Application Environment, Configuration and Security

CKAD · 75 questions

• A city data team needs managed Postgres for an application. A Postgres Operator is installed and exposes a custom Postgres resource. What should the app team create to consume that capability?
• Before writing manifests that reference an extended kind, a developer wants to see which custom APIs are installed. Which command best discovers them?
• Applying an application manifest that includes kind BackupSchedule fails because the API is unknown. What does this most likely indicate?
• After creating a custom database resource, an Operator creates a Secret and Service that the application mounts and calls. What does this illustrate for CKAD-level understanding?
• A developer must fill required fields on a custom resource whose schema is unfamiliar. Which kubectl aid helps document those fields?
• A cert-manager style Certificate custom resource produces a TLS Secret. How should an application Ingress typically consume that output?
• An Operator manages Pods and Services owned by a custom database resource. A developer manually edits those child objects, but changes keep reverting. What should they do instead?
• A platform team offers a validated custom API for provisioning caches, while another team only needs a few key/value settings for one app. When is a CRD the better fit than a ConfigMap?
• A developer’s kubeconfig user receives Forbidden when applying a Deployment in the permits namespace. What is the most likely authorization issue?
• A CI Job deploys apps using a dedicated ServiceAccount in the payments namespace but cannot create Deployments. What binding pattern grants the least-privilege fix?
• A city permits API only needs to read ConfigMaps and update its own Deployment inside the permits namespace. A teammate drafts a ClusterRoleBinding to a ClusterRole with those verbs. What change best applies least privilege?
• A validating admission webhook requires every new Pod in the tax namespace to carry an app.city.gov/owner label. A developer submits a Pod without that label. What happens at create time?
• kubectl get pods fails for a clerk using a kubeconfig whose client certificate no longer matches any known user, while a coworker with a valid user but no RoleBinding sees Forbidden. How do these failures differ?
• The parks namespace enforces the baseline Pod Security level. A developer’s Pod sets privileged: true on a container SecurityContext. What should the developer expect?
• A Deployment’s Pod template sets serviceAccountName: permits-api. Controllers create and manage those Pods, but live API calls from inside a running Pod use that ServiceAccount’s token. When debugging Forbidden errors from the application process, which identity matters most?
• On-call staff need a ServiceAccount that can inspect Pods and Deployments in the billing namespace for troubleshooting but must not delete or mutate them. Which Role verb set best matches least privilege?
• An app ServiceAccount should update only the ConfigMap named billing-ui-config, not every ConfigMap in the namespace. How should the Role be constrained?
• After a Pod create, the stored object includes an extra envoy sidecar container that was not in the developer’s manifest. A separate webhook later rejects Pods missing a required annotation. What admission behaviors do these describe?
• A municipal API container should reserve 100 millicores and 128Mi of memory while capping use at 500 millicores and 256Mi. Which resources block matches that intent?
• A new parks-api Pod stays Pending. kubectl describe shows FailedScheduling with Insufficient cpu, and the Pod’s requests.cpu is 4 on nodes that each have about 2 allocatable cores left. What is the most accurate diagnosis?
• A payment container’s memory limit is 256Mi. Under a traffic spike the process allocates beyond that limit and the container exits with reason OOMKilled. What caused that termination?
• On-call notices a city API Pod is slow but still Running. Metrics show the container repeatedly hitting its CPU limit, while memory stays under the memory limit. What behavior should they expect from those limits?
• Creating another Pod in the permits namespace returns Forbidden with a message that a ResourceQuota is exceeded for pods count. What does that indicate?
• A developer creates a Pod in a namespace that has a LimitRange defining default CPU and memory limits. The Pod template omitted resources entirely. After admission, what typically appears on the container?
• How does Kubernetes assign Guaranteed, Burstable, or BestEffort QoS to a Pod based on container requests and limits?
• A team cannot create additional ConfigMaps in the finance namespace even though CPU and memory quota still show headroom. Which ResourceQuota capability most likely explains the deny?
• Civic payment Pods must receive Guaranteed QoS so they are last to be evicted under memory pressure. What resources configuration achieves that for every container?
• A LimitRange in the reporting namespace sets max memory to 1Gi for containers. A developer submits a Pod requesting 4Gi of memory. What is the expected result?
• A developer needs a ConfigMap holding a non-sensitive database host for a city permits app using kubectl. Which approach correctly creates that configuration object?
• A Deployment should inject every key from ConfigMap permits-settings as environment variables without listing each key. Which Pod spec pattern does that?
• Only the apiurl key from ConfigMap city-portal should become the PORTALURL environment variable. Which configuration is appropriate?
• An app expects configuration files under /etc/config inside the container. The data lives in ConfigMap portal-files. How should the Pod consume it as files?
• Operators update a ConfigMap that is mounted as files into running Pods. Environment variables were also injected from the same ConfigMap at container start. What should an application developer expect?
• A team marks a ConfigMap as immutable after validating its data. What is the primary operational effect?
• A developer proposes storing a 50Mi proprietary binary installer inside a ConfigMap for a batch Job. What guidance best matches ConfigMap purpose and practical limits?
• A permits API must start with a feature flag and listen port taken from a ConfigMap without baking those values into the image. Which approach parameterizes startup args from that ConfigMap?
• A Pod in the inspections namespace mounts a volume from ConfigMap app-settings, but the ConfigMap was created only in default. What is the most likely result?
• A multi-container Pod runs an app container plus a logging sidecar. Where must CPU and memory requests be defined for accurate scheduling of both processes?
• An init container requests 2 CPU while the two app containers together request 500m. How do init container requests influence Pod scheduling?
• kubectl top shows a Deployment's Pods consistently using far less CPU and memory than their requests. What is the application-developer response to improve packing?
• A civic PDF worker Pod stays Pending with events about insufficient CPU after requesting 16 CPU on a pool of 4-CPU nodes. What should the developer do?
• A PDF rendering Pod writes large temporary files under the container filesystem and occasionally fills the node. Which resource setting specifically governs that scratch usage?
• A team wants to omit memory limits on a bursty reporting container so it can use spare node memory. What risk must they accept?
• A seasonal licensing API should run with Burstable QoS so it can use spare capacity above its baseline. How should requests and limits be set?
• Where in a Deployment manifest should a developer place container CPU and memory requests so every replica inherits them?
• A background worker needs an API token stored as an Opaque Secret named worker-token in namespace billing. Which command creates it from a literal value?
• How should a container receive a single Secret key password from Secret db-creds as the environment variable DBPASSWORD?
• A reverse-proxy sidecar must read a TLS certificate and key as files under /certs. Which consumption pattern fits?
• A teammate claims Secret objects are encrypted because data values appear as base64 in YAML. What correction is accurate?
• What is the safest source-control practice for Kubernetes Secret manifests that hold live production credentials?
• An app needs both a private registry pull credential and a database password. Which Secret-type guidance is correct?
• A Deployment injects Secret keys with envFrom.secretRef. After you update the Secret data, application processes still show the old values. What should you expect?
• A Pod mounts Secret tls-prod as a volume, but that Secret name does not exist in the Pod's namespace. What is the likely outcome?
• An Ingress must terminate HTTPS for permits.example.gov using certificate files you already have. Which Secret approach fits Ingress TLS?
• A Pod must call cloud APIs using permissions bound to ServiceAccount geo-reader instead of the namespace default. What Pod field assigns that identity?
• A static content Pod never calls the Kubernetes API. Which setting reduces unnecessary credential exposure?
• Why should powerful Roles not be bound to the namespace default ServiceAccount?
• An application needs a time-bound, audience-scoped ServiceAccount token rather than the legacy long-lived secret-based token. Which pattern should the developer use?
• Several Deployments should pull from a private registry without repeating pull-secret references on every PodSpec. What ServiceAccount technique helps?
• A Role grants get/list on ConfigMaps in maps. How is ServiceAccount map-reader authorized to use that Role?
• A city permits API service must call the Kubernetes API to get and list Endpoints using its Pod's ServiceAccount. How should the team grant only those permissions?
• A municipal billing Deployment and its metrics sidecar should not share one over-privileged identity. What ServiceAccount pattern best supports least privilege?
• A public-facing civic web Pod must not run as UID 0. Which securityContext setting best enforces that requirement?
• Platform policy for ordinary city apps requires containers not to gain extra privileges beyond their start UID. Which securityContext field should be set to false by default?
• A civic HTTPS reverse-proxy container only needs to bind privileged ports. How should Linux capabilities be configured for least privilege?
• A records app should run with a read-only root filesystem but still needs a writable cache directory. What configuration satisfies both?
• A reviewer rejects privileged: true on a routine citizen portal Deployment. Why is that setting inappropriate for ordinary application Pods?
• A team must set fsGroup for volume ownership and allowPrivilegeEscalation on a single container. Where do these securityContext fields belong?
• An image declares USER 10001 and the city policy requires matching non-root identities. How should runAsUser and runAsGroup be chosen?
• A developer wants a basic syscall filter on app Pods without custom profiles. Which seccompProfile setting is appropriate awareness-level hardening?
• A shared emptyDir volume is not group-readable by the app process even though runAsUser is set. Which Pod securityContext field should fix volume group permissions?
• A main civic container is hardened, but a logging sidecar requests CAPSYSADMIN. What should the candidate conclude?
• After enabling readOnlyRootFilesystem, a portal Pod CrashLoops because it writes temporary files under /tmp. What is the correct fix?
• A Deployment must meet common Pod Security restricted-level expectations for an ordinary app. Which checklist item belongs?
• Why should a normal ClusterIP Service-backed civic app avoid hostNetwork and hostPID?