Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A legacy data-client application is hardcoded to communicate with a database instance at localhost:5432. The development. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A legacy data-client application is hardcoded to communicate with a database instance at localhost:5432. The…
- A specialized custom message broker is being deployed that does not provide an HTTP-based health check endpoi…
- Your application consumes a Secret named 'api-credentials' which is mounted as a volume at /etc/api-keys. The…
- The security team has audited the 'payment-processing' namespace and issued a new mandate. All application co…
- A legacy enterprise microservice named 'registry-client' is being deployed into a production namespace. The a…
- Your company uses a single Ingress controller to manage traffic for multiple internal services. You need to c…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A legacy data-client application is hardcoded to communicate with a database instance at localhost:5432. The development team is migrating this application to a Kubernetes cluster where the PostgreSQL database is hosted as a separate Servi…
Answer: D. Include an Ambassador container in the Pod that runs a TCP proxy configured to listen on localhost:5432 and forward traffic to the 'postgres-db' Service address.
The Ambassador pattern acts as a proxy for the main container. By running a proxy on localhost inside the same Pod, the legacy application connects locally while traffic is seamlessly forwarded to the actual Service. Adapters are for standardizing output, not proxying traffic.
Q2. A specialized custom message broker is being deployed that does not provide an HTTP-based health check endpoint. To be considered healthy, the container must satisfy two conditions: it must be listening for connections on TCP port 9090, an…
Answer: D. Define a livenessProbe using 'exec' that runs a shell command to verify both the file existence and the port status.
Since a container can only have one livenessProbe, using exec to run a combined shell script is the only way to validate multiple distinct conditions for health. A readiness probe would only pause traffic, whereas the mandate requires failing and restarting the pod.
Q3. Your application consumes a Secret named 'api-credentials' which is mounted as a volume at /etc/api-keys. The security team performs a manual rotation of the API keys in the Kubernetes Secret. You need to understand how this update will pr…
Answer: B. The Kubelet will eventually update the files in the volume, and the application must be designed to periodically re-read the files from the disk.
When Secrets are mounted as volumes, the kubelet eventually refreshes the data on disk. Applications must be designed to periodically re-read these files to pick up changes without requiring a process restart. Environment variables are immutable and never update dynamically.
Q4. The security team has audited the 'payment-processing' namespace and issued a new mandate. All application containers must run with a read-only root filesystem to minimize the attack surface. However, the 'transaction-logger' application r…
Answer: A. Set readOnlyRootFilesystem: true in the securityContext and mount an emptyDir volume at the /var/log/app mount path.
Enabling readOnlyRootFilesystem protects the container, and mounting an emptyDir at the specific logging path provides a writable scratch space that is isolated from the root filesystem. Using privileged mode or HostPath directly violates the required security mandates.
Q5. A legacy enterprise microservice named 'registry-client' is being deployed into a production namespace. The application was designed to manually register its IP address into a legacy external service discovery system whenever it starts up…
Answer: B. Define a postStart lifecycle hook within the container specification to execute the registration script.
A postStart hook executes a registration script immediately after container creation without altering the core application code. Init containers run before the primary container starts, so they cannot expose the pod IP.
Q6. Your company uses a single Ingress controller to manage traffic for multiple internal services. You need to configure an Ingress resource for the 'corporate-portal' application. The requirements are: traffic to 'portal.example.com/finance'…
Answer: A. Define an Ingress with two rules for the same host, using pathType: Prefix for both /finance and /hr, and specify the 'portal-tls' secret in the tls section.
The Prefix path type satisfies the requirement to match exact paths or sub-paths by validating the URI prefix. The word exact in the prompt creates slight ambiguity, but Prefix is ultimately the correct technical match.
Q7. A development team is working in a shared namespace called dev-team-alpha. They are attempting to deploy a new microservice, but the Pod remains in the Pending state. Upon investigation, the kubectl describe pod command reveals a message s…
Answer: A. Update the new Pod's manifest to decrease its CPU request to 1 CPU core or less to fit within the remaining quota
Lowering the CPU request to 1 core or less fits the remaining namespace quota. While deleting the ResourceQuota would also allow scheduling, it violates the implicit organizational constraints and removes cluster guardrails.
Q8. Your enterprise application, 'legacy-metrics-engine', generates performance data in a proprietary binary format that cannot be directly scraped by the cluster's Prometheus monitoring system. To ensure visibility without modifying the appli…
Answer: C. Deploy an Adapter container within the same Pod to read the binary metrics and expose them in the required Prometheus format
The Adapter pattern standardizes or simplifies the application output for external systems, fitting perfectly for translating metrics. The Sidecar and Ambassador patterns manage inbound traffic or logs, failing to address the required transformation.
Q9. A legacy web application, 'customer-portal', is being migrated to Kubernetes. The application takes 3 minutes to perform a self-check and load its internal cache from an external database. During this time, the application is running but c…
Answer: A. Configure a ReadinessProbe with a 'periodSeconds' of 10 and a check that only succeeds after the cache loading process is complete
A readiness probe removes the pod from service endpoints until the cache finishes loading, preventing premature traffic. A liveness probe would only prevent restarts, leaving the unresponsive pod exposed to user requests.
Q10. Your organization is deploying a microservice that requires a specific API key to communicate with a third-party billing provider. This key is stored in a Kubernetes Secret named 'provider-credentials' along with fifty other sensitive keys…
Answer: A. Define an environment variable in the Pod spec using valueFrom with the secretKeyRef property specifying the key.
Using secretKeyRef inside valueFrom exposes only the specific key needed to the container environment. Using envFrom would mount all fifty keys, violating the required principle of least privilege.
Q11. A data processing Pod named 'heavy-worker' is stuck in a 'Pending' state. Upon investigation, you find that the target nodes for this workload have been tainted with 'dedicated=high-mem:NoSchedule' to reserve them for specific memory-inten…
Answer: C. Update the Pod specification to include a toleration that matches the key, value, and effect of the taint on the high-memory nodes.
Adding a toleration matching the node taint allows the scheduler to place the memory-intensive pod on the reserved hardware. Using a nodeSelector or node affinity does not override a NoSchedule taint.
Q12. Your cluster administrator has enabled the Pod Security Admission controller to enforce strict security standards. You are attempting to deploy a network monitoring tool into the 'restricted-workloads' namespace, which is labeled with 'pod…
Answer: C. Remove the NET_ADMIN capability and ensure 'allowPrivilegeEscalation' is set to false in the securityContext.
The restricted profile strictly blocks adding Linux capabilities like NET_ADMIN and requires privilege escalation to be disabled. Changing namespace labels to privileged undermines cluster security and violates baseline governance rules.
Q13. A stateful database cluster is managed using a StatefulSet named 'db-store' with 3 replicas. Each Pod in the StatefulSet is associated with a PersistentVolumeClaim (PVC) through a volumeClaimTemplate. Due to a change in demand, you are ins…
Answer: A. The PVCs for replicas 1 and 2 are retained in the cluster, preserving the data; they must be manually deleted if the storage is no longer required.
PersistentVolumeClaims created by a StatefulSet are not automatically deleted when scaled down. This retains data for potential scale-up operations, meaning admins must manually clean up unused volumes.
Q14. A data-processing application named log-analyzer requires a specific directory structure and a configuration file to be dynamically generated on the local node's file system before the main container starts. The generation script is a comp…
Answer: A. Configure an InitContainer in the Pod manifest to run the generation script and share the directory via an emptyDir volume.
Init containers run to completion before the main application starts, using shared volumes to pass generated files. A postStart hook executes concurrently with the main container, risking a race condition where the app starts before setup finishes.
Q15. Your organization is hosting a multi-tenant platform where a single Ingress controller handles traffic for various departments. You need to configure the Ingress resource so that requests to 'api.company.com/v1/orders' are routed to the 'o…
Answer: A. Define a single Ingress resource with a 'rules' section for the host 'api.company.com' containing multiple paths under the 'http' attribute
A single Ingress resource uses a rules section with multiple http paths to route traffic based on the URL. Creating multiple Ingress resources for the same host is unnecessary and complicates path management.
Q16. You are managing an Ingress resource that routes traffic to several microservices. You have a legacy service named 'v1-service' mapped to the path '/api' and a new service named 'v2-service' mapped to '/api/v2'. During testing, you notice…
Answer: C. Modify the Ingress resource to use pathType: Exact for both paths and ensure the more specific path is listed first in the rules.
Using pathType Exact forces exact string matching, preventing broader prefix paths from catching specific routes. The Prefix path type can also work if configured correctly, making the provided options slightly ambiguous.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.