of a large dataset to process. The team wants to avoid hardc…
Answer: B. Implement a Kubernetes Job with the completionMode set to Indexed and access the JOB_COMPLETION_INDEX environment variable within the container.
Setting completionMode to Indexed ensures that each Pod is assigned an immutable completion index. This index is automatically injected into the JOB_COMPLETION_INDEX environment variable for reliable programmatic access.
Q9. You are troubleshooting a complex microservice that occasionally hangs without crashing. To diagnose the issue, you need to run a sidecar container in the same Pod that can inspect the process tree of the main application container and run…
Answer: D. Grant the sidecar container the SYS_PTRACE capability and set the shareProcessNamespace field to true in the Pod specification.
Setting shareProcessNamespace to true allows containers in a Pod to see and interact with each other's processes. Combined with the SYS_PTRACE capability, it enables deep debugging tools like strace against peer containers.
Q10. You are managing a long-running Kubernetes Job named 'monthly-data-sync' that processes several thousand records. Occasionally, due to external API throttling or network instability, the Job's process hangs indefinitely without failing. Th…
Answer: D. Configure activeDeadlineSeconds: 7200 in the Job's spec to limit the total duration of the Job execution.
The activeDeadlineSeconds field limits the total duration of a Job from the moment it starts. Once the deadline is reached, Kubernetes terminates all associated Pods and marks the Job as failed with reason DeadlineExceeded.
Q11. Your organization is implementing a private container registry that requires authentication for all image pulls. You need to deploy a microservice named 'secure-api' that uses an image from this private registry. You have already created a…
Answer: A. Define the 'imagePullSecrets' field at the Pod specification level and reference the 'regcred' Secret to provide authentication to the Kubelet.
The imagePullSecrets field in the Pod spec is the standard mechanism to pass registry credentials to the Kubelet. The Kubelet securely handles the image pull operation before the container runtime initializes.
Q12. A data analytics application writes heavy temporary logs and cache files to the /tmp directory within the container. On several occasions, these files have grown so large that they filled the node's local disk, causing the node to become u…
Answer: C. Update the container's resource limits to include a request and limit for the 'ephemeral-storage' resource type.
Setting ephemeral-storage limits in the resources section is the standard way to manage local disk usage, ensuring the pod is evicted if it exceeds its quota. While emptyDir sizeLimits exist, they only constrain individual mounted volumes, whereas resource limits apply to the entire pod.
Q13. Your production environment currently runs a critical 'user-session-manager' Deployment with exactly 20 replicas. To ensure high availability during an upcoming update to version 2.0, the business requirement states that at least 15 replic…
Answer: A. Set maxSurge to 5 and maxUnavailable to 5 in the rollingUpdate strategy block.
This is correct because maxSurge 5 allows for 25 total pods, and maxUnavailable 5 ensures that 15 pods are always running, perfectly matching the capacity and availability constraints. Be careful with absolute values versus percentages, as percentages calculate dynamically based on replica counts.
Q14. You are deploying a web application that depends on a configuration file generated by a complex script. This script requires several specialized tools that are not included in the main application image to keep it slim and secure. You need…
Answer: A. Use an InitContainer to run the generation script and save the output to an emptyDir volume that is mounted by both the InitContainer and the main container.
InitContainers run to completion before the main container starts. By sharing an emptyDir volume, the InitContainer can write the file and the main container can consume it securely. Sidecars run concurrently, so they cannot guarantee file creation before the main app starts.
Q15. A security-sensitive financial application uses a ConfigMap named api-config to store endpoint URLs and non-secret metadata. To prevent unauthorized or accidental changes to the production configuration that could lead to routing errors, t…
Answer: C. Set the immutable: true field in the ConfigMap manifest to prevent any further updates to the data field of the resource.
The immutable field is a built-in feature for ConfigMaps and Secrets. Once set to true, it prevents any modifications to the data, ensuring configuration stability and reducing kubelet load. Mounting a volume as read-only only restricts the container, not the API server.
Q16. Your company hosts a web platform on Kubernetes. You need to expose two different backend services, 'marketing-site' and 'customer-portal', using a single external IP address. Traffic for 'example.com/marketing' must go to the 'marketing-s…
Answer: A. An Ingress resource with a single host 'example.com' and a list of paths mapping '/marketing' and '/portal' to their respective services and ports.
Ingress resources operate at Layer 7 and are specifically designed for path-based or host-based routing of HTTP traffic to internal services. Services operate at Layer 4 and cannot inspect URL paths to differentiate traffic between backend deployments.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.