Certified Kubernetes Application Developer (CKAD)

Correct answer: C. Set the automountServiceAccountToken field to false within the spec.template.spec section of the Deployment manifest.

Setting automountServiceAccountToken to false within the Pod template spec prevents Kubernetes from injecting the default API token. Overwriting the mount path with an emptyDir is a hacky workaround, whereas the native boolean field is the intended security control.

Correct answer: A. The Adapter pattern, where a second container transforms the output of the main container into a standardized format for external systems

The Adapter pattern transforms the main container output into a standardized format for external monitoring systems to consume. A generic sidecar merely adds features, while an Ambassador strictly proxies external network traffic.

Correct answer: B. Create a Job with 'completions: 500', 'parallelism: 10', and 'backoffLimit: 5' to manage the execution and retries.

A Kubernetes Job uses completions to target successful exits and parallelism to control concurrency. The backoffLimit halts the entire workload after the specified failure count, which Deployments cannot do natively.

Correct answer: B. Implement a startupProbe with a failureThreshold of 30 and a periodSeconds of 5 to allow up to 150 seconds for initialization

A startup probe disables liveness and readiness checks until it succeeds, providing a dedicated window for initialization without affecting long-term monitoring.

Correct answer: D. Use an httpGet probe with the path, port, and an httpHeaders array containing the name and value of the token.

An httpGet probe natively supports custom HTTP headers, allowing you to pass authentication tokens directly during health checks. While an exec probe using curl could technically work, it introduces unnecessary operational overhead and relies on external binaries inside the container image.

Correct answer: C. Set maxUnavailable to 2 and maxSurge to 3 within the RollingUpdate strategy block of the Deployment manifest.

Setting maxUnavailable to 2 ensures at least 8 pods remain available during the rollout. Setting maxSurge to 3 guarantees that the total number of pods never exceeds 13, satisfying both high availability and resource constraints.

Correct answer: C. Configure a startupProbe with a long failureThreshold and a readinessProbe for traffic control

A startupProbe protects slow-starting applications by disabling liveness checks until initialization completes. Coupling it with a readinessProbe ensures the application receives traffic only when fully prepared, preventing premature container restarts.

Correct answer: D. Set completions to 50 and parallelism to 5 within the Job's spec section

The Kubernetes Job controller natively handles parallel batch processing using the completions and parallelism fields. Setting parallelism to 5 maintains the desired workload concurrency until 50 successful completions are recorded.

Correct answer: C. Create a LimitRange object in the 'sandbox' namespace and specify the 'default' memory limit for containers.

A LimitRange is the correct Kubernetes mechanism to enforce default resource limits at the container level. While a ResourceQuota restricts total namespace consumption, it does not automatically inject missing memory limits into individual pod manifests.

Correct answer: C. Run 'kubectl describe pod [pod-name]' and check the Events section for mount failures

The kubectl describe pod command outputs a detailed Events section that explicitly states why a container failed to start. You can quickly spot volume mount errors or missing secret dependencies there without needing application logs.

Correct answer: C. Create a HorizontalPodAutoscaler (HPA) targeting the 'orders' deployment with a targetAverageUtilization of 70 and appropriate stabilization windows.

A HorizontalPodAutoscaler automatically scales the number of pods based on observed CPU utilization. Configuring its behavior field with stabilization windows prevents rapid scaling actions, effectively avoiding flapping during minor metric fluctuations.

Correct answer: C. The Ambassador pattern, which acts as a proxy to represent an external service as if it were a local service.

The Ambassador pattern acts as a dedicated proxy to simplify communication with complex external services. The main application connects to this helper container on localhost, entirely abstracting away the custom authentication and caching logic.

Correct answer: C. Use secretKeyRef to map the password to an environment variable and define a volume of type secret to mount at /etc/tls

Using secretKeyRef maps a specific secret key directly into an environment variable for the container. Mounting a secret volume separately exposes the certificate files securely into the specified directory without hardcoding sensitive data.

Correct answer: C. Configure a RollingUpdate with maxSurge set to 2 and maxUnavailable set to 0 to maintain full capacity during the update.

Setting maxUnavailable to 0 maintains full capacity, while maxSurge to 2 strictly limits extra pods. Allowing unavailable pods is the strongest distractor, but it breaks the required capacity rule.

Correct answer: D. Define a Liveness Probe using an httpGet request to port 8080 on the /healthz path.

A liveness probe using HTTP GET accurately restarts containers stuck in deadlock states. A readiness probe is the strongest distractor, but it merely stops traffic instead of restarting.

Correct answer: B. Utilize an initContainer in the Pod spec to run the database migration script before the main container

An initContainer runs to completion before the main container, blocking startup if it fails. A sidecar is the strongest distractor, but it runs concurrently instead of sequentially.

Correct answer: A. Set the concurrencyPolicy to Forbid in the CronJob specification to prevent overlapping executions.

Setting concurrencyPolicy to Forbid correctly prevents overlapping jobs from running simultaneously. Changing schedule frequency is the strongest distractor, but it fails under delays.

Correct answer: B. Add a sidecar container to the Pod that runs a tail -f command on the log file, sharing the log directory via an emptyDir volume.

Adding a sidecar container that streams the log file to stdout makes the logs visible to standard Kubernetes logging tools. Do not use hostPath or persistent volumes, as they bypass container stdout and are not collected by node-level logging agents.

Correct answer: C. Use the 'volumes.configMap.items' field to select the key and 'volumeMounts.subPath' to mount only that file.

Using the volumeMounts subPath property mounts a single file from a ConfigMap without obscuring existing application files. Mounting a ConfigMap directly to the directory masks the entire folder, which would break the container image defaults.

Correct answer: C. Edit the existing PersistentVolumeClaim and increase the storage value in the resources.requests section

Increasing the requested storage value on an existing PersistentVolumeClaim triggers dynamic volume expansion if the StorageClass permits it. Deleting the PVC would destroy the data, while manual resizing bypasses Kubernetes reconciliation.

Correct answer: C. Utilize an Init Container to run the database migration script, ensuring the Pod waits for its successful completion before starting the main container.

Init containers run to completion before the main application container starts, blocking startup until the migration succeeds. Jobs lack this strict lifecycle coupling, and readiness probes incorrectly handle initialization tasks instead of traffic routing.

Correct answer: D. A NetworkPolicy with an ingress rule allowing traffic from pods labeled 'app: frontend' on port 9000.

NetworkPolicy resources use label selectors to define precise ingress and egress rules for pod communication. Ingress and Service resources lack native layer three or four firewall capabilities needed for this internal namespace isolation.

Correct answer: B. Set the RollingUpdate strategy with maxSurge: 5 and maxUnavailable: 5.

Configuring maxSurge and maxUnavailable to absolute integers safely dictates the exact replica counts allowed during rollouts. Using percentage values is risky here because fractional rounds up, violating the strict minimum availability constraint.

Correct answer: C. Both containers must share the same network namespace and communicate over the 127.0.0.1 loopback address.

Containers within the same pod inherently share the exact same network namespace and loopback interface. This localhost communication is required for the proxy to forward traffic internally without complex routing configurations or host ports.

Correct answer: C. Implement a Readiness Probe that checks a specific health endpoint which only returns a 200 OK status once the data is fully loaded into memory.

A readiness probe controls traffic routing by removing unready pods from service endpoints until the endpoint succeeds. Liveness probes only manage container restarts and do not prevent premature traffic delivery during initialization.

Correct answer: D. Set up a LivenessProbe with an 'exec' action that runs 'python /app/health_check.py' to trigger a container restart upon failure.

A liveness probe using an exec action runs the diagnostic script and restarts the container if it returns a non-zero exit code. Readiness probes only remove the pod from service endpoints without triggering the required self-healing restart.

Correct answer: A. Set the memory requests and limits to the exact same value for all containers within the Pod to achieve a Guaranteed Quality of Service class.

Matching memory requests and limits exactly grants the Guaranteed Quality of Service class, protecting pods from system OOM kills longer. PriorityClasses manage scheduling and eviction but do not change the Quality of Service during memory pressure.

Correct answer: A. Define an Egress NetworkPolicy with two rules: one targeting pods with the db-prod label on port 5432, and another allowing port 53 for DNS.

An egress NetworkPolicy isolates outbound traffic by strictly defining allowed destinations, implicitly denying everything else. Option B fails because it configures ingress on the database rather than restricting the source pod's outbound connections.

Correct answer: A. Set the service port to 443 and the targetPort to 8443 within the Service spec ports array

Mapping the service port to 443 and the targetPort to 8443 handles the translation between the exposed cluster port and the container port. Option C is wrong because the container port must match where the application is actually listening.

Correct answer: D. Define a RollingUpdate strategy where maxUnavailable is set to 2 and maxSurge is set to 2 to meet both capacity and resource constraints.

Setting maxUnavailable to 2 ensures at least 8 replicas stay available, and maxSurge to 2 limits the maximum total pods to 12. Option A violates the resource constraint by allowing up to 13 total pods during the rollout.

Correct answer: B. Define an initContainer that runs the verification script and shares a volume with the main application container.

An init container runs to completion before the main application container starts, blocking startup if validation fails. Option D is incorrect because a postStart hook executes concurrently with the main process, failing to prevent startup.

Correct answer: A. Create a ResourceQuota object in the research-lab namespace defining hard limits for requests.cpu and requests.memory

A ResourceQuota sets hard limits on total aggregate resource consumption across all pods within a namespace. Option C fails because LimitRange objects enforce constraints on individual containers rather than namespace-wide totals.

Correct answer: C. Set readOnlyRootFilesystem: true in the SecurityContext and mount an EmptyDir volume at /var/log/app.

Setting readOnlyRootFilesystem to true ensures immutability, while mounting an EmptyDir at the specific log path provides required writable storage. Option B is invalid because Pod Security Policies were removed in modern Kubernetes versions.

Correct answer: B. Define a Liveness Probe using an exec command that pings the Unix socket and set failureThreshold to 3.

A liveness probe using an exec handler runs custom commands like a Unix socket ping to restart deadlocked containers. Option C fails because httpGet handlers do not support local Unix socket paths in Kubernetes.

Correct answer: A. Service type NodePort with a specific nodePort value defined in the ports section

A NodePort service exposes the application on a static port across all cluster nodes, making it ideal for environments without cloud load balancers. Option D is invalid because the LoadBalancer type requires external cloud integration.

Correct answer: D. An Ingress resource with a single host 'api.example.com' containing multiple paths, each mapping to its respective service and port

A single Ingress host can define multiple paths to efficiently route HTTP traffic to different backend services. Option C is incorrect because consolidating paths into one resource is the standard method for path-based routing.

Correct answer: D. Create a ConfigMap from the properties file and use the envFrom field in the container specification to load all values.

The envFrom field automatically populates environment variables from an entire ConfigMap, streamlining bulk configurations. Option A is less efficient because it requires mapping individual keys using configMapKeyRef.

Correct answer: B. Set the fsGroup field to 2000 within the pod-level securityContext to manage volume permissions

Setting fsGroup to 2000 in the pod securityContext chowns mounted volume files so the non-root user can write. Avoid runAsUser 0, which violates the non-root requirement and defeats the security purpose.

Correct answer: C. Mount the ConfigMap as a volume in the Pod specification so that the kubelet automatically updates the projected files when the ConfigMap changes.

Mounting the ConfigMap as a volume lets the kubelet automatically update the projected files so the application can detect changes. Environment variables are only set at startup, so envFrom fails the dynamic reload requirement.

Correct answer: C. Implement a Startup probe that disables Liveness and Readiness checks until the container has successfully passed its initial boot sequence.

A Startup probe suspends Liveness and Readiness checks until it succeeds, protecting slow booting containers from restarts. While increasing the Liveness delay works, it risks false restarts if the container crashes before the delay expires.

Correct answer: C. Implement a readinessProbe with an httpGet check on the /health path to ensure the pod is only added to the service endpoints when ready.

A readinessProbe with an httpGet on the /health path keeps the Pod out of Service endpoints until it passes. The Liveness probe only controls restarts and cannot prevent traffic from routing to the uninitialized Pod.

Correct answer: D. Modify both Deployments to use identical labels for the 'app' key while ensuring the Service selector targets that specific 'app' label.

Using a common app label across both Deployments allows the Service to balance traffic evenly across all matching Pods proportionally. The traffic imbalance indicates the v2 Pods likely have a different or missing label included in the selector.

Correct answer: B. Create a NetworkPolicy in the 'backend' namespace with an ingress rule selecting the 'web' namespace and pods with the label 'app: frontend'.

Applying a NetworkPolicy in the backend namespace with both pod and namespace selectors restricts ingress strictly to frontend Pods. The policy must target the destination namespace to effectively control incoming traffic from the web namespace.

Correct answer: D. Create a Role that allows the list verb on pods, and create a RoleBinding to associate this Role with a new ServiceAccount used by the Pod.

Creating a dedicated ServiceAccount bound to a namespace scoped Role restricts access strictly to listing pods. Modifying the default ServiceAccount with broad ClusterRoleBindings violates least privilege and expands the attack surface unnecessarily.

Correct answer: A. Create an Ingress resource with two paths defined under a single host, each pointing to their respective backend services.

An Ingress resource provides Layer 7 routing, mapping distinct URL paths to separate ClusterIP services behind one IP. LoadBalancer and NodePort services operate at Layer 4 and cannot route traffic based on the URL path natively.

Correct answer: C. Create an Egress policy with a single rule allowing traffic to the specific ipBlock of 192.168.1.50/32 and no other rules

An egress policy with a single allow rule for a specific IP block implicitly denies all other outbound traffic. Do not confuse this with an ExternalName service, which handles internal routing to an external name without restricting pod egress.

Correct answer: B. Set the backoffLimit field to 4 in the Job specification to allow for a maximum of 5 attempts including the first run

The backoff limit defines the number of retries before a job is marked as failed. A value of 4 allows 1 original run plus 4 retries, totaling 5 attempts, whereas the completions field dictates successful finishes.

Correct answer: B. Set maxUnavailable to 20% and maxSurge to 20% within the rollingUpdate strategy block

Setting maximum unavailable and maximum surge to 20% restricts unavailable replicas to 2 and surges to 2. This guarantees 8 replicas remain available while capping the total at 12 pods during the rollout.

Correct answer: B. Define a NetworkPolicy with an ingress rule that selects pods with the 'app: payment-api' label and specifies port 5432.

A NetworkPolicy isolates a selected pod by implicitly denying all ingress unless explicitly allowed. By specifying the payment API label and port 5432 in the ingress rule, only matching traffic is permitted.

Correct answer: B. Use podAntiAffinity with requiredDuringSchedulingIgnoredDuringExecution specifying the app label

Using required pod anti-affinity strictly prevents the scheduler from placing multiple pods with the same label on one node. Preferred anti-affinity acts only as a soft hint and will not strictly guarantee distribution.

Correct answer: C. Include an initContainer in the Pod specification that uses a busybox image to run a network check loop until the database port is open.

An init container runs to completion before the main application container starts, blocking startup until the database is reachable. Liveness and readiness probes manage running containers but do not delay initial startup.

Correct answer: C. Apply runAsUser: 1000, readOnlyRootFilesystem: true, and add the NET_BIND_SERVICE capability in the securityContext of the container.

Setting a non-root user and a read-only root filesystem meets baseline security requirements. Adding the NET_BIND_SERVICE capability explicitly permits the non-root process to bind to privileged ports like 443.

Correct answer: A. Set the path to '/static' with a pathType of 'Prefix' for the assets-service.

Prefix path type matching routes any request that begins with the defined path. Exact path type would require a perfectly matching URL, and ImplementationSpecific relies on custom controller logic.

Correct answer: B. Utilize the 'subPath' property within the 'volumeMounts' section to map the specific key from the ConfigMap to the exact file path.

Using the subPath property mounts a single file from a volume without obscuring existing files in the target directory. A standard volume mount would hide the original directory contents.

Correct answer: B. Configure both memory and CPU requests and limits to the exact same values for every container within the pod specification.

Assigning identical CPU and memory requests and limits to every container grants the Guaranteed Quality of Service class. This provides the highest protection against eviction, while a PriorityClass only affects scheduling.

Correct answer: D. Define a single Ingress with a 'tls' section referencing the secret and 'rules' containing multiple paths under the same host.

Defining a single Ingress with a tls section and multiple path rules correctly handles routing and HTTPS termination. Creating separate Ingress resources for the same host often causes controller conflicts, making a single resource the required approach.

Correct answer: A. Configure an Ambassador container that acts as a local proxy, allowing the legacy app to send logs to localhost while the proxy handles authentication.

The Ambassador container pattern acts as a local proxy, handling complex external authentication so the main app connects only to localhost. A standard sidecar simply extends functionality, whereas an Ambassador specifically brokers outside connections.

Correct answer: A. Provision a PersistentVolume (PV) and a PersistentVolumeClaim (PVC) with ReadWriteMany access mode to mount the volume into all pods.

PersistentVolumes and PersistentVolumeClaims provide storage with a lifecycle independent of pods, and ReadWriteMany access allows concurrent mounting. The hostPath and emptyDir options fail the persistence requirement when nodes or pods are recycled.

Correct answer: D. Define an Init Container in the Pod spec to run the specialized tool and write the schema to a shared EmptyDir volume.

Init containers run sequentially and must complete successfully before the main application containers start. Using a postStart hook runs concurrently with the main container, creating a race condition, whereas an init container guarantees the dependency is met.

Correct answer: C. Use an emptyDir volume mounted at /var/log in both the application and the sidecar containers

An emptyDir volume provides a temporary shared disk that both containers in the same Pod can mount to read and write files. A persistent volume is unnecessary for temporary logs, and sharing the process namespace is less clean.

Correct answer: D. Set completions to 50 and parallelism to 5 in the Job's spec section

The completions field defines the total successful pod finishes required, while parallelism controls the active pods at once. Replicas are used for Deployments, not run-to-completion batch Jobs.

Correct answer: B. Create a ResourceQuota to limit total namespace usage and a LimitRange to provide default requests and limits for individual containers.

A ResourceQuota caps the total aggregate resources consumed within a namespace, while a LimitRange applies default bounds to individual containers. PriorityClasses only handle eviction order during node pressure and do not restrict total namespace limits.

Correct answer: A. Add a securityContext block with runAsUser set to 1001 and allowPrivilegeEscalation set to false

The securityContext block directly enforces runtime constraints, letting you set the user ID and disable privilege escalation. Rebuilding the image fails because Kubernetes configurations must override image defaults to guarantee the security policy at runtime.

Correct answer: D. Set fsGroup: 2000 in the Pod securityContext to change the ownership of the mounted volume to a specific group.

Setting fsGroup in the pod securityContext instructs Kubernetes to modify the mounted volume ownership, granting access to the specified group. Using privileged mode or root introduces severe security risks and violates standard container hardening practices.

Correct answer: D. An Ingress resource with path-based rules for /orders and /catalog, and a defaultBackend set to 'identity-svc'.

An Ingress resource manages Layer 7 routing, letting you map specific URL paths to different backend services. The defaultBackend property catches any traffic that does not match your explicit path rules, solving the fallback requirement perfectly.

Correct answer: A. Update the labels of the web-canary pods to match the selector defined in the web-service and ensure the pod labels are identical to web-prod.

Matching pod labels to the existing service selector naturally balances traffic proportionally based on pod count. The Ingress option requires modifying routing rules and creating separate services, which violates the stated restriction.

Correct answer: A. An Egress policy with an empty podSelector and an allow rule for the specific IP block and port

A NetworkPolicy is additive, so defining an egress rule for the specific IP and port implicitly blocks all other outbound traffic. NetworkPolicy does not support explicit deny rules, making the sequential rule option invalid.

Correct answer: B. Use the subPath property within the volumeMounts section to mount only the specific key from the ConfigMap to the desired file path.

The subPath property mounts a single file from a volume without masking the existing files in the target directory. Standard volume mounts always overlay the entire directory, which is why your runtime files disappear.

Correct answer: D. Set the legacy agent to send traffic to localhost on port 443 where the sidecar container is listening and encrypting

Containers in the same pod share a network namespace, so routing localhost traffic to the proxy port works seamlessly. This intercepts the payload locally, allowing the sidecar to encrypt the outbound traffic.

Correct answer: D. Use a single Ingress resource with a host 'app.example.com' and a list of paths under the 'http' section, each mapping to its respective service.

A single Ingress resource efficiently handles multiple paths for a single host by mapping each path to a specific backend. Creating multiple Ingress resources for the same host often causes controller conflicts and unnecessary routing complexity.

Correct answer: C. Create a Role with 'list' permissions for 'pods', a ServiceAccount for the worker, and a RoleBinding to link them.

Creating a dedicated ServiceAccount bound to a namespace Role via a RoleBinding grants strictly scoped API access. Assigning cluster-admin grants excessive permissions, violating security best practices and creating dangerous cluster-wide risks.

Correct answer: C. Define a securityContext with runAsUser 1001, allowPrivilegeEscalation set to false, and readOnlyRootFilesystem set to true

The securityContext configures runtime security at the pod or container level, directly enforcing the required user ID, blocking privilege escalation, and mounting the root filesystem as read-only. PodSecurityPolicy was removed and is no longer valid.

Correct answer: D. Configure 'backoffLimit: 4' in the Job specification to allow for 4 retries (total of 5 attempts) before the Job is considered failed.

The backoffLimit specifies the number of retries before a Job fails. Setting it to 4 allows the initial attempt plus four retries, resulting in exactly five total attempts. The activeDeadlineSeconds limits duration, not attempt counts.

Correct answer: A. Set completions: 100, parallelism: 10, and backoffLimit: 5.

The completions, parallelism, and backoffLimit fields directly map to total chunks, simultaneous workers, and failure retries. Other options confuse these parameters or introduce unrelated concepts like CronJobs and active deadlines.

Correct answer: A. Add a Toleration for the security taint and implement a nodeAffinity rule with a requiredDuringSchedulingIgnoredDuringExecution constraint.

Tolerations allow pods to be scheduled on tainted nodes, while nodeAffinity enforces placement based on specific hardware labels. This combination ensures strict targeting compared to the more basic nodeSelector.

Correct answer: D. Specify a strategy with maxSurge set to 2 and maxUnavailable set to 1 in the RollingUpdate configuration block

MaxSurge controls how many pods exceed the desired count, so two allows exactly twelve. MaxUnavailable dictates the drop ceiling, so one keeps nine pods available. Other percentages or values violate the stated resource constraints.

Correct answer: C. Create a Headless Service by setting the clusterIP field to None in the Service specification.

A Headless Service, created by setting clusterIP to None, skips assigning a virtual IP. DNS returns individual Pod IPs instead, enabling direct peer discovery required for StatefulSet databases. Standard Services blindly load-balance traffic.

Correct answer: B. Utilizing an ambassador container that acts as a local proxy to handle complex communication with the external legacy system

The ambassador pattern is specifically designed to provide a local proxy for the main container to reach external services. This abstracts the complexity of mutual TLS and proprietary encryption away from the primary application code.

Correct answer: D. Use a single rule with the host 'api.example.com' and a list of two paths under the 'http' section, each pointing to their respective service.

An Ingress rule for a specific host can contain multiple paths under the paths section. Each path specifies a path type and a backend, which is the standard for path-based routing.

Correct answer: A. Apply a NetworkPolicy that selects the payment-service pods and defines an ingress rule allowing only pods with the label 'app=frontend'.

Network policies act as a firewall for pods. By creating a policy that selects the payment service and only allows traffic from pods labeled app=frontend, all other internal traffic is implicitly denied.

Correct answer: A. Update the selector in the Service manifest to match the labels of the green deployment

Changing the service selector is the standard way to perform a blue-green switch in Kubernetes. Traffic is immediately routed to the new pods without changing the service IP.

Correct answer: A. Store the API key in a Secret and mount it as a volume, and use a CSI driver (like HashiCorp Vault) to mount the session token as an in-memory volume.

Secrets are intended for sensitive data and are backed by temporary storage in modern Kubernetes. Using a specialized driver for the rapidly rotating token ensures it is fetched directly from the vault and never touches the disk.

Correct answer: D. Set maxUnavailable to 2 and maxSurge to 2 in the strategy section.

Setting max unavailable to 2 ensures at least 8 pods are running, meeting the 80% availability requirement. Setting max surge to 2 allows up to 12 pods total, perfectly matching the resource constraints.

Correct answer: C. Set maxSurge to 3 and maxUnavailable to 0 in the deployment's rollingUpdate strategy section.

Setting max unavailable to 0 ensures that the current number of available pods never drops below the desired count. Setting max surge to 3 allows the deployment to start 3 new pods before stopping old ones.

Correct answer: A. Define an emptyDir volume and mount it at /mnt/data/logs in both the app and sidecar containers

An empty directory volume is created when a pod is assigned to a node and exists as long as that pod is running. It is the standard way for containers in a pod to share files locally without persisting data.

Correct answer: C. Use a nodeSelector in the Pod specification with the key-value pair storage-type: nvme to force the scheduler to select these specific nodes.

A node selector is the simplest and most effective way to constrain pods to nodes with particular labels. It ensures the data cruncher only lands on NVMe nodes without blocking other pods.

Correct answer: B. Define an Ingress NetworkPolicy for the backend-db pods with a podSelector matching 'app: api-gateway' and a specified port of 5432.

An ingress NetworkPolicy applied to the backend-db pods whitelists specific traffic sources. By defining a podSelector matching the api-gateway and restricting the port, you automatically block all non-matching traffic from other pods or namespaces.

Correct answer: D. A ResourceQuota object that specifies hard limits for requests.cpu and requests.memory at the namespace level

A ResourceQuota successfully restricts aggregate resource consumption per namespace. LimitRange is the strongest distractor, but it sets default bounds for individual containers rather than capping total usage.

Correct answer: A. Mount the ConfigMap as a volume at the specified mountPath within the container specification

Mounting a ConfigMap as a volume correctly projects files into the container and automatically updates them. Environment variables are the strongest distractor, but they require a pod restart to reflect updates.

Correct answer: A. Configure a livenessProbe using the exec field to run the /app/check_redis.py script within the container

A liveness probe correctly detects broken states and triggers automatic container restarts. A readiness probe is the strongest distractor, but it only removes traffic without restarting.

Correct answer: A. Configure an Ambassador container in the Pod to act as a local proxy for outgoing traffic and handle the encryption logic.

The Ambassador pattern correctly acts as a local proxy to handle outgoing traffic encryption. An initContainer is the strongest distractor, but it only runs before startup, not alongside.

Correct answer: A. Implement an Adapter container within the same Pod that reads from the Unix socket and exposes a web endpoint with Prometheus metrics.

The Adapter pattern successfully translates non-standard outputs into a format external systems expect. A generic sidecar is the strongest distractor, but it lacks the specific translation role.

Correct answer: A. Set memory requests to 512Mi and memory limits to 1Gi.

Setting memory requests lower than limits allows bursting while maintaining a hard cap. Removing limits is the strongest distractor, but it risks node instability without bounds.

Correct answer: A. Define a RollingUpdate strategy where maxUnavailable is 2 and maxSurge is 30%.

Setting maxUnavailable to 2 keeps eight pods available, satisfying the 80 percent minimum. Setting maxSurge to 30 percent allows up to 13 pods total, preventing the exact 3-pod limit from being misunderstood as an absolute cap.

Correct answer: A. Set the field automountServiceAccountToken to false at the Pod level specification.

Setting automountServiceAccountToken to false at the Pod level cleanly prevents the default API credentials from being mounted. Overwriting the path with an emptyDir is a hacky workaround that fails to follow Kubernetes security best practices.

Correct answer: A. Define the migration container within the initContainers section of the Pod specification to ensure it completes successfully before the app container starts.

Init containers run to completion before app containers start, guaranteeing the migration finishes first. If it fails, the pod aborts, which prevents data corruption. Liveness probes or sidecars do not gate startup in this strict sequence.

Correct answer: B. Store the file content in a ConfigMap and mount it as a volume at /etc/config/ in the Pod specification.

ConfigMaps handle non-sensitive configuration data and bypass the 1MB limit typical of environment variables. When mounted as a volume, Kubernetes automatically updates the files without requiring a full pod restart, perfectly meeting all requirements.

Correct answer: A. Deploy a Sidecar container using the Adapter pattern to transform proprietary logs into JSON before they are sent to the logging agent.

The sidecar adapter pattern modifies or filters data from a shared volume without altering the main application. An init container runs only before startup, so it cannot continuously convert real-time logs during the application lifecycle.

Correct answer: D. An Egress policy with a single rule containing an ipBlock that specifies 203.0.113.50/32.

An Egress policy restricts outbound traffic and acts as a whitelist. By specifying only the target ipBlock, all other traffic is implicitly denied. Ingress policies control incoming traffic, not outbound connections.