Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A microservice requires a sensitive configuration file to be fetched from a secure vault and placed into a shared volume. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A microservice requires a sensitive configuration file to be fetched from a secure vault and placed into a sh…
- An application pod requires a specific configuration file to be generated based on the current environment's…
- An application requires sensitive API keys and a large configuration file to operate. The developer decides t…
- Your application needs to perform a complex calculation using a large static dataset provided as a CSV file…
- An application Pod named 'batch-processor' has entered a 'CrashLoopBackOff' state immediately after deploymen…
- You are configuring an Ingress resource to route traffic to multiple microservices. The external users access…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A microservice requires a sensitive configuration file to be fetched from a secure vault and placed into a shared volume before the main application starts. The main application does not have the credentials or logic to interact with the v…
Answer: A. Implement an init container that fetches the file and writes it to an emptyDir volume
Init containers run to completion before any app containers start, guaranteeing the file exists. A postStart hook executes concurrently with the main container, creating a race condition where the app might look for the file before it is written.
Q2. An application pod requires a specific configuration file to be generated based on the current environment's dynamic variables before the main application starts. This generation process involves running a specialized utility tool that is…
Answer: A. Use an init container with the utility tool image and a shared emptyDir volume to generate and pass the file to the main container
Init containers run to completion before the main app starts, safely using separate images. A sidecar runs concurrently and wastes resources, while modifying the main image bloats it.
Q3. An application requires sensitive API keys and a large configuration file to operate. The developer decides to use a Secret for the keys and a ConfigMap for the configuration file, both mounted as volumes. During a maintenance window, the…
Answer: C. The kubelet periodically synchronizes mounted ConfigMaps and Secrets, updating the projected files in the volume without a restart.
The kubelet automatically synchronizes mounted volumes on a configurable delay, updating files without a restart. Avoid using subPath for files that require updates, as subPath mounts do not receive live updates.
Q4. Your application needs to perform a complex calculation using a large static dataset provided as a CSV file. This dataset is updated weekly by a separate data science team and stored in a ConfigMap named 'calculation-data'. The application…
Answer: C. Mount the ConfigMap using a volumeMount with a subPath that points specifically to the 'values.csv' key within the directory.
Using subPath mounts a specific file without overwriting the target directory. This avoids permission issues entirely. Setting readOnly to false does not bypass filesystem permission rules for the directory.
Q5. An application Pod named 'batch-processor' has entered a 'CrashLoopBackOff' state immediately after deployment. You have attempted to check the logs using 'kubectl logs batch-processor', but the output is completely empty because the conta…
Answer: A. kubectl describe pod batch-processor and then kubectl logs –previous
The describe command reveals events like failed probes or pull errors. The previous flag retrieves logs from the last crashed instance. Executing into the container will fail because it keeps crashing.
Q6. You are configuring an Ingress resource to route traffic to multiple microservices. The external users access the services via a single domain 'api.example.com'. Requests to 'api.example.com/orders' should be routed to the 'orders-service'…
Answer: D. Add an annotation such as 'nginx.ingress.kubernetes.io/rewrite-target: /' to the Ingress resource to modify the URI path
Ingress controllers use annotations like rewrite-target to modify HTTP requests before forwarding them. Services and NetworkPolicies operate below the application layer and cannot manipulate HTTP paths.
Q7. A production deployment named 'inventory-api' currently runs 10 replicas of version v1. The management requires that during the update to version v2, the application must never drop below 100% of its current capacity to ensure zero perform…
Answer: C. Set maxSurge to 2 and maxUnavailable to 0 to maintain full capacity
Setting maxUnavailable to zero maintains the ten replicas, satisfying full capacity. Setting maxSurge to two respects the strict limit of two extra pods. Any maxUnavailable value above zero drops capacity.
Q8. Your organization is hosting a web application that must be accessible over HTTPS via the domain 'app.example.com'. You have been provided with a TLS certificate and a private key. You have already created a Kubernetes Secret named 'app-tl…
Answer: A. A tls block containing the hosts list and the secretName referencing the secret
The spec dot tls block configures TLS termination by mapping domain hosts to a specific Kubernetes Secret. The Ingress controller serves the certificate, so backend services can remain on standard HTTP.
Q9. Your engineering team is deploying a modern application that outputs performance metrics in Prometheus format. However, the organization's legacy centralized monitoring server only accepts metrics via a proprietary XML-based API. You need…
Answer: C. Utilize an Adapter container to standardize the output of the application to match the requirements of the external monitoring system.
The Adapter pattern standardizes output by transforming internal application data for external systems. This differs from a standard sidecar, which typically extends or proxies services without fundamentally altering the data format.
Q10. A critical banking application requires a deployment strategy where the new version (v2) is fully deployed and tested alongside the current version (v1) before any production traffic is cut over. The organization requires a method that all…
Answer: A. Deploy version v2 as a separate Deployment and update the Service label selector to point to the new version's labels.
Updating a service selector to point to a completely new deployment achieves a Blue-Green release. Rolling updates lack instantaneous rollback because traffic must be gradually shifted back to the original pods.
Q11. A DevOps engineer is troubleshooting a 'payments-api' deployment that keeps failing with a status of OOMKilled. The node has plenty of available memory, but the Pod specifically is being terminated shortly after it starts processing transa…
Answer: B. Increase the memory limit in the resources section of the container specification to match the application's peak usage requirements.
The OOMKilled status indicates a container exceeded its configured memory limit. Increasing the limit in the resource specification directly resolves the termination. Moving the pod to a larger node will not help because the kernel kills the process based on the pod limit, not node capacity.
Q12. You are tasked with securing a public-facing web application hosted on Kubernetes. The application is accessed via an Ingress resource at the host 'api.company-services.com'. Your security department has provided a valid SSL certificate an…
Answer: A. Add a tls section to the Ingress spec containing the secretName and the list of hosts
The standard method for enabling TLS on an Ingress is adding a tls section to the spec with the secretName and hosts list. Controller-specific annotations are deprecated and non-portable. Relying on the native tls block ensures the controller correctly serves the certificate for the specified hostname.
Q13. A developer is troubleshooting a deployment named 'order-service' that is constantly crashing immediately after start. The 'kubectl get pods' command shows the status as 'CrashLoopBackOff'. The developer needs to see the log output from th…
Answer: B. Execute 'kubectl logs order-service –previous' to retrieve the logs from the last terminated container instance
The –previous flag retrieves stdout and stderr from the previously terminated container instance. This is the primary debugging tool for CrashLoopBackOff scenarios where the current container has not logged anything yet. The describe command only shows cluster events, not application output.
Q14. During a troubleshooting session, you notice that several Pods for your application are stuck in the 'ImagePullBackOff' state. You suspect that the issue is related to the private container registry credentials, but you need to confirm exa…
Answer: A. kubectl describe pod <pod-name> to inspect the 'Events' section at the bottom of the output.
The kubectl describe pod command displays a chronological Events section containing explicit Kubelet messages detailing exactly why the image pull failed. The logs command will not work because the container has not started, meaning there is no application output to inspect.
Q15. An enterprise legacy application is migrating to a Kubernetes environment. The application is hardcoded to write its internal transaction logs to a specific local file path within its container. To comply with the company's centralized log…
Answer: A. Implementing a Sidecar container that shares an emptyDir volume with the main application and tails the log file to stdout.
A sidecar container shares an emptyDir volume with the main application to read and stream logs to stdout. This decouples logging from the primary application and allows standard Kubernetes logging to capture the output. An init container cannot continuously run to stream logs.
Q16. A mission-critical financial application Pod is consistently being terminated with an 'OOMKilled' status. You have observed that while the container usually stays under 256Mi of RAM, it occasionally spikes to 1Gi during daily reconciliatio…
Answer: A. Update the Pod's container spec to set a memory 'limit' of 1Gi and ensure the namespace LimitRange is adjusted to allow this value.
The container memory limit must be raised above the spike threshold to prevent the kernel from killing the process. Because a LimitRange enforces maximum values, it must also be updated to permit the new 1Gi limit. Increasing requests without limits does not prevent termination.
Q17. Your organization is implementing strict security controls for a three-tier application consisting of a frontend, a backend, and a database. The security policy dictates that the 'backend' pods in the 'prod' namespace should only accept in…
Answer: B. Apply an Ingress policy allowing the frontend label and a separate Egress policy with an empty set of allowed destinations.
Applying an Ingress rule with a podSelector for the frontend allows specific incoming traffic, while an empty Egress rule blocks all outgoing traffic. Using a CIDR block filter is imprecise for dynamic pod IPs, and HostPort bypasses standard network policy enforcement entirely.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.