Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An enterprise application generates operational metrics in a proprietary XML format through a local Unix socket. The org. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- An enterprise application generates operational metrics in a proprietary XML format through a local Unix sock…
- Your team is preparing to deploy a mission-critical update to a financial API. The management requires a depl…
- A security audit reveals that several Pods in the 'finance' namespace are running with root privileges, which…
- A specialized database container requires a specific configuration script to be executed immediately after th…
- Your company is deploying a complex web application architecture where different services need to be accessib…
- You are deploying a distributed database where each instance must be addressable individually by a stable DNS…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An enterprise application generates operational metrics in a proprietary XML format through a local Unix socket. The organization has standardized on Prometheus for monitoring, which requires metrics to be exposed via HTTP in a specific pl…
Answer: B. Deploy an Adapter container within the same Pod that consumes the XML metrics and exposes them on a dedicated HTTP port for Prometheus
An adapter container standardizes output by transforming proprietary application metrics into a format the monitoring system expects. Running in the same pod allows it to access the local socket efficiently. An ambassador container proxies traffic, while an init container cannot run continuously.
Q2. Your team is preparing to deploy a mission-critical update to a financial API. The management requires a deployment strategy where the new version is fully deployed and tested in the production environment before any live traffic is switch…
Answer: B. Deploy a second Deployment for the new version and update the Service selector to point to the new version labels after successful validation.
Deploying a second deployment and updating the service selector implements a blue-green strategy, providing instant traffic shifting and rollback. A rolling update gradually replaces old pods, meaning both versions receive live traffic simultaneously and rollback is not instantaneous.
Q3. A security audit reveals that several Pods in the 'finance' namespace are running with root privileges, which violates the company's security policy. The developer must update the Deployment manifest to ensure that the container runs as a…
Answer: B. Set the securityContext at the container level with runAsUser: 1000 and allowPrivilegeEscalation: false.
Setting the container-level securityContext with runAsUser: 1000 and allowPrivilegeEscalation: false directly enforces the required non-root and non-escalating execution. RoleBindings and ResourceQuotas manage API access and resource limits, not the running container's process privileges.
Q4. A specialized database container requires a specific configuration script to be executed immediately after the container process starts. This script registers the container's IP in a legacy registry system. The script must run within the s…
Answer: B. A postStart lifecycle hook that executes the registration script once the container has been created.
The postStart hook executes immediately after the container is created, making it perfect for registering the IP. An InitContainer is incorrect because it runs and terminates before the main container starts.
Q5. Your company is deploying a complex web application architecture where different services need to be accessible via a single public IP address. The requirements specify that requests to 'api.company.com/v1' should be routed to the 'v1-serv…
Answer: A. An Ingress resource with rules defining a single host and multiple paths, each pointing to a different backend service
An Ingress resource is the standard choice for Layer 7 load balancing, natively supporting path-based routing for splitting traffic between services. NetworkPolicies are incorrect because they manage IP-level firewall rules, not HTTP request routing.
Q6. You are deploying a distributed database where each instance must be addressable individually by a stable DNS name to manage peer-to-peer synchronization. The instances manage their own replication and need to know the direct IP addresses…
Answer: D. Create a Headless Service by setting the clusterIP field to None in the specification
Setting clusterIP to None creates a Headless Service, which returns individual pod IP addresses via DNS instead of a single virtual IP. This enables direct peer-to-peer communication required by stateful applications. NodePort or Ingress add unwanted load balancing.
Q7. A monolithic legacy application is being containerized and deployed into a production cluster. During its startup phase, the application performs a heavy checksum validation of its local data files, which typically takes 180 seconds to com…
Answer: A. Implement a StartupProbe with a failureThreshold of 30 and a periodSeconds of 10 to disable other probes during initialization
A StartupProbe disables Liveness and Readiness probes until it succeeds, preventing slow containers from being killed by the Kubelet during initialization. Relying on initialDelaySeconds is brittle because exact startup times fluctuate under variable loads or hardware conditions.
Q8. A financial data processing application uses a CronJob to run a reconciliation script every minute. The script typically completes in 45 seconds, but during peak hours, it can take up to 150 seconds. The operations team notices that multip…
Answer: B. Set the concurrencyPolicy field to Forbid within the CronJob specification
Setting concurrencyPolicy to Forbid tells the controller to skip creating new Jobs if an existing one is still running. The Replace policy kills the active Job, while changing history limits only cleans up old completed tasks without preventing overlaps.
Q9. A web application experiences highly variable traffic patterns throughout the day. To ensure high availability and cost-efficiency, the operations team wants the number of running pods to automatically increase when the average CPU utiliza…
Answer: A. A Horizontal Pod Autoscaler (HPA) targeting the Deployment with the specified CPU utilization threshold
The Horizontal Pod Autoscaler automatically scales the number of Deployment replicas based on observed CPU utilization. The Cluster Autoscaler only adjusts the cluster node size, and the Vertical Pod Autoscaler modifies resource requests rather than replica counts.
Q10. A production team is managing a high-traffic web service currently running on Deployment 'webapp-v1'. They need to perform a zero-downtime update to 'webapp-v2'. The requirement is to maintain 100% of the current capacity at all times duri…
Answer: B. Define maxUnavailable as 0% and maxSurge as 25% to ensure no capacity is lost while limiting the temporary resource overhead
Setting maxUnavailable to 0 guarantees no existing pods are removed before new ones are ready. Pairing it with a 25% maxSurge strictly limits the temporary extra pods, satisfying the resource constraint while maintaining full application availability.
Q11. Your development team has provided a ConfigMap named 'app-config' that contains over 40 individual environment variables required by a microservice. Instead of mapping each variable individually in the Deployment manifest using the 'valueF…
Answer: C. Use the envFrom field and reference the ConfigMap using the configMapRef attribute
The envFrom field automatically imports all key-value pairs from a ConfigMap as container environment variables. This avoids listing each variable individually with valueFrom and ensures future ConfigMap additions are automatically consumed by the container.
Q12. A financial reconciliation task is scheduled to run every 5 minutes using a Kubernetes CronJob. Due to occasional high data volumes, the task sometimes takes 7 or 8 minutes to complete. The business requirement states that if a previous ex…
Answer: A. Configure concurrencyPolicy to 'Forbid' to prevent the controller from creating a new Job if the previous one has not finished
The Forbid policy explicitly tells the CronJob controller to skip creating a new Job if an existing one is still running. Replace terminates the current Job, and backoffLimit only dictates retry behavior for failed tasks rather than concurrency rules.
Q13. A security policy requires that the 'frontend' pods in the 'production' namespace must only be allowed to communicate with 'backend' pods on port 8080. All other outgoing traffic from the 'frontend' pods, including traffic to external inte…
Answer: A. Create an Egress policy for 'frontend' pods with a 'to' rule selecting 'backend' pods and a 'ports' rule for 8080.
An Egress policy applied to the frontend pods explicitly restricts outgoing traffic to only the specified backend on port 8080. An Ingress policy on the backend fails this requirement because it does not block the frontend from sending traffic to external addresses.
Q14. A healthcare technology company is deploying a HIPAA-compliant web service in a Kubernetes cluster. The application, named 'portal-app', must be accessible over HTTPS using the domain 'portal.healthcare.com'. The infrastructure team has pr…
Answer: D. Define the 'tls' field with 'hosts' containing 'portal.healthcare.com' and 'secretName' set to 'portal-tls-secret', while setting the 'rules' to forward traffic to 'portal-svc' on port 8080.
The tls block in the Ingress specification correctly associates the TLS secret with the host, while the rules block maps the host to the backend service port. ConfigMaps cannot store TLS keys, and annotations alone fail to configure secure routing properly.
Q15. You are performing a canary release for a new version of a stateless web service. The current version is running in a Deployment named 'webapp-v1' with 9 replicas. You have created a new Deployment named 'webapp-v2' with 1 replica. Both de…
Answer: A. Traffic will be distributed randomly among all 10 available pods, resulting in approximately 10% of traffic reaching the new 'webapp-v2' version.
The Service load balances randomly across all matching pods, sending roughly 10% of traffic to the new version. Kubernetes does not understand version labels natively, so it treats all matching pods as identical endpoints rather than isolating deployments.
Q16. A developer wants to deploy a container that needs to capture network packets for debugging purposes within a specific namespace. For security reasons, you must grant the minimum necessary Linux capabilities rather than running the contain…
Answer: C. Add the NET_RAW capability to the capabilities list in the security context
The NET_RAW capability allows processes to use raw and packet sockets, which tools like tcpdump need for capturing traffic without full host access. Setting privileged to true violates the least-privilege principle, and root permissions do not directly grant specific capabilities securely.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.