Certified Kubernetes Application Developer (CKAD) Practice Test – 597 Free Exam Questions with Answers

Correct answer: C. A securityContext block at the container level defining runAsUser, runAsGroup, and allowPrivilegeEscalation: false.

The container-level securityContext is the correct block because it directly defines runAsUser, runAsGroup, and allowPrivilegeEscalation to enforce these specific runtime constraints. A NetworkPolicy or RBAC bindings cannot enforce user IDs or prevent privilege escalation inside a running container.

Correct answer: C. Update the Ingress specification by adding a 'tls' block that specifies the hosts and references the 'hr-tls-secret' name.

Adding a TLS block to the Ingress specification referencing the existing Secret enables TLS termination for the specified host. You do not need to modify the Service or manually mount certificate volumes into the Ingress controller deployment.

Correct answer: B. A NetworkPolicy with an ingress rule that selects 'role: frontend' pods and specifies port 443 under the 'role: backend' pod selector

A NetworkPolicy isolates the backend pods by selecting them and defining an ingress rule that permits traffic only from the frontend pod selector on TCP port 443. RBAC roles control API permissions rather than network access between pods.

Correct answer: C. Create a NetworkPolicy with an ingress rule matching the frontend podSelector and a port 5432

A NetworkPolicy applied to the database pods with an ingress rule restricting port 5432 to the frontend pod selector effectively isolates the database. By default, NetworkPolicies allow egress traffic unless specifically restricted, so cluster DNS remains accessible.

Correct answer: C. Set maxUnavailable to 1 and maxSurge to 2 to maintain the required availability and resource usage limits during the update.

Configuring maxUnavailable to 1 ensures 4 replicas stay available, while maxSurge set to 2 limits the maximum total replicas to 7 during the rollout. Using percentages introduces fractional replicas and unpredictable scaling limits.

Correct answer: D. A LimitRange to set default and maximum constraints on individual pods and a ResourceQuota to limit the total namespace usage.

A LimitRange enforces the maximum CPU limit per individual pod, while a ResourceQuota caps the total aggregate CPU usage across the namespace. PodSecurityPolicies are deprecated, and NetworkPolicies do not restrict compute resource consumption.

Correct answer: C. Configure the memory limits field to 2Gi in the container's resource specification

Setting the container memory limits field to 2Gi triggers an Out Of Memory kill if the application attempts to exceed that threshold. A ResourceQuota caps total namespace usage rather than terminating individual offending pods.

Correct answer: B. Set completions: 50 and parallelism: 5 in the Job specification

The correct answer uses completions for the total successful pods and parallelism for the concurrent workers. Do not confuse this with Deployments, which use replicas for steady-state services.

Correct answer: B. Set completions to 100 and parallelism to 10 to ensure a steady state of 10 concurrent workers

The correct answer sets completions to the total desired successes and parallelism to the concurrent worker count. Avoid swapping these values or mixing in activeDeadlineSeconds, which only sets a timeout.

Correct answer: D. Specify an egress rule with a to block containing an ipBlock for 10.50.0.22/32

The correct answer uses an egress rule with an ipBlock targeting the database IP. Once an egress policy applies, Kubernetes isolates the pod and blocks all unspecified outbound traffic.

Correct answer: A. Assign the 'priorityClassName: high-priority' field in the Pod's spec to indicate its importance to the Kubernetes scheduler

The correct answer assigns the priorityClassName field in the pod spec. The scheduler uses this exact field to determine priority and evict lower-priority workloads, whereas labels and autoscalers do not trigger preemption.

Correct answer: D. Mount the Secret and ConfigMap as separate volumes and use volumeMounts to map them to the specific directory paths

Mounting Secrets and ConfigMaps as volumes projects the data as files at the specified paths. Using envFrom would inject values as environment variables, violating the strict security policy.

Correct answer: C. Replace the livenessProbe with a startupProbe that has a sufficient failureThreshold and periodSeconds for the 90-second delay.

A startupProbe correctly disables liveness checks during initialization, preventing premature restarts for slow-starting apps. Relying only on livenessProbe delays risks killing the container before it fully boots.

Correct answer: A. Deploy a sidecar container sharing an emptyDir volume with the main application to tail the log file to stdout.

A sidecar container sharing an emptyDir volume correctly tails the log file and streams it to stdout. This pattern extends the main container's functionality without modifying its source code or image.

Correct answer: B. A LimitRange object defined within the namespace to set default requests and limits for CPU and Memory.

A LimitRange is the correct object to automatically enforce default CPU and memory limits for individual containers. A ResourceQuota caps total namespace usage but does not assign default limits per pod.

Correct answer: C. Define a Job with completions: 100 and parallelism: 5 to manage the lifecycle of the worker pods.

A Job specifically manages batch tasks using parallelism to limit concurrent pods and completions to set the total success count. Deployments and ReplicaSets are meant for long-running services, not tasks that terminate after processing.

Correct answer: A. runAsNonRoot: true, allowPrivilegeEscalation: false, and readOnlyRootFilesystem: true

This combination directly enforces non-root execution, prevents privilege escalation, and makes the root filesystem immutable. Option C misses the required read-only filesystem, and Option B adds unnecessary complexity without meeting all criteria.

Correct answer: D. Use an InitContainer to run the legacy script and write the file to a shared volume

An InitContainer runs to completion before the main container starts, blocking startup if it fails. Sidecars and lifecycle hooks run concurrently with the app, meaning they cannot guarantee the file exists before the main process begins.

Correct answer: A. Set the 'strategy' type to 'Recreate' to ensure all existing pods are killed before any new pods are created during the update.

The Recreate strategy terminates all existing pods before creating new ones, preventing concurrent access. RollingUpdate attempts to scale new pods while old ones are still terminating, which would cause lock contention.

Correct answer: A. Implement a LivenessProbe that checks an internal health endpoint for responsiveness

A LivenessProbe detects unrecoverable states like deadlocks and triggers the kubelet to restart the container. A ReadinessProbe would only remove the pod from service, but it would not restart the deadlocked process.

Correct answer: C. Configure a volume of type 'secret' in the Pod spec and mount it as a volumeMount at the specified path in the container.

Mounting a Secret as a volume writes the data to a memory-backed filesystem at the exact target path. This avoids accidental exposure via environment variables in process listings or application crash logs.

Correct answer: C. Configure a LivenessProbe that executes a script checking for recent activity in the application processing logs.

A LivenessProbe using an exec action checks application activity and restarts the container if the probe fails. A ReadinessProbe only removes the pod from the service endpoints without restarting the deadlocked process.

Correct answer: A. Add a sidecar container to the Pod that shares a volume with the main container and runs a command to tail the log file to its own stdout.

A sidecar container shares a volume with the main app and tails the log file to its own standard output. This streams the logs to the Kubernetes infrastructure without modifying the original application image.

Correct answer: C. Set the strategy type to Recreate to ensure all existing Pods are killed before new ones are created

Setting the strategy type to Recreate guarantees all old pods are killed before new ones are created. A RollingUpdate would temporarily run both versions concurrently, crashing the older pods accessing the new schema.

Correct answer: B. Configure a Service of type NodePort and specify a value in the nodePort field between 30000 and 32767.

A NodePort service exposes the application on a static port across all cluster nodes. ClusterIP is internal only, while LoadBalancer relies on cloud provider integration rather than direct node access.

Correct answer: C. Update the persistentVolumeReclaimPolicy of the PV to the value Retain

The Retain reclaim policy ensures the underlying storage asset and data are preserved when the PersistentVolumeClaim is deleted. On the exam, recall that the default policy for dynamically provisioned cloud volumes is Delete, so you must explicitly patch the PersistentVolume to Retain.

Correct answer: D. Kubernetes will automatically set the requests to match the defined limits

In a restricted namespace, Kubernetes automatically sets the CPU and memory requests to match the defined limits if limits are omitted. The default request of zero is incorrect because ResourceQuota validation requires explicit values, which it derives from the limits.

Correct answer: C. An Ingress resource with path-based rules mapping / and /search to their respective backend services.

An Ingress resource handles Layer 7 routing based on URL paths, efficiently mapping different routes to backend services. Using a LoadBalancer service is incorrect because it lacks native HTTP path-awareness, and manually updating endpoints is not a standard Kubernetes pattern.

Correct answer: C. Use ReadWriteOnce (RWO) access mode with a PersistentVolumeClaim to ensure exclusive access for the single database Pod.

ReadWriteOnce allows a single node to mount the cloud block storage for exclusive read-write access, protecting the database. ReadWriteMany is incorrect because cloud block storage typically does not support multi-node simultaneous writing.

Correct answer: C. Configure 'concurrencyPolicy' to 'Forbid' to prevent the controller from starting a new Job if the previous one is still running.

Setting concurrencyPolicy to Forbid prevents overlapping Job executions by skipping new runs if a previous one is active. backoffLimit is incorrect because it limits failure retries rather than controlling concurrent schedules.

Correct answer: D. Create two separate Deployments (v1 and v2) with the same labels used by the Service's selector, and adjust the replica counts to a 9:1 ratio.

A Kubernetes Service load-balances across all Pods matching its label selector. Creating two Deployments with identical labels and a 9:1 replica ratio achieves the 10% traffic split. Setting an image list is invalid because Deployments only run a single image per container template.

Correct answer: C. Define an egress rule with a 'to' block containing an 'ipBlock' for 10.10.10.53/32 and a 'ports' block for UDP port 53.

Specifying an ipBlock destination and specific port creates an explicit allow-list for egress traffic, denying everything else by default. An empty or undefined egress list blocks all outbound traffic entirely, breaking DNS resolution and violating the functional requirement.

Correct answer: C. A Service of type ExternalName that points to the external database FQDN

The ExternalName service type maps a service to a DNS name by returning a CNAME record with the external address. Other options like ClusterIP or LoadBalancer are intended for routing traffic to cluster pods rather than providing lightweight aliasing to external FQDNs.

Correct answer: A. Create a NetworkPolicy in the finance namespace with an egress rule specifying the target CIDR and an empty podSelector.

A NetworkPolicy with an egress section allows you to define white-listed destinations based on CIDR blocks and labels. Defining allowed egress CIDRs isolates traffic, as all other outbound paths are automatically denied once the policy applies.

Correct answer: C. Deploy an Adapter container that reads the binary logs and exports them in JSON format

The Adapter container pattern standardizes or translates application output, converting proprietary logs into JSON format for monitoring tools. An init container runs only once before the app starts, so it cannot handle continuous, real-time log transformation during the application lifecycle.

Correct answer: A. Create a LimitRange object in the accounting-prod namespace to define default requests and limits

A LimitRange sets default request and limit values for containers, automatically injecting them if a pod lacks explicit resource definitions. This ensures pods comply with namespace ResourceQuotas, resolving the pending state without manually adjusting individual deployments.

Correct answer: A. Utilize an InitContainer with an image that includes the AWS CLI to download the data into a shared emptyDir volume.

Init containers run to completion before the main application starts, preparing shared volumes safely using specialized tools. A postStart hook executes concurrently with the main container, creating a race condition where the app might access the directory before the download finishes.

Correct answer: C. Set topologySpreadConstraints with maxSkew: 1, topologyKey: topology.kubernetes.io/zone, and whenUnsatisfiable: ScheduleAnyway.

Setting whenUnsatisfiable to ScheduleAnyway within topologySpreadConstraints creates a soft rule, prioritizing even spread while guaranteeing the pod schedules during resource constraints. Using DoNotSchedule acts as a hard constraint, leaving the pod pending if exact distribution fails.

Correct answer: A. Define the maxSurge as 2 and the maxUnavailable as 1 in the deployment specification

A maxSurge of 2 permits scaling up to 12 pods maximum, preventing node pressure during the update. A maxUnavailable of 1 guarantees at least 9 replicas remain ready, satisfying the minimum capacity requirement throughout the rollout process.

Correct answer: C. catalog-db.data-services.svc.cluster.local

The standard Kubernetes service FQDN format is service-name.namespace.svc.cluster.local, which allows cross-namespace resolution via CoreDNS. Watch the domain word order carefully, as reversing the service and namespace parts is a common trap.

Correct answer: B. Set maxSurge to 0 and maxUnavailable to 2 in the RollingUpdate strategy specification.

Setting maxSurge to 0 prevents any new pods beyond the desired count, while maxUnavailable to 2 maintains the minimum required availability. Choosing a non-zero maxSurge would violate the hard cluster capacity limit.

Correct answer: A. Configure an 'livenessProbe' that uses an 'exec' command to run a script checking the age of the last processed message file.

A liveness probe using an exec command directly checks internal application health and triggers a restart if the script fails. A readiness probe would only stop traffic routing, leaving the deadlocked consumer unhealed.

Correct answer: C. Use the secret volume with the 'items' field to map the specific key to a path

Using the items field in a secret volume projection selectively exposes specific keys at designated file paths. Environment variables cannot easily map to required file paths, and mounting the entire secret overwrites the directory.

Correct answer: A. A CronJob resource that defines the schedule and contains a Job template for the maintenance task.

A CronJob schedules time-based tasks and wraps them in a Job template to ensure finite execution with retries. Deployments are for perpetual services, while StatefulSets and DaemonSets do not guarantee task completion.

Correct answer: B. kubectl rollout undo deployment order-api –to-revision=12

The kubectl rollout undo command with the to-revision flag immediately restores a deployment to its exact previous state. The pause command simply halts a rollout, and set image pushes a new update forward.

Correct answer: A. A readinessProbe configured to check the cache status via an exec command

A readiness probe checks if an application is ready to accept traffic and removes the pod from endpoints until it passes. A liveness probe restarts unhealthy containers, and a startup probe only gates other probes during initialization.

Correct answer: A. Configure the Pod's securityContext with the fsGroup field set to 1005 to allow the volume to be owned by that group

Setting fsGroup in the pod securityContext automatically changes the mounted volume ownership to the specified group. Running privileged containers or using hostPath volumes violates basic security best practices.

Correct answer: A. A NetworkPolicy with an ingress rule that selects the backend pods and specifies the target port for the database pods.

A NetworkPolicy applied to the database pods uses an ingress rule to explicitly allow traffic only from pods matching the backend label on port 5432. Services and Ingress resources handle traffic routing and discovery but do not block unauthorized pod-to-pod traffic.

Correct answer: A. Configure a Readiness probe to check database connectivity while keeping the Liveness probe focused only on the local process health.

Failing a Readiness probe removes the Pod from Service endpoints without restarting the container, fulfilling the requirement to stop traffic during an external database outage. A Liveness probe failure would force a restart, which is the exact behavior to avoid here.

Correct answer: A. An Ingress resource with a set of rules defining path-based backend targets for each service.

An Ingress resource configured with path-based routing rules maps distinct HTTP paths to different backend Services behind a single IP. ClusterIP services lack Layer 7 routing capabilities, and custom sidecars introduce unnecessary operational complexity.

Correct answer: D. Store the credentials in a Kubernetes Secret and mount that Secret as a volume at a specific path in the container.

The correct answer uses a Kubernetes Secret mounted as a volume to project credentials as files. ConfigMaps lack security features for sensitive data, and environment variables risk exposure via logs.

Correct answer: A. Implement an init container that fetches the file and writes it to an emptyDir volume

Init containers run to completion before any app containers start, guaranteeing the file exists. A postStart hook executes concurrently with the main container, creating a race condition where the app might look for the file before it is written.

Correct answer: A. Use an init container with the utility tool image and a shared emptyDir volume to generate and pass the file to the main container

Init containers run to completion before the main app starts, safely using separate images. A sidecar runs concurrently and wastes resources, while modifying the main image bloats it.

Correct answer: C. The kubelet periodically synchronizes mounted ConfigMaps and Secrets, updating the projected files in the volume without a restart.

The kubelet automatically synchronizes mounted volumes on a configurable delay, updating files without a restart. Avoid using subPath for files that require updates, as subPath mounts do not receive live updates.

Correct answer: C. Mount the ConfigMap using a volumeMount with a subPath that points specifically to the 'values.csv' key within the directory.

Using subPath mounts a specific file without overwriting the target directory. This avoids permission issues entirely. Setting readOnly to false does not bypass filesystem permission rules for the directory.

Correct answer: A. kubectl describe pod batch-processor and then kubectl logs –previous

The describe command reveals events like failed probes or pull errors. The previous flag retrieves logs from the last crashed instance. Executing into the container will fail because it keeps crashing.

Correct answer: D. Add an annotation such as 'nginx.ingress.kubernetes.io/rewrite-target: /' to the Ingress resource to modify the URI path

Ingress controllers use annotations like rewrite-target to modify HTTP requests before forwarding them. Services and NetworkPolicies operate below the application layer and cannot manipulate HTTP paths.

Correct answer: C. Set maxSurge to 2 and maxUnavailable to 0 to maintain full capacity

Setting maxUnavailable to zero maintains the ten replicas, satisfying full capacity. Setting maxSurge to two respects the strict limit of two extra pods. Any maxUnavailable value above zero drops capacity.

Correct answer: A. A tls block containing the hosts list and the secretName referencing the secret

The spec dot tls block configures TLS termination by mapping domain hosts to a specific Kubernetes Secret. The Ingress controller serves the certificate, so backend services can remain on standard HTTP.

Correct answer: C. Utilize an Adapter container to standardize the output of the application to match the requirements of the external monitoring system.

The Adapter pattern standardizes output by transforming internal application data for external systems. This differs from a standard sidecar, which typically extends or proxies services without fundamentally altering the data format.

Correct answer: A. Deploy version v2 as a separate Deployment and update the Service label selector to point to the new version's labels.

Updating a service selector to point to a completely new deployment achieves a Blue-Green release. Rolling updates lack instantaneous rollback because traffic must be gradually shifted back to the original pods.

Correct answer: B. Increase the memory limit in the resources section of the container specification to match the application's peak usage requirements.

The OOMKilled status indicates a container exceeded its configured memory limit. Increasing the limit in the resource specification directly resolves the termination. Moving the pod to a larger node will not help because the kernel kills the process based on the pod limit, not node capacity.

Correct answer: A. Add a tls section to the Ingress spec containing the secretName and the list of hosts

The standard method for enabling TLS on an Ingress is adding a tls section to the spec with the secretName and hosts list. Controller-specific annotations are deprecated and non-portable. Relying on the native tls block ensures the controller correctly serves the certificate for the specified hostname.

Correct answer: B. Execute 'kubectl logs order-service –previous' to retrieve the logs from the last terminated container instance

The –previous flag retrieves stdout and stderr from the previously terminated container instance. This is the primary debugging tool for CrashLoopBackOff scenarios where the current container has not logged anything yet. The describe command only shows cluster events, not application output.

Correct answer: A. kubectl describe pod <pod-name> to inspect the 'Events' section at the bottom of the output.

The kubectl describe pod command displays a chronological Events section containing explicit Kubelet messages detailing exactly why the image pull failed. The logs command will not work because the container has not started, meaning there is no application output to inspect.

Correct answer: A. Implementing a Sidecar container that shares an emptyDir volume with the main application and tails the log file to stdout.

A sidecar container shares an emptyDir volume with the main application to read and stream logs to stdout. This decouples logging from the primary application and allows standard Kubernetes logging to capture the output. An init container cannot continuously run to stream logs.

Correct answer: A. Update the Pod's container spec to set a memory 'limit' of 1Gi and ensure the namespace LimitRange is adjusted to allow this value.

The container memory limit must be raised above the spike threshold to prevent the kernel from killing the process. Because a LimitRange enforces maximum values, it must also be updated to permit the new 1Gi limit. Increasing requests without limits does not prevent termination.

Correct answer: B. Apply an Ingress policy allowing the frontend label and a separate Egress policy with an empty set of allowed destinations.

Applying an Ingress rule with a podSelector for the frontend allows specific incoming traffic, while an empty Egress rule blocks all outgoing traffic. Using a CIDR block filter is imprecise for dynamic pod IPs, and HostPort bypasses standard network policy enforcement entirely.

Correct answer: B. Deploy an Adapter container within the same Pod that consumes the XML metrics and exposes them on a dedicated HTTP port for Prometheus

An adapter container standardizes output by transforming proprietary application metrics into a format the monitoring system expects. Running in the same pod allows it to access the local socket efficiently. An ambassador container proxies traffic, while an init container cannot run continuously.

Correct answer: B. Deploy a second Deployment for the new version and update the Service selector to point to the new version labels after successful validation.

Deploying a second deployment and updating the service selector implements a blue-green strategy, providing instant traffic shifting and rollback. A rolling update gradually replaces old pods, meaning both versions receive live traffic simultaneously and rollback is not instantaneous.

Correct answer: B. Set the securityContext at the container level with runAsUser: 1000 and allowPrivilegeEscalation: false.

Setting the container-level securityContext with runAsUser: 1000 and allowPrivilegeEscalation: false directly enforces the required non-root and non-escalating execution. RoleBindings and ResourceQuotas manage API access and resource limits, not the running container's process privileges.

Correct answer: B. A postStart lifecycle hook that executes the registration script once the container has been created.

The postStart hook executes immediately after the container is created, making it perfect for registering the IP. An InitContainer is incorrect because it runs and terminates before the main container starts.

Correct answer: A. An Ingress resource with rules defining a single host and multiple paths, each pointing to a different backend service

An Ingress resource is the standard choice for Layer 7 load balancing, natively supporting path-based routing for splitting traffic between services. NetworkPolicies are incorrect because they manage IP-level firewall rules, not HTTP request routing.

Correct answer: D. Create a Headless Service by setting the clusterIP field to None in the specification

Setting clusterIP to None creates a Headless Service, which returns individual pod IP addresses via DNS instead of a single virtual IP. This enables direct peer-to-peer communication required by stateful applications. NodePort or Ingress add unwanted load balancing.

Correct answer: A. Implement a StartupProbe with a failureThreshold of 30 and a periodSeconds of 10 to disable other probes during initialization

A StartupProbe disables Liveness and Readiness probes until it succeeds, preventing slow containers from being killed by the Kubelet during initialization. Relying on initialDelaySeconds is brittle because exact startup times fluctuate under variable loads or hardware conditions.

Correct answer: B. Set the concurrencyPolicy field to Forbid within the CronJob specification

Setting concurrencyPolicy to Forbid tells the controller to skip creating new Jobs if an existing one is still running. The Replace policy kills the active Job, while changing history limits only cleans up old completed tasks without preventing overlaps.

Correct answer: A. A Horizontal Pod Autoscaler (HPA) targeting the Deployment with the specified CPU utilization threshold

The Horizontal Pod Autoscaler automatically scales the number of Deployment replicas based on observed CPU utilization. The Cluster Autoscaler only adjusts the cluster node size, and the Vertical Pod Autoscaler modifies resource requests rather than replica counts.

Correct answer: B. Define maxUnavailable as 0% and maxSurge as 25% to ensure no capacity is lost while limiting the temporary resource overhead

Setting maxUnavailable to 0 guarantees no existing pods are removed before new ones are ready. Pairing it with a 25% maxSurge strictly limits the temporary extra pods, satisfying the resource constraint while maintaining full application availability.

Correct answer: C. Use the envFrom field and reference the ConfigMap using the configMapRef attribute

The envFrom field automatically imports all key-value pairs from a ConfigMap as container environment variables. This avoids listing each variable individually with valueFrom and ensures future ConfigMap additions are automatically consumed by the container.

Correct answer: A. Configure concurrencyPolicy to 'Forbid' to prevent the controller from creating a new Job if the previous one has not finished

The Forbid policy explicitly tells the CronJob controller to skip creating a new Job if an existing one is still running. Replace terminates the current Job, and backoffLimit only dictates retry behavior for failed tasks rather than concurrency rules.

Correct answer: A. Create an Egress policy for 'frontend' pods with a 'to' rule selecting 'backend' pods and a 'ports' rule for 8080.

An Egress policy applied to the frontend pods explicitly restricts outgoing traffic to only the specified backend on port 8080. An Ingress policy on the backend fails this requirement because it does not block the frontend from sending traffic to external addresses.

Correct answer: D. Define the 'tls' field with 'hosts' containing 'portal.healthcare.com' and 'secretName' set to 'portal-tls-secret', while setting the 'rules' to forward traffic to 'portal-svc' on port 8080.

The tls block in the Ingress specification correctly associates the TLS secret with the host, while the rules block maps the host to the backend service port. ConfigMaps cannot store TLS keys, and annotations alone fail to configure secure routing properly.

Correct answer: A. Traffic will be distributed randomly among all 10 available pods, resulting in approximately 10% of traffic reaching the new 'webapp-v2' version.

The Service load balances randomly across all matching pods, sending roughly 10% of traffic to the new version. Kubernetes does not understand version labels natively, so it treats all matching pods as identical endpoints rather than isolating deployments.

Correct answer: C. Add the NET_RAW capability to the capabilities list in the security context

The NET_RAW capability allows processes to use raw and packet sockets, which tools like tcpdump need for capturing traffic without full host access. Setting privileged to true violates the least-privilege principle, and root permissions do not directly grant specific capabilities securely.

Correct answer: C. Set the strategy type to RollingUpdate with maxUnavailable set to 0 and maxSurge set to 25%.

Setting maxUnavailable to 0 ensures no pods are removed until new ones are ready, maintaining full capacity. Setting maxSurge allows the deployment to create additional pods during the update, fulfilling the requirement to speed up the rollout.

Correct answer: A. Apply the runAsUser and runAsGroup settings within the securityContext section at the Pod level of the manifest.

Defining runAsUser and runAsGroup in the pod-level securityContext ensures all containers inherit these exact execution permissions. Applying settings at the container level only affects one container, and service accounts handle API authentication.

Correct answer: C. Use the 'subPath' field in the volumeMounts section to mount only the specific 'nginx.conf' key from the volume into the full file path

Using the subPath field in volumeMounts injects a single ConfigMap file into an existing directory without overwriting neighbors. Without subPath, the entire directory is masked by the mounted volume, breaking the container.

Correct answer: D. Define a single Ingress with a 'tls' block where the 'hosts' list only includes 'billing.example.com' and the 'secretName' is 'billing-tls-cert'.

Creating a single Ingress with a TLS block for the billing host correctly restricts HTTPS to that domain. However, creating two separate Ingress resources is also valid, making the options ambiguous.

Correct answer: B. Implement an Ingress resource with rules defined for each host pointing to their services

An Ingress resource manages external access to services, providing Layer 7 routing and TLS termination. Services lack host-based routing, making Ingress the only option for HTTP host rules.

Correct answer: B. Deploying an Ambassador container to proxy the database connections

The Ambassador pattern deploys a proxy container to handle outbound traffic on behalf of the main application. This abstracts complex service discovery or sharding logic away from the application code.

Correct answer: A. Define a single host with multiple paths in the 'rules' section and specify the 'tls' section referencing the 'tls-secret'.

A single Ingress resource can define multiple paths under a specific host block and configure TLS termination. Using NodePort or separate Ingress resources lacks native path mapping and unified TLS management.

Correct answer: C. Implement a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to protect the container during its initial boot

A Startup probe specifically disables Liveness and Readiness checks until it succeeds, accommodating slow-starting applications. Modifying initialDelaySeconds forces rigid timing limits that cannot adapt.

Correct answer: D. An Egress policy with two rules: one with an ipBlock allowing 203.0.113.10/32, and another allowing UDP/TCP port 53 to the kube-system namespace

Defining an Egress policy triggers default-deny behavior for all unspecified outbound traffic. You must explicitly allow an ipBlock for the external API and a namespace selector for DNS resolution.

Correct answer: D. Specify the custom 'serviceAccountName' in the Pod's spec section

A Pod inherits permissions based on its explicitly assigned serviceAccountName, mounting the correct API token. Without mapping the specific ServiceAccount, the default restricted permissions remain active.

Correct answer: D. A Job with completions: 10 and parallelism: 3 to ensure sequential completion with a set amount of concurrent workers.

A Kubernetes Job is designed for finite tasks and automatically retries failed pods until they succeed. Setting parallelism limits concurrent workers, optimizing resource usage while completions tracks the total required successes. CronJobs are for scheduled recurring tasks.

Correct answer: A. Deploy a Job with a restartPolicy set to OnFailure to ensure task completion

A Job handles run-to-completion workloads. Setting restartPolicy: OnFailure guarantees that Kubernetes retries the container exactly until it succeeds. A Deployment or DaemonSet is incorrect because they manage continuous, long-running processes.

Correct answer: A. Define a LivenessProbe with an HTTP GET action targeting a health check endpoint that verifies internal application logic.

A LivenessProbe with an HTTP GET action checks application health and restarts the container upon failure. TCP socket checks only verify network listening, failing to detect internal application deadlocks.

Correct answer: A. An emptyDir volume mounted at the same path in both containers to provide a shared, temporary filesystem in memory or on disk

An emptyDir volume provides shared, temporary storage accessible by all containers within a single Pod. Persistent volumes are unnecessary for transient data, and ConfigMaps are strictly read-only.

Correct answer: A. Configure the Nginx sidecar and application container to share the same Network namespace using localhost for communication.

Containers within the same Pod inherently share the same Network namespace, enabling them to communicate via localhost. The proxy sidecar listens on external ports while forwarding traffic to localhost.

Correct answer: A. Run 'kubectl logs pod-name -c helper-container –previous' to retrieve the logs from the last terminated container instance.

The –previous flag retrieves logs from the last terminated instance of a container, essential for debugging crash loops. Events and current logs rarely capture the exact application failure trace.

Correct answer: C. Set the automountServiceAccountToken field to false within the spec.template.spec section of the Deployment manifest.

Setting automountServiceAccountToken to false within the Pod template spec prevents Kubernetes from injecting the default API token. Overwriting the mount path with an emptyDir is a hacky workaround, whereas the native boolean field is the intended security control.

Correct answer: A. The Adapter pattern, where a second container transforms the output of the main container into a standardized format for external systems

The Adapter pattern transforms the main container output into a standardized format for external monitoring systems to consume. A generic sidecar merely adds features, while an Ambassador strictly proxies external network traffic.

Correct answer: B. Create a Job with 'completions: 500', 'parallelism: 10', and 'backoffLimit: 5' to manage the execution and retries.

A Kubernetes Job uses completions to target successful exits and parallelism to control concurrency. The backoffLimit halts the entire workload after the specified failure count, which Deployments cannot do natively.

Correct answer: B. Implement a startupProbe with a failureThreshold of 30 and a periodSeconds of 5 to allow up to 150 seconds for initialization

A startup probe disables liveness and readiness checks until it succeeds, providing a dedicated window for initialization without affecting long-term monitoring.

Correct answer: D. Use an httpGet probe with the path, port, and an httpHeaders array containing the name and value of the token.

An httpGet probe natively supports custom HTTP headers, allowing you to pass authentication tokens directly during health checks. While an exec probe using curl could technically work, it introduces unnecessary operational overhead and relies on external binaries inside the container image.

Correct answer: C. Set maxUnavailable to 2 and maxSurge to 3 within the RollingUpdate strategy block of the Deployment manifest.

Setting maxUnavailable to 2 ensures at least 8 pods remain available during the rollout. Setting maxSurge to 3 guarantees that the total number of pods never exceeds 13, satisfying both high availability and resource constraints.

Correct answer: C. Configure a startupProbe with a long failureThreshold and a readinessProbe for traffic control

A startupProbe protects slow-starting applications by disabling liveness checks until initialization completes. Coupling it with a readinessProbe ensures the application receives traffic only when fully prepared, preventing premature container restarts.

Correct answer: D. Set completions to 50 and parallelism to 5 within the Job's spec section

The Kubernetes Job controller natively handles parallel batch processing using the completions and parallelism fields. Setting parallelism to 5 maintains the desired workload concurrency until 50 successful completions are recorded.

Correct answer: C. Create a LimitRange object in the 'sandbox' namespace and specify the 'default' memory limit for containers.

A LimitRange is the correct Kubernetes mechanism to enforce default resource limits at the container level. While a ResourceQuota restricts total namespace consumption, it does not automatically inject missing memory limits into individual pod manifests.

Correct answer: C. Run 'kubectl describe pod [pod-name]' and check the Events section for mount failures

The kubectl describe pod command outputs a detailed Events section that explicitly states why a container failed to start. You can quickly spot volume mount errors or missing secret dependencies there without needing application logs.

Correct answer: C. Create a HorizontalPodAutoscaler (HPA) targeting the 'orders' deployment with a targetAverageUtilization of 70 and appropriate stabilization windows.

A HorizontalPodAutoscaler automatically scales the number of pods based on observed CPU utilization. Configuring its behavior field with stabilization windows prevents rapid scaling actions, effectively avoiding flapping during minor metric fluctuations.

Correct answer: C. The Ambassador pattern, which acts as a proxy to represent an external service as if it were a local service.

The Ambassador pattern acts as a dedicated proxy to simplify communication with complex external services. The main application connects to this helper container on localhost, entirely abstracting away the custom authentication and caching logic.

Correct answer: C. Use secretKeyRef to map the password to an environment variable and define a volume of type secret to mount at /etc/tls

Using secretKeyRef maps a specific secret key directly into an environment variable for the container. Mounting a secret volume separately exposes the certificate files securely into the specified directory without hardcoding sensitive data.

Correct answer: C. Configure a RollingUpdate with maxSurge set to 2 and maxUnavailable set to 0 to maintain full capacity during the update.

Setting maxUnavailable to 0 maintains full capacity, while maxSurge to 2 strictly limits extra pods. Allowing unavailable pods is the strongest distractor, but it breaks the required capacity rule.

Correct answer: D. Define a Liveness Probe using an httpGet request to port 8080 on the /healthz path.

A liveness probe using HTTP GET accurately restarts containers stuck in deadlock states. A readiness probe is the strongest distractor, but it merely stops traffic instead of restarting.

Correct answer: B. Utilize an initContainer in the Pod spec to run the database migration script before the main container

An initContainer runs to completion before the main container, blocking startup if it fails. A sidecar is the strongest distractor, but it runs concurrently instead of sequentially.

Correct answer: A. Set the concurrencyPolicy to Forbid in the CronJob specification to prevent overlapping executions.

Setting concurrencyPolicy to Forbid correctly prevents overlapping jobs from running simultaneously. Changing schedule frequency is the strongest distractor, but it fails under delays.

Correct answer: B. Add a sidecar container to the Pod that runs a tail -f command on the log file, sharing the log directory via an emptyDir volume.

Adding a sidecar container that streams the log file to stdout makes the logs visible to standard Kubernetes logging tools. Do not use hostPath or persistent volumes, as they bypass container stdout and are not collected by node-level logging agents.

Correct answer: C. Use the 'volumes.configMap.items' field to select the key and 'volumeMounts.subPath' to mount only that file.

Using the volumeMounts subPath property mounts a single file from a ConfigMap without obscuring existing application files. Mounting a ConfigMap directly to the directory masks the entire folder, which would break the container image defaults.

Correct answer: C. Edit the existing PersistentVolumeClaim and increase the storage value in the resources.requests section

Increasing the requested storage value on an existing PersistentVolumeClaim triggers dynamic volume expansion if the StorageClass permits it. Deleting the PVC would destroy the data, while manual resizing bypasses Kubernetes reconciliation.

Correct answer: C. Utilize an Init Container to run the database migration script, ensuring the Pod waits for its successful completion before starting the main container.

Init containers run to completion before the main application container starts, blocking startup until the migration succeeds. Jobs lack this strict lifecycle coupling, and readiness probes incorrectly handle initialization tasks instead of traffic routing.

Correct answer: D. A NetworkPolicy with an ingress rule allowing traffic from pods labeled 'app: frontend' on port 9000.

NetworkPolicy resources use label selectors to define precise ingress and egress rules for pod communication. Ingress and Service resources lack native layer three or four firewall capabilities needed for this internal namespace isolation.

Correct answer: B. Set the RollingUpdate strategy with maxSurge: 5 and maxUnavailable: 5.

Configuring maxSurge and maxUnavailable to absolute integers safely dictates the exact replica counts allowed during rollouts. Using percentage values is risky here because fractional rounds up, violating the strict minimum availability constraint.

Correct answer: C. Both containers must share the same network namespace and communicate over the 127.0.0.1 loopback address.

Containers within the same pod inherently share the exact same network namespace and loopback interface. This localhost communication is required for the proxy to forward traffic internally without complex routing configurations or host ports.

Correct answer: C. Implement a Readiness Probe that checks a specific health endpoint which only returns a 200 OK status once the data is fully loaded into memory.

A readiness probe controls traffic routing by removing unready pods from service endpoints until the endpoint succeeds. Liveness probes only manage container restarts and do not prevent premature traffic delivery during initialization.

Correct answer: D. Set up a LivenessProbe with an 'exec' action that runs 'python /app/health_check.py' to trigger a container restart upon failure.

A liveness probe using an exec action runs the diagnostic script and restarts the container if it returns a non-zero exit code. Readiness probes only remove the pod from service endpoints without triggering the required self-healing restart.

Correct answer: A. Set the memory requests and limits to the exact same value for all containers within the Pod to achieve a Guaranteed Quality of Service class.

Matching memory requests and limits exactly grants the Guaranteed Quality of Service class, protecting pods from system OOM kills longer. PriorityClasses manage scheduling and eviction but do not change the Quality of Service during memory pressure.

Correct answer: A. Define an Egress NetworkPolicy with two rules: one targeting pods with the db-prod label on port 5432, and another allowing port 53 for DNS.

An egress NetworkPolicy isolates outbound traffic by strictly defining allowed destinations, implicitly denying everything else. Option B fails because it configures ingress on the database rather than restricting the source pod's outbound connections.

Correct answer: A. Set the service port to 443 and the targetPort to 8443 within the Service spec ports array

Mapping the service port to 443 and the targetPort to 8443 handles the translation between the exposed cluster port and the container port. Option C is wrong because the container port must match where the application is actually listening.

Correct answer: D. Define a RollingUpdate strategy where maxUnavailable is set to 2 and maxSurge is set to 2 to meet both capacity and resource constraints.

Setting maxUnavailable to 2 ensures at least 8 replicas stay available, and maxSurge to 2 limits the maximum total pods to 12. Option A violates the resource constraint by allowing up to 13 total pods during the rollout.

Correct answer: B. Define an initContainer that runs the verification script and shares a volume with the main application container.

An init container runs to completion before the main application container starts, blocking startup if validation fails. Option D is incorrect because a postStart hook executes concurrently with the main process, failing to prevent startup.

Correct answer: A. Create a ResourceQuota object in the research-lab namespace defining hard limits for requests.cpu and requests.memory

A ResourceQuota sets hard limits on total aggregate resource consumption across all pods within a namespace. Option C fails because LimitRange objects enforce constraints on individual containers rather than namespace-wide totals.

Correct answer: C. Set readOnlyRootFilesystem: true in the SecurityContext and mount an EmptyDir volume at /var/log/app.

Setting readOnlyRootFilesystem to true ensures immutability, while mounting an EmptyDir at the specific log path provides required writable storage. Option B is invalid because Pod Security Policies were removed in modern Kubernetes versions.

Correct answer: B. Define a Liveness Probe using an exec command that pings the Unix socket and set failureThreshold to 3.

A liveness probe using an exec handler runs custom commands like a Unix socket ping to restart deadlocked containers. Option C fails because httpGet handlers do not support local Unix socket paths in Kubernetes.

Correct answer: A. Service type NodePort with a specific nodePort value defined in the ports section

A NodePort service exposes the application on a static port across all cluster nodes, making it ideal for environments without cloud load balancers. Option D is invalid because the LoadBalancer type requires external cloud integration.

Correct answer: D. An Ingress resource with a single host 'api.example.com' containing multiple paths, each mapping to its respective service and port

A single Ingress host can define multiple paths to efficiently route HTTP traffic to different backend services. Option C is incorrect because consolidating paths into one resource is the standard method for path-based routing.

Correct answer: D. Create a ConfigMap from the properties file and use the envFrom field in the container specification to load all values.

The envFrom field automatically populates environment variables from an entire ConfigMap, streamlining bulk configurations. Option A is less efficient because it requires mapping individual keys using configMapKeyRef.

Correct answer: B. Set the fsGroup field to 2000 within the pod-level securityContext to manage volume permissions

Setting fsGroup to 2000 in the pod securityContext chowns mounted volume files so the non-root user can write. Avoid runAsUser 0, which violates the non-root requirement and defeats the security purpose.

Correct answer: C. Mount the ConfigMap as a volume in the Pod specification so that the kubelet automatically updates the projected files when the ConfigMap changes.

Mounting the ConfigMap as a volume lets the kubelet automatically update the projected files so the application can detect changes. Environment variables are only set at startup, so envFrom fails the dynamic reload requirement.

Correct answer: C. Implement a Startup probe that disables Liveness and Readiness checks until the container has successfully passed its initial boot sequence.

A Startup probe suspends Liveness and Readiness checks until it succeeds, protecting slow booting containers from restarts. While increasing the Liveness delay works, it risks false restarts if the container crashes before the delay expires.

Correct answer: C. Implement a readinessProbe with an httpGet check on the /health path to ensure the pod is only added to the service endpoints when ready.

A readinessProbe with an httpGet on the /health path keeps the Pod out of Service endpoints until it passes. The Liveness probe only controls restarts and cannot prevent traffic from routing to the uninitialized Pod.

Correct answer: D. Modify both Deployments to use identical labels for the 'app' key while ensuring the Service selector targets that specific 'app' label.

Using a common app label across both Deployments allows the Service to balance traffic evenly across all matching Pods proportionally. The traffic imbalance indicates the v2 Pods likely have a different or missing label included in the selector.

Correct answer: B. Create a NetworkPolicy in the 'backend' namespace with an ingress rule selecting the 'web' namespace and pods with the label 'app: frontend'.

Applying a NetworkPolicy in the backend namespace with both pod and namespace selectors restricts ingress strictly to frontend Pods. The policy must target the destination namespace to effectively control incoming traffic from the web namespace.

Correct answer: D. Create a Role that allows the list verb on pods, and create a RoleBinding to associate this Role with a new ServiceAccount used by the Pod.

Creating a dedicated ServiceAccount bound to a namespace scoped Role restricts access strictly to listing pods. Modifying the default ServiceAccount with broad ClusterRoleBindings violates least privilege and expands the attack surface unnecessarily.

Correct answer: A. Create an Ingress resource with two paths defined under a single host, each pointing to their respective backend services.

An Ingress resource provides Layer 7 routing, mapping distinct URL paths to separate ClusterIP services behind one IP. LoadBalancer and NodePort services operate at Layer 4 and cannot route traffic based on the URL path natively.

Correct answer: C. Create an Egress policy with a single rule allowing traffic to the specific ipBlock of 192.168.1.50/32 and no other rules

An egress policy with a single allow rule for a specific IP block implicitly denies all other outbound traffic. Do not confuse this with an ExternalName service, which handles internal routing to an external name without restricting pod egress.

Correct answer: B. Set the backoffLimit field to 4 in the Job specification to allow for a maximum of 5 attempts including the first run

The backoff limit defines the number of retries before a job is marked as failed. A value of 4 allows 1 original run plus 4 retries, totaling 5 attempts, whereas the completions field dictates successful finishes.

Correct answer: B. Set maxUnavailable to 20% and maxSurge to 20% within the rollingUpdate strategy block

Setting maximum unavailable and maximum surge to 20% restricts unavailable replicas to 2 and surges to 2. This guarantees 8 replicas remain available while capping the total at 12 pods during the rollout.

Correct answer: B. Define a NetworkPolicy with an ingress rule that selects pods with the 'app: payment-api' label and specifies port 5432.

A NetworkPolicy isolates a selected pod by implicitly denying all ingress unless explicitly allowed. By specifying the payment API label and port 5432 in the ingress rule, only matching traffic is permitted.

Correct answer: B. Use podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution specifying the app label

Using required pod anti-affinity strictly prevents the scheduler from placing multiple pods with the same label on one node. Preferred anti-affinity acts only as a soft hint and will not strictly guarantee distribution.

Correct answer: C. Include an initContainer in the Pod specification that uses a busybox image to run a network check loop until the database port is open.

An init container runs to completion before the main application container starts, blocking startup until the database is reachable. Liveness and readiness probes manage running containers but do not delay initial startup.

Correct answer: C. Apply runAsUser: 1000, readOnlyRootFilesystem: true, and add the NET_BIND_SERVICE capability in the securityContext of the container.

Setting a non-root user and a read-only root filesystem meets baseline security requirements. Adding the NET_BIND_SERVICE capability explicitly permits the non-root process to bind to privileged ports like 443.

Correct answer: A. Set the path to '/static' with a pathType of 'Prefix' for the assets-service.

Prefix path type matching routes any request that begins with the defined path. Exact path type would require a perfectly matching URL, and ImplementationSpecific relies on custom controller logic.

Correct answer: B. Utilize the 'subPath' property within the 'volumeMounts' section to map the specific key from the ConfigMap to the exact file path.

Using the subPath property mounts a single file from a volume without obscuring existing files in the target directory. A standard volume mount would hide the original directory contents.

Correct answer: B. Configure both memory and CPU requests and limits to the exact same values for every container within the pod specification.

Assigning identical CPU and memory requests and limits to every container grants the Guaranteed Quality of Service class. This provides the highest protection against eviction, while a PriorityClass only affects scheduling.

Correct answer: D. Define a single Ingress with a 'tls' section referencing the secret and 'rules' containing multiple paths under the same host.

Defining a single Ingress with a tls section and multiple path rules correctly handles routing and HTTPS termination. Creating separate Ingress resources for the same host often causes controller conflicts, making a single resource the required approach.

Correct answer: A. Configure an Ambassador container that acts as a local proxy, allowing the legacy app to send logs to localhost while the proxy handles authentication.

The Ambassador container pattern acts as a local proxy, handling complex external authentication so the main app connects only to localhost. A standard sidecar simply extends functionality, whereas an Ambassador specifically brokers outside connections.

Correct answer: A. Provision a PersistentVolume (PV) and a PersistentVolumeClaim (PVC) with ReadWriteMany access mode to mount the volume into all pods.

PersistentVolumes and PersistentVolumeClaims provide storage with a lifecycle independent of pods, and ReadWriteMany access allows concurrent mounting. The hostPath and emptyDir options fail the persistence requirement when nodes or pods are recycled.

Correct answer: D. Define an Init Container in the Pod spec to run the specialized tool and write the schema to a shared EmptyDir volume.

Init containers run sequentially and must complete successfully before the main application containers start. Using a postStart hook runs concurrently with the main container, creating a race condition, whereas an init container guarantees the dependency is met.

Correct answer: C. Use an emptyDir volume mounted at /var/log in both the application and the sidecar containers

An emptyDir volume provides a temporary shared disk that both containers in the same Pod can mount to read and write files. A persistent volume is unnecessary for temporary logs, and sharing the process namespace is less clean.

Correct answer: D. Set completions to 50 and parallelism to 5 in the Job's spec section

The completions field defines the total successful pod finishes required, while parallelism controls the active pods at once. Replicas are used for Deployments, not run-to-completion batch Jobs.

Correct answer: B. Create a ResourceQuota to limit total namespace usage and a LimitRange to provide default requests and limits for individual containers.

A ResourceQuota caps the total aggregate resources consumed within a namespace, while a LimitRange applies default bounds to individual containers. PriorityClasses only handle eviction order during node pressure and do not restrict total namespace limits.

Correct answer: A. Add a securityContext block with runAsUser set to 1001 and allowPrivilegeEscalation set to false

The securityContext block directly enforces runtime constraints, letting you set the user ID and disable privilege escalation. Rebuilding the image fails because Kubernetes configurations must override image defaults to guarantee the security policy at runtime.

Correct answer: D. Set fsGroup: 2000 in the Pod securityContext to change the ownership of the mounted volume to a specific group.

Setting fsGroup in the pod securityContext instructs Kubernetes to modify the mounted volume ownership, granting access to the specified group. Using privileged mode or root introduces severe security risks and violates standard container hardening practices.

Correct answer: D. An Ingress resource with path-based rules for /orders and /catalog, and a defaultBackend set to 'identity-svc'.

An Ingress resource manages Layer 7 routing, letting you map specific URL paths to different backend services. The defaultBackend property catches any traffic that does not match your explicit path rules, solving the fallback requirement perfectly.

Correct answer: A. Update the labels of the web-canary pods to match the selector defined in the web-service and ensure the pod labels are identical to web-prod.

Matching pod labels to the existing service selector naturally balances traffic proportionally based on pod count. The Ingress option requires modifying routing rules and creating separate services, which violates the stated restriction.

Correct answer: A. An Egress policy with an empty podSelector and an allow rule for the specific IP block and port

A NetworkPolicy is additive, so defining an egress rule for the specific IP and port implicitly blocks all other outbound traffic. NetworkPolicy does not support explicit deny rules, making the sequential rule option invalid.

Correct answer: B. Use the subPath property within the volumeMounts section to mount only the specific key from the ConfigMap to the desired file path.

The subPath property mounts a single file from a volume without masking the existing files in the target directory. Standard volume mounts always overlay the entire directory, which is why your runtime files disappear.

Correct answer: D. Set the legacy agent to send traffic to localhost on port 443 where the sidecar container is listening and encrypting

Containers in the same pod share a network namespace, so routing localhost traffic to the proxy port works seamlessly. This intercepts the payload locally, allowing the sidecar to encrypt the outbound traffic.

Correct answer: D. Use a single Ingress resource with a host 'app.example.com' and a list of paths under the 'http' section, each mapping to its respective service.

A single Ingress resource efficiently handles multiple paths for a single host by mapping each path to a specific backend. Creating multiple Ingress resources for the same host often causes controller conflicts and unnecessary routing complexity.

Correct answer: C. Create a Role with 'list' permissions for 'pods', a ServiceAccount for the worker, and a RoleBinding to link them.

Creating a dedicated ServiceAccount bound to a namespace Role via a RoleBinding grants strictly scoped API access. Assigning cluster-admin grants excessive permissions, violating security best practices and creating dangerous cluster-wide risks.

Correct answer: C. Define a securityContext with runAsUser 1001, allowPrivilegeEscalation set to false, and readOnlyRootFilesystem set to true

The securityContext configures runtime security at the pod or container level, directly enforcing the required user ID, blocking privilege escalation, and mounting the root filesystem as read-only. PodSecurityPolicy was removed and is no longer valid.

Correct answer: D. Configure 'backoffLimit: 4' in the Job specification to allow for 4 retries (total of 5 attempts) before the Job is considered failed.

The backoffLimit specifies the number of retries before a Job fails. Setting it to 4 allows the initial attempt plus four retries, resulting in exactly five total attempts. The activeDeadlineSeconds limits duration, not attempt counts.

Correct answer: A. Set completions: 100, parallelism: 10, and backoffLimit: 5.

The completions, parallelism, and backoffLimit fields directly map to total chunks, simultaneous workers, and failure retries. Other options confuse these parameters or introduce unrelated concepts like CronJobs and active deadlines.

Correct answer: A. Add a Toleration for the security taint and implement a nodeAffinity rule with a requiredDuringSchedulingIgnoredDuringExecution constraint.

Tolerations allow pods to be scheduled on tainted nodes, while nodeAffinity enforces placement based on specific hardware labels. This combination ensures strict targeting compared to the more basic nodeSelector.

Correct answer: D. Specify a strategy with maxSurge set to 2 and maxUnavailable set to 1 in the RollingUpdate configuration block

MaxSurge controls how many pods exceed the desired count, so two allows exactly twelve. MaxUnavailable dictates the drop ceiling, so one keeps nine pods available. Other percentages or values violate the stated resource constraints.

Correct answer: C. Create a Headless Service by setting the clusterIP field to None in the Service specification.

A Headless Service, created by setting clusterIP to None, skips assigning a virtual IP. DNS returns individual Pod IPs instead, enabling direct peer discovery required for StatefulSet databases. Standard Services blindly load-balance traffic.

Correct answer: B. Utilizing an ambassador container that acts as a local proxy to handle complex communication with the external legacy system

The ambassador pattern is specifically designed to provide a local proxy for the main container to reach external services. This abstracts the complexity of mutual TLS and proprietary encryption away from the primary application code.

Correct answer: D. Use a single rule with the host 'api.example.com' and a list of two paths under the 'http' section, each pointing to their respective service.

An Ingress rule for a specific host can contain multiple paths under the paths section. Each path specifies a path type and a backend, which is the standard for path-based routing.

Correct answer: A. Apply a NetworkPolicy that selects the payment-service pods and defines an ingress rule allowing only pods with the label 'app=frontend'.

Network policies act as a firewall for pods. By creating a policy that selects the payment service and only allows traffic from pods labeled app=frontend, all other internal traffic is implicitly denied.

Correct answer: A. Update the selector in the Service manifest to match the labels of the green deployment

Changing the service selector is the standard way to perform a blue-green switch in Kubernetes. Traffic is immediately routed to the new pods without changing the service IP.

Correct answer: A. Store the API key in a Secret and mount it as a volume, and use a CSI driver (like HashiCorp Vault) to mount the session token as an in-memory volume.

Secrets are intended for sensitive data and are backed by temporary storage in modern Kubernetes. Using a specialized driver for the rapidly rotating token ensures it is fetched directly from the vault and never touches the disk.

Correct answer: D. Set maxUnavailable to 2 and maxSurge to 2 in the strategy section.

Setting max unavailable to 2 ensures at least 8 pods are running, meeting the 80% availability requirement. Setting max surge to 2 allows up to 12 pods total, perfectly matching the resource constraints.

Correct answer: C. Set maxSurge to 3 and maxUnavailable to 0 in the deployment's rollingUpdate strategy section.

Setting max unavailable to 0 ensures that the current number of available pods never drops below the desired count. Setting max surge to 3 allows the deployment to start 3 new pods before stopping old ones.

Correct answer: A. Define an emptyDir volume and mount it at /mnt/data/logs in both the app and sidecar containers

An empty directory volume is created when a pod is assigned to a node and exists as long as that pod is running. It is the standard way for containers in a pod to share files locally without persisting data.

Correct answer: C. Use a nodeSelector in the Pod specification with the key-value pair storage-type: nvme to force the scheduler to select these specific nodes.

A node selector is the simplest and most effective way to constrain pods to nodes with particular labels. It ensures the data cruncher only lands on NVMe nodes without blocking other pods.

Correct answer: B. Define an Ingress NetworkPolicy for the backend-db pods with a podSelector matching 'app: api-gateway' and a specified port of 5432.

An ingress NetworkPolicy applied to the backend-db pods whitelists specific traffic sources. By defining a podSelector matching the api-gateway and restricting the port, you automatically block all non-matching traffic from other pods or namespaces.

Correct answer: D. A ResourceQuota object that specifies hard limits for requests.cpu and requests.memory at the namespace level

A ResourceQuota successfully restricts aggregate resource consumption per namespace. LimitRange is the strongest distractor, but it sets default bounds for individual containers rather than capping total usage.

Correct answer: A. Mount the ConfigMap as a volume at the specified mountPath within the container specification

Mounting a ConfigMap as a volume correctly projects files into the container and automatically updates them. Environment variables are the strongest distractor, but they require a pod restart to reflect updates.

Correct answer: A. Configure a livenessProbe using the exec field to run the /app/check_redis.py script within the container

A liveness probe correctly detects broken states and triggers automatic container restarts. A readiness probe is the strongest distractor, but it only removes traffic without restarting.

Correct answer: A. Configure an Ambassador container in the Pod to act as a local proxy for outgoing traffic and handle the encryption logic.

The Ambassador pattern correctly acts as a local proxy to handle outgoing traffic encryption. An initContainer is the strongest distractor, but it only runs before startup, not alongside.

Correct answer: A. Implement an Adapter container within the same Pod that reads from the Unix socket and exposes a web endpoint with Prometheus metrics.

The Adapter pattern successfully translates non-standard outputs into a format external systems expect. A generic sidecar is the strongest distractor, but it lacks the specific translation role.

Correct answer: A. Set memory requests to 512Mi and memory limits to 1Gi.

Setting memory requests lower than limits allows bursting while maintaining a hard cap. Removing limits is the strongest distractor, but it risks node instability without bounds.

Correct answer: A. Define a RollingUpdate strategy where maxUnavailable is 2 and maxSurge is 30%.

Setting maxUnavailable to 2 keeps eight pods available, satisfying the 80 percent minimum. Setting maxSurge to 30 percent allows up to 13 pods total, preventing the exact 3-pod limit from being misunderstood as an absolute cap.

Correct answer: A. Set the field automountServiceAccountToken to false at the Pod level specification.

Setting automountServiceAccountToken to false at the Pod level cleanly prevents the default API credentials from being mounted. Overwriting the path with an emptyDir is a hacky workaround that fails to follow Kubernetes security best practices.

Correct answer: A. Define the migration container within the initContainers section of the Pod specification to ensure it completes successfully before the app container starts.

Init containers run to completion before app containers start, guaranteeing the migration finishes first. If it fails, the pod aborts, which prevents data corruption. Liveness probes or sidecars do not gate startup in this strict sequence.

Correct answer: B. Store the file content in a ConfigMap and mount it as a volume at /etc/config/ in the Pod specification.

ConfigMaps handle non-sensitive configuration data and bypass the 1MB limit typical of environment variables. When mounted as a volume, Kubernetes automatically updates the files without requiring a full pod restart, perfectly meeting all requirements.

Correct answer: A. Deploy a Sidecar container using the Adapter pattern to transform proprietary logs into JSON before they are sent to the logging agent.

The sidecar adapter pattern modifies or filters data from a shared volume without altering the main application. An init container runs only before startup, so it cannot continuously convert real-time logs during the application lifecycle.

Correct answer: D. An Egress policy with a single rule containing an ipBlock that specifies 203.0.113.50/32.

An Egress policy restricts outbound traffic and acts as a whitelist. By specifying only the target ipBlock, all other traffic is implicitly denied. Ingress policies control incoming traffic, not outbound connections.

Correct answer: C. Configure a Startup Probe with a failureThreshold and periodSeconds that cover the 2-minute window

Startup probes disable liveness and readiness checks until the application fully initializes, preventing the kubelet from prematurely restarting slow-starting containers. Setting a high initialDelaySeconds on a liveness probe is a legacy workaround that fails if application startup times vary or take longer than expected.

Correct answer: A. Define an Ingress policy for the 'postgres-db' pods with a podSelector matching the backend and a ports section for TCP 5432.

An ingress network policy isolating the database pods explicitly permits traffic only from the backend pods on port 5432. Defining an empty podSelector would inadvertently allow traffic from all pods in the namespace, violating the strict security requirement.

Correct answer: D. Implement an Adapter container that reads the legacy log files from a shared volume and serves them in the required JSON format via a local endpoint.

The adapter pattern standardizes output by transforming a legacy application format into a required interface, like JSON. This specialized sidecar handles the translation logic without modifying the primary container image, unlike init containers which only run during startup.

Correct answer: A. Define a Liveness Probe that performs an HTTP GET request against the /healthz endpoint on port 8080

An HTTP liveness probe detects application deadlocks and automatically restarts the unresponsive container to restore service. A readiness probe would only remove the pod from service endpoints, but it would not initiate a restart to fix the underlying deadlock.

Correct answer: B. Define an InitContainer that runs a shell script to loop until the Redis service hostname is resolvable and reachable

An init container runs to completion before the main application container starts, making it perfect for blocking startup until dependencies are ready. Sidecar containers run concurrently, which would not prevent the main worker from crashing if Redis is unavailable.

Correct answer: A. Set the fsGroup field within the Pod SecurityContext to 5000 to allow the volume to be owned by that group

Setting the fsGroup in the pod security context ensures the kubelet automatically adjusts volume ownership, allowing the non-root user to write files. Using privileged mode or temporarily running as root violates security requirements.

Correct answer: A. Define an InitContainer in the Pod spec that runs the migration script and exits with a zero status code

Init containers run sequentially to completion before the main application container starts, ensuring database migrations finish safely. A postStart hook executes concurrently with the main application, creating a race condition if it runs at the same time.

Correct answer: B. Define a NetworkPolicy in the finance namespace using an ingress rule that combines a namespaceSelector for 'public-facing' and a podSelector for 'frontend-proxy'.

To allow traffic from specific pods in another namespace, combine namespaceSelector and podSelector inside the same rule element. Leaving out the namespaceSelector would incorrectly allow traffic from matching pods in any namespace.

Correct answer: A. Set the automountServiceAccountToken field to false in the Pod spec or the ServiceAccount resource

Setting automountServiceAccountToken to false explicitly prevents the kubelet from injecting API credentials. Deleting the default ServiceAccount is not allowed, as Kubernetes automatically manages it.

Correct answer: D. Specify a 'tls' list in the Ingress spec with two entries, each mapping the specific 'hosts' to their respective 'secretName'.

The Ingress tls field accepts an array of host and secret pairs, enabling SNI for multiple domains. Using two separate Ingress resources is unnecessary and misses the benefit of consolidating routing rules.

Correct answer: A. Define a 'tls' block in the Ingress spec containing the 'hosts' list with 'payments.example.com' and the 'secretName' as 'tls-secret'

The tls section maps hosts to a specific secret containing the private key and certificate. Configuring a sidecar is unnecessary overhead since the Ingress controller is built to handle TLS termination.

Correct answer: A. Add NET_RAW and NET_ADMIN to the capabilities list within the securityContext of the container specification

The capabilities field inside securityContext grants fine-grained Linux kernel privileges, so you add only NET_RAW and NET_ADMIN without running as fully privileged. Avoid setting privileged: true, because it completely undermines the non-root compliance requirement.

Correct answer: B. Set 'failedJobsHistoryLimit' to 10 in the CronJob spec to prevent the controller from cleaning up failed Job objects too quickly.

The failedJobsHistoryLimit field explicitly controls how many failed Job objects remain before garbage collection. The successfulJobsHistoryLimit only retains successful executions, which fails the auditing requirement for failed runs.

Correct answer: D. Use a secret volume and define the 'items' field to map the specific keys 'cert.pem' and 'key.pem' to their respective relative paths.

Using a secret volume with the items array lets you map specific keys to custom relative paths while excluding other files. Mounting the entire Secret would expose sensitive files unnecessarily, violating the strict compliance requirement.

Correct answer: D. Use a StartupProbe with a failureThreshold of 10 and a periodSeconds of 10 to cover the 45-second boot time, followed by Liveness and Readiness probes.

A StartupProbe protects slow-booting applications by disabling Liveness and Readiness checks until it succeeds. Relying only on initialDelaySeconds is brittle, because actual startup times often vary unpredictably under heavy load.

Correct answer: B. Deploy an Ambassador container within the same Pod to act as a local proxy for the database sharding logic

An Ambassador container acts as a local proxy inside the Pod, handling complex external routing logic like database sharding. This offloads the work from the legacy application without requiring any modifications to its source code.

Correct answer: C. Configure the 'backoffLimit' field in the Job spec to 4 to define the maximum number of retries before the Job is marked as failed

The backoffLimit field defines the exact number of retries allowed before the Job controller marks it as failed. The activeDeadlineSeconds parameter restricts total execution time but fails to reliably limit the number of failed Pod attempts.

Correct answer: A. Run the kubectl debug command to attach an ephemeral container with a specialized image to the existing Pod instance

Using kubectl debug to attach an ephemeral container is the standard way to troubleshoot running Pods without modifying their spec. Using exec to install tools directly often fails on distroless images and dangerously alters the production environment.

Correct answer: D. Set readOnlyRootFilesystem: true in the container securityContext and mount an emptyDir volume at /var/log/app

Setting readOnlyRootFilesystem to true blocks writes to the root filesystem, while an emptyDir volume provides writable temporary storage for logs. For the exam, remember that a read-only root still needs explicit volume mounts for writable paths.

Correct answer: D. Define the fsGroup field with the value 1005 within the pod-level securityContext specification

The fsGroup field in the pod securityContext automatically changes mounted volume ownership to the specified group. Option A only changes the user, but without group ownership of the volume, the user still cannot write to the directory.

Correct answer: D. Modify the container's securityContext by adding 'CAP_NET_RAW' to the 'capabilities' list and ensuring 'allowPrivilegeEscalation' is set to false.

Adding CAP_NET_RAW to the container securityContext capabilities grants raw socket access without full root privileges. Option C violates the principle of least privilege by making the entire container privileged.

Correct answer: D. Create a Secret of type kubernetes.io/tls and reference its name in the tls section of the Ingress manifest

Creating a Secret of type kubernetes.io/tls and referencing it in the Ingress tls block is the standard method for configuring Ingress TLS. Option B fails because ConfigMaps cannot securely store private keys.

Correct answer: D. Configure backoffLimit: 4 to restrict retries and activeDeadlineSeconds: 1800 to enforce a hard time limit.

The backoffLimit restricts retry attempts, while activeDeadlineSeconds enforces a hard timeout across the entire Job lifecycle. Option A only restarts containers but does not limit the overall Job retries correctly.

Correct answer: B. Use 'kubectl debug' to create an ephemeral container using a diagnostic image that shares the target Pod's network namespace.

Ephemeral containers attached via kubectl debug share the target pod's network namespace. This provides diagnostic tools for distroless images without altering the original deployment or restarting the application.

Correct answer: A. Use a single from element containing both a podSelector and a namespaceSelector to match both criteria simultaneously

Placing podSelector and namespaceSelector in the same element applies an AND logic. This ensures only pods matching the label within the specific namespace can access the database.

Correct answer: B. Configure a Startup Probe with a failureThreshold of 30 and a periodSeconds of 10 to allow sufficient time before Liveness Probes take over.

A Startup Probe disables Liveness Probes until it succeeds, allowing slow applications to boot safely without triggering false restarts. On the exam, remember that failureThreshold multiplied by periodSeconds defines the maximum startup time window.

Correct answer: C. Create a Service of type ExternalName with the externalName field set to db.internal.company.com

Creating a Service of type ExternalName correctly provides a local DNS alias for an external resource. This approach avoids manual endpoint management and seamlessly routes internal cluster traffic to the specified external database hostname.

Correct answer: A. A Service of type ExternalName with the 'externalName' field set to the FQDN of the external database server.

An ExternalName Service maps a cluster DNS name to an external DNS name via a CNAME record. This abstraction decouples the application from the backend location, so code remains unchanged if the database moves.

Correct answer: D. Execute the command kubectl rollout undo deployment order-manager –to-revision=1 to target the specific stable state

The –to-revision flag reverts a Deployment to a specific historical revision. A standard undo only goes back one revision, which fails here because the immediately preceding revision was also broken.

Correct answer: C. env: – name: DATABASE_PASSWORD valueFrom: secretKeyRef: name: db-credentials key: password

Using valueFrom with secretKeyRef injects the key as an environment variable during container startup. Mounted volumes update dynamically, but environment variables only reflect Secret updates when the Pod restarts.

Correct answer: C. Create a LimitRange object in the 'dev-namespace' specifying the default and defaultRequest values for CPU and memory resources.

A LimitRange sets default compute requests and limits for individual containers in a namespace. A ResourceQuota restricts total namespace consumption but does not assign default values to unconfigured Pods.

Correct answer: C. kubectl logs batch-job-v2 -c app-container –previous

The –previous flag retrieves logs from the last terminated instance of a container. Omitting the container name fails here because a multi-container Pod requires explicitly specifying the target container.

Correct answer: B. The sidecar container can reach the legacy application by connecting to 127.0.0.1:8080 because they share the same network namespace.

Containers inside the same Pod share the same network namespace, meaning they interact using localhost. The sidecar can proxy external cluster traffic to the legacy loopback application without code changes.

Correct answer: A. Set fsGroup: 6000 under the Pod-level securityContext to allow Kubernetes to change the ownership of the volume.

Setting fsGroup in the Pod securityContext changes the mounted volume ownership to the specified group. Kubernetes handles this permission change, allowing the non-root UID to write files without privileges.

Correct answer: D. Use the envFrom field in the container specification and reference the app-settings ConfigMap via configMapRef.

Using envFrom with configMapRef populates the environment with all current ConfigMap keys. Listing individual keys is tedious and requires manifest updates whenever new configuration parameters are introduced.

Correct answer: A. Deploy an Ambassador container in the same Pod that accepts plain HTTP traffic from the main container on localhost and proxies it to the API using mTLS.

The Ambassador pattern uses a helper container to proxy outbound requests and offload complex configurations. Because containers share a network namespace, the application sends plain local traffic, which the Ambassador secures.

Correct answer: D. Containers in the same Pod share the same Network namespace, allowing them to communicate via 'localhost' and share the same IP address

Containers within a Pod share the same network namespace and IP address. This allows the sidecar to listen on external interfaces and forward incoming cluster traffic to the loopback application locally.

Correct answer: B. Set completions to 100, parallelism to 10, and backoffLimit to 5 in the Job specification.

Setting completions to 100 and parallelism to 10 properly distributes the workload, while backoffLimit handles the retries. Avoid using Deployments for batch processing, as they lack native completion tracking.

Correct answer: D. Mount the Secret using a volume with a defaultMode of 0400 and specify the mountPath as /etc/certs in the volumeMounts section.

Using defaultMode 0400 restricts file access to the owning user, satisfying the strict security requirement. Environment variables do not mount as files, and hostPath volumes are not recommended for secrets.

Correct answer: B. Set the completions field to 100 and the parallelism field to 10 to control the total work and the number of concurrent pods.

The completions field defines the total successful pods needed, and parallelism dictates how many run concurrently. Swapping the values would create ten completions running one hundred pods at once.

Correct answer: A. Set fsGroup to 2000 and runAsUser to 1001 in the Pod's securityContext, and set allowPrivilegeEscalation to false in the container's securityContext.

Setting fsGroup ensures the mounted storage is writable by the specified group, while allowPrivilegeEscalation blocks setuid exploits. Init containers are less ideal because they require manual permission changes.

Correct answer: D. Configure a Liveness Probe with periodSeconds set to 10 and failureThreshold set to 3

A Liveness Probe detects deadlocks and triggers a container restart after three failed attempts. A Readiness Probe only removes the Pod from service endpoints, but it does not restart the stuck container.

Correct answer: A. Define a Service with no selector and manually create an Endpoints object pointing to the IP 10.50.10.25

Creating a selectorless Service with a manual Endpoints object provides a stable internal DNS record for external IPs. Ingress resources are intended for HTTP routing to cluster services, not proxying external databases.

Correct answer: C. A NetworkPolicy in the payment-prod namespace with an Ingress rule combining a namespaceSelector for frontend-prod and a podSelector for role: web-ui.

Applying an Ingress NetworkPolicy in the target namespace isolates those Pods, and combining selectors restricts access precisely. A podSelector alone would allow traffic from any namespace matching the labels.

Correct answer: A. Configure a postStart lifecycle hook within the container specification to execute the registration script.

The postStart hook executes immediately after the container is created, handling registration without modifying the image. Init containers run before the main container starts, so they cannot access its environment.

Correct answer: B. Define a Startup Probe targeting the /health endpoint and a Liveness Probe that starts only after the Startup Probe succeeds

A Startup Probe protects slow-starting applications by disabling Liveness checks until the container is ready. Relying on initialDelaySeconds requires guessing the exact startup time, risking premature container restarts.

Correct answer: D. Define an initContainer that uses a utility-rich image to download and unpack the data into an emptyDir volume shared with the main application container.

Init containers run sequentially before the main application, making them perfect for preparing shared volumes with required tools. Sidecars run concurrently, risking application crashes if the data is not yet available.

Correct answer: A. The total memory request (12Gi) plus existing usage (2Gi) exceeds the namespace quota of 10Gi. You should reduce the replicas or the memory requests per Pod.

The Deployment requests 12Gi of memory, which exceeds the 10Gi namespace quota when combined with the 2Gi already in use. ResourceQuotas strictly enforce total namespace consumption. Increasing node capacity does not override namespace quotas.

Correct answer: B. Define an egress NetworkPolicy with two rules: one matching the kube-system namespace and DNS port, and another matching the data namespace and database port.

Defining an egress network policy with specific namespace and port selectors restricts outbound traffic precisely to DNS and database endpoints. Any egress traffic not explicitly matched by these rules is automatically blocked, ensuring strict network isolation.

Correct answer: D. Configure the strategy type of the Deployment to Recreate to ensure all old Pods are terminated before the new version is scheduled.

The Recreate strategy terminates all existing Pods before starting the new ones, ensuring the RWO volume is fully released. Remember that RollingUpdate is the default, but it fails here because it tries to run the new Pod concurrently.

Correct answer: B. Add an InitContainer with a lightweight image containing 'wget' to download the file into a shared EmptyDir volume that is also mounted by the main container.

Init containers run to completion before the main application container starts, making them perfect for setup tasks. By saving the file to a shared EmptyDir volume, the main container immediately accesses the required data.

Correct answer: C. Create a NetworkPolicy with an egress rule using an ipBlock that defines the CIDR 203.0.113.10/32.

Using an ipBlock set to 203.0.113.10/32 permits traffic only to that single IP address. A default deny egress policy then blocks all other subnet traffic, fulfilling the strict security compliance requirements.

Correct answer: D. Define an Init Container in the Pod specification that runs the verification script and completes before the main container starts

Init containers run sequentially and must complete successfully before the main application containers ever start. Probes do not prevent startup, and sidecars run concurrently, making init containers the correct choice.

Correct answer: B. Apply a ResourceQuota to the namespace with the 'services.loadbalancers' field set to a value of 3.

ResourceQuotas are used to limit the total number of specific objects within a namespace. LimitRanges constrain individual resource defaults, whereas Network Policies strictly govern pod traffic.

Correct answer: A. Configure the pod-level securityContext with the fsGroup field set to 1001 to automatically change the ownership of the volume's contents.

Setting fsGroup in the pod security context automatically alters the mounted volume ownership to match the specified group ID. This grants the non-root application user the necessary write permissions without requiring image changes.

Correct answer: A. Mount the ConfigMap as a volume and use the 'items' field to specify only the 'api-keys.json' and 'runtime-opts.conf' keys and their paths

Using the items field within a ConfigMap volume projection specifically filters and mounts only the designated keys. This cleanly prevents unrelated ConfigMap data from cluttering the application filesystem.

Correct answer: A. Create a Service of type ExternalName in the same namespace and set the externalName field to 'db.internal.company.com'.

An ExternalName service acts as a DNS alias, seamlessly routing internal cluster requests to an external domain name. This avoids the manual endpoint maintenance required by headless services.

Correct answer: A. A policy in the 'secure-db' namespace with an ingress rule that uses a namespaceSelector matching the 'frontend-apps' labels

NetworkPolicies are applied in the target namespace to control incoming traffic. A namespaceSelector in the ingress rule restricts access so only pods from frontend-apps can connect. Options using podSelector across namespaces fail without exact labels.

Correct answer: C. Label both sets of Pods with 'app=user-profile' and set the v1 Deployment to 9 replicas and the v2 Deployment to 1 replica

Standard Kubernetes Services balance traffic randomly across all matching pods. Matching labels with a nine-to-one replica ratio naturally yields the desired ten percent split. Services do not support assigning custom weights to multiple selectors.

Correct answer: B. Define an egress rule with an ipBlock allowing 203.0.113.15/32 on port 443, and another rule allowing traffic to the kube-system namespace on port 53.

Egress policies require explicit allowances for all destination IP addresses and ports. Defining an ipBlock for the external gateway and a namespace selector for DNS traffic enforces the required boundaries. Broad allowances violate the strict security request.

Correct answer: D. Define a livenessProbe using the grpc field to specify the port and service name for the built-in Kubernetes gRPC health checking protocol.

A liveness probe configured with the native grpc field detects unresponsive services and triggers a container restart. Startup probes only safeguard the initialization phase, while readiness probes merely remove pods from service endpoints without restarting them.

Correct answer: D. Use the 'httpGet' handler in the readinessProbe and define the 'httpHeaders' field with the required name and value.

The httpGet probe natively supports custom headers via the httpHeaders field, passing the required authentication key during checks. A TCP socket probe cannot send HTTP headers, making it unsuitable for an endpoint requiring specific authentication values.

Correct answer: C. Mount the Secret as a volume, use valueFrom for the environment variable, and set runAsUser to 1001 in the securityContext

Mounting sensitive files as volumes and injecting non-sensitive variables via valueFrom follows core configuration principles. Setting runAsUser inside the securityContext correctly enforces the required user ID constraint. Hardcoding secrets or running privileged containers violates security standards.

Correct answer: B. The Ambassador pattern used to provide a specialized network proxy for connecting the application to external services

The Ambassador pattern acts as a local proxy to manage complex external connections like mutual TLS. The Adapter pattern transforms internal output for external systems, while a Sidecar typically provides auxiliary services like centralized logging for the application.

Correct answer: B. Set maxSurge to 2 and maxUnavailable to 0 in the rollingUpdate strategy of the Deployment.

Setting maxSurge to 2 permits two extra pods during the rollout, while maxUnavailable set to 0 maintains all existing replicas. If maxUnavailable were set higher, it would violate the strict requirement for continuous availability.

Correct answer: D. Set the activeDeadlineSeconds field to 1800 in the Job's spec section to limit the total duration of the Job regardless of how many pods it creates.

The activeDeadlineSeconds field enforces a hard timeout on the entire Job duration. When this limit is reached, Kubernetes terminates all running pods and marks the Job as failed. Other options fail to stop runaway processes reliably.

Correct answer: D. Specify the 'backoffLimit' field in the Job specification and set its value to 8.

The backoffLimit field specifies the number of retries allowed before a Job is marked as failed. Setting it to 8 ensures the task gives up after eight unsuccessful attempts. The completions field controls parallelism rather than failure retries.

Correct answer: B. Create a second Deployment for v2.0.0 with the same labels as the v1.0.0 pods and scale the v1.0.0 Deployment to 9 replicas and the v2.0.0 Deployment to 1 replica.

Kubernetes Services load balance randomly across matching Pod endpoints. Deploying the v2 version with identical labels and scaling it to a 1:9 ratio with v1 guarantees roughly ten percent of traffic. Other strategies cannot guarantee exact traffic ratios.

Correct answer: C. Modify the selector of the web-service Service to match the labels of the Green deployment

Switching the Service selector is the standard method for Blue-Green deployments because it instantly redirects traffic to the new Pods. Deleting the Blue deployment defeats the purpose of maintaining a quick rollback path.

Correct answer: A. Add an initContainer with a script that uses a tool like 'nc' or 'pg_isready' to loop until the database port is reachable.

Init containers run sequentially to completion before the main application containers start. A livenessProbe fails if the database is down, but it needlessly restarts the entire Pod instead of waiting gracefully.

Correct answer: B. Set maxUnavailable to 20% and maxSurge to 25% within the rollingUpdate strategy section of the Deployment specification.

Using percentages directly fulfills the requirement and scales appropriately if the replica count changes. Hardcoding the numbers works today but breaks the requirement if the deployment later scales.

Correct answer: A. Add a 'tls' block in the Ingress spec with a list containing the 'example-tls' secret name and the 'internal.example.com' host, and define both paths in the rules section.

A single Ingress can secure multiple paths under the same hostname by referencing the TLS secret once. Splitting the configuration into separate Ingress resources is unnecessary and adds management overhead.

Correct answer: A. Configure a RollingUpdate strategy with maxSurge set to 0 and maxUnavailable set to 1

Setting maxSurge to zero prevents Kubernetes from creating any extra Pods during the rollout, respecting the strict capacity limits. Configuring maxUnavailable to one allows the strategy to terminate an old Pod first, freeing resources for the new one.

Correct answer: D. Set lower resource requests for the init container as Kubernetes calculates Pod scheduling based on the highest of init vs. main containers.

Kubernetes calculates Pod scheduling based on the maximum of either the init containers or the sum of the app containers. Lowering the init container requests means the main app container dictates the resources, preventing artificial scheduling delays.

Correct answer: C. Set the minReadySeconds field in the Deployment spec to 60 to specify the minimum time a new Pod must stay in the Ready state before it is considered available.

The minReadySeconds field ensures a Pod remains ready for a specified duration before the Deployment proceeds. Option B delays health checks but does not guarantee a wait after readiness is achieved.

Correct answer: B. Configure fsGroup to 1050 in the PodSpec's securityContext to allow Kubernetes to change the ownership of the volume to be accessible by that group ID.

Setting fsGroup in the pod security context automatically changes the ownership of mounted volumes to the specified group ID. This allows non-root containers to read and write files without escalating privileges or running as root.

Correct answer: A. An httpGet probe targeting port 8080 and path /healthz, with a timeoutSeconds value set to 3.

An httpGet probe specifically inspects HTTP response codes to determine application health. The timeoutSeconds field ensures that deadlocked applications failing to respond within the required timeframe are correctly marked as unhealthy.

Correct answer: C. A readinessProbe with a timeoutSeconds value set to 2, which will remove the Pod from the Service's Endpoints if the response takes longer than 2 seconds.

Readiness probes control whether a pod receives traffic from a service. Setting a low timeout value removes struggling pods from endpoints, preventing application slow-downs without forcing unnecessary restarts.

Correct answer: C. Mount the Secret using a volume with a secretName and an items list specifying the key and path, while setting the defaultMode to 0400.

Using an items list in the secret volume projection ensures only specific keys are mounted. Setting defaultMode to 0400 restricts file permissions, making it readable only by the assigned user ID.

Correct answer: C. Set the activeDeadlineSeconds field in the Job specification to 1800

The activeDeadlineSeconds field limits the total duration a job can run. Once reached, Kubernetes terminates the pods and marks the job as failed, preventing stuck processes from wasting cluster resources.

Correct answer: D. Specify the subPath field in the volumeMounts section to map the specific ConfigMap key to the desired file path

Specifying the subPath field in the volumeMounts section mounts a single file from a volume into a directory without masking existing files. This prevents the mount from overwriting the target directory's contents, which is a critical detail for config injection.

Correct answer: D. Mount the ConfigMap to /etc/app/ and use the subPath property to map production-settings to config.yaml

Mounting the ConfigMap to the directory and using the subPath property correctly maps a specific key to a specific file path. Without subPath, mounting a volume overwrites or hides all pre-existing files in that target directory, breaking the application.

Correct answer: B. Add a sidecar container that shares an emptyDir volume with the application container and runs the command 'tail -f /var/log/app/audit.log'.

Adding a sidecar container that shares an emptyDir volume and tails the application log correctly forwards logs to standard output. This classic sidecar pattern bridges legacy file logging with cluster-level container logging agents without altering application code.

Correct answer: B. Remove the version label from the Service selector and ensure both Deployments share a common identifying label targeted by the Service

Removing the version label from the Service selector correctly allows it to target pods across multiple Deployments via a common label. Kubernetes Service routing does not support logical OR operations, so a shared generic label is required.

Correct answer: B. Define a Headless Service by setting the clusterIP field to None in the Service specification

Defining a Headless Service by setting clusterIP to None returns the individual Pod IP addresses via DNS instead of load-balancing them. This mechanism provides StatefulSet pods with the stable network identities required for peer discovery.

Correct answer: B. Create a second Ingress resource for the canary service and use the nginx.ingress.kubernetes.io/canary-weight annotation set to '10'.

Creating a secondary Ingress with the NGINX canary-weight annotation accurately routes a specific percentage of traffic to the new service. This is a controller-specific feature rather than standard upstream Kubernetes functionality.

Correct answer: A. Set completions: 50, parallelism: 5, and backoffLimit: 4

The completions field sets the total successful work items required, while parallelism controls concurrent execution. The backoffLimit specifically dictates the allowed retries before the entire Job is marked as failed.

Correct answer: A. The volume will be mounted as read-only by default, and any attempt by the application to write to it will result in a filesystem error.

ConfigMap-backed volumes are projected as read-only filesystems by the kubelet, preventing applications from modifying them. While using readOnly: true in volumeMounts is a valid explicit practice, the default projection behavior makes it inherently read-only.

Correct answer: B. Edit the ResourceQuota to increase the pods limit from 10 to 15 to accommodate the presence of terminal Pods that are still consuming quota.

Increasing the ResourceQuota is the most direct way to resolve the immediate Forbidden error while preserving terminal Pods for auditing. A LimitRange cannot bypass a strict pods quota, and deleting the quota removes necessary guardrails.

Correct answer: A. Add a path with the value '/' at the end of the paths list for the host 'portal.example.com' pointing to the 'maintenance-service'.

Adding a path with the value slash at the end of the paths list for the host acts as a catch-all for unmatched requests. Option D would catch unmatched traffic across all hosts rather than just portal.example.com.

Correct answer: A. Set maxUnavailable to 0 and maxSurge to 2 to ensure no pods are removed before new ones are ready and allow up to 7 pods total.

Setting maxUnavailable to 0 and maxSurge to 2 maintains full capacity while strictly limiting extra resource consumption. Option D fails the 100% capacity requirement because it allows one Pod to be unavailable.

Correct answer: A. Configure the startingDeadlineSeconds field to 1800 in the CronJob specification to limit the window for starting a missed or delayed job.

The startingDeadlineSeconds field limits how long after the scheduled time a missed Job can start. Option C controls total Job execution time rather than the startup delay window.

Correct answer: A. Define two separate entries in the tls list, each specifying its own hosts and secretName, and include a rule for each host in the rules list with a fallback backend.

Defining two TLS entries and using a defaultBackend ensures correct routing and security for multiple domains. Option B fails because using a shared secret will not serve the correct individual certificates.

Correct answer: A. Define two separate path entries under the same host: one for '/assets' with pathType Prefix and one for '/' with pathType ImplementationSpecific

Defining multiple paths under a single host in an Ingress resource routes traffic to different services based on the URI. The longest matching path is typically chosen by the controller, correctly directing requests to the appropriate backend.

Correct answer: A. The Pod manifest needs a toleration block that matches the key 'type', operator 'Equal', and value 'gpu' with the effect 'NoSchedule'.

Adding a matching toleration to the pod manifest allows it to be scheduled onto nodes with corresponding taints. Without this toleration, the scheduler prevents the pod from running on the tainted nodes.

Correct answer: B. A ReadinessProbe configured with an initialDelaySeconds of 120 to delay traffic until the application is ready

Readiness probes prevent services from routing traffic to unready pods. By delaying the initial probe, the application has time to load its cache before accepting requests, avoiding client errors.

Correct answer: A. Implement a Sidecar container in the Pod that shares an emptyDir volume with the main container at /var/logs/app and runs a continuous loop to compress old files.

Implementing a sidecar container that shares an emptyDir volume is the correct architectural pattern for augmenting legacy applications. Shared volumes allow the primary container to write logs while the sidecar independently processes them without altering the main application.

Correct answer: C. Utilize the envFrom field under the container specification and provide a configMapRef pointing to the app-env-vars ConfigMap.

The envFrom field is designed to populate environment variables automatically from an entire ConfigMap or Secret. This approach saves time compared to specifying individual env entries using configMapKeyRef for every single key.

Correct answer: C. Run kubectl rollout undo deployment/shipping-api and update the manifest with the kubernetes.io/change-cause annotation.

Running the rollout undo command immediately reverts the Deployment to its previous working revision. Adding the kubernetes.io/change-cause annotation during future rollouts ensures the history controller properly populates the audit trail.

Correct answer: C. Set maxSurge to 25% and set maxUnavailable to 25% in the Deployment rollingUpdate strategy

A maxSurge of 25% allows up to 5 extra pods, matching the 125% maximum requirement. However, setting maxSurge and maxUnavailable to the integer 5 is mathematically identical for a 20-replica deployment. Both options effectively fulfill the stated requirements.

Correct answer: C. Create a Service of type ExternalName with the externalName field set to 'prod-db-99.provider.com'.

An ExternalName Service creates a DNS CNAME record, perfectly mapping an internal cluster domain to an external FQDN without code changes. Modifying CoreDNS directly is an anti-pattern and a poor distractor, whereas Ingress only manages HTTP traffic routing.

Correct answer: D. Define a livenessProbe using an exec command that evaluates the file's modification time

A liveness probe determines when a container needs a restart due to deadlock or failure. Using an exec handler runs a custom script to validate complex conditions, such as file modification times, which readiness probes or startup delays do not manage.

Correct answer: B. Set completions to 100, parallelism to 10, backoffLimit to 4, and activeDeadlineSeconds to 1800

In Kubernetes Jobs, backoffLimit governs the maximum pod retries before failing. The activeDeadlineSeconds parameter enforces a strict time limit for the entire job execution. Avoid sidecar workarounds and use native API fields during the exam.

Correct answer: D. Configure the Pod specification to use the Downward API to map fieldRef values like metadata.name and spec.nodeName into environment variables.

The Downward API exposes pod metadata directly to containers without using the Kubernetes API client. Use fieldRef for environment variables to pass the pod name and node name dynamically. Static ConfigMaps fail when pods are rescheduled.

Correct answer: B. Define the strategy with maxUnavailable set to 0 and maxSurge set to 2 to maintain at least 6 pods while allowing a maximum of 8 pods during the transition.

Setting maxUnavailable to zero keeps all desired replicas running during updates. Configuring maxSurge to two allows only two extra pods to be created, keeping the maximum total within the required limit. The Recreate strategy causes downtime.

Correct answer: B. Apply a volumeMount with the subPath property to map the specific key from the ConfigMap volume directly to the desired file path in the container.

The subPath property mounts a single file from a volume into an existing directory without obscuring other files. This is the exact Kubernetes feature for injecting specific ConfigMap keys safely. Using init containers is an unnecessary workaround.

Correct answer: A. Specify fsGroup: 2000 within the Pod-level securityContext to automatically change the ownership of the mounted volume to be owned by group 2000.

Specifying fsGroup in the Pod securityContext automatically adjusts the group ownership of mounted volumes. This built-in kubelet feature handles permissions cleanly, avoiding the need for insecure privileged containers or application modifications.

Correct answer: B. Define an Init container that runs a script to check for the availability of the 'db-backend' service using a tool like netcat or nslookup.

Init containers run sequentially and must complete successfully before the main application containers start. This makes them the perfect tool for blocking startup until external network dependencies are fully reachable and ready.

Correct answer: B. Implement a LivenessProbe using an HTTP GET request with an initialDelaySeconds of 30 and a failureThreshold of 3.

A LivenessProbe detects application deadlocks and restarts the unresponsive container to restore functionality. The initialDelaySeconds parameter ensures the probe does not prematurely kill the container during its 30-second startup routine.

Correct answer: B. Set an ephemeral-storage resource limit of 500Mi within the container specification

Setting an ephemeral-storage limit triggers pod eviction when container writes exceed the specified threshold, protecting the node. ResourceQuotas only cap total namespace usage rather than enforcing strict limits on individual pod consumption.

Correct answer: D. Implement a projected volume that includes secret, configMap, and downwardAPI sources

A projected volume maps several volume sources like secrets and downwardAPI data into a single unified directory tree. This provides a clean aggregation method, whereas overlapping standard volume mounts will simply overwrite each other.

Correct answer: C. Define a readinessProbe using httpGet specifying port 9090 and the appropriate path for health checks.

A readinessProbe using httpGet on the management port accurately validates application readiness before routing traffic. Liveness or startup probes do not control traffic routing, making them unsuitable for this specific Service requirement.

Correct answer: D. Set the boolean field automountServiceAccountToken to false in the Pod specification to prevent the automatic mount.

Setting automountServiceAccountToken to false explicitly stops the kubelet from injecting the API credentials into the pod. Overriding the mount path with an emptyDir is a dangerous hack that does not properly secure the environment.

Correct answer: B. A Headless Service with the clusterIP field set to None and a selector that matches the labels defined in the StatefulSet's pod template.

A Headless Service returns individual pod IP addresses instead of providing a single virtual IP for load balancing. This behavior is required for StatefulSets to provide stable network identities for distributed data replication.

Correct answer: C. Define backoffLimit set to 4 and activeDeadlineSeconds set to 300

The backoffLimit field specifies the number of retries before a Job is marked as failed, while activeDeadlineSeconds enforces a hard time limit. Use activeDeadlineSeconds rather than a grace period when you need an absolute cap on Job duration.

Correct answer: C. Change the Deployment strategy type to Recreate in the spec section

The Recreate deployment strategy terminates all existing Pods before creating new ones, which is required for singleton applications. A RollingUpdate will temporarily run both versions simultaneously, risking database locks.

Correct answer: A. Configure topologySpreadConstraints in the Pod spec with a topologyKey set to 'topology.kubernetes.io/zone' and a maxSkew of 1.

TopologySpreadConstraints give the scheduler explicit rules for distributing Pods evenly across designated topology domains like zones. NodeSelectors or anti-affinity rules cannot mathematically enforce an even spread across multiple failure domains.

Correct answer: B. Define a Readiness Probe using the exec handler to run the /usr/bin/verify-dependencies.sh script to control the Pod's inclusion in Service endpoints.

A Readiness Probe evaluates if an application can serve requests, removing it from Service endpoints if checks fail. A Liveness Probe would restart the Pod unnecessarily when external dependencies become temporarily unavailable.

Correct answer: C. Modify the label selector of the 'checkout-service' to match the unique labels of the Version 2 Deployment pods.

Updating the Service selector instantly changes traffic routing to match the new deployment pods. Deleting the old deployment removes rollback capability, and Ingress canary rules apply proxy traffic splitting, not standard Kubernetes service routing.

Correct answer: C. A Headless Service with the 'clusterIP' set to 'None' and matching the 'serviceName' of the StatefulSet

A Headless Service with clusterIP set to None provides stable DNS records for individual StatefulSet pods. Standard ClusterIP services balance traffic across random pods, destroying direct addressability, while Ingress and LoadBalancers manage external routing.

Correct answer: B. Implement an initContainer that uses a specialized image containing the tools to generate the key and save it into an emptyDir volume shared with the main container.

Init containers run sequentially before the main app, securely passing data via an emptyDir volume. Granting elevated runtime capabilities or relying on lifecycle hooks leaves heavy diagnostic tools exposed inside the primary production image.

Correct answer: B. Define an Init Container that runs the SQL validation script and only exits successfully when the database schema version is confirmed as 2.4.

Init containers block application startup until prerequisite checks successfully complete. PostStart hooks execute concurrently with the main app, and readiness probes only prevent service routing without stopping the main process from crashing.

Correct answer: B. Set maxSurge to 20% and maxUnavailable to 20%

A twenty percent surge permits exactly two extra pods, staying safely under the twelve pod limit. Concurrently, twenty percent unavailable ensures at least eight pods remain active, perfectly meeting the strict availability requirements.

Correct answer: D. Apply a NetworkPolicy with an 'egress' section that includes a CIDR rule for 10.0.0.55/32 and a rule for the DNS port.

A NetworkPolicy with an egress section explicitly allows traffic to the database IP and DNS port while blocking everything else. RBAC controls API access rather than network traffic, and Ingress only manages incoming connections.

Correct answer: D. Apply a Taint with the NoSchedule effect to the GPU nodes and add a matching Toleration and NodeAffinity to the fraud-detection Pod specification.

Taints repel standard Pods from the GPU nodes, while Tolerations and NodeAffinity ensure the fraud-detection Pods are specifically scheduled there. Using NodeAffinity guarantees the workload lands on the correct hardware.

Correct answer: A. Add a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to allow the container up to 300 seconds to initialize before Liveness probes take over.

A Startup probe disables Liveness and Readiness checks until it succeeds, protecting slow-starting applications. Just increasing the Liveness delay leaves the container unmonitored during steady-state, defeating the probe's purpose.

Correct answer: B. Deploy a sidecar container running a proxy (like HAProxy or Socat) that listens on localhost:3306 and forwards traffic to the remote database address.

The Ambassador pattern uses a sidecar to act as a local proxy, making remote services appear local without code changes. Modifying Pod hosts or synchronizing databases adds unnecessary complexity and fails the proxy requirement.

Correct answer: A. Use the 'subPath' field in the volumeMounts section for each file to mount them individually into the target directory.

Using subPath mounts individual files without overwriting the destination directory. However, using a projected volume is also a valid, modern solution for merging multiple volume sources into a single directory.

Correct answer: B. Set the 'fsGroup' field within the Pod's securityContext to 2005 to ensure Kubernetes changes the group ownership of the volume.

Setting fsGroup in the Pod securityContext tells Kubernetes to change the mounted volume's group ownership to that ID. This grants the non-privileged container write access without requiring risky privileged escalations.

Correct answer: A. Update the selector labels in the Service manifest to match the version 2.0 Pod labels

A Kubernetes Service routes traffic using label selectors. Updating the selector to match the new labels instantly shifts all traffic to the Green environment without deploying a new Service or modifying Deployment strategies.

Correct answer: A. Set readOnlyRootFilesystem to true in the securityContext and mount an emptyDir volume at /tmp/app-cache.

Setting readOnlyRootFilesystem to true secures the container image. Mounting an emptyDir at the specific path provides a writable scratch space that remains isolated to the Pod's lifecycle.

Correct answer: B. Apply labels to the namespace that configure the Pod Security Admission controller to enforce the restricted profile

Pod Security Admission is the modern replacement for PodSecurityPolicies. Applying namespace labels like pod-security.kubernetes.io/enforce: restricted automatically enforces the baseline security standard natively.

Correct answer: C. Set the 'terminationGracePeriodSeconds' field in the Pod specification to 60 to allow the application enough time to shut down.

The terminationGracePeriodSeconds defines the duration Kubernetes waits after sending SIGTERM before issuing SIGKILL. Increasing this value ensures the application has the necessary window to finish cleanup tasks safely.

Correct answer: A. Update the selector labels of the 'payment-service' Service to match the labels unique to the Version 2.0 Deployment pods.

Updating the Service selector implements an atomic Blue-Green switch by redirecting internal load balancing to the new Pods. Rolling updates risk mixing traffic, whereas deleting deployments causes downtime.

Correct answer: B. Use a projected volume that includes secret, configMap, and downwardAPI sources.

A projected volume maps several volume sources like Secrets, ConfigMaps, and Downward API into a single directory. This avoids mounting multiple separate volumes and provides a clean, unified filesystem structure.

Correct answer: A. A LivenessProbe configured with an appropriate failureThreshold to trigger a container restart upon repeated failures.

A liveness probe checks if an application is stuck or deadlocked, and failing it triggers the kubelet to restart the container. A readiness probe only routes traffic, meaning a frozen container would stay offline indefinitely without being replaced.

Correct answer: A. Set fsGroup to 5000 in the Pod's securityContext specification

Setting fsGroup to 5000 in the pod security context automatically grants the mounted volume group ownership so your user can read and write files. Running privileged containers or applying broad permissions creates unnecessary security risks on the certification exam.

Correct answer: C. Point the Service selector to a common label shared by both Deployments

A service routes traffic by matching pod labels, so pointing it to a common label shared by both deployments adds them to the pool. The control plane dynamically manages endpoints, making manual edits unreliable and temporary.

Correct answer: A. Set parallelism to 4 and completions to 20 in the Job spec

The parallelism field dictates concurrent worker pods, and completions dictates total successful finishes required. Using activeDeadlineSeconds sets timeout limits rather than concurrency, completely failing to match workload requirements.

Correct answer: A. Use the envFrom field in the container spec and reference the ConfigMap via configMapRef

The envFrom field bulk injects all ConfigMap or Secret keys as environment variables into a container. Mapping individual keys manually using configMapKeyRef is tedious and inefficient for large configurations.

Correct answer: B. Set 'successfulJobsHistoryLimit' to 3 and 'failedJobsHistoryLimit' to 1 in the CronJob spec.

The successfulJobsHistoryLimit and failedJobsHistoryLimit fields restrict how many finished jobs and pods remain for auditing. Configuring ttlSecondsAfterFinished on the job template controls deletion timing rather than strict retention counts.

Correct answer: A. Set the 'startingDeadlineSeconds' field in the CronJob specification to 1800 seconds to define the allowed scheduling window.

Setting startingDeadlineSeconds dictates the grace period before a delayed job is skipped entirely by the controller. The activeDeadlineSeconds field sets the maximum duration a job runs once started, not scheduling delay tolerances.

Correct answer: A. Use an Init container with curl to fetch keys into a shared emptyDir volume

Init containers run sequentially before the main application starts and can share an emptyDir volume. This approach securely passes data to minimal distroless images that lack standard shell utilities. Sidecars run concurrently, making them unsuitable.

Correct answer: B. Configure securityContext with runAsUser 5000 and allowPrivilegeEscalation set to false

Setting runAsUser enforces a specific UID while allowPrivilegeEscalation prevents a process from gaining more privileges than its parent. Configuring these in the security context meets the requirement. PodSecurityPolicy is deprecated and a strong distractor.

Correct answer: C. Set the service property sessionAffinity to ClientIP in the Service manifest.

Setting sessionAffinity to ClientIP ensures requests from a specific IP route to the same pod during the session timeout window. This is the native service configuration for legacy applications. Avoid manual pod selectors or complex Ingress rules.

Correct answer: A. Configure a LivenessProbe using an 'exec' command that runs a custom script to check the status of the internal worker

A liveness probe triggers a container restart when it detects an application deadlock. Using an exec handler allows you to run custom logic that verifies the background worker status directly. Readiness probes only manage traffic routing.

Correct answer: A. Assign the concurrencyPolicy to Forbid to prevent the CronJob controller from starting a new job if the previous instance has not yet finished its execution.

The Forbid policy prevents concurrent executions, ensuring a new job is skipped if the previous one is still running. Replace would terminate the existing job, which violates the requirement to skip the new execution entirely.

Correct answer: C. Create a Service of type ExternalName and set the externalName field to the database DNS name