Practice for the Certified Kubernetes Application Developer (CKAD) exam with 17 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Your on-premises Kubernetes cluster lacks a cloud LoadBalancer. You must expose a 'data-receiver' service to a legacy ex. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Certified Kubernetes Application Developer (CKAD) practice test →
What you will practice
- Your on-premises Kubernetes cluster lacks a cloud LoadBalancer. You must expose a 'data-receiver' service to…
- You are configuring access for a cloud-native application suite. The inventory service should be reached by e…
- You are deploying a legacy Java application that requires several environment variables to be set for databas…
- A containerized application runs as a non-root user with UID 2000 and needs to write to a persistent volume m…
- You are deploying a web application that stores its configuration in a Kubernetes ConfigMap. The application…
- A Java-based microservice takes approximately 120 seconds to load its configuration from a remote server and…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Your on-premises Kubernetes cluster lacks a cloud LoadBalancer. You must expose a 'data-receiver' service to a legacy external system that can only reach the cluster via a static IP and a specific port. The service should be accessible on…
Answer: A. Service type NodePort with a specific nodePort value defined in the ports section
A NodePort service exposes the application on a static port across all cluster nodes, making it ideal for environments without cloud load balancers. Option D is invalid because the LoadBalancer type requires external cloud integration.
Q2. You are configuring access for a cloud-native application suite. The inventory service should be reached by external clients at the URL api.example.com/inventory and the orders service should be reached at api.example.com/orders. Both serv…
Answer: D. An Ingress resource with a single host 'api.example.com' containing multiple paths, each mapping to its respective service and port
A single Ingress host can define multiple paths to efficiently route HTTP traffic to different backend services. Option C is incorrect because consolidating paths into one resource is the standard method for path-based routing.
Q3. You are deploying a legacy Java application that requires several environment variables to be set for database connectivity. Instead of hardcoding these values in the deployment manifest, you have been provided with a properties file. You…
Answer: D. Create a ConfigMap from the properties file and use the envFrom field in the container specification to load all values.
The envFrom field automatically populates environment variables from an entire ConfigMap, streamlining bulk configurations. Option A is less efficient because it requires mapping individual keys using configMapKeyRef.
Q4. A containerized application runs as a non-root user with UID 2000 and needs to write to a persistent volume mounted at /var/app/data. The application fails because the volume is mounted with root ownership (UID 0) by default. You need to e…
Answer: B. Set the fsGroup field to 2000 within the pod-level securityContext to manage volume permissions
Setting fsGroup to 2000 in the pod securityContext chowns mounted volume files so the non-root user can write. Avoid runAsUser 0, which violates the non-root requirement and defeats the security purpose.
Q5. You are deploying a web application that stores its configuration in a Kubernetes ConfigMap. The application is designed to watch for changes in its configuration file and reload settings dynamically without a restart. You need to ensure t…
Answer: C. Mount the ConfigMap as a volume in the Pod specification so that the kubelet automatically updates the projected files when the ConfigMap changes.
Mounting the ConfigMap as a volume lets the kubelet automatically update the projected files so the application can detect changes. Environment variables are only set at startup, so envFrom fails the dynamic reload requirement.
Q6. A Java-based microservice takes approximately 120 seconds to load its configuration from a remote server and initialize its internal cache. During this startup phase, the process is active but cannot serve traffic. If you use a Readiness p…
Answer: C. Implement a Startup probe that disables Liveness and Readiness checks until the container has successfully passed its initial boot sequence.
A Startup probe suspends Liveness and Readiness checks until it succeeds, protecting slow booting containers from restarts. While increasing the Liveness delay works, it risks false restarts if the container crashes before the delay expires.
Q7. Your team is deploying a Java-based microservice that takes approximately 90 seconds to load its internal cache and warm up its connection pool. During this initialization phase, the application process is running, but it cannot handle inc…
Answer: C. Implement a readinessProbe with an httpGet check on the /health path to ensure the pod is only added to the service endpoints when ready.
A readinessProbe with an httpGet on the /health path keeps the Pod out of Service endpoints until it passes. The Liveness probe only controls restarts and cannot prevent traffic from routing to the uninitialized Pod.
Q8. Your engineering team is performing a manual canary release for a new version of the 'order-service' microservice. You currently have a Deployment named 'order-service-v1' running with 10 replicas. You have created a second Deployment name…
Answer: D. Modify both Deployments to use identical labels for the 'app' key while ensuring the Service selector targets that specific 'app' label.
Using a common app label across both Deployments allows the Service to balance traffic evenly across all matching Pods proportionally. The traffic imbalance indicates the v2 Pods likely have a different or missing label included in the selector.
Q9. Your organization is hosting a multi-tenant application where the 'frontend' service in the 'web' namespace needs to communicate with the 'api-service' in the 'backend' namespace. A strict network isolation policy is in place. You need to…
Answer: B. Create a NetworkPolicy in the 'backend' namespace with an ingress rule selecting the 'web' namespace and pods with the label 'app: frontend'.
Applying a NetworkPolicy in the backend namespace with both pod and namespace selectors restricts ingress strictly to frontend Pods. The policy must target the destination namespace to effectively control incoming traffic from the web namespace.
Q10. A custom reporting application running in the analytics namespace needs to list all existing Pods in the same namespace to generate a resource usage report. When the application attempts to call the Kubernetes API using the default credent…
Answer: D. Create a Role that allows the list verb on pods, and create a RoleBinding to associate this Role with a new ServiceAccount used by the Pod.
Creating a dedicated ServiceAccount bound to a namespace scoped Role restricts access strictly to listing pods. Modifying the default ServiceAccount with broad ClusterRoleBindings violates least privilege and expands the attack surface unnecessarily.
Q11. A company is migrating its web portal to Kubernetes and needs to expose two separate services: 'orders-svc' and 'inventory-svc'. Both services must be reachable via a single external IP address on port 80. Traffic sent to 'portal.com/order…
Answer: A. Create an Ingress resource with two paths defined under a single host, each pointing to their respective backend services.
An Ingress resource provides Layer 7 routing, mapping distinct URL paths to separate ClusterIP services behind one IP. LoadBalancer and NodePort services operate at Layer 4 and cannot route traffic based on the URL path natively.
Q12. You are tasked with isolating the sensitive-data pod in the backend namespace. This pod needs to initiate connections to an external legacy API located at a specific IP address 192.168.1.50 for synchronization purposes. However, to prevent…
Answer: C. Create an Egress policy with a single rule allowing traffic to the specific ipBlock of 192.168.1.50/32 and no other rules
An egress policy with a single allow rule for a specific IP block implicitly denies all other outbound traffic. Do not confuse this with an ExternalName service, which handles internal routing to an external name without restricting pod egress.
Q13. A batch processing job is designed to handle large datasets and is known to encounter intermittent network failures. The business logic dictates that if the job fails due to an error, it should be retried automatically by the Kubernetes co…
Answer: B. Set the backoffLimit field to 4 in the Job specification to allow for a maximum of 5 attempts including the first run
The backoff limit defines the number of retries before a job is marked as failed. A value of 4 allows 1 original run plus 4 retries, totaling 5 attempts, whereas the completions field dictates successful finishes.
Q14. The deployment 'web-app' currently runs with 10 replicas. During an update to a new image, the team must ensure that at least 8 replicas are always available to handle traffic, and the total number of pods in the cluster for this deploymen…
Answer: B. Set maxUnavailable to 20% and maxSurge to 20% within the rollingUpdate strategy block
Setting maximum unavailable and maximum surge to 20% restricts unavailable replicas to 2 and surges to 2. This guarantees 8 replicas remain available while capping the total at 12 pods during the rollout.
Q15. A mission-critical payment processing system consists of a backend deployment and a database pod in the same namespace. To comply with strict internal security audits, you must ensure that the database pod only accepts incoming TCP traffic…
Answer: B. Define a NetworkPolicy with an ingress rule that selects pods with the 'app: payment-api' label and specifies port 5432.
A NetworkPolicy isolates a selected pod by implicitly denying all ingress unless explicitly allowed. By specifying the payment API label and port 5432 in the ingress rule, only matching traffic is permitted.
Q16. A high-availability banking portal requires that its three replicas are never scheduled on the same worker node to prevent a single node failure from taking down the entire service. The infrastructure consists of five distinct nodes across…
Answer: B. Use podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution specifying the app label
Using required pod anti-affinity strictly prevents the scheduler from placing multiple pods with the same label on one node. Preferred anti-affinity acts only as a soft hint and will not strictly guarantee distribution.
Q17. An enterprise application deployment named order-service is failing because the application starts faster than the backend SQL database. The application does not have built-in retry logic and crashes immediately if it cannot establish a co…
Answer: C. Include an initContainer in the Pod specification that uses a busybox image to run a network check loop until the database port is open.
An init container runs to completion before the main application container starts, blocking startup until the database is reachable. Liveness and readiness probes manage running containers but do not delay initial startup.
More Certified Kubernetes Application Developer (CKAD) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.