Certified Kubernetes Application Developer (CKAD)

Correct answer: B. Specify the fsGroup: 2000 in the Pod-level SecurityContext to allow Kubernetes to change the ownership of the volume.

The fsGroup setting in the pod security context instructs Kubernetes to change the ownership of mounted volumes to the specified group ID. This directly grants the non-root application process the required write permissions without using privileged mode or init containers.

Correct answer: D. Set 'spec.sessionAffinity: ClientIP' in the Service manifest to enable session persistence based on the source IP.

Setting sessionAffinity to ClientIP on the Service ensures requests from the same source IP are routed to the same backend Pod. This provides the required session stickiness for legacy applications, unlike standard round-robin load balancing.

Correct answer: A. Add an InitContainer to the Pod specification that runs a shell loop script to check database connectivity before exiting successfully.

Init containers run to completion before any regular containers in a Pod are started, making them the perfect place for dependency checks. Readiness probes only prevent traffic routing and do not delay the main container's startup process.

Correct answer: B. Set maxSurge to 2 and set maxUnavailable to 2 in the deployment strategy section

Setting maxUnavailable to 2 ensures at least 8 pods remain available during the rollout, meeting the traffic requirement. Setting maxSurge to 2 restricts the total number of pods to 12, successfully preventing node resource overload.

Correct answer: A. Deploy an Ambassador container within the same Pod to act as a local proxy that manages the mTLS handshake with the external API.

The Ambassador pattern abstracts external service complexity by running a proxy container in the same network namespace. The legacy application connects locally while the proxy transparently handles the complex mTLS handshake.

Correct answer: A. Set the terminationGracePeriodSeconds in the Pod specification to 30 and implement a preStop hook that executes a sleep command for 15 seconds.

A preStop hook delays container shutdown while an extended terminationGracePeriodSeconds provides ample time for cleanup. Relying solely on readiness probes does not guarantee the application enough time to process in-flight requests before termination.

Correct answer: C. Create a Headless Service by setting the clusterIP field to None and ensuring the service name matches the serviceName of the StatefulSet.

A Headless Service sets clusterIP to None, which creates individual DNS A records for each Pod managed by the StatefulSet. This allows applications to discover specific peers directly via DNS instead of routing through a load balancer.

Correct answer: D. Deploy an Adapter container within the Pod that monitors the /var/log/audit.xml file, transforms the data to JSON, and forwards it to the central logging server.

The Adapter pattern transforms primary container output to match external system standards without modifying the original image. Using a shared volume, the adapter container reads the XML logs, translates them to JSON, and forwards them successfully.

Correct answer: C. Set the terminationMessagePath field in the container specification to /dev/termination-log to capture the specific exit data.

Setting the terminationMessagePath directs Kubernetes to capture specific exit data from a designated file. This diagnostic message is then easily retrieved later using standard kubectl describe pod commands when troubleshooting crashes.

Correct answer: B. An ingress rule in the 'db-layer' namespace using both a namespaceSelector matching the 'web-layer' namespace and a podSelector matching 'role=frontend'.

Combining namespaceSelector and podSelector inside a single ingress rule restricts traffic to the specified pods. Applying the rule to a service is invalid because network policies target pods directly.

Correct answer: B. Approximately 9% of the traffic will be routed to the v2 canary pod, while 91% will continue to be routed to the v1 stable pods.

The Service load balances equally across all matching Pods, so the single v2 Pod receives roughly nine percent of the traffic. Remember that Services route based on selectors, not Deployment objects, avoiding the trap of assuming fifty-fifty traffic splits.

Correct answer: B. Implement an adapter container that shares a volume with the main application, reads the binary logs, converts them to JSON, and exposes them via its own standard output.

An adapter container modifies files or output from the main application to meet external requirements without changing the core code. Do not use a basic sidecar, because it typically forwards logs untouched rather than converting the proprietary binary format.

Correct answer: D. Implement the Adapter pattern by adding a container that reads the logs from a shared volume and converts them to the required XML format.

The Adapter container pattern translates heterogeneous outputs into a unified format before sending them to external systems. A standard sidecar container usually forwards raw logs untouched, whereas an adapter specifically performs the required XML transformation.

Correct answer: D. Configure a startupProbe with a failureThreshold of 30 and a periodSeconds of 10 to protect the container during boot

A startup probe disables liveness checks until it succeeds, perfectly protecting slow-starting applications during initialization. Relying heavily on high initialDelaySeconds values is less efficient because fast-booting pods will wait unnecessarily before receiving traffic.

Correct answer: D. Create a Role in the 'customer-data' namespace and a RoleBinding in the same namespace that associates the Role with the ServiceAccount from 'security-ops'.

Creating a Role and RoleBinding in the target namespace allows you to securely grant cross-namespace access to a specific ServiceAccount. ClusterRoles grant access across the entire cluster, which violates the principle of least privilege required for security compliance.

Correct answer: C. Use an initContainer to execute the download script and store the result in an emptyDir volume shared with the main container.

InitContainers run sequentially to completion before any application containers start. Use an initContainer to fetch dependencies into a shared volume, ensuring the main container only starts once its required files are present.

Correct answer: D. Set the RollingUpdate strategy with maxUnavailable: 4 and maxSurge: 5 to maintain capacity and limit total Pod count.

Setting maxUnavailable to 4 and maxSurge to 5 maintains 16 available pods and limits total pods to 25. During the exam, calculate these values using the exact replica count rather than defaulting to standard percentages.

Correct answer: C. Use an initContainer with the decryption utility image to download and process the file, saving the result into a shared emptyDir volume.

InitContainers run to completion before the main application starts, making them perfect for preparing data. By saving the decrypted file into a shared volume, the main container securely accesses the prepared data without needing the utility.

Correct answer: C. Add an 'initContainer' that runs a script using 'nslookup' in a loop to check the resolution of both service names.

InitContainers block the main container from starting until they complete successfully. This pattern guarantees your application will not crash loop if it relies on external services that need time to register in DNS.

Correct answer: C. No special configuration is needed because containers within the same Pod automatically share the same network namespace.

Containers within the same Pod share the exact same network namespace, meaning they communicate via localhost. You do not need a Service or host networking for inter-container traffic on the same loopback interface.

Correct answer: A. jsonpath='{range .items[*]}{.metadata.name}{" "}{.status.containerStatuses[?(@.name=="engine-worker")].restartCount}{" "}{.spec.containers[?(@.name=="engine-worker")].image}{"\n"}{end}'

It uses the range operator to iterate over items, then applies filters inside brackets to target the specific container by name for both the restart count and the image. Remember that restart counts live under status containerStatuses, while the image is under spec containers.

Correct answer: A. Modify the 'web-prod-svc' Service selector to point to 'version: v2' instead of 'version: v1' to reroute the traffic

Changing the Service label selector instantly routes production traffic to the new version v2 pods. Do not delete the old deployment immediately, as you need it for a quick rollback if the green deployment fails.

Correct answer: C. Use a single Ingress with path '/shop' (Prefix), path '/checkout' (Prefix), and path '/' (Prefix) for the frontend

A single Ingress using Prefix path types handles all routing needs efficiently. The Ingress controller automatically evaluates the longest, most specific paths first, so the slash prefix safely acts as a catch-all backend.

Correct answer: B. Implement an InitContainer with a base utility image to download the dataset into a shared volume before the main container starts

An init container runs to completion before the main application starts, using a separate utility image to fetch the data. Sidecars run concurrently, which risks race conditions if the main container needs the data immediately upon starting.

Correct answer: C. Configure an 'ingress' rule with 'ipBlock' specifying 'cidr: 10.50.0.0/16' and 'except: [10.50.20.0/24]'.

The ipBlock selector natively supports a comma-separated except field to exclude untrusted subnets from an allowed range. NetworkPolicies are allow-lists by default, so defining allowed traffic inherently blocks everything else.

Correct answer: D. Define a livenessProbe using the tcpSocket field targeting port 9000 to perform a simple TCP connection check.

The tcpSocket probe verifies basic network connectivity by attempting to open a TCP connection to the designated port. It avoids the processing overhead and security risks associated with running shell commands inside the container.

Correct answer: B. Update the 'spec.resources.requests.storage' field of the existing PVC to 50Gi and apply the change.

Patching the storage request on the PVC triggers the dynamic provisioner to expand the volume seamlessly. Directly modifying the PersistentVolume is discouraged because Kubernetes manages the lifecycle and reconciliation of the bound claim.

Correct answer: D. Apply a securityContext at the container level setting runAsNonRoot to true, allowPrivilegeEscalation to false, and readOnlyRootFilesystem to true.

A container-level security context directly applies required restrictions like read-only filesystems and non-root execution. Resource quotas only limit resource consumption across namespaces, while environment variables lack actual enforcement capabilities.

Correct answer: C. Use an initContainer to execute the setup script. Ensure the script returns a non-zero exit code on failure and mounts the same volume as the main container.

Init containers block the main container from starting until they complete successfully, guaranteeing the environment is fully prepared. If the setup script fails, the init container aborts, safely preventing the main pod from crashing.

Correct answer: C. Implement an adapter container that reads the local log file and exports it to the external monitoring system format

The adapter container pattern transforms the main application's output into a format required by an external system. While a sidecar shares the same lifecycle, an adapter specifically standardizes logs or metrics without altering the core application code.

Correct answer: B. Use the envFrom field with the configMapRef attribute pointing to the 'global-config' ConfigMap name.

The envFrom field populates all ConfigMap keys as environment variables automatically. Manual mapping using env with configMapKeyRef is tedious and fails the requirement to dynamically include future additions without manifest edits.

Correct answer: C. Create a Volume of type 'secret' referencing 'auth-materials' and add a volumeMount in the container to mount it at '/mnt/secrets/'.

Mounting a Secret as a volume projects its keys as individual files into the specified directory path. Environment variables expose values in process logs, violating the strict security requirement to keep them strictly on the filesystem.

Correct answer: B. Define readinessGates in the Pod spec to specify additional conditions that must be met before the Pod is considered ready.

Readiness gates allow external services to inject custom readiness conditions directly into a Pod's status. Startup probes only delay traffic until the application boots, whereas readiness gates hold traffic until external verification passes.

Correct answer: C. Use the envFrom field in the container specification and provide a configMapRef that points to the 'service-env-vars' ConfigMap.

The envFrom field automatically populates the container environment with all keys from a referenced ConfigMap. Manual mounting requires custom scripts, which fails the requirement for efficient, native Kubernetes manifest syntax.

Correct answer: D. Create an Ingress resource with two separate entries in the 'rules' list, each specifying a 'host' and a corresponding 'http' path pointing to its respective service.

Defining multiple rules with distinct host fields in a single Ingress resource directs traffic based on the requested hostname. Wildcard hosts or path-based routing are unnecessary here since the exact internal domain names are fully specified.

Correct answer: D. Define a securityContext at the container level with runAsUser: 5000 and add the NET_RAW capability under the capabilities field.

Adding NET_RAW capabilities explicitly grants packet capture privileges while runAsUser enforces the UID. Privileged containers bypass least privilege rules and violate the strict security policy demanding a non-root identity.

Correct answer: B. Configure a startupProbe to handle the 45-second initialization, combined with a readinessProbe for traffic and a livenessProbe for health.

A startup probe safeguards slow-booting applications by disabling liveness checks during initialization. Without a startup probe, using initialDelaySeconds forces you to guess maximum boot times, delaying actual crash detection later.

Correct answer: C. Define 'fsGroup: 2000' within the Pod-level 'securityContext' in the manifest.

Setting fsGroup in the Pod security context dynamically changes the mounted volume's group ownership. Using privileged root containers violates security requirements, and manual chown commands fail if the user lacks root permissions.

Correct answer: C. Set the 'defaultMode' field to 0400 within the ConfigMap volume definition in the Pod spec.

The defaultMode field in a ConfigMap volume sets exact Unix permissions for mounted files. Setting readOnly on the volumeMount prevents writing but leaves default permissions untouched, failing the strict octal mode requirement.

Correct answer: B. Use a 'projected' volume type that aggregates the Secret, ConfigMap, and downwardAPI into one volume.

A projected volume combines several volume sources into a single directory. While an initContainer could technically stage files, it requires unnecessary scripting and violates the direct native integration expected for the exam.

Correct answer: C. Configure topologySpreadConstraints with the topologyKey for zones and set whenUnsatisfiable to DoNotSchedule with a maxSkew value of 1.

Topology spread constraints with a low maxSkew force the scheduler to distribute pods evenly across the specified topology domains. Pod anti-affinity lacks the granular control needed for exact proportional distribution across multiple zones.

Correct answer: C. Set maxSurge to 3 and maxUnavailable to 2 in the deployment strategy section.

Setting maxSurge to 3 permits the cluster to temporarily create up to 13 pods, and maxUnavailable to 2 guarantees 8 remain active. Using percentages fails the strict integer constraints outlined in the scenario.

Correct answer: C. Configure the strategy with 'maxUnavailable: 1' and 'maxSurge: 1' in the Deployment spec.

Setting maxUnavailable to 1 permits exactly 7 replicas during updates, and maxSurge to 1 respects the single spare pod capacity. Option A fails because maxUnavailable zero demands higher surge capacity the cluster lacks.

Correct answer: A. Add the 'NET_RAW' and 'SYS_TIME' capabilities to the securityContext section of the container specification

Adding specific Linux capabilities like NET_RAW and SYS_TIME adheres to the principle of least privilege by granting only the exact permissions needed. Using privileged mode or root access violates this security principle unnecessarily for the monitoring tool.

Correct answer: C. Define a NetworkPolicy for the 'secure-pay' Pod with an egress rule targeting the 'data' namespace and a podSelector for 'postgres-db' on port 5432

An egress rule using both namespaceSelector and podSelector restricts outgoing traffic to the exact database pod. Remember that default deny requires separate policies, but this option correctly identifies the egress target components.

Correct answer: C. An ingress policy on the 'database' pods with a 'from' rule containing a 'podSelector' matching 'role: frontend'

Applying an ingress policy to the database pods with a podSelector for the frontend implicitly denies all other traffic. Egress policies control outbound traffic, not incoming requests, making option B the wrong direction.

Correct answer: C. A livenessProbe using an exec command that runs a shell script to check the modification time of the file and returns a non-zero exit code if it exceeds the limit.

A liveness probe with an exec command checks file staleness and restarts the container upon failure. A readiness probe would only remove the pod from the service without actually restarting the frozen process.

Correct answer: C. Define the securityContext at the Pod level and set the fsGroup field to 5000 to ensure the volume is re-permissioned for the user.

Setting fsGroup in the pod security context automatically adjusts volume permissions for non-root users. Using a privileged container defeats the security purpose, and a chmod init container is less reliable.

Correct answer: C. Define a RollingUpdate strategy with maxSurge set to 3 and maxUnavailable set to 0 to maintain at least 10 active Pods while allowing up to 13 during the transition.

Setting maxUnavailable to zero maintains processing capacity, while maxSurge limits overhead to three pods. A strategy with maxSurge zero and maxUnavailable three would immediately drop below capacity, violating the requirement.

Correct answer: B. Set 'completions' to 200, 'parallelism' to 5, and 'backoffLimit' to 3 in the Job specification to control execution and retries

Completions sets the required successful finishes, parallelism sets concurrent pods, and backoffLimit handles retries. The activeDeadlineSeconds parameter restricts total runtime but does not define the retry behavior.

Correct answer: D. Create a PodDisruptionBudget resource targeting the payment-service labels and set the minAvailable field to a value of 3.

A PodDisruptionBudget with minAvailable set to three protects the application during voluntary disruptions like node drains. A PriorityClass only prevents preemption by other workloads, not evictions requested by administrators.

Correct answer: D. Set the maxSurge parameter to 3 and the maxUnavailable parameter to 2 to maintain capacity while limiting the maximum number of concurrent pods

Setting maxSurge to 3 allows up to 13 total pods, while maxUnavailable 2 keeps at least 8 pods available during the rollout. Do not confuse absolute integer values with percentages, as percentages would yield different pod counts here.

Correct answer: A. Implement a livenessProbe using the grpc field, specifying the port as 50051 and leaving the service field empty or set to a specific gRPC service name.

Native gRPC probes use the grpc protocol field to directly check the gRPC Health Checking Protocol. An exec probe requires bundling a separate binary, which the scenario explicitly prohibits.

Correct answer: D. Create a second Deployment for 'app-v2' with 1 replica, and ensure both Deployments have the same labels that match the Service's selector.

Services balance traffic across all Pods matching their selector regardless of the managing Deployment. Creating one new replica alongside nine existing replicas achieves the exact ten percent traffic split.

Correct answer: C. Implement an ambassador container running a lightweight TCP proxy like HAProxy or Envoy to forward traffic from localhost:5432 to the external cloud database address.

The ambassador pattern uses a local proxy container to broker connections to external services. This allows the legacy application to connect to localhost while the proxy handles the complex external routing.

Correct answer: A. Define a Service of type ExternalName with the externalName field set to 'db.corporate-legacy.net'.

An ExternalName Service returns a CNAME record pointing to the specified external DNS name. This cleanly abstracts external dependencies without creating unnecessary proxy pods or manual endpoint management.

Correct answer: C. An EmptyDir volume mounted at '/var/log/app/' in both containers, providing a shared temporary storage space that exists only for the life of the Pod

An emptyDir volume provides shared temporary storage tied directly to the Pod's lifecycle for multiple containers. HostPath volumes violate the security requirement by exposing the node filesystem.

Correct answer: A. Configure a LivenessProbe using the exec field to run the /usr/local/bin/check-health.sh script periodically.

A LivenessProbe using the exec action runs the diagnostic script and restarts the container upon failure. A ReadinessProbe only removes the Pod from Service endpoints without triggering a restart.

Correct answer: A. Set 'successfulJobsHistoryLimit: 3' and 'failedJobsHistoryLimit: 2' in the CronJob spec section

The successfulJobsHistoryLimit and failedJobsHistoryLimit fields directly control automatic cleanup of old Job objects. The concurrencyPolicy only manages overlapping schedules, not historical retention.

Correct answer: A. Configure a RollingUpdate strategy with maxSurge set to 3 and maxUnavailable set to 0 to ensure capacity is never reduced below the desired count.

A RollingUpdate strategy with maxSurge of three and maxUnavailable of zero keeps the active replica count at ten while temporarily allowing up to thirteen total pods. Avoid using the Recreate strategy, as it immediately terminates all pods.

Correct answer: A. Store the password in a Secret and the configuration in a ConfigMap, then mount the ConfigMap as a volume and the Secret as an environment variable

Using a Secret for the password and a ConfigMap for the configuration keeps sensitive data secure while allowing easy updates. Injecting large files via environment variables is not recommended because it increases the risk of exposing sensitive values in logs.

Correct answer: A. Create a NetworkPolicy that selects the 'transaction-db' pod, defines a single ingress rule for port 5432 from pods matching 'app: backend', and includes an empty podSelector policy elsewhere to deny all other traffic.

A NetworkPolicy applied to the database pod restricts incoming traffic exclusively to the specified backend pods while blocking all other connections. LoadBalancer source ranges restrict external access, whereas NetworkPolicies are required to isolate internal pod traffic.

Correct answer: D. Define an egress policy with a rule allowing traffic to the database service name and a second rule with an ipBlock for 192.168.10.50/32.

NetworkPolicies are additive and deny all non-matching egress traffic once applied. Defining specific rules using a podSelector for the database and an ipBlock for the external service restricts egress to only the approved destinations.

Correct answer: A. Set maxSurge to 2 and maxUnavailable to 2 to ensure the total Pod count never exceeds 12 and the available Pod count never drops below 8.

Setting maxSurge to two and maxUnavailable to two strictly guarantees that total pods never exceed twelve and available pods never drop below eight. Options using percentages should be avoided here because they can result in unpredictable rounding that violates hard limits.

Correct answer: A. Set the backoffLimit field to 3 in the Job specification to limit the number of retries before the Job is considered failed.

The backoffLimit field specifies the maximum number of failed Pod retries before the Job is marked as failed. For the exam, remember that parallelism and completions control scaling, while activeDeadlineSeconds restricts total execution time.

Correct answer: C. Create an egress policy with a single rule containing to: ipBlock: cidr: 192.168.10.0/24.

Defining an egress policy with a specific ipBlock creates an implicit deny rule for all other traffic. Remember that podSelector chooses destinations, whereas ipBlock is required for external subnets.

Correct answer: A. Create a single Ingress with a 'rules' section containing the 'host', and a 'http' section with two entries under 'paths', each specifying the path, pathType, and backend.

Path-based routing is configured under a single host rule with multiple backend paths. For the exam, recall that each path requires a path type, such as Prefix or Exact, along with the backend service and port.

Correct answer: B. Configure the securityContext of the container to set allowPrivilegeEscalation to false within the container specification.

Setting allowPrivilegeEscalation to false prevents child processes from gaining more privileges than their parent. Remember that runAsNonRoot only prevents root execution, while privilege escalation controls setuid behavior.

Correct answer: C. The mounted files in /etc/keys will be updated eventually by the kubelet, and the application's file watcher will trigger a reload of the new keys.

When a Secret is mounted as a volume, the kubelet eventually updates the symlinks for the mounted files. Remember that Secrets injected as environment variables are not updated automatically and require a pod restart.

Correct answer: A. Increase the memory limit in the Deployment to at least 768Mi to account for the JVM's non-heap memory and stack overhead

Increasing the limit provides room for the JVM heap plus overhead like Metaspace and thread stacks, preventing the OS from killing the process. A Kubernetes OOMKilled error means the container exceeded its limit, not the physical node memory.

Correct answer: C. Create a NetworkPolicy in the 'secure-data' namespace with a podSelector for app=pi-db, an ingress rule with a namespaceSelector for 'public' and a podSelector for app=frontend.

This policy correctly targets the database pods in their own namespace. By defining an ingress rule with both namespaceSelector and podSelector, it restricts access precisely to the authorized frontend pods.

Correct answer: C. An ingress rule with a namespaceSelector for 'frontend' combined with a podSelector for 'role: web-server', and an egress rule to the 'kube-system' namespace on UDP port 53.

For cross-namespace ingress, you must use both namespaceSelector and podSelector within the same rule. For DNS, you need an egress rule specifically targeting UDP port 53 in the kube-system namespace.

Correct answer: B. Set 'successfulJobsHistoryLimit: 5', 'failedJobsHistoryLimit: 2', and 'concurrencyPolicy: Forbid' in the CronJob's spec section.

This configuration precisely meets all requirements: it manages the cleanup of old jobs and prevents concurrent runs. The concurrencyPolicy Forbid specifically skips new runs if an existing one is still active.

Correct answer: A. Define an initContainer in the Pod that executes a 'while' loop checking for network connectivity to the database service

InitContainers must complete successfully before the main application container starts. A script in an initContainer can effectively block the startup sequence until the external database is completely ready. Avoid using liveness probes for startup dependencies.

Correct answer: C. Define 'allowPrivilegeEscalation: false' and 'runAsUser: 10001' within the securityContext section of the specific container's definition.

The allowPrivilegeEscalation false setting specifically prevents a process from gaining more privileges than its parent. The runAsUser field enforces that the container process starts with the exact specified non-root UID.

Correct answer: B. Implement a Kubernetes Job with the completionMode set to Indexed and access the JOB_COMPLETION_INDEX environment variable within the container.

Setting completionMode to Indexed ensures that each Pod is assigned an immutable completion index. This index is automatically injected into the JOB_COMPLETION_INDEX environment variable for reliable programmatic access.

Correct answer: D. Grant the sidecar container the SYS_PTRACE capability and set the shareProcessNamespace field to true in the Pod specification.

Setting shareProcessNamespace to true allows containers in a Pod to see and interact with each other's processes. Combined with the SYS_PTRACE capability, it enables deep debugging tools like strace against peer containers.

Correct answer: D. Configure activeDeadlineSeconds: 7200 in the Job's spec to limit the total duration of the Job execution.

The activeDeadlineSeconds field limits the total duration of a Job from the moment it starts. Once the deadline is reached, Kubernetes terminates all associated Pods and marks the Job as failed with reason DeadlineExceeded.

Correct answer: A. Define the 'imagePullSecrets' field at the Pod specification level and reference the 'regcred' Secret to provide authentication to the Kubelet.

The imagePullSecrets field in the Pod spec is the standard mechanism to pass registry credentials to the Kubelet. The Kubelet securely handles the image pull operation before the container runtime initializes.

Correct answer: C. Update the container's resource limits to include a request and limit for the 'ephemeral-storage' resource type.

Setting ephemeral-storage limits in the resources section is the standard way to manage local disk usage, ensuring the pod is evicted if it exceeds its quota. While emptyDir sizeLimits exist, they only constrain individual mounted volumes, whereas resource limits apply to the entire pod.

Correct answer: A. Set maxSurge to 5 and maxUnavailable to 5 in the rollingUpdate strategy block.

This is correct because maxSurge 5 allows for 25 total pods, and maxUnavailable 5 ensures that 15 pods are always running, perfectly matching the capacity and availability constraints. Be careful with absolute values versus percentages, as percentages calculate dynamically based on replica counts.

Correct answer: A. Use an InitContainer to run the generation script and save the output to an emptyDir volume that is mounted by both the InitContainer and the main container.

InitContainers run to completion before the main container starts. By sharing an emptyDir volume, the InitContainer can write the file and the main container can consume it securely. Sidecars run concurrently, so they cannot guarantee file creation before the main app starts.

Correct answer: C. Set the immutable: true field in the ConfigMap manifest to prevent any further updates to the data field of the resource.

The immutable field is a built-in feature for ConfigMaps and Secrets. Once set to true, it prevents any modifications to the data, ensuring configuration stability and reducing kubelet load. Mounting a volume as read-only only restricts the container, not the API server.

Correct answer: A. An Ingress resource with a single host 'example.com' and a list of paths mapping '/marketing' and '/portal' to their respective services and ports.

Ingress resources operate at Layer 7 and are specifically designed for path-based or host-based routing of HTTP traffic to internal services. Services operate at Layer 4 and cannot inspect URL paths to differentiate traffic between backend deployments.

Correct answer: D. Include an Ambassador container in the Pod that runs a TCP proxy configured to listen on localhost:5432 and forward traffic to the 'postgres-db' Service address.

The Ambassador pattern acts as a proxy for the main container. By running a proxy on localhost inside the same Pod, the legacy application connects locally while traffic is seamlessly forwarded to the actual Service. Adapters are for standardizing output, not proxying traffic.

Correct answer: D. Define a livenessProbe using 'exec' that runs a shell command to verify both the file existence and the port status.

Since a container can only have one livenessProbe, using exec to run a combined shell script is the only way to validate multiple distinct conditions for health. A readiness probe would only pause traffic, whereas the mandate requires failing and restarting the pod.

Correct answer: B. The Kubelet will eventually update the files in the volume, and the application must be designed to periodically re-read the files from the disk.

When Secrets are mounted as volumes, the kubelet eventually refreshes the data on disk. Applications must be designed to periodically re-read these files to pick up changes without requiring a process restart. Environment variables are immutable and never update dynamically.

Correct answer: A. Set readOnlyRootFilesystem: true in the securityContext and mount an emptyDir volume at the /var/log/app mount path.

Enabling readOnlyRootFilesystem protects the container, and mounting an emptyDir at the specific logging path provides a writable scratch space that is isolated from the root filesystem. Using privileged mode or HostPath directly violates the required security mandates.

Correct answer: B. Define a postStart lifecycle hook within the container specification to execute the registration script.

A postStart hook executes a registration script immediately after container creation without altering the core application code. Init containers run before the primary container starts, so they cannot expose the pod IP.

Correct answer: A. Define an Ingress with two rules for the same host, using pathType: Prefix for both /finance and /hr, and specify the 'portal-tls' secret in the tls section.

The Prefix path type satisfies the requirement to match exact paths or sub-paths by validating the URI prefix. The word exact in the prompt creates slight ambiguity, but Prefix is ultimately the correct technical match.

Correct answer: A. Update the new Pod's manifest to decrease its CPU request to 1 CPU core or less to fit within the remaining quota

Lowering the CPU request to 1 core or less fits the remaining namespace quota. While deleting the ResourceQuota would also allow scheduling, it violates the implicit organizational constraints and removes cluster guardrails.

Correct answer: C. Deploy an Adapter container within the same Pod to read the binary metrics and expose them in the required Prometheus format

The Adapter pattern standardizes or simplifies the application output for external systems, fitting perfectly for translating metrics. The Sidecar and Ambassador patterns manage inbound traffic or logs, failing to address the required transformation.

Correct answer: A. Configure a ReadinessProbe with a 'periodSeconds' of 10 and a check that only succeeds after the cache loading process is complete

A readiness probe removes the pod from service endpoints until the cache finishes loading, preventing premature traffic. A liveness probe would only prevent restarts, leaving the unresponsive pod exposed to user requests.

Correct answer: A. Define an environment variable in the Pod spec using valueFrom with the secretKeyRef property specifying the key.

Using secretKeyRef inside valueFrom exposes only the specific key needed to the container environment. Using envFrom would mount all fifty keys, violating the required principle of least privilege.

Correct answer: C. Update the Pod specification to include a toleration that matches the key, value, and effect of the taint on the high-memory nodes.

Adding a toleration matching the node taint allows the scheduler to place the memory-intensive pod on the reserved hardware. Using a nodeSelector or node affinity does not override a NoSchedule taint.

Correct answer: C. Remove the NET_ADMIN capability and ensure 'allowPrivilegeEscalation' is set to false in the securityContext.

The restricted profile strictly blocks adding Linux capabilities like NET_ADMIN and requires privilege escalation to be disabled. Changing namespace labels to privileged undermines cluster security and violates baseline governance rules.

Correct answer: A. The PVCs for replicas 1 and 2 are retained in the cluster, preserving the data; they must be manually deleted if the storage is no longer required.

PersistentVolumeClaims created by a StatefulSet are not automatically deleted when scaled down. This retains data for potential scale-up operations, meaning admins must manually clean up unused volumes.

Correct answer: A. Configure an InitContainer in the Pod manifest to run the generation script and share the directory via an emptyDir volume.

Init containers run to completion before the main application starts, using shared volumes to pass generated files. A postStart hook executes concurrently with the main container, risking a race condition where the app starts before setup finishes.

Correct answer: A. Define a single Ingress resource with a 'rules' section for the host 'api.company.com' containing multiple paths under the 'http' attribute

A single Ingress resource uses a rules section with multiple http paths to route traffic based on the URL. Creating multiple Ingress resources for the same host is unnecessary and complicates path management.

Correct answer: C. Modify the Ingress resource to use pathType: Exact for both paths and ensure the more specific path is listed first in the rules.

Using pathType Exact forces exact string matching, preventing broader prefix paths from catching specific routes. The Prefix path type can also work if configured correctly, making the provided options slightly ambiguous.