Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A security-focused financial microservice named audit-logger is being deployed into a hardened Kubernetes namespace. Dur. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A security-focused financial microservice named audit-logger is being deployed into a hardened Kubernetes nam…
- Your main application container generates metrics in a proprietary binary format and writes them to a shared…
- You need to run a high-volume data migration task that involves processing 500 independent datasets. The task…
- A containerized Node.js application takes a significant amount of time to load its initial configuration and…
- You are managing a secure web API container that requires custom authentication headers for its health check…
- You are updating a critical 'api-gateway' deployment which currently has 10 replicas. To maintain high availa…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A security-focused financial microservice named audit-logger is being deployed into a hardened Kubernetes namespace. During a recent internal security assessment, the compliance team discovered that the application Pods are automatically m…
Answer: C. Set the automountServiceAccountToken field to false within the spec.template.spec section of the Deployment manifest.
Setting automountServiceAccountToken to false within the Pod template spec prevents Kubernetes from injecting the default API token. Overwriting the mount path with an emptyDir is a hacky workaround, whereas the native boolean field is the intended security control.
Q2. Your main application container generates metrics in a proprietary binary format and writes them to a shared volume at /data/logs/metrics.bin. The company's monitoring system requires these metrics to be available in a Prometheus-compatibl…
Answer: A. The Adapter pattern, where a second container transforms the output of the main container into a standardized format for external systems
The Adapter pattern transforms the main container output into a standardized format for external monitoring systems to consume. A generic sidecar merely adds features, while an Ambassador strictly proxies external network traffic.
Q3. You need to run a high-volume data migration task that involves processing 500 independent datasets. The task is encapsulated in a container image that processes one dataset and then exits. To complete the migration quickly, you want to en…
Answer: B. Create a Job with 'completions: 500', 'parallelism: 10', and 'backoffLimit: 5' to manage the execution and retries.
A Kubernetes Job uses completions to target successful exits and parallelism to control concurrency. The backoffLimit halts the entire workload after the specified failure count, which Deployments cannot do natively.
Q4. A containerized Node.js application takes a significant amount of time to load its initial configuration and cache into memory, typically between 45 and 60 seconds. If the container is checked for health during this period, it fails the ch…
Answer: B. Implement a startupProbe with a failureThreshold of 30 and a periodSeconds of 5 to allow up to 150 seconds for initialization
A startup probe disables liveness and readiness checks until it succeeds, providing a dedicated window for initialization without affecting long-term monitoring.
Q5. You are managing a secure web API container that requires custom authentication headers for its health check endpoint. The liveness probe must target the '/healthz' path on port 8443 and include a header named 'X-Internal-Token' with a val…
Answer: D. Use an httpGet probe with the path, port, and an httpHeaders array containing the name and value of the token.
An httpGet probe natively supports custom HTTP headers, allowing you to pass authentication tokens directly during health checks. While an exec probe using curl could technically work, it introduces unnecessary operational overhead and relies on external binaries inside the container image.
Q6. You are updating a critical 'api-gateway' deployment which currently has 10 replicas. To maintain high availability during the update, the business requires that at least 8 replicas remain available at all times. Additionally, to avoid ove…
Answer: C. Set maxUnavailable to 2 and maxSurge to 3 within the RollingUpdate strategy block of the Deployment manifest.
Setting maxUnavailable to 2 ensures at least 8 pods remain available during the rollout. Setting maxSurge to 3 guarantees that the total number of pods never exceeds 13, satisfying both high availability and resource constraints.
Q7. A developer is reporting that their application keeps restarting because the internal cache takes 2 minutes to populate. Currently, the Pod is marked as unhealthy by the liveness probe after 30 seconds, triggering a container kill and rest…
Answer: C. Configure a startupProbe with a long failureThreshold and a readinessProbe for traffic control
A startupProbe protects slow-starting applications by disabling liveness checks until initialization completes. Coupling it with a readinessProbe ensures the application receives traffic only when fully prepared, preventing premature container restarts.
Q8. You need to process a queue of 50 work items using a Kubernetes Job. To speed up the process, you want to ensure that exactly 5 Pods are running at any given time until all 50 items are processed successfully. If a Pod fails, it should be…
Answer: D. Set completions to 50 and parallelism to 5 within the Job's spec section
The Kubernetes Job controller natively handles parallel batch processing using the completions and parallelism fields. Setting parallelism to 5 maintains the desired workload concurrency until 50 successful completions are recorded.
Q9. In a shared development cluster, several teams are deploying applications into the 'sandbox' namespace. Occasionally, a poorly configured application consumes all the available memory on a node, causing the Kubelet to evict critical pods f…
Answer: C. Create a LimitRange object in the 'sandbox' namespace and specify the 'default' memory limit for containers.
A LimitRange is the correct Kubernetes mechanism to enforce default resource limits at the container level. While a ResourceQuota restricts total namespace consumption, it does not automatically inject missing memory limits into individual pod manifests.
Q10. An engineer is investigating an 'auth-service' deployment stuck in 'CreateContainerConfigError'. The pod is configured to mount a secret named 'api-credentials' as a volume. The engineer suspects the secret might be missing or incorrectly…
Answer: C. Run 'kubectl describe pod [pod-name]' and check the Events section for mount failures
The kubectl describe pod command outputs a detailed Events section that explicitly states why a container failed to start. You can quickly spot volume mount errors or missing secret dependencies there without needing application logs.
Q11. A retail application experiences sudden spikes in traffic during holiday sales. You want to implement an automatic scaling mechanism that increases the number of replicas when the average CPU utilization across all pods in the 'orders' dep…
Answer: C. Create a HorizontalPodAutoscaler (HPA) targeting the 'orders' deployment with a targetAverageUtilization of 70 and appropriate stabilization windows.
A HorizontalPodAutoscaler automatically scales the number of pods based on observed CPU utilization. Configuring its behavior field with stabilization windows prevents rapid scaling actions, effectively avoiding flapping during minor metric fluctuations.
Q12. A web application needs to connect to an external database that requires a complex custom authentication protocol and local caching of query results. To keep the main application code simple and clean, you decide to use a multi-container p…
Answer: C. The Ambassador pattern, which acts as a proxy to represent an external service as if it were a local service.
The Ambassador pattern acts as a dedicated proxy to simplify communication with complex external services. The main application connects to this helper container on localhost, entirely abstracting away the custom authentication and caching logic.
Q13. A web application requires a sensitive database password and a TLS certificate to initialize correctly. These credentials are stored in Kubernetes Secrets named db-pass and site-tls. For security and architectural reasons, the password mus…
Answer: C. Use secretKeyRef to map the password to an environment variable and define a volume of type secret to mount at /etc/tls
Using secretKeyRef maps a specific secret key directly into an environment variable for the container. Mounting a secret volume separately exposes the certificate files securely into the specified directory without hardcoding sensitive data.
Q14. Your company is running a mission-critical web application on Kubernetes. During updates, you must ensure that the application never drops below 100% of its desired replica count to handle peak traffic. At the same time, the cluster has li…
Answer: C. Configure a RollingUpdate with maxSurge set to 2 and maxUnavailable set to 0 to maintain full capacity during the update.
Setting maxUnavailable to 0 maintains full capacity, while maxSurge to 2 strictly limits extra pods. Allowing unavailable pods is the strongest distractor, but it breaks the required capacity rule.
Q15. You are troubleshooting a legacy Java application deployed in the 'production' namespace. The application occasionally enters a 'zombie' state where the process is still running, but the internal HTTP server stops responding to requests du…
Answer: D. Define a Liveness Probe using an httpGet request to port 8080 on the /healthz path.
A liveness probe using HTTP GET accurately restarts containers stuck in deadlock states. A readiness probe is the strongest distractor, but it merely stops traffic instead of restarting.
Q16. A development team is deploying a Node.js microservice that requires a specific database schema to be present in an external PostgreSQL instance. To ensure the application does not start with an incompatible schema, a migration script must…
Answer: B. Utilize an initContainer in the Pod spec to run the database migration script before the main container
An initContainer runs to completion before the main container, blocking startup if it fails. A sidecar is the strongest distractor, but it runs concurrently instead of sequentially.
Q17. A data analysis team uses a CronJob to run a heavy reconciliation script every hour. Recently, they noticed that if a job takes longer than 60 minutes, a second job starts while the first is still running, leading to database lock contenti…
Answer: A. Set the concurrencyPolicy to Forbid in the CronJob specification to prevent overlapping executions.
Setting concurrencyPolicy to Forbid correctly prevents overlapping jobs from running simultaneously. Changing schedule frequency is the strongest distractor, but it fails under delays.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.