CKAD practice questions
CNCF · CKAD · 300 questions
Original practice questions for the CNCF/Linux Foundation Certified Kubernetes Application Developer (CKAD) exam, covering application design and build, deployment strategies, observability and maintenance, environment configuration and security, and services and networking. Tests developer-level judgment on designing, building, configuring, and exposing cloud-native applications on Kubernetes.
This course contains the use of artificial intelligence.
About the CKAD exam
- Exam fee
- $445 USD
- Time allowed
- 2 hours
- Format
- Online, proctored, performance-based: solve tasks from a command line
Schedule this exam The certification this earns
Exam details published by the vendor, checked 25 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Application Design and Build · 60 questions
- A city permitting portal team still ships a fat Ubuntu VM-style image into the cluster and wonders why builds and pulls take forever. What should they do for a Kubernetes application image?
- A county library app Dockerfile copies source, runs npm install, then leaves compilers and caches in the final image. How should the team shrink the runtime image?
- A municipal 311 API tags every push as latest and production Pods flip unpredictably between builds. What change makes application releases reproducible?
- A parks recreation site sets imagePullPolicy to Never for an image that exists only in a private registry, and worker nodes cannot find it locally. Which pull policy fits this situation?
- A water-billing microservice must pull from a private container registry. What application-side configuration enables successful pulls?
- A civic open-data exporter embeds database passwords in Dockerfile ENV and COPY layers. What should the team do instead?
- A transit app rebuilds the entire image when only an HTML asset changed because dependency installs sit after the full source COPY. How should the Dockerfile be ordered?
- A health-clinic portal ENTRYPOINT uses a shell wrapper that never forwards SIGTERM, so Pods hang until they are force-killed. What image design fix helps Kubernetes stop the container cleanly?
- A housing lottery service image runs as root by default, and the platform requires non-root containers. What should the image build include?
- A city Wi-Fi captive portal image contains only amd64 binaries, but several worker nodes are arm64. What should the team do?
- A records-management team asks whether modifying a container image means running docker commit against a live Pod. What is the correct application practice?
- A grant-tracking API needs a temporary debug image. How should the application developer change what the Pods run?
- A sanitation routing app republishes the same :v2 tag with new bits, but Pods on some nodes keep the old digest because imagePullPolicy is IfNotPresent. What practice avoids this stale-content trap?
- A court e-filing service image defines CMD, but the Pod template sets container command and args. Which statement is true?
- A tourism booking widget uses a distroless image, and operators cannot kubectl exec with bash. What is the right takeaway for application design?
- A 24/7 city website needs always-on replicas behind a Service with rolling updates. Which workload should the team choose?
- A log-forwarder must run exactly one agent Pod on every node to read node-local files. Which workload fits?
- A nightly GIS tile rebuild must run to completion and then exit. Which workload is appropriate?
- A weekly parking-citation export must fire on a calendar schedule. Which resource should wrap the batch work?
- A developer creates a naked Pod for a production API. Why should they prefer a Deployment instead?
- A municipal queue worker must finish a fixed number of batch items with controlled concurrency. Which Job settings express that intent?
- After maintenance, a utility-billing CronJob still has suspend: true and no new Jobs appear. What should the team do?
- Stakeholders say both a DaemonSet and a Deployment can "run on all nodes." Which distinction should guide the choice?
- A legacy case-management component needs stable per-instance network identity and durable storage attachment as replicas come and go. Which workload contrast is most accurate at selection time?
- A one-off database migration Job failed and must be run again. What is the appropriate application approach?
- A municipal reporting CronJob was meant to run once per day at 02:00, but Jobs keep appearing every hour. Which schedule expression correctly runs only daily at 02:00 UTC?
- During a rolling update of a civic permits API, several ReplicaSets appear under the same app. As an application developer, which resource should you normally edit to change the desired replica count and container image?
- A library CDN caching proxy must run on every worker node and appear automatically when the cluster adds a node. Which workload should the application team use?
- A short-lived overnight report Job must stop retrying after a few failed attempts instead of restarting forever. Which approach best matches Job failure handling?
- A team wants one workload for a always-on web UI and a nightly ETL that loads GIS parcels. How should those concerns be separated?
- A payments API Pod must finish a database schema migration before the main container starts listening. Which multi-container pattern enforces that gate?
- A permitting service writes logs to files on disk. A second container in the same Pod must tail those files and ship them to a central system. Which pattern fits?
- A civic permitting service should keep calling localhost while a helper container translates those calls to a legacy mainframe adapter. Which pattern is this?
- A dashboard exporter needs a helper that continuously reshapes the app’s metrics format for a scrape endpoint. Why is an adapter sidecar chosen instead of an init container?
- Two containers in one Pod must exchange intermediate files quickly during a request. What is the most direct built-in approach?
- A Pod defines init container A, then init container B, then the app. Init B fails and keeps restarting. What happens to later startup?
- A developer proposes packing a second unrelated business microservice into the same Pod “for locality.” What is the sound CKAD-oriented guidance?
- A service-mesh style proxy sidecar must reach the application container without Service DNS. Why does connecting to localhost work inside the Pod?
- An init container must read database credentials that the main app also uses. What is an appropriate approach?
- A logging sidecar crashes repeatedly in a multi-container Pod. What should an application developer understand about failure coupling?
- A helper must pull configuration from Git into a shared emptyDir before the main app reads those files. Which statement best describes the pattern?
- A Pod includes a slow-starting metrics sidecar and a web container that should receive Service traffic only when the web app is ready. Where should the readinessProbe typically be placed?
- An engineer needs tools to triage a one-off crash in a production Pod. Which approach best matches ephemeral troubleshooting versus always-on helpers?
- A Pod runs containers named api, shipper, and warmer. Which action correctly targets only the shipper log stream?
- A Pod stays in Init:ImagePullBackOff and the main app container image is known-good. What is the most likely focus for diagnosis?
- A PDF-render sidecar needs scratch space that must disappear when the Pod is deleted. Which volume type fits best?
- A records app must keep uploaded PDFs across Pod restarts and reschedules to other nodes. Which volume approach should the developer choose?
- An application expects configuration as files under /etc/app. How should a ConfigMap typically provide those files, and what must developers remember about updates?
- A TLS private key must appear as files inside the container with restricted permissions rather than being baked into the image. What should the developer do?
- A developer asks to mount the node’s container runtime socket via hostPath into a ordinary business app Pod for convenience. What is the CKAD-oriented response?
- A city batch Job must read shared CSV files from a PVC while several worker Pods run at once. Writers elsewhere already finished the data. Which consume-side access mode should the Job’s PVC request?
- A municipal API Pod needs a very fast scratch cache that vanishes when the Pod is deleted. Which emptyDir setting gives tmpfs-backed memory storage?
- A county intake Pod has a producer container that writes reports and a consumer container that processes them. How should both containers share one PVC?
- A ConfigMap holds several keys, but the app only needs app.properties as one file inside an existing config directory that already has other files. What should the volumeMount use?
- A developer’s Pod stays Pending and events show it cannot attach a volume because the PVC is still unbound. What is the application-side understanding?
- An app writes session files under /var/cache inside the container and loses them every time the Pod restarts. Why?
- A workload needs its ServiceAccount token, a ConfigMap, and a Secret presented together under one mount path for identity and config. Which volume type fits?
- Operators want to stop the app from accidentally rewriting mounted ConfigMap files at runtime. What volumeMount setting helps?
- A CronJob writes intermediate files to an emptyDir during each run. A developer assumes last night’s emptyDir data is still there for tonight’s Job. What is true?
- A developer on a CKAD-scoped team needs durable storage for an app and starts drafting a PersistentVolume and StorageClass. What responsibility boundary should they follow?
Application Deployment · 60 questions
- A city website cutover must keep the old version live until operators point traffic at the new version. How should blue/green be designed with Kubernetes primitives?
- A tax-payment API needs a canary so only a small fraction of users hit v2. Using Deployments and a Service (no service mesh), what approach fits?
- A release includes a breaking schema change that cannot safely mix v1 and v2 Pods behind the same Service. Which deployment approach is most appropriate?
- For a canary, v2 Pods are labeled version=canary while stable Pods use version=stable. How should the Service be labeled so both receive traffic?
- After green is validated and the Service points at green Pods, what is an appropriate teardown step for the old blue Deployment?
- A team calls every Deployment rolling update a “canary.” What distinction should they learn?
- When is a Deployment recreate strategy acceptable despite briefly taking the app offline?
- After a blue/green cutover attempt, clients still reach old blue Pods. Investigation shows the Service selector was never updated. What went wrong?
- A progressive delivery product is unavailable in the cluster. How should a CKAD candidate implement a basic canary?
- Green Deployment Pods are Ready, but users still hit blue because Ingress still references the blue Service name. What lesson applies?
- During canary analysis, operators want only healthy v2 Pods to receive Service traffic before scaling the canary up. What should they rely on?
- A city wants near-instant rollback from green back to blue. Blue Pods are still running at reduced scale. What advantage does blue/green offer?
- Operators start a rolling update on a Deployment while also adding a separate canary Deployment for the same release, and the plan becomes unclear. What guidance applies?
- A developer tries to implement a web API canary by creating a Job that runs the v2 image once. Why is that the wrong workload?
- Product wants header-based canary routing for internal testers. At CKAD depth with basic Service weighting only, what should the candidate conclude?
- A city API Deployment cannot drop capacity during updates. The rollingUpdate strategy sets maxUnavailable to 0 and maxSurge to 1. What behavior should the candidate expect?
- After updating a permitting portal Deployment image, a developer needs a CLI wait that blocks until the new ReplicaSet is progressing successfully. Which command is the right wait signal?
- A parks department Deployment hangs after a bad container image was rolled out. Which action restores traffic using the previous ReplicaSet revision?
- A permitting UI team needs to inspect past Deployment revisions and then undo to a specific older revision—not only the immediate previous one. Which approach matches that goal?
- An ops note says changing only a Deployment annotation can record a change-cause, while Pod template changes drive rollouts. Which statement is accurate for when a new rolling update begins?
- A batch invoice worker can tolerate brief downtime but must never run old and new code together. Which Deployment strategy type fits that downtime tolerance and mutual-exclusion need?
- A slow-starting civic reporting app passes its Ready condition quickly but still flakes under load for a few seconds. How does setting minReadySeconds on the Deployment help during a rolling update?
- A Deployment update stops making progress and the status later shows ProgressDeadlineExceeded. Which field primarily defines how long Kubernetes waits before marking that timeout?
- Traffic to a 311 API spikes overnight. The team needs more Pods but must not change the running container image. Which action correctly separates scale from a rolling image update?
- Old ReplicaSets for a library catalog Deployment keep accumulating and clutter etcd, but the team still wants some undo depth. Which field tunes how many old ReplicaSets are retained?
- During a canary-style bake, platform engineers want a Deployment to stop creating further new Pods mid-rollout until they manually continue. Which control matches that need?
- During a rolling update of a utility billing API, new Pods start but must not receive Service traffic until healthy. Which statement correctly ties readiness to rollout safety?
- A developer needs a quick, valid way to change one container image on a Deployment and start a rolling update without hand-editing the full manifest. Which approach is appropriate?
- A Deployment rollout appears stuck: new Pods remain Pending while old Pods still serve traffic. Image name and tags look correct. What should the candidate investigate first for this failure mode?
- A Deployment has 4 replicas and rollingUpdate.maxUnavailable set to 50%. During the update, how many Pods may be unavailable at once relative to the desired count?
- A city queue worker needs Redis from a public Helm chart already packaged by the community. Which command pattern correctly installs that existing chart as a named release?
- A municipal chart needs different database URLs per environment without forking the upstream chart. Which Helm approach customizes the release correctly?
- The municipal CMS Helm release must move to a newer chart version with updated values in place. Which command is the correct in-place update path?
- A Helm upgrade breaks the city’s permit search UI. Which action restores the prior successful release revision?
- An app team works only in namespace permitting-apps and needs to see Helm releases for their apps—not cluster-admin inventory. Which practice fits?
- A pilot Redis Helm release is no longer needed. Which command cleanly removes the release’s owned resources?
- helm install fails because the chart cannot be found; the team never configured chart repositories. What should they do first to consume published charts?
- Before installing a third-party chart into a production municipal namespace, a developer wants to inspect the rendered manifests without creating a release. Which command supports that review?
- Two developers accidentally choose the same Helm release name in namespace parks-web. What is the correct understanding of Helm release naming?
- A CKAD-style application chart’s values.yaml exposes replicaCount and image.tag. How do those common keys typically map when the chart templates a Deployment?
- After a flaky Helm upgrade of a city permitting dashboard, helm history lists several failed revisions. What should the developer do before choosing a rollback target?
- A municipal analytics team needs to install a widely packaged Kubernetes dashboard that already ships as a chart. Building a custom Operator just to install it would be overkill. Which approach best fits CKAD application deployment?
- A developer runs helm install for a parks recreation API and forgets to set a namespace flag, so the release lands in the wrong place. Which practice prevents that mistake?
- During a Helm upgrade of a billing chart, a one-shot migrate Job runs before the new Deployment pods start. At awareness depth, what Helm feature typically drives that Job?
- A Helm chart treats ConfigMaps as immutable and templates a new ConfigMap name when values change on upgrade. What side effect should the developer expect?
- A 311 API has one shared base of manifests and needs different settings for staging versus production. Which Kustomize layout matches that goal?
- An overlay must stamp app.kubernetes.io/ labels onto every resource in a Kustomize build. Which kustomization.yaml field injects those shared labels?
- Staging and production overlays for a grants portal share one cluster and would collide on resource names if left unchanged. How does Kustomize typically avoid that collision?
- A Kustomize overlay must bump a Deployment’s container image tag without hand-editing every base YAML file. Which field is designed for that change?
- Production should run five replicas of a ticket API while the staging overlay keeps one. Where in Kustomize should those environment-specific counts live?
- Only the staging overlay must change a Deployment’s readinessProbe path. Which Kustomize mechanism makes that surgical edit?
- A developer has a directory with kustomization.yaml and wants Kubernetes to build and apply that overlay in one step. Which kubectl invocation is appropriate?
- A Kustomize configMapGenerator builds a ConfigMap from local files and appends a content hash to the name. Why does that hash suffix matter for Deployments that reference the generated ConfigMap?
- An overlay needs Kubernetes Secrets derived from local key files without pasting raw secret YAML into every environment folder by hand. Which Kustomize feature addresses that pattern?
- A base kustomization.yaml must declare which YAML files belong in the build. Which field lists those manifests?
- A staging overlay directory must reuse the shared base manifests. How should its kustomization.yaml wire that relationship?
- Each environment overlay should place rendered objects into a different Kubernetes namespace without editing every resource’s metadata.namespace by hand. Which kustomization field does that?
- A team must install a third-party packaged chart with rich values, while another team only needs light YAML overlays on first-party manifests. Which tool choice is most appropriate?
- Before applying a Kustomize overlay for a inspections service, the developer wants to review the fully merged YAML. Which approach renders that output for inspection?
- A Kustomize patch is meant to update a Deployment named inspections-api, but the patch target lists the wrong kind or name and the change never appears in the build. What is the most likely cause?
Application Observability and Maintenance · 45 questions
- A city’s Ingress manifest still declares a removed beta apiVersion and fails on a current cluster. What should the application developer do?
- While applying application manifests, kubectl prints a warning that a resource type is deprecated. What is the correct response before the API is removed?
- A developer writing new workload YAML needs to know which apiVersion the cluster prefers for a resource kind. Which approach helps choose the preferred version?
- A scheduled reports CronJob still uses batch/v1beta1 and fails on a newer cluster. Which migration fixes the application schedule object?
- kubectl warns that a field in a Deployment manifest is deprecated, yet the apply still succeeds today. What should the application developer do?
- A city permits API still ships Deployment manifests using an API version that staging accepts on an older cluster, but production rejects the apply. What should the team do first?
- After a cluster upgrade, a parks-and-recreation Deployment YAML still references a deprecated API. What maintenance approach updates the manifests correctly?
- A 311 Operator ships a new CRD version and marks the old one deprecated. How should the application team that owns Custom Resources respond?
- A web Pod for a tax-filing helper fails its liveness probe and restarts in a loop, yet the process is only slow to finish initializing. What probe change best stops premature kills?
- A civic API Pod’s readinessProbe fails while its livenessProbe still passes. What is the expected Service behavior?
- A city open-data API exposes HTTP health on path /healthz at container port 8080. How should an httpGet probe be configured?
- A TCP-only batch worker for meter readings has no HTTP server. Which probe type correctly checks that its listen port is open?
- A licensing microservice needs a custom in-container check that runs a shell command and uses its exit code. Which probe handler fits?
- Operators want faster failure detection on a civic chat Pod without flapping on brief blips. Which probe timing approach balances speed and stability?
- A readinessProbe on every permits API Pod calls a shared external payment dependency. During a brief payment outage, all Pods become NotReady. What is the main pitfall?
- A modern cluster runs an app that needs several minutes to warm caches. Engineers only set a large initialDelaySeconds on liveness. What is the preferred modern pattern?
- A busy records-search API is healthy but occasionally slow under load. An aggressive liveness httpGet treats latency as death and restarts Pods, causing a thundering herd. What design lesson applies?
- A Deployment defines a container port named http on 8080. How can a probe reference that port clearly?
- After readiness failures, a flaky health endpoint flickers. Which probe field requires multiple consecutive successes before marking the Pod ready again?
- A multi-container Pod has a main city-maps API and a log-shipping sidecar. Probes were attached only to the sidecar, which never serves /healthz. What should the developer fix?
- A failing parks mobile backend needs a quick first look at Pod status and which node hosts each replica. Which kubectl command is the best first monitoring step?
- A Deployment’s Pods stay Pending or fail image pulls. Which kubectl view best surfaces the Events explaining scheduling or image errors?
- Platform metrics are available. Engineers need live CPU and memory usage for a permits API Pod to right-size requests. Which built-in CLI command helps?
- On-call needs a chronological view of what happened in the permits namespace during an incident. Which approach helps reconstruct the timeline?
- A bad rollout leaves unclear which ReplicaSet owns the struggling Pods. What kubectl listing helps monitor the Deployment ownership chain together?
- A busy shared namespace hosts many apps. How should an operator list only the 311 application Pods for monitoring?
- Users report connection failures to a Service even though Pods look Running. What should the developer check to see if the Service has backends?
- During a release, engineers want a live stream of Pod phase changes without repeatedly re-running get. Which kubectl feature fits?
- A developer needs the current stdout/stderr from Pods managed by Deployment myapp. Which command pattern retrieves those application logs?
- A container restarted after a crash and current logs only show the new instance. How can the developer read logs from the previous terminated container?
- A civic permitting Pod runs containers named app and sidecar. A developer runs kubectl logs permitting-7f and sees an error asking which container. What should they do next?
- During a short outage window for a library catalog API, an engineer needs recent lines with wall-clock times rather than the entire container history. Which kubectl logs approach fits best?
- A municipal reporting Pod restarts repeatedly. The last log lines cut off mid-request, and kubectl describe pod shows the previous container terminated with reason OOMKilled. What is the best conclusion?
- A parks-and-rec team wants one kubectl command that aggregates application logs from every Pod across the cluster like a production logging platform. What should you clarify?
- A fee-payment API Pod is Running, but application logs repeatedly show authentication failures to Postgres. kubectl describe shows the expected Secret volume mount path is empty or missing keys. What should the developer investigate first?
- A readiness HTTP probe hits /healthz every few seconds, and the app logs every probe as INFO, drowning useful traffic logs. What is the most appropriate application-side response?
- After deploying a new tax-forms API image, Pods enter CrashLoopBackOff. What systematic first path best identifies why the container exits?
- A new Deployment for a court-calendar UI stays in ImagePullBackOff. Which cause is most consistent with that status?
- A grants-intake Pod remains Pending. Events mention insufficient CPU on nodes, and a second similar Pod is Pending waiting for a PVC to bind. What should the developer do?
- A civic GIS app Pod is Running but returns wrong basemap tiles. The developer wants to inspect files under /etc/gis and test DNS from inside the container. Which approach fits?
- From inside a permits API Pod, resolving the Service name permits-db fails, while the Pod itself is Ready. What is the best next debugging focus?
- An engineer swears the billing-api Deployment vanished: kubectl get deploy prints nothing, yet the CI job reports a successful apply. What should they check first?
- A license-renewal container listens on port 8080, but the Pod’s containerPort and the Service targetPort are set to 80. Users hit connection failures. How should the developer diagnose and fix?
- A distroless payment container has no shell, so kubectl exec ... -- sh fails. The developer still needs tools inside the Pod’s network namespace for debugging. What is the appropriate approach?
- A Deployment for a records-search API shows zero ready Pods. What ownership chain should the developer walk to find the broken application template?
Application Environment, Configuration and Security · 75 questions
- A city data team needs managed Postgres for an application. A Postgres Operator is installed and exposes a custom Postgres resource. What should the app team create to consume that capability?
- Before writing manifests that reference an extended kind, a developer wants to see which custom APIs are installed. Which command best discovers them?
- Applying an application manifest that includes kind BackupSchedule fails because the API is unknown. What does this most likely indicate?
- After creating a custom database resource, an Operator creates a Secret and Service that the application mounts and calls. What does this illustrate for CKAD-level understanding?
- A developer must fill required fields on a custom resource whose schema is unfamiliar. Which kubectl aid helps document those fields?
- A cert-manager style Certificate custom resource produces a TLS Secret. How should an application Ingress typically consume that output?
- An Operator manages Pods and Services owned by a custom database resource. A developer manually edits those child objects, but changes keep reverting. What should they do instead?
- A platform team offers a validated custom API for provisioning caches, while another team only needs a few key/value settings for one app. When is a CRD the better fit than a ConfigMap?
- A developer’s kubeconfig user receives Forbidden when applying a Deployment in the permits namespace. What is the most likely authorization issue?
- A CI Job deploys apps using a dedicated ServiceAccount in the payments namespace but cannot create Deployments. What binding pattern grants the least-privilege fix?
- A city permits API only needs to read ConfigMaps and update its own Deployment inside the permits namespace. A teammate drafts a ClusterRoleBinding to a ClusterRole with those verbs. What change best applies least privilege?
- A validating admission webhook requires every new Pod in the tax namespace to carry an app.city.gov/owner label. A developer submits a Pod without that label. What happens at create time?
- kubectl get pods fails for a clerk using a kubeconfig whose client certificate no longer matches any known user, while a coworker with a valid user but no RoleBinding sees Forbidden. How do these failures differ?
- The parks namespace enforces the baseline Pod Security level. A developer’s Pod sets privileged: true on a container SecurityContext. What should the developer expect?
- A Deployment’s Pod template sets serviceAccountName: permits-api. Controllers create and manage those Pods, but live API calls from inside a running Pod use that ServiceAccount’s token. When debugging Forbidden errors from the application process, which identity matters most?
- On-call staff need a ServiceAccount that can inspect Pods and Deployments in the billing namespace for troubleshooting but must not delete or mutate them. Which Role verb set best matches least privilege?
- An app ServiceAccount should update only the ConfigMap named billing-ui-config, not every ConfigMap in the namespace. How should the Role be constrained?
- After a Pod create, the stored object includes an extra envoy sidecar container that was not in the developer’s manifest. A separate webhook later rejects Pods missing a required annotation. What admission behaviors do these describe?
- A municipal API container should reserve 100 millicores and 128Mi of memory while capping use at 500 millicores and 256Mi. Which resources block matches that intent?
- A new parks-api Pod stays Pending. kubectl describe shows FailedScheduling with Insufficient cpu, and the Pod’s requests.cpu is 4 on nodes that each have about 2 allocatable cores left. What is the most accurate diagnosis?
- A payment container’s memory limit is 256Mi. Under a traffic spike the process allocates beyond that limit and the container exits with reason OOMKilled. What caused that termination?
- On-call notices a city API Pod is slow but still Running. Metrics show the container repeatedly hitting its CPU limit, while memory stays under the memory limit. What behavior should they expect from those limits?
- Creating another Pod in the permits namespace returns Forbidden with a message that a ResourceQuota is exceeded for pods count. What does that indicate?
- A developer creates a Pod in a namespace that has a LimitRange defining default CPU and memory limits. The Pod template omitted resources entirely. After admission, what typically appears on the container?
- How does Kubernetes assign Guaranteed, Burstable, or BestEffort QoS to a Pod based on container requests and limits?
- A team cannot create additional ConfigMaps in the finance namespace even though CPU and memory quota still show headroom. Which ResourceQuota capability most likely explains the deny?
- Civic payment Pods must receive Guaranteed QoS so they are last to be evicted under memory pressure. What resources configuration achieves that for every container?
- A LimitRange in the reporting namespace sets max memory to 1Gi for containers. A developer submits a Pod requesting 4Gi of memory. What is the expected result?
- A developer needs a ConfigMap holding a non-sensitive database host for a city permits app using kubectl. Which approach correctly creates that configuration object?
- A Deployment should inject every key from ConfigMap permits-settings as environment variables without listing each key. Which Pod spec pattern does that?
- Only the apiurl key from ConfigMap city-portal should become the PORTALURL environment variable. Which configuration is appropriate?
- An app expects configuration files under /etc/config inside the container. The data lives in ConfigMap portal-files. How should the Pod consume it as files?
- Operators update a ConfigMap that is mounted as files into running Pods. Environment variables were also injected from the same ConfigMap at container start. What should an application developer expect?
- A team marks a ConfigMap as immutable after validating its data. What is the primary operational effect?
- A developer proposes storing a 50Mi proprietary binary installer inside a ConfigMap for a batch Job. What guidance best matches ConfigMap purpose and practical limits?
- A permits API must start with a feature flag and listen port taken from a ConfigMap without baking those values into the image. Which approach parameterizes startup args from that ConfigMap?
- A Pod in the inspections namespace mounts a volume from ConfigMap app-settings, but the ConfigMap was created only in default. What is the most likely result?
- A multi-container Pod runs an app container plus a logging sidecar. Where must CPU and memory requests be defined for accurate scheduling of both processes?
- An init container requests 2 CPU while the two app containers together request 500m. How do init container requests influence Pod scheduling?
- kubectl top shows a Deployment's Pods consistently using far less CPU and memory than their requests. What is the application-developer response to improve packing?
- A civic PDF worker Pod stays Pending with events about insufficient CPU after requesting 16 CPU on a pool of 4-CPU nodes. What should the developer do?
- A PDF rendering Pod writes large temporary files under the container filesystem and occasionally fills the node. Which resource setting specifically governs that scratch usage?
- A team wants to omit memory limits on a bursty reporting container so it can use spare node memory. What risk must they accept?
- A seasonal licensing API should run with Burstable QoS so it can use spare capacity above its baseline. How should requests and limits be set?
- Where in a Deployment manifest should a developer place container CPU and memory requests so every replica inherits them?
- A background worker needs an API token stored as an Opaque Secret named worker-token in namespace billing. Which command creates it from a literal value?
- How should a container receive a single Secret key password from Secret db-creds as the environment variable DBPASSWORD?
- A reverse-proxy sidecar must read a TLS certificate and key as files under /certs. Which consumption pattern fits?
- A teammate claims Secret objects are encrypted because data values appear as base64 in YAML. What correction is accurate?
- What is the safest source-control practice for Kubernetes Secret manifests that hold live production credentials?
- An app needs both a private registry pull credential and a database password. Which Secret-type guidance is correct?
- A Deployment injects Secret keys with envFrom.secretRef. After you update the Secret data, application processes still show the old values. What should you expect?
- A Pod mounts Secret tls-prod as a volume, but that Secret name does not exist in the Pod's namespace. What is the likely outcome?
- An Ingress must terminate HTTPS for permits.example.gov using certificate files you already have. Which Secret approach fits Ingress TLS?
- A Pod must call cloud APIs using permissions bound to ServiceAccount geo-reader instead of the namespace default. What Pod field assigns that identity?
- A static content Pod never calls the Kubernetes API. Which setting reduces unnecessary credential exposure?
- Why should powerful Roles not be bound to the namespace default ServiceAccount?
- An application needs a time-bound, audience-scoped ServiceAccount token rather than the legacy long-lived secret-based token. Which pattern should the developer use?
- Several Deployments should pull from a private registry without repeating pull-secret references on every PodSpec. What ServiceAccount technique helps?
- A Role grants get/list on ConfigMaps in maps. How is ServiceAccount map-reader authorized to use that Role?
- A city permits API service must call the Kubernetes API to get and list Endpoints using its Pod's ServiceAccount. How should the team grant only those permissions?
- A municipal billing Deployment and its metrics sidecar should not share one over-privileged identity. What ServiceAccount pattern best supports least privilege?
- A public-facing civic web Pod must not run as UID 0. Which securityContext setting best enforces that requirement?
- Platform policy for ordinary city apps requires containers not to gain extra privileges beyond their start UID. Which securityContext field should be set to false by default?
- A civic HTTPS reverse-proxy container only needs to bind privileged ports. How should Linux capabilities be configured for least privilege?
- A records app should run with a read-only root filesystem but still needs a writable cache directory. What configuration satisfies both?
- A reviewer rejects privileged: true on a routine citizen portal Deployment. Why is that setting inappropriate for ordinary application Pods?
- A team must set fsGroup for volume ownership and allowPrivilegeEscalation on a single container. Where do these securityContext fields belong?
- An image declares USER 10001 and the city policy requires matching non-root identities. How should runAsUser and runAsGroup be chosen?
- A developer wants a basic syscall filter on app Pods without custom profiles. Which seccompProfile setting is appropriate awareness-level hardening?
- A shared emptyDir volume is not group-readable by the app process even though runAsUser is set. Which Pod securityContext field should fix volume group permissions?
- A main civic container is hardened, but a logging sidecar requests CAPSYSADMIN. What should the candidate conclude?
- After enabling readOnlyRootFilesystem, a portal Pod CrashLoops because it writes temporary files under /tmp. What is the correct fix?
- A Deployment must meet common Pod Security restricted-level expectations for an ordinary app. Which checklist item belongs?
- Why should a normal ClusterIP Service-backed civic app avoid hostNetwork and hostPID?
Services and Networking · 60 questions
- Operators apply a NetworkPolicy that selects all Pods in a namespace and allows no ingress peers. What is the effective result until allow rules are added?
- Frontend Pods labeled app=frontend must reach backend Pods labeled app=backend on TCP 8080. Which NetworkPolicy approach allows that ingress?
- A shared monitoring namespace must scrape app Pods in another namespace. Which NetworkPolicy source matches that whole monitoring namespace?
- Egress from a payment Pod must be denied except DNS and one external payment gateway IP. What NetworkPolicy pattern fits?
- A NetworkPolicy selects only Pods with tier=api. What happens to Pods in the same namespace that lack that label?
- Two NetworkPolicies select the same Pod: one allows ingress from frontend, another allows ingress from monitoring. How do they combine?
- A cluster's CNI does not implement NetworkPolicy. What should an application developer expect after creating NetworkPolicy objects?
- App Pods are behind a default-deny ingress NetworkPolicy. External users reach the app through an Ingress controller. What additional allow is typically required?
- A policy should restrict only egress and leave ingress unspecified intentionally. What must be set so egress rules are honored as intended?
- After applying an egress default-deny NetworkPolicy, Pods can no longer resolve Service DNS names. What allow is missing?
- A city parking API listens on TCP 8080, but a NetworkPolicy allow rule lists protocol UDP and port 8080 for the same Pods. What happens to legitimate client traffic?
- A NetworkPolicy egress rule allows ipBlock.cidr: 10.0.0.0/8 but lists except: ["10.20.0.0/16"]. How should egress to 10.20.5.10 be treated relative to that rule?
- A frontend Deployment’s Pods are labeled app=web, but a NetworkPolicy that selects app=api only allows ingress from role=frontend. Clients still time out. What is the most likely policy cause?
- A platform team wants a namespace-wide default-deny ingress NetworkPolicy in permits. Which podSelector shape applies the policy to every Pod in that namespace?
- A municipal API gateway Pod is protected by a strict NetworkPolicy. Product still asks whether that alone authenticates callers. What should you tell them?
- After applying a new NetworkPolicy in permits, a previously healthy web-to-api path starts timing out. Pods remain Ready. What should you check first?
- For a 3-tier app in one namespace, db Pods should accept TCP 5432 only from Pods labeled tier=api, not from tier=web. Which NetworkPolicy approach fits?
- A CKAD-style task asks you to restrict a checkout Pod’s egress to its payment API Service Pods on TCP 8443. What is the appropriate focus?
- An admin jump tool Pod should accept SSH-like traffic on TCP 2222 only from the trusted CIDR 203.0.113.0/24. Which NetworkPolicy peer fits that ingress allow?
- In a new namespace with healthy Pods and no NetworkPolicy objects, what is the default Pod-to-Pod connectivity posture?
- A city permits microservice must be reachable by other in-cluster clients only, not published on node or cloud load-balancer fronts. Which Service type fits?
- A developer needs a short-lived external demo of a UI on a lab cluster without an Ingress controller. Which Service choice is reasonable for that temporary access?
- On a cloud Kubernetes cluster, a public parks website should get a provider-provisioned external address in front of its Service. Which type requests that?
- A Service selector is app=billing, but the Deployment Pods are labeled app=invoice. The Pods are Ready. What do you expect for Endpoints?
- Clients call Service port 80, the container listens on 8080, and traffic never arrives. Which mapping is correct to fix the blackhole?
- Why define a named container port (for example name: http) and set the Service targetPort: http instead of only numeric ports?
- You have a working Deployment and need a ClusterIP Service quickly for in-cluster callers. Which kubectl helper creates a Service from that Deployment?
- A legacy municipal UI keeps server-side session state in memory on one Pod. Which Service setting improves sticky routing by client IP?
- An application needs DNS that returns Pod IPs directly for custom client-side discovery instead of a single ClusterIP. Which Service configuration enables that pattern?
- Pods must call legacy.permits.example.com using an in-cluster DNS name legacy-permits. Which Service type creates a CNAME-style mapping for that external hostname?
- A Service exists, its Endpoints list Ready Pod IPs, yet curls to the Service port hang. Containers listen on 9090 but targetPort is 8080. What is wrong?
- By default, when a Pod fails its readiness probe, how does that affect Service traffic?
- One Service must expose application traffic on port 80 and metrics on port 9090 to the same Pods. What is required?
- A Service is ClusterIP and you need a brief external test on node IPs without recreating the object from scratch. What change accomplishes that exposure style?
- From a Pod in namespace web, what DNS name reliably reaches Service my-svc in namespace my-ns?
- A city recreation API should receive traffic only after its readiness probe succeeds. The Service currently has publishNotReadyAddresses set to true for a rare warm-up case that no longer applies. What should the developer do for normal app traffic?
- A permits desk app must talk to a legacy database that runs outside the cluster at a fixed IP. Which Service approach maps a stable in-cluster DNS name to that external backend?
- A library kiosk NodePort Service must preserve the client source IP for audit logs and avoid an extra SNAT hop on nodes that have local endpoints. Which Service field setting supports that goal?
- A parks-api Service suddenly includes unintended Pods from a batch Job that reused the label app=parks. What should the developer change so only the API Deployment Pods receive Service traffic?
- After deploying a ClusterIP Service for a civic payments API, the developer needs to verify in-cluster reachability before opening Ingress. What is the most appropriate quick check?
- The city needs HTTPS-ready HTTP routing so host permit.city.example path / reaches Service permit-ui on port 80. Which Ingress configuration expresses that intent?
- A civic portal Ingress must terminate HTTPS for host portal.city.example using an existing TLS certificate stored in the cluster. Where should the Ingress reference that material?
- An API Ingress must match only the literal path /v1/status and must not match /v1/status/details. Which pathType should the rule use?
- A developer creates a valid Ingress object for a clinic booking UI, but no external HTTP routing appears. Cluster admins confirm no Ingress controller is running. What does that imply for the developer?
- One hostname parks.city.example should send path /ui to Service parks-ui and path /api to Service parks-api. How should the Ingress express that split?
- Users hit an Ingress host and receive HTTP 503. kubectl shows the Ingress backend Service name is misspelled relative to the real Service. What should the developer fix first?
- A cluster runs two Ingress controllers. The developer must ensure the civic Ingress is handled by the controller associated with class nginx. Which field selects that controller?
- For CKAD-level portable Ingress design, which approach should the developer prefer when routing host and path traffic to Services?
- A team exposes several HTTP municipal apps publicly via many NodePorts and wants cleaner hostname-based routing on standard ports. Which change best matches that goal?
- A request reaches the Ingress controller but matches none of the defined host or path rules. What should the developer understand about that case?
- One Ingress should serve parks.example to Service parks-web and library.example to Service library-web. Which rule structure supports that name-based virtual hosting?
- HTTP rules on an Ingress work, but HTTPS for the listed host fails. kubectl shows the tls Secret name referenced by the Ingress does not exist. What is the likely diagnosis?
- An Ingress backend must target Service payments on port 8080, while Pods listen on containerPort 8080 mapped from Service port 80 via targetPort. Which port should the Ingress backend reference?
- For a simple canary, host app.city.example should send path / to Service app-stable and path /beta to Service app-canary. Which Ingress design achieves that split?
- An Ingress in namespace permits references backend Service permit-ui, but that Service only exists in namespace libraries. Typical CKAD-style Ingress backends fail. What should the developer do?
- A product owner wants automatic HTTP to HTTPS redirects for an Ingress. Which statement reflects correct CKAD-level expectations?
- After validating the green Deployment behind Service app-green, the team wants live Ingress traffic to cut over from Service app-blue. What is the appropriate Ingress change?
- kubectl describe Ingress shows ADDRESS empty after creating rules. The controller is still provisioning an external load balancer. How should the developer interpret that status?
- A telemetry agent exposes a proprietary TCP protocol on port 7000 and must be reachable from outside the cluster. Why is a standard Ingress rule a poor primary choice?
- Pods behind an Ingress are protected by a default-deny NetworkPolicy. External clients reach the Ingress controller, but app Pods never receive traffic. What additional NetworkPolicy consideration is required?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by the exam vendor.