Certified Kubernetes Application Developer (CKAD)

Correct answer: C. A securityContext block at the container level defining runAsUser, runAsGroup, and allowPrivilegeEscalation: false.

The container-level securityContext is the correct block because it directly defines runAsUser, runAsGroup, and allowPrivilegeEscalation to enforce these specific runtime constraints. A NetworkPolicy or RBAC bindings cannot enforce user IDs or prevent privilege escalation inside a running container.

Correct answer: C. Update the Ingress specification by adding a 'tls' block that specifies the hosts and references the 'hr-tls-secret' name.

Adding a TLS block to the Ingress specification referencing the existing Secret enables TLS termination for the specified host. You do not need to modify the Service or manually mount certificate volumes into the Ingress controller deployment.

Correct answer: B. A NetworkPolicy with an ingress rule that selects 'role: frontend' pods and specifies port 443 under the 'role: backend' pod selector

A NetworkPolicy isolates the backend pods by selecting them and defining an ingress rule that permits traffic only from the frontend pod selector on TCP port 443. RBAC roles control API permissions rather than network access between pods.

Correct answer: C. Create a NetworkPolicy with an ingress rule matching the frontend podSelector and a port 5432

A NetworkPolicy applied to the database pods with an ingress rule restricting port 5432 to the frontend pod selector effectively isolates the database. By default, NetworkPolicies allow egress traffic unless specifically restricted, so cluster DNS remains accessible.

Correct answer: C. Set maxUnavailable to 1 and maxSurge to 2 to maintain the required availability and resource usage limits during the update.

Configuring maxUnavailable to 1 ensures 4 replicas stay available, while maxSurge set to 2 limits the maximum total replicas to 7 during the rollout. Using percentages introduces fractional replicas and unpredictable scaling limits.

Correct answer: D. A LimitRange to set default and maximum constraints on individual pods and a ResourceQuota to limit the total namespace usage.

A LimitRange enforces the maximum CPU limit per individual pod, while a ResourceQuota caps the total aggregate CPU usage across the namespace. PodSecurityPolicies are deprecated, and NetworkPolicies do not restrict compute resource consumption.

Correct answer: C. Configure the memory limits field to 2Gi in the container's resource specification

Setting the container memory limits field to 2Gi triggers an Out Of Memory kill if the application attempts to exceed that threshold. A ResourceQuota caps total namespace usage rather than terminating individual offending pods.

Correct answer: B. Set completions: 50 and parallelism: 5 in the Job specification

The correct answer uses completions for the total successful pods and parallelism for the concurrent workers. Do not confuse this with Deployments, which use replicas for steady-state services.

Correct answer: B. Set completions to 100 and parallelism to 10 to ensure a steady state of 10 concurrent workers

The correct answer sets completions to the total desired successes and parallelism to the concurrent worker count. Avoid swapping these values or mixing in activeDeadlineSeconds, which only sets a timeout.

Correct answer: D. Specify an egress rule with a to block containing an ipBlock for 10.50.0.22/32

The correct answer uses an egress rule with an ipBlock targeting the database IP. Once an egress policy applies, Kubernetes isolates the pod and blocks all unspecified outbound traffic.

Correct answer: A. Assign the 'priorityClassName: high-priority' field in the Pod's spec to indicate its importance to the Kubernetes scheduler

The correct answer assigns the priorityClassName field in the pod spec. The scheduler uses this exact field to determine priority and evict lower-priority workloads, whereas labels and autoscalers do not trigger preemption.

Correct answer: D. Mount the Secret and ConfigMap as separate volumes and use volumeMounts to map them to the specific directory paths

Mounting Secrets and ConfigMaps as volumes projects the data as files at the specified paths. Using envFrom would inject values as environment variables, violating the strict security policy.

Correct answer: C. Replace the livenessProbe with a startupProbe that has a sufficient failureThreshold and periodSeconds for the 90-second delay.

A startupProbe correctly disables liveness checks during initialization, preventing premature restarts for slow-starting apps. Relying only on livenessProbe delays risks killing the container before it fully boots.

Correct answer: A. Deploy a sidecar container sharing an emptyDir volume with the main application to tail the log file to stdout.

A sidecar container sharing an emptyDir volume correctly tails the log file and streams it to stdout. This pattern extends the main container's functionality without modifying its source code or image.

Correct answer: B. A LimitRange object defined within the namespace to set default requests and limits for CPU and Memory.

A LimitRange is the correct object to automatically enforce default CPU and memory limits for individual containers. A ResourceQuota caps total namespace usage but does not assign default limits per pod.

Correct answer: C. Define a Job with completions: 100 and parallelism: 5 to manage the lifecycle of the worker pods.

A Job specifically manages batch tasks using parallelism to limit concurrent pods and completions to set the total success count. Deployments and ReplicaSets are meant for long-running services, not tasks that terminate after processing.

Correct answer: A. runAsNonRoot: true, allowPrivilegeEscalation: false, and readOnlyRootFilesystem: true

This combination directly enforces non-root execution, prevents privilege escalation, and makes the root filesystem immutable. Option C misses the required read-only filesystem, and Option B adds unnecessary complexity without meeting all criteria.

Correct answer: D. Use an InitContainer to run the legacy script and write the file to a shared volume

An InitContainer runs to completion before the main container starts, blocking startup if it fails. Sidecars and lifecycle hooks run concurrently with the app, meaning they cannot guarantee the file exists before the main process begins.

Correct answer: A. Set the 'strategy' type to 'Recreate' to ensure all existing pods are killed before any new pods are created during the update.

The Recreate strategy terminates all existing pods before creating new ones, preventing concurrent access. RollingUpdate attempts to scale new pods while old ones are still terminating, which would cause lock contention.

Correct answer: A. Implement a LivenessProbe that checks an internal health endpoint for responsiveness

A LivenessProbe detects unrecoverable states like deadlocks and triggers the kubelet to restart the container. A ReadinessProbe would only remove the pod from service, but it would not restart the deadlocked process.

Correct answer: C. Configure a volume of type 'secret' in the Pod spec and mount it as a volumeMount at the specified path in the container.

Mounting a Secret as a volume writes the data to a memory-backed filesystem at the exact target path. This avoids accidental exposure via environment variables in process listings or application crash logs.

Correct answer: C. Configure a LivenessProbe that executes a script checking for recent activity in the application processing logs.

A LivenessProbe using an exec action checks application activity and restarts the container if the probe fails. A ReadinessProbe only removes the pod from the service endpoints without restarting the deadlocked process.

Correct answer: A. Add a sidecar container to the Pod that shares a volume with the main container and runs a command to tail the log file to its own stdout.

A sidecar container shares a volume with the main app and tails the log file to its own standard output. This streams the logs to the Kubernetes infrastructure without modifying the original application image.

Correct answer: C. Set the strategy type to Recreate to ensure all existing Pods are killed before new ones are created

Setting the strategy type to Recreate guarantees all old pods are killed before new ones are created. A RollingUpdate would temporarily run both versions concurrently, crashing the older pods accessing the new schema.

Correct answer: B. Configure a Service of type NodePort and specify a value in the nodePort field between 30000 and 32767.

A NodePort service exposes the application on a static port across all cluster nodes. ClusterIP is internal only, while LoadBalancer relies on cloud provider integration rather than direct node access.

Correct answer: C. Update the persistentVolumeReclaimPolicy of the PV to the value Retain

The Retain reclaim policy ensures the underlying storage asset and data are preserved when the PersistentVolumeClaim is deleted. On the exam, recall that the default policy for dynamically provisioned cloud volumes is Delete, so you must explicitly patch the PersistentVolume to Retain.

Correct answer: D. Kubernetes will automatically set the requests to match the defined limits

In a restricted namespace, Kubernetes automatically sets the CPU and memory requests to match the defined limits if limits are omitted. The default request of zero is incorrect because ResourceQuota validation requires explicit values, which it derives from the limits.

Correct answer: C. An Ingress resource with path-based rules mapping / and /search to their respective backend services.

An Ingress resource handles Layer 7 routing based on URL paths, efficiently mapping different routes to backend services. Using a LoadBalancer service is incorrect because it lacks native HTTP path-awareness, and manually updating endpoints is not a standard Kubernetes pattern.

Correct answer: C. Use ReadWriteOnce (RWO) access mode with a PersistentVolumeClaim to ensure exclusive access for the single database Pod.

ReadWriteOnce allows a single node to mount the cloud block storage for exclusive read-write access, protecting the database. ReadWriteMany is incorrect because cloud block storage typically does not support multi-node simultaneous writing.

Correct answer: C. Configure 'concurrencyPolicy' to 'Forbid' to prevent the controller from starting a new Job if the previous one is still running.

Setting concurrencyPolicy to Forbid prevents overlapping Job executions by skipping new runs if a previous one is active. backoffLimit is incorrect because it limits failure retries rather than controlling concurrent schedules.

Correct answer: D. Create two separate Deployments (v1 and v2) with the same labels used by the Service's selector, and adjust the replica counts to a 9:1 ratio.

A Kubernetes Service load-balances across all Pods matching its label selector. Creating two Deployments with identical labels and a 9:1 replica ratio achieves the 10% traffic split. Setting an image list is invalid because Deployments only run a single image per container template.

Correct answer: C. Define an egress rule with a 'to' block containing an 'ipBlock' for 10.10.10.53/32 and a 'ports' block for UDP port 53.

Specifying an ipBlock destination and specific port creates an explicit allow-list for egress traffic, denying everything else by default. An empty or undefined egress list blocks all outbound traffic entirely, breaking DNS resolution and violating the functional requirement.

Correct answer: C. A Service of type ExternalName that points to the external database FQDN

The ExternalName service type maps a service to a DNS name by returning a CNAME record with the external address. Other options like ClusterIP or LoadBalancer are intended for routing traffic to cluster pods rather than providing lightweight aliasing to external FQDNs.

Correct answer: A. Create a NetworkPolicy in the finance namespace with an egress rule specifying the target CIDR and an empty podSelector.

A NetworkPolicy with an egress section allows you to define white-listed destinations based on CIDR blocks and labels. Defining allowed egress CIDRs isolates traffic, as all other outbound paths are automatically denied once the policy applies.

Correct answer: C. Deploy an Adapter container that reads the binary logs and exports them in JSON format

The Adapter container pattern standardizes or translates application output, converting proprietary logs into JSON format for monitoring tools. An init container runs only once before the app starts, so it cannot handle continuous, real-time log transformation during the application lifecycle.

Correct answer: A. Create a LimitRange object in the accounting-prod namespace to define default requests and limits

A LimitRange sets default request and limit values for containers, automatically injecting them if a pod lacks explicit resource definitions. This ensures pods comply with namespace ResourceQuotas, resolving the pending state without manually adjusting individual deployments.

Correct answer: A. Utilize an InitContainer with an image that includes the AWS CLI to download the data into a shared emptyDir volume.

Init containers run to completion before the main application starts, preparing shared volumes safely using specialized tools. A postStart hook executes concurrently with the main container, creating a race condition where the app might access the directory before the download finishes.

Correct answer: C. Set topologySpreadConstraints with maxSkew: 1, topologyKey: topology.kubernetes.io/zone, and whenUnsatisfiable: ScheduleAnyway.

Setting whenUnsatisfiable to ScheduleAnyway within topologySpreadConstraints creates a soft rule, prioritizing even spread while guaranteeing the pod schedules during resource constraints. Using DoNotSchedule acts as a hard constraint, leaving the pod pending if exact distribution fails.

Correct answer: A. Define the maxSurge as 2 and the maxUnavailable as 1 in the deployment specification

A maxSurge of 2 permits scaling up to 12 pods maximum, preventing node pressure during the update. A maxUnavailable of 1 guarantees at least 9 replicas remain ready, satisfying the minimum capacity requirement throughout the rollout process.

Correct answer: C. catalog-db.data-services.svc.cluster.local

The standard Kubernetes service FQDN format is service-name.namespace.svc.cluster.local, which allows cross-namespace resolution via CoreDNS. Watch the domain word order carefully, as reversing the service and namespace parts is a common trap.

Correct answer: B. Set maxSurge to 0 and maxUnavailable to 2 in the RollingUpdate strategy specification.

Setting maxSurge to 0 prevents any new pods beyond the desired count, while maxUnavailable to 2 maintains the minimum required availability. Choosing a non-zero maxSurge would violate the hard cluster capacity limit.

Correct answer: A. Configure an 'livenessProbe' that uses an 'exec' command to run a script checking the age of the last processed message file.

A liveness probe using an exec command directly checks internal application health and triggers a restart if the script fails. A readiness probe would only stop traffic routing, leaving the deadlocked consumer unhealed.

Correct answer: C. Use the secret volume with the 'items' field to map the specific key to a path

Using the items field in a secret volume projection selectively exposes specific keys at designated file paths. Environment variables cannot easily map to required file paths, and mounting the entire secret overwrites the directory.

Correct answer: A. A CronJob resource that defines the schedule and contains a Job template for the maintenance task.

A CronJob schedules time-based tasks and wraps them in a Job template to ensure finite execution with retries. Deployments are for perpetual services, while StatefulSets and DaemonSets do not guarantee task completion.

Correct answer: B. kubectl rollout undo deployment order-api --to-revision=12

The kubectl rollout undo command with the to-revision flag immediately restores a deployment to its exact previous state. The pause command simply halts a rollout, and set image pushes a new update forward.

Correct answer: A. A readinessProbe configured to check the cache status via an exec command

A readiness probe checks if an application is ready to accept traffic and removes the pod from endpoints until it passes. A liveness probe restarts unhealthy containers, and a startup probe only gates other probes during initialization.

Correct answer: A. Configure the Pod's securityContext with the fsGroup field set to 1005 to allow the volume to be owned by that group

Setting fsGroup in the pod securityContext automatically changes the mounted volume ownership to the specified group. Running privileged containers or using hostPath volumes violates basic security best practices.

Correct answer: A. A NetworkPolicy with an ingress rule that selects the backend pods and specifies the target port for the database pods.

A NetworkPolicy applied to the database pods uses an ingress rule to explicitly allow traffic only from pods matching the backend label on port 5432. Services and Ingress resources handle traffic routing and discovery but do not block unauthorized pod-to-pod traffic.

Correct answer: A. Configure a Readiness probe to check database connectivity while keeping the Liveness probe focused only on the local process health.

Failing a Readiness probe removes the Pod from Service endpoints without restarting the container, fulfilling the requirement to stop traffic during an external database outage. A Liveness probe failure would force a restart, which is the exact behavior to avoid here.

Correct answer: A. An Ingress resource with a set of rules defining path-based backend targets for each service.

An Ingress resource configured with path-based routing rules maps distinct HTTP paths to different backend Services behind a single IP. ClusterIP services lack Layer 7 routing capabilities, and custom sidecars introduce unnecessary operational complexity.

Correct answer: D. Store the credentials in a Kubernetes Secret and mount that Secret as a volume at a specific path in the container.

The correct answer uses a Kubernetes Secret mounted as a volume to project credentials as files. ConfigMaps lack security features for sensitive data, and environment variables risk exposure via logs.

Correct answer: A. Implement an init container that fetches the file and writes it to an emptyDir volume

Init containers run to completion before any app containers start, guaranteeing the file exists. A postStart hook executes concurrently with the main container, creating a race condition where the app might look for the file before it is written.

Correct answer: A. Use an init container with the utility tool image and a shared emptyDir volume to generate and pass the file to the main container

Init containers run to completion before the main app starts, safely using separate images. A sidecar runs concurrently and wastes resources, while modifying the main image bloats it.

Correct answer: C. The kubelet periodically synchronizes mounted ConfigMaps and Secrets, updating the projected files in the volume without a restart.

The kubelet automatically synchronizes mounted volumes on a configurable delay, updating files without a restart. Avoid using subPath for files that require updates, as subPath mounts do not receive live updates.

Correct answer: C. Mount the ConfigMap using a volumeMount with a subPath that points specifically to the 'values.csv' key within the directory.

Using subPath mounts a specific file without overwriting the target directory. This avoids permission issues entirely. Setting readOnly to false does not bypass filesystem permission rules for the directory.

Correct answer: A. kubectl describe pod batch-processor and then kubectl logs --previous

The describe command reveals events like failed probes or pull errors. The previous flag retrieves logs from the last crashed instance. Executing into the container will fail because it keeps crashing.

Correct answer: D. Add an annotation such as 'nginx.ingress.kubernetes.io/rewrite-target: /' to the Ingress resource to modify the URI path

Ingress controllers use annotations like rewrite-target to modify HTTP requests before forwarding them. Services and NetworkPolicies operate below the application layer and cannot manipulate HTTP paths.

Correct answer: C. Set maxSurge to 2 and maxUnavailable to 0 to maintain full capacity

Setting maxUnavailable to zero maintains the ten replicas, satisfying full capacity. Setting maxSurge to two respects the strict limit of two extra pods. Any maxUnavailable value above zero drops capacity.

Correct answer: A. A tls block containing the hosts list and the secretName referencing the secret

The spec dot tls block configures TLS termination by mapping domain hosts to a specific Kubernetes Secret. The Ingress controller serves the certificate, so backend services can remain on standard HTTP.

Correct answer: C. Utilize an Adapter container to standardize the output of the application to match the requirements of the external monitoring system.

The Adapter pattern standardizes output by transforming internal application data for external systems. This differs from a standard sidecar, which typically extends or proxies services without fundamentally altering the data format.

Correct answer: A. Deploy version v2 as a separate Deployment and update the Service label selector to point to the new version's labels.

Updating a service selector to point to a completely new deployment achieves a Blue-Green release. Rolling updates lack instantaneous rollback because traffic must be gradually shifted back to the original pods.

Correct answer: B. Increase the memory limit in the resources section of the container specification to match the application's peak usage requirements.

The OOMKilled status indicates a container exceeded its configured memory limit. Increasing the limit in the resource specification directly resolves the termination. Moving the pod to a larger node will not help because the kernel kills the process based on the pod limit, not node capacity.

Correct answer: A. Add a tls section to the Ingress spec containing the secretName and the list of hosts

The standard method for enabling TLS on an Ingress is adding a tls section to the spec with the secretName and hosts list. Controller-specific annotations are deprecated and non-portable. Relying on the native tls block ensures the controller correctly serves the certificate for the specified hostname.

Correct answer: B. Execute 'kubectl logs order-service --previous' to retrieve the logs from the last terminated container instance

The --previous flag retrieves stdout and stderr from the previously terminated container instance. This is the primary debugging tool for CrashLoopBackOff scenarios where the current container has not logged anything yet. The describe command only shows cluster events, not application output.

Correct answer: A. kubectl describe pod <pod-name> to inspect the 'Events' section at the bottom of the output.

The kubectl describe pod command displays a chronological Events section containing explicit Kubelet messages detailing exactly why the image pull failed. The logs command will not work because the container has not started, meaning there is no application output to inspect.

Correct answer: A. Implementing a Sidecar container that shares an emptyDir volume with the main application and tails the log file to stdout.

A sidecar container shares an emptyDir volume with the main application to read and stream logs to stdout. This decouples logging from the primary application and allows standard Kubernetes logging to capture the output. An init container cannot continuously run to stream logs.

Correct answer: A. Update the Pod's container spec to set a memory 'limit' of 1Gi and ensure the namespace LimitRange is adjusted to allow this value.

The container memory limit must be raised above the spike threshold to prevent the kernel from killing the process. Because a LimitRange enforces maximum values, it must also be updated to permit the new 1Gi limit. Increasing requests without limits does not prevent termination.

Correct answer: B. Apply an Ingress policy allowing the frontend label and a separate Egress policy with an empty set of allowed destinations.

Applying an Ingress rule with a podSelector for the frontend allows specific incoming traffic, while an empty Egress rule blocks all outgoing traffic. Using a CIDR block filter is imprecise for dynamic pod IPs, and HostPort bypasses standard network policy enforcement entirely.

Correct answer: B. Deploy an Adapter container within the same Pod that consumes the XML metrics and exposes them on a dedicated HTTP port for Prometheus

An adapter container standardizes output by transforming proprietary application metrics into a format the monitoring system expects. Running in the same pod allows it to access the local socket efficiently. An ambassador container proxies traffic, while an init container cannot run continuously.

Correct answer: B. Deploy a second Deployment for the new version and update the Service selector to point to the new version labels after successful validation.

Deploying a second deployment and updating the service selector implements a blue-green strategy, providing instant traffic shifting and rollback. A rolling update gradually replaces old pods, meaning both versions receive live traffic simultaneously and rollback is not instantaneous.

Correct answer: B. Set the securityContext at the container level with runAsUser: 1000 and allowPrivilegeEscalation: false.

Setting the container-level securityContext with runAsUser: 1000 and allowPrivilegeEscalation: false directly enforces the required non-root and non-escalating execution. RoleBindings and ResourceQuotas manage API access and resource limits, not the running container's process privileges.

Correct answer: B. A postStart lifecycle hook that executes the registration script once the container has been created.

The postStart hook executes immediately after the container is created, making it perfect for registering the IP. An InitContainer is incorrect because it runs and terminates before the main container starts.

Correct answer: A. An Ingress resource with rules defining a single host and multiple paths, each pointing to a different backend service

An Ingress resource is the standard choice for Layer 7 load balancing, natively supporting path-based routing for splitting traffic between services. NetworkPolicies are incorrect because they manage IP-level firewall rules, not HTTP request routing.

Correct answer: D. Create a Headless Service by setting the clusterIP field to None in the specification

Setting clusterIP to None creates a Headless Service, which returns individual pod IP addresses via DNS instead of a single virtual IP. This enables direct peer-to-peer communication required by stateful applications. NodePort or Ingress add unwanted load balancing.

Correct answer: A. Implement a StartupProbe with a failureThreshold of 30 and a periodSeconds of 10 to disable other probes during initialization

A StartupProbe disables Liveness and Readiness probes until it succeeds, preventing slow containers from being killed by the Kubelet during initialization. Relying on initialDelaySeconds is brittle because exact startup times fluctuate under variable loads or hardware conditions.

Correct answer: B. Set the concurrencyPolicy field to Forbid within the CronJob specification

Setting concurrencyPolicy to Forbid tells the controller to skip creating new Jobs if an existing one is still running. The Replace policy kills the active Job, while changing history limits only cleans up old completed tasks without preventing overlaps.

Correct answer: A. A Horizontal Pod Autoscaler (HPA) targeting the Deployment with the specified CPU utilization threshold

The Horizontal Pod Autoscaler automatically scales the number of Deployment replicas based on observed CPU utilization. The Cluster Autoscaler only adjusts the cluster node size, and the Vertical Pod Autoscaler modifies resource requests rather than replica counts.

Correct answer: B. Define maxUnavailable as 0% and maxSurge as 25% to ensure no capacity is lost while limiting the temporary resource overhead

Setting maxUnavailable to 0 guarantees no existing pods are removed before new ones are ready. Pairing it with a 25% maxSurge strictly limits the temporary extra pods, satisfying the resource constraint while maintaining full application availability.

Correct answer: C. Use the envFrom field and reference the ConfigMap using the configMapRef attribute

The envFrom field automatically imports all key-value pairs from a ConfigMap as container environment variables. This avoids listing each variable individually with valueFrom and ensures future ConfigMap additions are automatically consumed by the container.

Correct answer: A. Configure concurrencyPolicy to 'Forbid' to prevent the controller from creating a new Job if the previous one has not finished

The Forbid policy explicitly tells the CronJob controller to skip creating a new Job if an existing one is still running. Replace terminates the current Job, and backoffLimit only dictates retry behavior for failed tasks rather than concurrency rules.

Correct answer: A. Create an Egress policy for 'frontend' pods with a 'to' rule selecting 'backend' pods and a 'ports' rule for 8080.

An Egress policy applied to the frontend pods explicitly restricts outgoing traffic to only the specified backend on port 8080. An Ingress policy on the backend fails this requirement because it does not block the frontend from sending traffic to external addresses.

Correct answer: D. Define the 'tls' field with 'hosts' containing 'portal.healthcare.com' and 'secretName' set to 'portal-tls-secret', while setting the 'rules' to forward traffic to 'portal-svc' on port 8080.

The tls block in the Ingress specification correctly associates the TLS secret with the host, while the rules block maps the host to the backend service port. ConfigMaps cannot store TLS keys, and annotations alone fail to configure secure routing properly.

Correct answer: A. Traffic will be distributed randomly among all 10 available pods, resulting in approximately 10% of traffic reaching the new 'webapp-v2' version.

The Service load balances randomly across all matching pods, sending roughly 10% of traffic to the new version. Kubernetes does not understand version labels natively, so it treats all matching pods as identical endpoints rather than isolating deployments.

Correct answer: C. Add the NET_RAW capability to the capabilities list in the security context

The NET_RAW capability allows processes to use raw and packet sockets, which tools like tcpdump need for capturing traffic without full host access. Setting privileged to true violates the least-privilege principle, and root permissions do not directly grant specific capabilities securely.

Correct answer: C. Set the strategy type to RollingUpdate with maxUnavailable set to 0 and maxSurge set to 25%.

Setting maxUnavailable to 0 ensures no pods are removed until new ones are ready, maintaining full capacity. Setting maxSurge allows the deployment to create additional pods during the update, fulfilling the requirement to speed up the rollout.

Correct answer: A. Apply the runAsUser and runAsGroup settings within the securityContext section at the Pod level of the manifest.

Defining runAsUser and runAsGroup in the pod-level securityContext ensures all containers inherit these exact execution permissions. Applying settings at the container level only affects one container, and service accounts handle API authentication.

Correct answer: C. Use the 'subPath' field in the volumeMounts section to mount only the specific 'nginx.conf' key from the volume into the full file path

Using the subPath field in volumeMounts injects a single ConfigMap file into an existing directory without overwriting neighbors. Without subPath, the entire directory is masked by the mounted volume, breaking the container.

Correct answer: D. Define a single Ingress with a 'tls' block where the 'hosts' list only includes 'billing.example.com' and the 'secretName' is 'billing-tls-cert'.

Creating a single Ingress with a TLS block for the billing host correctly restricts HTTPS to that domain. However, creating two separate Ingress resources is also valid, making the options ambiguous.

Correct answer: B. Implement an Ingress resource with rules defined for each host pointing to their services

An Ingress resource manages external access to services, providing Layer 7 routing and TLS termination. Services lack host-based routing, making Ingress the only option for HTTP host rules.

Correct answer: B. Deploying an Ambassador container to proxy the database connections

The Ambassador pattern deploys a proxy container to handle outbound traffic on behalf of the main application. This abstracts complex service discovery or sharding logic away from the application code.

Correct answer: A. Define a single host with multiple paths in the 'rules' section and specify the 'tls' section referencing the 'tls-secret'.

A single Ingress resource can define multiple paths under a specific host block and configure TLS termination. Using NodePort or separate Ingress resources lacks native path mapping and unified TLS management.

Correct answer: C. Implement a Startup probe with a failureThreshold of 30 and a periodSeconds of 10 to protect the container during its initial boot

A Startup probe specifically disables Liveness and Readiness checks until it succeeds, accommodating slow-starting applications. Modifying initialDelaySeconds forces rigid timing limits that cannot adapt.

Correct answer: D. An Egress policy with two rules: one with an ipBlock allowing 203.0.113.10/32, and another allowing UDP/TCP port 53 to the kube-system namespace

Defining an Egress policy triggers default-deny behavior for all unspecified outbound traffic. You must explicitly allow an ipBlock for the external API and a namespace selector for DNS resolution.

Correct answer: D. Specify the custom 'serviceAccountName' in the Pod's spec section

A Pod inherits permissions based on its explicitly assigned serviceAccountName, mounting the correct API token. Without mapping the specific ServiceAccount, the default restricted permissions remain active.

Correct answer: D. A Job with completions: 10 and parallelism: 3 to ensure sequential completion with a set amount of concurrent workers.

A Kubernetes Job is designed for finite tasks and automatically retries failed pods until they succeed. Setting parallelism limits concurrent workers, optimizing resource usage while completions tracks the total required successes. CronJobs are for scheduled recurring tasks.

Correct answer: A. Deploy a Job with a restartPolicy set to OnFailure to ensure task completion

A Job handles run-to-completion workloads. Setting restartPolicy: OnFailure guarantees that Kubernetes retries the container exactly until it succeeds. A Deployment or DaemonSet is incorrect because they manage continuous, long-running processes.

Correct answer: A. Define a LivenessProbe with an HTTP GET action targeting a health check endpoint that verifies internal application logic.

A LivenessProbe with an HTTP GET action checks application health and restarts the container upon failure. TCP socket checks only verify network listening, failing to detect internal application deadlocks.

Correct answer: A. An emptyDir volume mounted at the same path in both containers to provide a shared, temporary filesystem in memory or on disk

An emptyDir volume provides shared, temporary storage accessible by all containers within a single Pod. Persistent volumes are unnecessary for transient data, and ConfigMaps are strictly read-only.

Correct answer: A. Configure the Nginx sidecar and application container to share the same Network namespace using localhost for communication.

Containers within the same Pod inherently share the same Network namespace, enabling them to communicate via localhost. The proxy sidecar listens on external ports while forwarding traffic to localhost.

Correct answer: A. Run 'kubectl logs pod-name -c helper-container --previous' to retrieve the logs from the last terminated container instance.

The --previous flag retrieves logs from the last terminated instance of a container, essential for debugging crash loops. Events and current logs rarely capture the exact application failure trace.