Practice for the Certified Kubernetes Application Developer (CKAD) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: You are tasked with deploying a new version of a stateless web application. The business requirement is to ensure that t. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- You are tasked with deploying a new version of a stateless web application. The business requirement is to en…
- Your organization has a strict security policy requiring that all containers in the 'payment-gateway' namespa…
- A developer needs to deploy an Nginx container that uses a custom 'nginx.conf' file stored in a ConfigMap nam…
- You are deploying an Ingress resource to manage traffic for a multi-tenant platform. The platform hosts two s…
- An organization hosts two separate web services: 'shop.example.com' and 'blog.example.com'. Both services are…
- An enterprise microservice is being migrated to a Kubernetes cluster. The application was originally designed…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. You are tasked with deploying a new version of a stateless web application. The business requirement is to ensure that the transition happens with zero downtime. During the update, the cluster should always have at least the current number…
Answer: C. Set the strategy type to RollingUpdate with maxUnavailable set to 0 and maxSurge set to 25%.
Setting maxUnavailable to 0 ensures no pods are removed until new ones are ready, maintaining full capacity. Setting maxSurge allows the deployment to create additional pods during the update, fulfilling the requirement to speed up the rollout.
Q2. Your organization has a strict security policy requiring that all containers in the 'payment-gateway' namespace run as non-root users. You are deploying a new microservice that needs to run with the specific user ID 2000 and group ID 3000…
Answer: A. Apply the runAsUser and runAsGroup settings within the securityContext section at the Pod level of the manifest.
Defining runAsUser and runAsGroup in the pod-level securityContext ensures all containers inherit these exact execution permissions. Applying settings at the container level only affects one container, and service accounts handle API authentication.
Q3. A developer needs to deploy an Nginx container that uses a custom 'nginx.conf' file stored in a ConfigMap named 'web-config'. The Nginx image stores its default configuration files in the '/etc/nginx' directory. If the developer mounts the…
Answer: C. Use the 'subPath' field in the volumeMounts section to mount only the specific 'nginx.conf' key from the volume into the full file path
Using the subPath field in volumeMounts injects a single ConfigMap file into an existing directory without overwriting neighbors. Without subPath, the entire directory is masked by the mounted volume, breaking the container.
Q4. You are deploying an Ingress resource to manage traffic for a multi-tenant platform. The platform hosts two separate services: 'billing.example.com' and 'support.example.com'. The billing service requires HTTPS and uses a TLS certificate s…
Answer: D. Define a single Ingress with a 'tls' block where the 'hosts' list only includes 'billing.example.com' and the 'secretName' is 'billing-tls-cert'.
Creating a single Ingress with a TLS block for the billing host correctly restricts HTTPS to that domain. However, creating two separate Ingress resources is also valid, making the options ambiguous.
Q5. An organization hosts two separate web services: 'shop.example.com' and 'blog.example.com'. Both services are running in the same Kubernetes cluster. You need to configure a single entry point that routes traffic to the correct service bas…
Answer: B. Implement an Ingress resource with rules defined for each host pointing to their services
An Ingress resource manages external access to services, providing Layer 7 routing and TLS termination. Services lack host-based routing, making Ingress the only option for HTTP host rules.
Q6. An enterprise microservice is being migrated to a Kubernetes cluster. The application was originally designed to connect to a local database on a specific port. Due to architectural constraints, the application cannot be modified to handle…
Answer: B. Deploying an Ambassador container to proxy the database connections
The Ambassador pattern deploys a proxy container to handle outbound traffic on behalf of the main application. This abstracts complex service discovery or sharding logic away from the application code.
Q7. An enterprise is hosting multiple web services under the same domain but different subpaths: '/api' routes to the 'api-service' and '/static' routes to the 'content-service'. They need to implement an Ingress resource that handles this rou…
Answer: A. Define a single host with multiple paths in the 'rules' section and specify the 'tls' section referencing the 'tls-secret'.
A single Ingress resource can define multiple paths under a specific host block and configure TLS termination. Using NodePort or separate Ingress resources lacks native path mapping and unified TLS management.
Q8. Startup Probes for Legacy Apps. A legacy Java application takes a significant amount of time to initialize, often between 3 and 5 minutes, due to heavy JVM startup and database schema validations. During this period, the application does n…
Answer: C. Implement a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to protect the container during its initial boot
A Startup probe specifically disables Liveness and Readiness checks until it succeeds, accommodating slow-starting applications. Modifying initialDelaySeconds forces rigid timing limits that cannot adapt.
Q9. Egress Network Policies. An application Pod named 'data-fetcher' in the 'processing' namespace needs to communicate with an external API service located at the static IP address 203.0.113.10. For compliance reasons, the security team has r…
Answer: D. An Egress policy with two rules: one with an ipBlock allowing 203.0.113.10/32, and another allowing UDP/TCP port 53 to the kube-system namespace
Defining an Egress policy triggers default-deny behavior for all unspecified outbound traffic. You must explicitly allow an ipBlock for the external API and a namespace selector for DNS resolution.
Q10. An application Pod in the 'security-tools' namespace needs to interact with the Kubernetes API to list other Pods and their IP addresses for a network mapping utility. By default, the Pod is using the 'default' ServiceAccount, which does n…
Answer: D. Specify the custom 'serviceAccountName' in the Pod's spec section
A Pod inherits permissions based on its explicitly assigned serviceAccountName, mounting the correct API token. Without mapping the specific ServiceAccount, the default restricted permissions remain active.
Q11. An analytics team needs to run a data processing task that takes several hours to complete. The task consists of 10 independent units of work. To optimize time, they want to process 3 units simultaneously. The task must be resilient; if a…
Answer: D. A Job with completions: 10 and parallelism: 3 to ensure sequential completion with a set amount of concurrent workers.
A Kubernetes Job is designed for finite tasks and automatically retries failed pods until they succeed. Setting parallelism limits concurrent workers, optimizing resource usage while completions tracks the total required successes. CronJobs are for scheduled recurring tasks.
Q12. A data processing task must run to completion exactly once for each data set provided. If the pod performing the task fails due to a node crash, Kubernetes must ensure a new pod is scheduled to complete the remaining work. The task is not…
Answer: A. Deploy a Job with a restartPolicy set to OnFailure to ensure task completion
A Job handles run-to-completion workloads. Setting restartPolicy: OnFailure guarantees that Kubernetes retries the container exactly until it succeeds. A Deployment or DaemonSet is incorrect because they manage continuous, long-running processes.
Q13. You are managing a production deployment of a web application that frequently experiences internal deadlocks. When a deadlock occurs, the main process continues to run, so the container remains in a 'Running' state, but the application sto…
Answer: A. Define a LivenessProbe with an HTTP GET action targeting a health check endpoint that verifies internal application logic.
A LivenessProbe with an HTTP GET action checks application health and restarts the container upon failure. TCP socket checks only verify network listening, failing to detect internal application deadlocks.
Q14. Sidecar for Metrics Transformation. You are deploying a microservice that exposes raw performance data via a local text file updated every 30 seconds. You need to use a sidecar container to read this file and provide an HTTP endpoint that…
Answer: A. An emptyDir volume mounted at the same path in both containers to provide a shared, temporary filesystem in memory or on disk
An emptyDir volume provides shared, temporary storage accessible by all containers within a single Pod. Persistent volumes are unnecessary for transient data, and ConfigMaps are strictly read-only.
Q15. A legacy internal application only supports HTTP communication, but the security team mandates HTTPS for all traffic entering the pod. The development team decides to use an Nginx sidecar container to handle SSL/TLS termination so the appl…
Answer: A. Configure the Nginx sidecar and application container to share the same Network namespace using localhost for communication.
Containers within the same Pod inherently share the same Network namespace, enabling them to communicate via localhost. The proxy sidecar listens on external ports while forwarding traffic to localhost.
Q16. A development team is struggling with a Pod containing two containers: an 'app-container' and a 'helper-container'. The 'helper-container' crashes frequently during the first 10 seconds of startup due to a configuration error. When the tea…
Answer: A. Run 'kubectl logs pod-name -c helper-container –previous' to retrieve the logs from the last terminated container instance.
The –previous flag retrieves logs from the last terminated instance of a container, essential for debugging crash loops. Events and current logs rarely capture the exact application failure trace.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.