CKAD practice questions and answers

Correct answer: A — The container keeps exiting and the kubelet is waiting longer between restart attempts

CrashLoopBackOff means the container starts, exits, and is restarted with an increasing backoff delay, so the fix lies in the container's logs or command. Pull failures show as ImagePullBackOff, scheduling failures leave the Pod Pending, and endpoint problems are a Service concern.

Correct answer: A — kubectl debug with an ephemeral container

Ephemeral containers are added to a running Pod for troubleshooting and can use an image that includes debugging tools. kubectl cp copies files, port-forward tunnels a port, and attach connects to an existing container's process streams, which still requires that container to be usable.

Correct answer: A, B — The kubelet restarts the container · Repeated failures can produce a CrashLoopBackOff state

Liveness failures cause container restarts, and persistent failures produce the backoff loop. Removal from endpoints without restart is readiness behaviour, the Pod is not moved to another node, and Deployments do not roll back automatically on probe failure.

Correct answer: A — NodePort

NodePort allocates a port on every node that forwards to the Service. ClusterIP is internal only, ExternalName maps to a DNS name via CNAME, and a headless Service returns Pod addresses directly rather than opening a node port.

Correct answer: A — kubectl expose deployment web --port=80 --target-port=8080

kubectl expose creates a Service whose selector matches the Deployment's Pods, mapping the Service port to the container's target port. Scaling changes replica count, rollout status reports progress, and annotations are metadata.

Correct answer: A — The container exceeded its memory limit

Memory is incompressible, so exceeding the memory limit causes the kernel to kill the process and Kubernetes reports OOMKilled. Exceeding a CPU limit causes throttling instead, probe timeouts report a different reason, and cordoning only prevents new scheduling.

Correct answer: A — --follow

The follow flag tails the log stream continuously, which is what you want while reproducing a problem. previous reads the prior container instance, dry-run renders without applying, and record annotated the change cause on older kubectl versions.

Correct answer: A — Helm

Helm charts template manifests with values and track releases so upgrades and rollbacks are versioned. crictl talks to the container runtime, etcdctl administers etcd, and kubeadm bootstraps clusters.

Correct answer: A — To stdout and stderr

The container runtime captures standard output and error, which is what kubectl logs reads and what node log agents collect. Files inside the container are lost on restart, hostPath couples the Pod to a node, and sending only to a remote server bypasses the platform's own log pipeline.

Correct answer: A — kubectl port-forward pod/web 8080:80

port-forward tunnels a local port through the API server to the Pod, which is ideal for ad hoc testing. kubectl proxy exposes the API server, expose creates a Service, and cp copies files.

Correct answer: A — spec.serviceAccountName

serviceAccountName in the Pod spec selects the identity whose token is mounted and whose RBAC applies. runAsUser sets the Linux UID, labels are metadata, and schedulerName picks which scheduler places the Pod.

Correct answer: A — Values mounted as a volume are eventually updated in the container, while environment variables are not

The kubelet refreshes projected ConfigMap volumes after a sync period, but environment variables are set at container start and stay fixed until a restart. Kubernetes does not restart Pods automatically when a ConfigMap changes.

Correct answer: A — Never or OnFailure

A Job's Pod template must use Never or OnFailure because Always would prevent the Pod from ever reaching a terminal completed state. Restart policies do apply, and Always is specifically rejected for Jobs.

Correct answer: A — spec.concurrencyPolicy set to Forbid

Forbid skips a scheduled run if the previous Job is still active. Suspend stops all scheduling, a longer interval does not guarantee the previous run has finished, and the history limit only controls how many completed Jobs are retained.

Correct answer: A — runAsNonRoot set to true, with runAsUser set to a non-zero UID

runAsNonRoot makes the kubelet refuse to start a container that would run as UID 0, and runAsUser pins the identity. Privileged mode, host IPC sharing, and adding SYS_ADMIN all expand privilege rather than restricting it.

Correct answer: A — ResourceQuota

A ResourceQuota bounds aggregate consumption and object counts for the namespace. LimitRange operates per container or Pod, the autoscaler changes replica counts, and disruption budgets constrain evictions.

Correct answer: A — env with valueFrom.secretKeyRef naming the key

secretKeyRef selects one key from a Secret and binds it to a named environment variable. configMapRef injects a ConfigMap rather than a Secret, emptyDir is scratch space, and args cannot dereference a Secret by name.

Correct answer: A — Ingress with an ingress controller installed

Ingress declares layer 7 routing rules that an ingress controller implements. ClusterIP Services provide internal load balancing without host or path rules, NetworkPolicies filter traffic, and EndpointSlices list backing addresses.

Correct answer: A — Update the Service selector to match the new Deployment's Pod labels

Because a Service routes to whatever Pods its selector matches, changing the selector shifts all traffic in one step and can be reversed just as quickly. Deleting the old Deployment removes the rollback path, scaling the new one to zero serves nothing, and changing the Service type does not choose a backend version.

Correct answer: A — emptyDir

emptyDir is created when the Pod is assigned to a node, is shared by all containers in the Pod, and is deleted with the Pod, which matches the requirement exactly. A PVC provides durable storage that is unnecessary here, hostPath couples the Pod to a node, and configMap volumes project configuration data.

Correct answer: A, B — Containers in a Pod share the same network namespace and can reach each other on localhost · Containers in a Pod can share data through a volume mounted in each of them

Pod containers share one network namespace and can share volumes, which is what makes sidecar patterns work. The Pod holds a single IP, all its containers run on the same node, and each container specifies its own image.

Correct answer: A — CustomResourceDefinition

A CRD registers a new resource kind with the API server so custom controllers can watch and reconcile it. ConfigMaps hold data, ServiceAccounts provide workload identity, and Endpoints list Service backends.

Correct answer: A, B — Mount a ConfigMap as a volume of configuration files · Inject environment variables from a ConfigMap or Secret

ConfigMap volumes and injected environment variables both keep configuration outside the image so one artefact runs everywhere. Baking configuration in requires per-environment images, registry choice does not change configuration, and restartPolicy governs restarts.

Correct answer: A — kubectl get events --sort-by=.lastTimestamp

Events record scheduling decisions, image pull results, and probe failures, and sorting by timestamp puts the newest activity in context. Listing all objects, printing the current context, and showing versions provide no diagnostic detail.

Correct answer: A — Kustomize bases and overlays

Kustomize keeps one base and applies patches per overlay, so shared configuration stays in one place. Hand-copied manifests and live kubectl edits both drift, and changing build-time tags does not address environment configuration differences.

Correct answer: A — HorizontalPodAutoscaler

The HorizontalPodAutoscaler scales replicas up and down toward a metric target such as average CPU utilisation. PodDisruptionBudgets limit voluntary evictions, LimitRanges set default and maximum resources, and PriorityClasses affect preemption.

Correct answer: A — kubectl rollout history deployment/web

rollout history lists revisions and can show the change cause for each, and undo accepts a revision number. Events show recent activity, top shows resource usage, and api-resources lists available object types.

Correct answer: A, B — Secret data is base64 encoded in the object, not encrypted by that encoding · Access to Secrets should be restricted with RBAC

Base64 is an encoding rather than protection, so RBAC and encryption at rest are what actually protect Secrets. Encryption at rest requires explicit configuration, Secrets can be consumed as files or environment variables, and they are namespaced objects.

Correct answer: A, B — completions: 10 · parallelism: 5

completions sets the total successful runs required and parallelism caps how many run simultaneously. replicas belongs to Deployments and ReplicaSets, and concurrencyPolicy and schedule are CronJob fields.

Correct answer: A — CPU resource requests on the containers

Utilisation is computed as a percentage of the request, so without a CPU request the autoscaler cannot calculate a target. Volumes, Service types, and init containers have no bearing on the metric calculation.

Correct answer: A — kubectl top pods

kubectl top reads from the metrics API and shows live resource consumption. get with wide output shows node and IP information, describe quota shows namespace limits, and explain documents API fields.

Correct answer: A — api.prod.svc.cluster.local

Kubernetes DNS follows the pattern service.namespace.svc.cluster.local, and within the same namespace the short name api also resolves. The other orderings do not match the cluster DNS schema.

Correct answer: A, B — Set readOnlyRootFilesystem to true · Drop all Linux capabilities and add back only those required

A read-only root filesystem and a minimal capability set are two standard hardening measures. Privileged mode, mounting the host filesystem, and host networking all expand what a compromised container can reach.

Correct answer: A — A multi-stage build that copies only the compiled artefact into a minimal final image

Multi-stage builds keep the toolchain in an earlier stage and copy only the finished artefact into a small runtime image, cutting both size and attack surface. The other options all leave build tooling in the shipped image or move the build to run time.

Correct answer: A — A startup probe with a generous failureThreshold

The startup probe defers liveness and readiness checks until the application has started, which protects slow-starting containers from being restarted. A readiness probe does not prevent liveness restarts, an immediate liveness probe is the problem, and removing probes gives up health checking entirely.

Correct answer: A — --dry-run=client -o yaml

Client-side dry run with YAML output prints the object definition without sending a create request, which is the fastest way to scaffold a manifest. force deletes and recreates, cascade orphan leaves dependents behind, and watch streams changes.

Correct answer: A — kubectl rollout undo deployment/web

rollout undo reverts to the previous ReplicaSet revision, which is why revision history is retained. Pause halts an in-flight rollout, restart recreates Pods with the same spec, and status reports progress.

Correct answer: A — kubectl create configmap app-config --from-file=app.properties

create configmap with from-file builds a ConfigMap whose key is the file name and whose value is its contents. The secret variant creates a different object type, applying a properties file directly is not valid Kubernetes YAML, and labelling only adds metadata.

Correct answer: A, B — The Service selector and the Pod template labels · The Service targetPort and the container's listening port

The selector determines which Pods back the Service and targetPort must match where the container actually listens. Service and Deployment names need not match, and node names and image tags play no part in routing.

Correct answer: A — Pod Security Admission configured with namespace labels

Pod Security Admission applies the privileged, baseline, or restricted profile based on labels applied to the namespace, in enforce, audit, or warn mode. NetworkPolicies govern traffic, LimitRanges govern resources, and taints influence scheduling.

Correct answer: A — An init container that blocks until the dependency responds

Init containers run to completion in order before app containers start, so a blocking check is the standard way to express a startup dependency. A liveness probe restarts a container that is already running, a disruption budget limits evictions, and a node selector constrains placement.

Correct answer: A, B — New Pods never become ready before progressDeadlineSeconds elapses · The new image cannot be pulled, so replicas never reach the desired state

A rollout stalls when new Pods cannot become ready in time, whether because the application fails readiness checks or the image cannot be pulled. Revision count, Service type, and namespace labels do not affect rollout success.

Correct answer: A — A preStop lifecycle hook

The preStop hook runs before the container receives its termination signal, which is where graceful drain logic belongs. postStart runs at container start, readiness probes gate traffic, and init containers run before the application starts.

Correct answer: A, B — Write logs to stdout and stderr rather than to files inside the container · Read configuration from environment variables or mounted files rather than baking it into the image

Logging to standard streams lets the platform collect output, and externalised configuration lets the same image run in every environment. Local session state, fixed hostnames, and assuming no restarts all fight the way Kubernetes schedules and replaces Pods.

Correct answer: A — Sidecar

A sidecar runs alongside the application container for the whole Pod lifetime, sharing volumes and the network namespace, which is exactly how log shippers are deployed. Init containers run to completion before the app starts, and ambassador and adapter are more specific sidecar variants for proxying and reformatting.

Correct answer: A — spec.completions

completions sets the number of successful Pod completions required. parallelism controls how many run at once, backoffLimit caps retries, and activeDeadlineSeconds bounds total runtime.

Correct answer: A — Nothing extra, because all Pods can reach all other Pods by default

The Kubernetes network model gives every Pod a routable address and allows all Pod-to-Pod traffic unless a NetworkPolicy restricts it, regardless of namespace. Namespaces are not a network boundary by themselves, and VPNs, node ports, and shared storage are irrelevant here.

Correct answer: A — All ingress traffic to those Pods is denied

Once a Pod is selected by any NetworkPolicy with an ingress section, only traffic explicitly allowed by a rule is permitted, so an empty rule list denies everything inbound. Egress is unaffected unless the policy also declares an egress type.

Correct answer: A — envFrom with a configMapRef

envFrom with a configMapRef injects all keys as environment variables without listing each one. hostPath mounts a node directory, args set command arguments, and nodeSelector constrains scheduling.

Correct answer: A, B — DNS returns the individual Pod addresses rather than a single virtual IP · It is commonly used with StatefulSets for stable per-Pod DNS names

A headless Service skips the virtual IP so DNS resolves to Pod addresses, which is what gives StatefulSet members individually addressable names. Layer 7 routing belongs to Ingress, and no node port or cloud load balancer is involved.

Correct answer: A — A Secret of type kubernetes.io/tls referenced in the Ingress spec.tls section

TLS Secrets hold the certificate and key and are referenced by host in the Ingress tls section. ConfigMaps are for non-sensitive data, annotations are not a certificate store, and baking certificates into images makes rotation impossible.

Correct answer: A — LimitRange

A LimitRange applies default requests and limits and enforces minimum and maximum values per container or Pod. A ResourceQuota caps namespace-wide totals, PriorityClasses affect preemption, and disruption budgets limit evictions.

Correct answer: A — Run a second Deployment with fewer replicas whose Pods carry the same Service selector labels

With both Deployments' Pods matching one Service selector, traffic is split roughly in proportion to replica counts, which is the basic canary without a mesh. A second unused Service receives no traffic, maxSurge only affects rollout speed, and taints influence placement rather than traffic share.

Correct answer: A — kubectl set image deployment/web web=myapp:2.0

kubectl set image updates the Pod template, which triggers the Deployment's rolling update strategy. Scaling to zero causes an outage, deleting removes the workload, and cordoning marks a node unschedulable.

Correct answer: A — A Role plus a RoleBinding referencing the service account

A namespaced Role defines the permitted verbs and resources and a RoleBinding grants it to the service account. Binding cluster-admin grants far more than required, NetworkPolicies control traffic, and quotas cap resource consumption.

Correct answer: A — spec.terminationGracePeriodSeconds

terminationGracePeriodSeconds sets how long the kubelet waits after SIGTERM before forcing termination. activeDeadlineSeconds bounds total Pod runtime, restartPolicy governs restarts, and dnsPolicy controls name resolution.

Correct answer: A — ExternalName

An ExternalName Service returns a CNAME to the configured external hostname and does not proxy traffic or allocate an IP. LoadBalancer and NodePort publish the Service externally, and ClusterIP provides an internal virtual IP.

Correct answer: A — Whether the Service selector matches the Pod labels and the Pods are passing readiness

Endpoints are populated from Pods whose labels match the selector and that are ready, so a mismatch or failing readiness probe explains an empty endpoint list. Node addressing, image signing, and quotas do not affect endpoint population.

Correct answer: A — kubectl logs <pod> --previous

The previous flag retrieves the log output of the container instance that terminated, which is where the crash reason usually is. Following tails the current instance, describing a node shows node conditions, and the YAML output shows spec and status without log content.

Correct answer: A, B — maxUnavailable · maxSurge

maxUnavailable and maxSurge together define the rolling update window. revisionHistoryLimit controls how many old ReplicaSets are kept, progressDeadlineSeconds decides when a rollout is declared stalled, and minReadySeconds sets how long a Pod must be ready before counting as available.