Certified Kubernetes Application Developer (CKAD)

Correct answer: C. An emptyDir volume with the medium set to Memory for high-speed access

An emptyDir volume with the medium set to Memory provides high-speed, RAM-backed ephemeral storage that is shared between containers in the same Pod. On the exam, remember that emptyDir volumes are erased when the Pod is removed from the node.

Correct answer: B. Update the deployment strategy to Recreate to ensure the old Pod is terminated before the new one starts

The Recreate deployment strategy terminates all existing Pods before starting new ones, ensuring no overlap occurs during updates. RollingUpdate cannot achieve this because it inherently requires surging or tearing down Pods concurrently.

Correct answer: D. Add a startupProbe to the container that monitors the application's health and disables the livenessProbe until the startup is complete.

A startupProbe runs first and disables other probes until it succeeds, making it perfect for slow initializations. Increasing the liveness probe delay is a weaker solution because it delays detecting deadlocks later in the application lifecycle.

Correct answer: C. Adjust the container memory limit to be higher than the Java Heap Size, for example setting the limit to 2Gi.

An OOMKilled status means the container exceeded its Kubernetes memory limit, so you must increase the container limit above the JVM heap size. Reducing memory requests only changes scheduling and does not prevent the container from being killed.

Correct answer: B. Use the fsGroup field in the Pod's securityContext to specify the group ID 2000 for all volumes in the Pod.

Using the fsGroup field in the Pod security context ensures Kubernetes automatically adjusts the mounted volume ownership for the specified group. This allows non-root users to write to the directory without requiring insecure privileged access.

Correct answer: A. Set the backoffLimit field in the Job spec to 4, which determines the number of retries before the Job is considered failed.

The backoffLimit field defines the exact number of retries the Job controller will attempt before marking the Job as failed. The parallelism field only controls the number of Pods running simultaneously, not failure retries.

Correct answer: C. The Ambassador pattern, where a sidecar container acts as a specialized proxy for external communication

The Ambassador pattern acts as a dedicated proxy inside the Pod, abstracting complex external routing away from the main application. The Adapter pattern is incorrect because it transforms output data rather than routing traffic.

Correct answer: D. Define an emptyDir volume in the Pod spec and mount it at /var/log/app in both the app-container and the sidecar-log-shipper.

An emptyDir volume is explicitly designed for sharing ephemeral data between containers within the same Pod, automatically deleting its contents when the Pod is removed. On the exam, look for the keywords ephemeral and shared between containers to immediately identify emptyDir over PersistentVolumeClaims.

Correct answer: B. Define an Ingress with a tls section specifying the host and the secretName, and a rule for host portal.example.org with the path /dashboard

An Ingress resource uses a dedicated tls block to bind a Kubernetes Secret for TLS termination, while rules route specific host and path combinations to backend services. NodePort or Service annotations do not handle layer seven path-based routing or native TLS termination.

Correct answer: C. Create a custom ServiceAccount, a Role granting access only to ConfigMaps, and a RoleBinding to associate them with the Pod

You grant specific API permissions to a Pod by binding a custom ServiceAccount to a properly scoped Role using a RoleBinding. Using the default ServiceAccount with cluster-admin or hardcoding tokens violates the principle of least privilege and fails security best practices.

Correct answer: D. Set completionMode to Indexed and specify a completions value of 50 with a parallelism of 5.

Indexed Jobs provide each Pod with a unique completion index via the JOB_COMPLETION_INDEX environment variable, allowing parallel workers to partition workloads without external coordination. Using standard Jobs or Deployments requires custom scripts or external state tracking to assign work.

Correct answer: B. Create a Headless Service by setting 'clusterIP: None' in the Service specification and ensuring the selector matches the StatefulSet pods.

A Headless Service, created by setting clusterIP to None, returns the individual Pod IP addresses via DNS instead of a single virtual IP. This behavior is essential for StatefulSet peer discovery, whereas standard Services only provide load-balanced virtual IPs.

Correct answer: A. Configure the livenessProbe with the grpc field, specifying the port as 50051 and leaving the service field empty or as a specific string.

For clusters running v1.24 or later, you configure a native gRPC probe by specifying the grpc field and the appropriate port directly in the probe definition. The older exec method using the sidecar binary is no longer necessary and adds unnecessary operational overhead.

Correct answer: B. Define an emptyDir volume in the Pod spec and mount it at the required paths in both containers

An emptyDir volume is explicitly designed for sharing ephemeral data between containers within the same Pod, automatically deleting its contents when the Pod is removed. ConfigMaps or PersistentVolumeClaims are incorrect because they persist data beyond the Pod lifecycle.

Correct answer: B. Add a toleration to the Pod spec with the key 'hardware', operator 'Equal', value 'specialized', and effect 'NoSchedule'.

Tolerations are applied to Pods to allow them to be scheduled onto tainted nodes matching the specified key, value, and effect. Node affinity and selectors attract Pods to nodes but do not override taints that explicitly repel workloads with NoSchedule.

Correct answer: A. An ingress rule using an ipBlock with cidr: 10.50.0.0/16 and an except: [10.50.10.25/32] field

The ipBlock field in a NetworkPolicy allows you to define a broad CIDR range while using the except field to exclude specific IP addresses or subnets. Kubernetes NetworkPolicies are additive and do not support priorities, so separate deny rules will not work.

Correct answer: C. Define the fsGroup: 5000 setting within the Pod-level securityContext to ensure Kubernetes changes the ownership and permissions of the volume to the specified group.

Setting fsGroup in the Pod securityContext ensures Kubernetes recursively changes the mounted volume ownership to the specified group identifier. This allows non-root containers to write to attached storage, avoiding the need for insecure privileged init containers.

Correct answer: D. The namespace has a ResourceQuota enabled, and because the Pod does not define resource requests/limits, it is being rejected by the admission controller.

A ResourceQuota tracking CPU and memory forces every Pod to define those values before admission. Remember that LimitRanges set default requests, whereas ResourceQuotas hard-block any Pod missing them.

Correct answer: D. Set the 'immutable' field to true in the ConfigMap metadata to stop the Kubelet from watching for updates

Setting the immutable field to true disables kubelet polling, dropping unnecessary API server load. Secrets and ConfigMaps behave identically here, so swapping object types won't help.

Correct answer: A. Define an Ingress rule with a podSelector for 'role: backend' and a namespaceSelector that matches the 'app' namespace label

Combining namespaceSelector and podSelector within a single ingress rule creates the required logical AND condition. Using CIDR ranges is brittle because Pod IPs are ephemeral and dynamic.

Correct answer: D. Add an InitContainer with a script that uses nc or a similar tool to loop until port 5432 is open

Init containers run sequentially and must complete before the main app starts. Probes only act after startup, so they cannot delay the initial container boot process.

Correct answer: D. Add an Adapter container to the Pod that reads the binary log file, converts it to JSON, and writes it to its own stdout.

The Adapter pattern transforms the primary application output into a standardized format like JSON. A standard sidecar merely tails logs without modifying their underlying format.

Correct answer: C. Use the Prefix pathType for the paths '/api/v1' and '/api/v2' to match based on the URL path components.

The Prefix pathType separates URL elements by slashes, preventing accidental matches. Exact matching would block legitimate sub-paths, breaking standard API endpoint routing.

Correct answer: B. Set completions to 100, parallelism to 5, and backoffLimit to 4 in the Job specification template.

Setting parallelism and completions distributes the workload while backoffLimit halts execution after failures. Use the backoffLimit instead of activeDeadlineSeconds to stop based on error counts.

Correct answer: D. Set allowPrivilegeEscalation to false and readOnlyRootFilesystem to true in the container securityContext

Setting allowPrivilegeEscalation to false blocks setuid exploits while a read-only root filesystem protects the base image. PodSecurityPolicies were removed in version 1.25, making them an invalid distractor.

Correct answer: B. The Ambassador pattern, implemented by adding a second container to the Pod that handles the signing logic and listens on localhost

The Ambassador pattern acts as an outbound proxy managing complex connections to external services. Unlike an Adapter, it brokers outbound traffic rather than normalizing application output.

Correct answer: C. Add a preStop hook that executes the cleanup command and set the terminationGracePeriodSeconds for the Pod to a value like 60.

The preStop hook executes cleanup logic before the SIGTERM signal reaches the container. Pairing it with a longer terminationGracePeriodSeconds ensures the pod avoids a premature SIGKILL. PostStart hooks run immediately at startup, making them useless for termination.

Correct answer: D. Apply a Taint to the NVMe nodes and add a matching Toleration and NodeAffinity to the database Pods

The correct answer applies a Taint to repel standard workloads while using Toleration and NodeAffinity to specifically attract the database Pods. NodeSelector alone cannot repel unwanted pods from the NVMe nodes.

Correct answer: A. Set the Job completionMode to Indexed and access the JOB_COMPLETION_INDEX environment variable inside the container

The correct answer uses an indexed completion mode to automatically expose the job completion index. This is the native Kubernetes feature for parallel processing, preventing the need for complex API queries to identify partitions.

Correct answer: C. A Service of type ExternalName with the externalName field set to db-cluster-xyz.provider.com and the metadata name db.internal.production

The correct answer creates an ExternalName Service. This acts as a CNAME record in cluster DNS, seamlessly redirecting the hardcoded internal hostname to the external cloud database without requiring application changes.

Correct answer: C. Create a Kubernetes Secret of type kubernetes.io/tls and reference it in the 'tls' section of the Ingress resource manifest.

Creating a Secret of type kubernetes.io/tls and referencing it in the Ingress spec correctly terminates TLS at the controller. Avoid base64 encoding certificates directly in annotations, as standard manifests use the tls block.

Correct answer: A. An exec probe that runs the command 'test -f /var/lib/db/active.lock' to check for the existence of the file.

An exec probe runs a command directly inside the container, making it perfect for checking file existence. Using tcpSocket would only check if the port is open, which fails to verify if the underlying process is actually healthy or hung.

Correct answer: B. Add a securityContext to the container with seccompProfile set to type 'Localhost' and localhostProfile set to 'audit-policy.json'.

Setting the seccompProfile to Localhost with the specific profile name applies the custom security profile at the container level. The annotation-based method is completely deprecated and replaced by the modern securityContext fields.

Correct answer: A. Configure allowPrivilegeEscalation to false and set readOnlyRootFilesystem to true, while providing an EmptyDir volume for the /tmp directory.

Setting readOnlyRootFilesystem to true blocks writes across the entire container, while mounting an emptyDir to /tmp explicitly allows necessary temporary logging. Disabling privilege escalation ensures compromised processes cannot gain root.

Correct answer: B. Deploy the application as a StatefulSet and create a Headless Service by setting 'clusterIP: None' in the Service spec.

A StatefulSet paired with a Headless Service provides stable pod identities like data-node-0, returning individual pod IPs via DNS. Standard ClusterIP Services load balance across pods, destroying direct pod-to-pod routing required for clustered stateful apps.

Correct answer: C. Deploy an ambassador container in the same Pod that listens on localhost:5432 and proxies traffic to the external database's address.

An ambassador container runs in the same pod network namespace, allowing it to listen on localhost and proxy traffic to the external database. Kubernetes Services and HostAliases cannot bind external traffic to the localhost loopback address.

Correct answer: B. Define a securityContext at the container level and add 'NET_ADMIN' and 'NET_RAW' to the capabilities list.

Adding specific capabilities like NET_ADMIN and NET_RAW via the container securityContext follows the principle of least privilege. Enabling privileged mode grants excessive unwanted root access, while PodSecurityPolicies are deprecated and removed.

Correct answer: B. Modify the selector in the 'frontend-svc' Service definition to match the labels of the 'app-green' Pods

Modifying the Service selector immediately shifts traffic to the new deployment pods based on their updated labels. Deleting the old deployment causes unintended downtime, violating the instantaneous traffic shift requirement of a blue-green deployment.

Correct answer: D. Configure a Readiness probe to detect the latency and fail when the app is slow, while keeping the Liveness probe configured to check only the basic process existence.

A failing Readiness probe removes the pod from Service endpoints, stopping traffic during latency spikes without restarting it. A Liveness probe failure triggers a restart, which would corrupt the ongoing background data migration and cause data loss.

Correct answer: C. Configure a startupProbe with a sufficient failureThreshold and periodSeconds to cover the initialization period.

A startupProbe disables liveness and readiness checks until it succeeds, protecting slow-starting applications from premature termination. Using initialDelaySeconds forces you to guess maximum startup times, leaving the application unprotected if it hangs later.

Correct answer: D. Add the annotation nginx.ingress.kubernetes.io/affinity set to cookie and specify the cookie name using the session-cookie-name annotation.

NGINX Ingress controllers handle sticky sessions via specific annotations rather than standard Kubernetes object fields. Do not choose the native serviceAffinity option, as that applies strictly to Layer 4 Service routing, not Layer 7 Ingress configurations.

Correct answer: C. Omit both the requests and limits fields in the container specification to categorize the Pod into the BestEffort Quality of Service class.

Omitting requests and limits assigns the BestEffort QoS class, making these pods the first evicted during node memory pressure. Avoid the Burstable option, as setting explicit limits restricts the pod from utilizing spare memory.

Correct answer: C. Use 'kubectl debug' to create an ephemeral container inside the existing Pod that shares the same network and process namespaces

The kubectl debug command injects an ephemeral container into a running pod to share its namespaces for troubleshooting. You cannot kubectl exec into a distroless image lacking a shell, nor can you modify a running pod's containers.

Correct answer: B. Configure the fsGroup field within the Pod-level SecurityContext to manage volume ownership

Setting the fsGroup field in the pod-level security context automatically adjusts mounted volume ownership for the specified group. Simply using runAsUser changes the executing user but does not fix the underlying volume ownership problem.

Correct answer: D. Define a single Ingress resource with multiple paths under the same host rule, each pointing to its respective service

A single Ingress resource can route traffic to different backend services based on multiple URL path definitions. Avoid creating separate Ingress objects for this, as combining them under one host rule cleanly manages path-based routing.

Correct answer: B. Configure an HTTP Liveness Probe that targets a specific /health endpoint returning a 200 OK status

An HTTP liveness probe validates actual application health by checking a dedicated endpoint. TCP probes are inadequate here because the network socket remains open even when the application is frozen and cannot process traffic.

Correct answer: D. The Ambassador pattern where a proxy container manages and simplifies the connection between the application and external services.

The Ambassador pattern acts as a local proxy to shield the main application from complex external networking duties. The Sidecar pattern is the strongest distractor, but it focuses on local enhancements rather than proxying external traffic.

Correct answer: B. Apply a common label like 'app: search-engine' to both Deployments, then set version 1 to 3 replicas and version 2 to 1 replica, and point the Service selector to 'app: search-engine'.

A Service load balances randomly across all matching Pods, so matching four total Pods sends roughly twenty five percent of traffic to the single version two Pod. Option D fails because it requires a specific Ingress controller.

Correct answer: A. Add a ReadinessProbe that performs an HTTP GET request to a specific /health/ready endpoint in the application.

A ReadinessProbe controls when a Pod joins a Service endpoint list to receive traffic. The LivenessProbe distractor fails because it only restarts unhealthy containers and does not manage traffic routing.

Correct answer: A. Change the deployment strategy type to Recreate to ensure all existing Pods are terminated before any new Pods are created.

The Recreate strategy ensures old Pods terminate before new ones start, preventing attachment conflicts with ReadWriteOnce volumes. The RollingUpdate option fails because it still attempts to create new Pods before old ones fully terminate.

Correct answer: D. Configure the startingDeadlineSeconds field in the CronJob spec to 1800 to limit the allowed delay.

Setting startingDeadlineSeconds limits how late a Job can start before being skipped entirely. The activeDeadlineSeconds distractor fails because it limits the execution duration of a running Job rather than its start delay.

Correct answer: D. A PersistentVolumeClaim with the accessModes set to ReadWriteMany.

The ReadWriteMany access mode is required to mount a volume as read-write across multiple nodes simultaneously. The ReadWriteOnce distractor fails because it strictly restricts write access to a single node.

Correct answer: B. Set maxUnavailable: 2 and maxSurge: 3 in the rollingUpdate strategy.

Using a maxUnavailable of 2 ensures 8 replicas stay available while a maxSurge of 3 strictly limits the total to 13 Pods. Option C fails because percentages round up, exceeding the specified hard limits.

Correct answer: C. Set the securityContext.fsGroup field to 2000 in the Pod specification to allow Kubernetes to change the volume ownership.

Setting the fsGroup in the Pod securityContext automatically adjusts the mounted volume ownership to match the application. The initContainer distractor fails because running it as root violates strict security boundaries.

Correct answer: A. Use topologySpreadConstraints with a maxSkew of 1, topologyKey set to kubernetes.io/hostname, and whenUnsatisfiable set to DoNotSchedule.

The correct answer uses topology spread constraints with a maxSkew of one. Pod anti-affinity cannot guarantee even distribution and might block scheduling, while maxSkew explicitly limits the pod count difference across your topology domains.

Correct answer: A. Configure the 'securityContext' at the container level and set the 'seccompProfile' type to 'Localhost' with the 'localhostProfile' set to 'audit.json'

The correct answer configures the security context and sets the seccomp profile type to Localhost. The annotation method is deprecated and no longer valid in modern Kubernetes, so always use the security context for seccomp.

Correct answer: B. Mount the entire Secret as a volume and ensure the application reads the data from the projected symlinks created by Kubernetes in the mount path.

The correct answer mounts the entire Secret as a volume to allow atomic updates via symlinks. Using subPath breaks this functionality because it creates a direct file mount, preventing the kubelet from injecting live updates.

Correct answer: A. Set the startingDeadlineSeconds field to 30 in the CronJob specification

The correct answer sets the starting deadline seconds to thirty. If the controller misses this window, it skips the execution, whereas concurrency policy only manages overlapping pods and does not enforce strict start times.

Correct answer: D. Add a 'tls' section under the Ingress spec, specifying 'portal.example.com' in the hosts list and 'portal-tls-secret' as the secretName.

Adding a tls section under the Ingress spec correctly references the Secret for TLS termination at the controller. Do not mount Secrets manually into the controller or use backend sections, as the spec.tls block handles certificates natively.

Correct answer: B. Configure a livenessProbe using the exec field to run a shell command that checks the modification time of the heartbeat file.

A liveness probe using the exec field correctly triggers the kubelet to restart the container based on internal file changes. TCP and HTTP probes lack arbitrary command execution, and readiness probes control traffic routing rather than restarts.

Correct answer: C. Deploy an Ambassador container in the same Pod that listens on 127.0.0.1:5432 and proxies traffic to the external database endpoint.

An ambassador container correctly proxies local loopback traffic to the external database without code changes. ExternalName services cannot bind to local IP addresses like 127.0.0.1, making sidecars the standard adapter pattern.

Correct answer: C. Define a NetworkPolicy with a podSelector matching 'backend-api' and an ingress rule allowing 'frontend-web' on port 9000.

Defining a NetworkPolicy that targets backend-api and allows ingress from frontend-web on port 9000 correctly isolates the pod. Empty selectors or egress rules fail to secure the target destination from unauthorized callers.

Correct answer: D. The Deployment will be accepted, but the third Pod will remain in Pending state because it exceeds the namespace's total CPU quota

The Deployment is accepted, but the third Pod stays Pending because the namespace ResourceQuota is exceeded. Quotas are checked during Pod admission by the API server, not by stripping sidecars or immediately rejecting the Deployment.

Correct answer: A. Implement a startupProbe with a failureThreshold and periodSeconds that cover the 180-second window before the livenessProbe takes over

A startupProbe correctly protects slow-starting applications from liveness checks killing them prematurely. Relying on initialDelaySeconds makes later deployments fragile if startup times vary, whereas startup probes adapt seamlessly.

Correct answer: C. Define an Egress policy with two rules: one with an ipBlock for 203.0.113.5 and another allowing UDP/TCP on port 53 to the kube-dns CIDR.

The correct answer works because an Egress NetworkPolicy explicitly permits traffic to the specified ipBlock and allows DNS resolution via port 53, while implicitly blocking all other outbound traffic. Remember that Kubernetes network policies are default-deny once applied, so you must explicitly allow DNS.

Correct answer: C. Mount the Secret as a volume in the Pod, as Kubernetes automatically updates the projected files when the Secret object changes

Mounting the Secret as a volume is correct because the kubelet automatically handles syncing and updating the mounted files whenever the underlying Secret object changes. Environment variables loaded from Secrets remain static after pod creation and do not support live updates without a manual restart.

Correct answer: B. Set the startingDeadlineSeconds field in the CronJob spec to 60 to limit the window for starting missed jobs.

Setting startingDeadlineSeconds to 60 is correct because it dictates the maximum deadline window for a CronJob to start after its scheduled time, skipping missed executions. The activeDeadlineSeconds field limits how long a started Job runs, not its creation delay window.

Correct answer: C. Use a projected volume with a serviceAccountToken source, specifying the target path, expirationSeconds, and audience

Using a projected volume with a serviceAccountToken source is correct because it safely injects short-lived, audience-bound tokens directly into the pod, handling rotation automatically. ConfigMaps store static data and lack native expiration handling, failing security requirements.

Correct answer: C. Deploy version 2.0 with a new selector and update the existing Service selector to point to the new version only after validation

Deploying version 2.0 with a new selector and updating the existing Service selector is correct because it instantly shifts all traffic to the new pods once validated. This allows an immediate rollback by simply reverting the Service selector if issues arise.

Correct answer: B. Define the '/api/v2' path with pathType: Exact and the '/api' path with pathType: Prefix in the Ingress rules

Using pathType: Exact for the specific route and pathType: Prefix for the broader route is correct because it prevents overlapping matches and ensures traffic routes predictably. Relying on physical YAML ordering or ImplementationSpecific behavior fails the consistency requirement.

Correct answer: D. Define an InitContainer with the necessary tools to download the assets into a shared volume accessible by the main container.

Defining an InitContainer is correct because it runs to completion and blocks the main container from starting until the shared assets are successfully downloaded. Sidecars run concurrently, risking an inconsistent application state if the required files are missing.

Correct answer: B. Implement an Ambassador container as a sidecar that runs a proxy like HAProxy or Nginx to forward localhost:5432 traffic to the external database endpoint.

An Ambassador container acts as a proxy, letting the legacy application connect to localhost while the sidecar forwards traffic to the external endpoint. Remember that init containers or modifying /etc/hosts cannot redirect localhost traffic dynamically.

Correct answer: D. Configure maxSurge to 2 and maxUnavailable to 1 in the rollingUpdate section of the Deployment strategy specification.

Setting maxSurge to 2 allows up to 12 pods during the rollout. Setting maxUnavailable to 1 ensures at least 9 pods remain available. Absolute integer values strictly enforce these operational limits.

Correct answer: A. Apply a NetworkPolicy with an Ingress rule that matches the podSelector with the label role: frontend.

A NetworkPolicy controls traffic flow at the pod level. By using a podSelector in the ingress rule, you specifically allow connections only from frontend pods. Services or Ingress cannot enforce this strict IP-level zero-trust security.

Correct answer: C. Implement a Readiness Probe that verifies the connectivity to the third-party provider and reports failure when the service is unreachable

A Readiness Probe controls traffic routing by removing the pod from Service endpoints when it fails. This isolates the application without restarting it. A Liveness Probe would incorrectly trigger a restart during external outages.

Correct answer: A. Set maxSurge to 0 and maxUnavailable to 1 to ensure a pod is deleted first, creating space for the new version.

Setting maxSurge to 0 prevents creating extra pods during the rollout. Setting maxUnavailable to 1 allows terminating one old pod first, freeing cluster resources for the replacement. This guarantees continuous availability under tight constraints.

Correct answer: D. Deploy a Service of type ExternalName with the externalName field set to the cloud database DNS string

A Service of type ExternalName creates a DNS alias by returning a CNAME record to an external domain. This transparently maps your internal service name to the cloud database. Manual endpoints require static IPs.

Correct answer: C. Define a single rule for the host with a list of paths, each specifying a pathType and a backend service with a service name and port.

An Ingress resource defines a host with multiple path entries. Each path maps a specific URI to a distinct backend service and port. Using separate resources risks routing conflicts depending on controller merging behavior.

Correct answer: D. Utilize topologySpreadConstraints in the Pod spec with the topologyKey set to topology.kubernetes.io/zone.

TopologySpreadConstraints automatically distribute pods across defined topology domains like availability zones. Setting the maxSkew ensures even balancing during scheduling. Node selectors require manual management and lack dynamic scaling.

Correct answer: C. Create a Service of type ExternalName with the externalName field set to the cloud database FQDN

A Service of type ExternalName creates a DNS alias by returning a CNAME record to the external database address. This lets internal pods resolve the local service name seamlessly. Other service types cannot handle dynamic external DNS.

Correct answer: B. Create two Ingress resources and set the service weights manually using the 'nginx.ingress.kubernetes.io/canary-weight' annotation set to '10'

The NGINX Ingress controller shifts traffic percentages when you add a second Ingress annotated with canary-weight. Standard Kubernetes Services do not support percentage-based routing natively.

Correct answer: B. Define a Kubernetes Service of type ClusterIP named db-inventory-legacy without a label selector and manually create an Endpoints resource with the same name that specifies the external database IP address and port.

A selectorless Service combined with manually created Endpoints correctly maps an internal DNS name to an external IP. This abstraction lets you update the database IP later without touching application code. ExternalName only handles DNS CNAMEs, not local port remapping.

Correct answer: B. Modify the Service resource to set the sessionAffinity field to ClientIP to ensure sticky sessions based on the source IP.

Setting sessionAffinity to ClientIP in the Service spec ensures requests from the same client route to the same backend pod, preserving in-memory session data. A Headless Service simply exposes pod IPs but does not enforce sticky routing like ClientIP affinity.

Correct answer: A. Define the 'content-builder' as an InitContainer and use a shared volume to pass the generated HTML files

InitContainers run sequentially to completion before app containers start, making them perfect for build steps. Shared volumes pass data between the builder and web server. The sidecar pattern starts containers concurrently, which fails the sequential execution requirement.

Correct answer: B. Configure the completions field to 500 and the parallelism field to 10 within the Job specification

The completions field defines the total successful pods needed, while parallelism dictates how many run at once. For the exam, remember that Deployments use replicas, while Jobs use parallelism and completions to manage batch workloads.

Correct answer: A. Utilize the subPath field within the volumeMounts section to mount only the specific key from the ConfigMap into the target file path.

The subPath field in volumeMounts lets you mount a single file without overwriting the destination directory. Avoid using InitContainers for this, as subPath declaratively solves the file masking issue directly within the pod manifest.

Correct answer: D. Set the fsGroup field in the Pod securityContext to the group ID associated with the application user to change volume ownership

Configuring the fsGroup in the pod security context automatically changes volume ownership to the specified group ID. This declaratively grants write access to non-root users, unlike InitContainers which require imperative permission tweaks.

Correct answer: C. Create a Job with the completions field set to 500 and the parallelism field set to 5 to process chunks in groups of five until done

The completions field sets the total successful pods required, while parallelism controls the concurrent workers. Remember that swapping these values would either overload the cluster or fail to achieve the desired concurrency.

Correct answer: C. Configure topologySpreadConstraints with a maxSkew of 1, topologyKey set to topology.kubernetes.io/zone, and whenUnsatisfiable set to ScheduleAnyway.

Using topologySpreadConstraints with a maxSkew of 1 and ScheduleAnyway fulfills both the distribution and priority requirements. Pod anti-affinity lacks the granular control needed to prioritize scheduling without strictly blocking the pods.

Correct answer: D. Configure memory limits to 512Mi in the container's resources section to trigger a restart upon exceeding the limit.

Setting memory limits forces the container to restart when it exceeds the specified threshold. The memory requests distractor fails because requests only handle scheduling and do not enforce hard restarts.

Correct answer: A. Create a NetworkPolicy targeting pods with 'app: internal-db' that includes an ingress rule allowing traffic from pods with 'app: api-server' on port 5432.

Targeting the database pods with an ingress rule restricting traffic to the api-server on port 5432 successfully isolates the workload. Egress policies only restrict outgoing traffic from the source pod, leaving the database open to other clients.

Correct answer: A. Execute the kubectl debug command to create an ephemeral container with a debugging image like alpine inside the existing Pod

The kubectl debug command correctly injects an ephemeral container into a running Pod to share its namespaces. Standard kubectl exec fails on distroless images lacking a shell, and modifying the deployment requires restarts.

Correct answer: A. Configure the minReadySeconds field to 30 in the Deployment specification

The minReadySeconds field correctly forces the Deployment to wait before moving to the next Pod. The initialDelaySeconds parameter only delays the initial probe and does not guarantee post-ready stability during rollouts.

Correct answer: B. Create a Secret of type kubernetes.io/tls and reference it in the 'tls' section of the Ingress resource

Creating a Secret of type kubernetes.io/tls and referencing it in the Ingress resource is correct because it provides the standard mechanism for controllers to load certificates for SSL termination. Mounting certificates directly via ConfigMaps lacks the required key separation and native integration.

Correct answer: B. Apply a strategy with maxSurge set to 1 and maxUnavailable set to 2 to maintain exactly the number of required healthy instances

Applying maxSurge of 1 and maxUnavailable of 2 is correct because it respects the strict quota by creating a maximum of 9 pods, while keeping 6 available. Setting maxSurge to 0 would cap replicas at 8, dropping below the required 6 available instances during updates.

Correct answer: A. Define an Egress policy with an ipBlock CIDR of 192.168.10.50/32 and specify the UDP/TCP port 514

Defining an Egress policy with an ipBlock CIDR and port is correct because it explicitly allows traffic to the external logging server while defaulting to deny for all other destinations. Ingress policies only control incoming traffic and cannot restrict outbound data exfiltration.

Correct answer: C. Implement an Adapter container that exposes a standard metrics endpoint and translates internal binary data for the monitoring system

The correct answer uses the Adapter pattern to translate internal binary metrics into a standard format. A Sidecar container that polls the shared volume and pushes JSON also technically solves the stated requirements.

Correct answer: C. Use a startupProbe with a failureThreshold of 12 and a periodSeconds of 10 to cover the 120-second initialization window

A startup probe disables liveness checks during initialization, preventing unwanted restarts. Pairing it with a readiness probe ensures traffic flows only after warmup. Fixed delays are brittle because actual startup times vary.