Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A legacy binary is running in a pod and writes its logs to a local file at /var/log/app.log. The cluster's logging infra. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- A legacy binary is running in a pod and writes its logs to a local file at /var/log/app.log. The cluster's lo…
- You have a ConfigMap named 'global-settings' that contains 50 different configuration keys. You need to deplo…
- A database application running in your cluster is running out of disk space on its mounted volume. The underl…
- You are deploying a microservice named 'report-generator' that depends on a database. Before the 'report-gene…
- A microservices architecture consists of a 'frontend' deployment and a 'backend' deployment in the same 'app-…
- A financial services company is managing a high-availability API currently running 20 replicas of version 'v1…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A legacy binary is running in a pod and writes its logs to a local file at /var/log/app.log. The cluster's logging infrastructure only collects logs from the standard output (stdout) and standard error (stderr) streams of the containers. Y…
Answer: B. Add a sidecar container to the Pod that runs a tail -f command on the log file, sharing the log directory via an emptyDir volume.
Adding a sidecar container that streams the log file to stdout makes the logs visible to standard Kubernetes logging tools. Do not use hostPath or persistent volumes, as they bypass container stdout and are not collected by node-level logging agents.
Q2. You have a ConfigMap named 'global-settings' that contains 50 different configuration keys. You need to deploy a specific Pod that only requires one of these keys, named 'proxy-config.json'. This file must be mounted at the path '/etc/app/…
Answer: C. Use the 'volumes.configMap.items' field to select the key and 'volumeMounts.subPath' to mount only that file.
Using the volumeMounts subPath property mounts a single file from a ConfigMap without obscuring existing application files. Mounting a ConfigMap directly to the directory masks the entire folder, which would break the container image defaults.
Q3. A database application running in your cluster is running out of disk space on its mounted volume. The underlying StorageClass supports dynamic volume expansion (allowVolumeExpansion: true). You need to increase the available storage for t…
Answer: C. Edit the existing PersistentVolumeClaim and increase the storage value in the resources.requests section
Increasing the requested storage value on an existing PersistentVolumeClaim triggers dynamic volume expansion if the StorageClass permits it. Deleting the PVC would destroy the data, while manual resizing bypasses Kubernetes reconciliation.
Q4. You are deploying a microservice named 'report-generator' that depends on a database. Before the 'report-generator' container starts, it must verify that the database schema is at the correct version. If the schema is outdated, a migration…
Answer: C. Utilize an Init Container to run the database migration script, ensuring the Pod waits for its successful completion before starting the main container.
Init containers run to completion before the main application container starts, blocking startup until the migration succeeds. Jobs lack this strict lifecycle coupling, and readiness probes incorrectly handle initialization tasks instead of traffic routing.
Q5. A microservices architecture consists of a 'frontend' deployment and a 'backend' deployment in the same 'app-prod' namespace. For security compliance, the organization requires that the 'backend' pods must only accept incoming traffic from…
Answer: D. A NetworkPolicy with an ingress rule allowing traffic from pods labeled 'app: frontend' on port 9000.
NetworkPolicy resources use label selectors to define precise ingress and egress rules for pod communication. Ingress and Service resources lack native layer three or four firewall capabilities needed for this internal namespace isolation.
Q6. A financial services company is managing a high-availability API currently running 20 replicas of version 'v1' through a Deployment named 'payment-api'. To maintain strict performance Service Level Agreements (SLAs), the operations team mu…
Answer: B. Set the RollingUpdate strategy with maxSurge: 5 and maxUnavailable: 5.
Configuring maxSurge and maxUnavailable to absolute integers safely dictates the exact replica counts allowed during rollouts. Using percentage values is risky here because fractional rounds up, violating the strict minimum availability constraint.
Q7. A legacy HR application only supports unencrypted HTTP traffic. However, the organization's security mandate requires all data in transit to be encrypted using TLS. To comply without modifying the legacy application code, you decide to dep…
Answer: C. Both containers must share the same network namespace and communicate over the 127.0.0.1 loopback address.
Containers within the same pod inherently share the exact same network namespace and loopback interface. This localhost communication is required for the proxy to forward traffic internally without complex routing configurations or host ports.
Q8. A sophisticated data analytics application requires a warm-up period after the container starts to load 5GB of reference data into local memory. During this warm-up phase, which lasts about 3 minutes, the application is technically 'runnin…
Answer: C. Implement a Readiness Probe that checks a specific health endpoint which only returns a 200 OK status once the data is fully loaded into memory.
A readiness probe controls traffic routing by removing unready pods from service endpoints until the endpoint succeeds. Liveness probes only manage container restarts and do not prevent premature traffic delivery during initialization.
Q9. A custom Python application is running in a pod and occasionally becomes unresponsive due to internal thread deadlocks. While the process remains running (the PID exists), it stops processing requests. You have a script at /app/health_chec…
Answer: D. Set up a LivenessProbe with an 'exec' action that runs 'python /app/health_check.py' to trigger a container restart upon failure.
A liveness probe using an exec action runs the diagnostic script and restarts the container if it returns a non-zero exit code. Readiness probes only remove the pod from service endpoints without triggering the required self-healing restart.
Q10. A mission-critical transaction processing application is running in the finance-prod namespace. During peak hours, several Pods of this application are being terminated by the Linux Out-of-Memory (OOM) killer, even though the total cluster…
Answer: A. Set the memory requests and limits to the exact same value for all containers within the Pod to achieve a Guaranteed Quality of Service class.
Matching memory requests and limits exactly grants the Guaranteed Quality of Service class, protecting pods from system OOM kills longer. PriorityClasses manage scheduling and eviction but do not change the Quality of Service during memory pressure.
Q11. You are managing a payment-processing pod that must communicate with an internal database pod named db-prod on port 5432. For security compliance, you must ensure that the payment-processing pod cannot initiate any other outbound connectio…
Answer: A. Define an Egress NetworkPolicy with two rules: one targeting pods with the db-prod label on port 5432, and another allowing port 53 for DNS.
An egress NetworkPolicy isolates outbound traffic by strictly defining allowed destinations, implicitly denying everything else. Option B fails because it configures ingress on the database rather than restricting the source pod's outbound connections.
Q12. You are exposing a backend application through a ClusterIP Service. The application container is listening on port 8443 (HTTPS), but the frontend developers expect to reach the service at backend-service on port 443. You need to configure…
Answer: A. Set the service port to 443 and the targetPort to 8443 within the Service spec ports array
Mapping the service port to 443 and the targetPort to 8443 handles the translation between the exposed cluster port and the container port. Option C is wrong because the container port must match where the application is actually listening.
Q13. You are managing a Deployment named 'catalog-service' which is currently running 10 replicas. You need to perform a rolling update to a new image version. The service is under heavy load, so you must ensure that at least 8 replicas are alw…
Answer: D. Define a RollingUpdate strategy where maxUnavailable is set to 2 and maxSurge is set to 2 to meet both capacity and resource constraints.
Setting maxUnavailable to 2 ensures at least 8 replicas stay available, and maxSurge to 2 limits the maximum total pods to 12. Option A violates the resource constraint by allowing up to 13 total pods during the rollout.
Q14. A mission-critical financial application requires a specific configuration file to be dynamically generated and verified before the main container starts. The verification script checks for the presence of a security certificate and valida…
Answer: B. Define an initContainer that runs the verification script and shares a volume with the main application container.
An init container runs to completion before the main application container starts, blocking startup if validation fails. Option D is incorrect because a postStart hook executes concurrently with the main process, failing to prevent startup.
Q15. A specific project team in your organization has been consuming excessive CPU resources, causing other teams' workloads to stay in a Pending state. You are tasked with enforcing a strict limit of 4 CPU cores and 8Gi of memory for all Pods…
Answer: A. Create a ResourceQuota object in the research-lab namespace defining hard limits for requests.cpu and requests.memory
A ResourceQuota sets hard limits on total aggregate resource consumption across all pods within a namespace. Option C fails because LimitRange objects enforce constraints on individual containers rather than namespace-wide totals.
Q16. A security audit requires all Pods in the 'finance-gateway' namespace to follow the principle of least privilege. One specific requirement is that the container's root filesystem must be completely immutable to prevent attackers from insta…
Answer: C. Set readOnlyRootFilesystem: true in the SecurityContext and mount an EmptyDir volume at /var/log/app.
Setting readOnlyRootFilesystem to true ensures immutability, while mounting an EmptyDir at the specific log path provides required writable storage. Option B is invalid because Pod Security Policies were removed in modern Kubernetes versions.
Q17. A critical backend service written in Python occasionally encounters a localized deadlock where the web server process remains active, but the internal request handler stops processing incoming traffic. The application exposes a health sta…
Answer: B. Define a Liveness Probe using an exec command that pings the Unix socket and set failureThreshold to 3.
A liveness probe using an exec handler runs custom commands like a Unix socket ping to restart deadlocked containers. Option C fails because httpGet handlers do not support local Unix socket paths in Kubernetes.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.