Application Design and Build

CKAD · 60 questions

• A city permitting portal team still ships a fat Ubuntu VM-style image into the cluster and wonders why builds and pulls take forever. What should they do for a Kubernetes application image?
• A county library app Dockerfile copies source, runs npm install, then leaves compilers and caches in the final image. How should the team shrink the runtime image?
• A municipal 311 API tags every push as latest and production Pods flip unpredictably between builds. What change makes application releases reproducible?
• A parks recreation site sets imagePullPolicy to Never for an image that exists only in a private registry, and worker nodes cannot find it locally. Which pull policy fits this situation?
• A water-billing microservice must pull from a private container registry. What application-side configuration enables successful pulls?
• A civic open-data exporter embeds database passwords in Dockerfile ENV and COPY layers. What should the team do instead?
• A transit app rebuilds the entire image when only an HTML asset changed because dependency installs sit after the full source COPY. How should the Dockerfile be ordered?
• A health-clinic portal ENTRYPOINT uses a shell wrapper that never forwards SIGTERM, so Pods hang until they are force-killed. What image design fix helps Kubernetes stop the container cleanly?
• A housing lottery service image runs as root by default, and the platform requires non-root containers. What should the image build include?
• A city Wi-Fi captive portal image contains only amd64 binaries, but several worker nodes are arm64. What should the team do?
• A records-management team asks whether modifying a container image means running docker commit against a live Pod. What is the correct application practice?
• A grant-tracking API needs a temporary debug image. How should the application developer change what the Pods run?
• A sanitation routing app republishes the same :v2 tag with new bits, but Pods on some nodes keep the old digest because imagePullPolicy is IfNotPresent. What practice avoids this stale-content trap?
• A court e-filing service image defines CMD, but the Pod template sets container command and args. Which statement is true?
• A tourism booking widget uses a distroless image, and operators cannot kubectl exec with bash. What is the right takeaway for application design?
• A 24/7 city website needs always-on replicas behind a Service with rolling updates. Which workload should the team choose?
• A log-forwarder must run exactly one agent Pod on every node to read node-local files. Which workload fits?
• A nightly GIS tile rebuild must run to completion and then exit. Which workload is appropriate?
• A weekly parking-citation export must fire on a calendar schedule. Which resource should wrap the batch work?
• A developer creates a naked Pod for a production API. Why should they prefer a Deployment instead?
• A municipal queue worker must finish a fixed number of batch items with controlled concurrency. Which Job settings express that intent?
• After maintenance, a utility-billing CronJob still has suspend: true and no new Jobs appear. What should the team do?
• Stakeholders say both a DaemonSet and a Deployment can "run on all nodes." Which distinction should guide the choice?
• A legacy case-management component needs stable per-instance network identity and durable storage attachment as replicas come and go. Which workload contrast is most accurate at selection time?
• A one-off database migration Job failed and must be run again. What is the appropriate application approach?
• A municipal reporting CronJob was meant to run once per day at 02:00, but Jobs keep appearing every hour. Which schedule expression correctly runs only daily at 02:00 UTC?
• During a rolling update of a civic permits API, several ReplicaSets appear under the same app. As an application developer, which resource should you normally edit to change the desired replica count and container image?
• A library CDN caching proxy must run on every worker node and appear automatically when the cluster adds a node. Which workload should the application team use?
• A short-lived overnight report Job must stop retrying after a few failed attempts instead of restarting forever. Which approach best matches Job failure handling?
• A team wants one workload for a always-on web UI and a nightly ETL that loads GIS parcels. How should those concerns be separated?
• A payments API Pod must finish a database schema migration before the main container starts listening. Which multi-container pattern enforces that gate?
• A permitting service writes logs to files on disk. A second container in the same Pod must tail those files and ship them to a central system. Which pattern fits?
• A civic permitting service should keep calling localhost while a helper container translates those calls to a legacy mainframe adapter. Which pattern is this?
• A dashboard exporter needs a helper that continuously reshapes the app’s metrics format for a scrape endpoint. Why is an adapter sidecar chosen instead of an init container?
• Two containers in one Pod must exchange intermediate files quickly during a request. What is the most direct built-in approach?
• A Pod defines init container A, then init container B, then the app. Init B fails and keeps restarting. What happens to later startup?
• A developer proposes packing a second unrelated business microservice into the same Pod “for locality.” What is the sound CKAD-oriented guidance?
• A service-mesh style proxy sidecar must reach the application container without Service DNS. Why does connecting to localhost work inside the Pod?
• An init container must read database credentials that the main app also uses. What is an appropriate approach?
• A logging sidecar crashes repeatedly in a multi-container Pod. What should an application developer understand about failure coupling?
• A helper must pull configuration from Git into a shared emptyDir before the main app reads those files. Which statement best describes the pattern?
• A Pod includes a slow-starting metrics sidecar and a web container that should receive Service traffic only when the web app is ready. Where should the readinessProbe typically be placed?
• An engineer needs tools to triage a one-off crash in a production Pod. Which approach best matches ephemeral troubleshooting versus always-on helpers?
• A Pod runs containers named api, shipper, and warmer. Which action correctly targets only the shipper log stream?
• A Pod stays in Init:ImagePullBackOff and the main app container image is known-good. What is the most likely focus for diagnosis?
• A PDF-render sidecar needs scratch space that must disappear when the Pod is deleted. Which volume type fits best?
• A records app must keep uploaded PDFs across Pod restarts and reschedules to other nodes. Which volume approach should the developer choose?
• An application expects configuration as files under /etc/app. How should a ConfigMap typically provide those files, and what must developers remember about updates?
• A TLS private key must appear as files inside the container with restricted permissions rather than being baked into the image. What should the developer do?
• A developer asks to mount the node’s container runtime socket via hostPath into a ordinary business app Pod for convenience. What is the CKAD-oriented response?
• A city batch Job must read shared CSV files from a PVC while several worker Pods run at once. Writers elsewhere already finished the data. Which consume-side access mode should the Job’s PVC request?
• A municipal API Pod needs a very fast scratch cache that vanishes when the Pod is deleted. Which emptyDir setting gives tmpfs-backed memory storage?
• A county intake Pod has a producer container that writes reports and a consumer container that processes them. How should both containers share one PVC?
• A ConfigMap holds several keys, but the app only needs app.properties as one file inside an existing config directory that already has other files. What should the volumeMount use?
• A developer’s Pod stays Pending and events show it cannot attach a volume because the PVC is still unbound. What is the application-side understanding?
• An app writes session files under /var/cache inside the container and loses them every time the Pod restarts. Why?
• A workload needs its ServiceAccount token, a ConfigMap, and a Secret presented together under one mount path for identity and config. Which volume type fits?
• Operators want to stop the app from accidentally rewriting mounted ConfigMap files at runtime. What volumeMount setting helps?
• A CronJob writes intermediate files to an emptyDir during each run. A developer assumes last night’s emptyDir data is still there for tonight’s Job. What is true?
• A developer on a CKAD-scoped team needs durable storage for an app and starts drafting a PersistentVolume and StorageClass. What responsibility boundary should they follow?