Certified Kubernetes Application Developer (CKAD) Exam Questions

Domain 1: Application Design and Build (20%)

---

A developer wants two containers in the same Pod to share the same network namespace (so they can reach each other over localhost) and the same set of mounted volumes. Which Kubernetes concept guarantees this?

⬜ Containers in the same Pod always share the Pod’s network namespace and can share mounted volumes by default.
⬜ Each container in a Pod always gets its own isolated network namespace.
⬜ Containers must be in separate Pods to share localhost networking.
⬜ Sharing localhost networking requires a dedicated NetworkPolicy.

A developer wants a lightweight helper container to run continuously alongside the main application container for the life of the Pod (for example, to stream logs to a remote endpoint), rather than running once before the main container starts. Which container type is designed for this?

⬜ An init container
⬜ A sidecar container
⬜ A Job
⬜ A DaemonSet

Which statement about Open Container Initiative (OCI) images is correct in the context of Kubernetes?

⬜ Kubernetes can only run images built specifically by Docker Desktop.
⬜ Kubernetes runs containers based on OCI-compliant container images and uses an OCI-compatible container runtime (such as containerd or CRI-O) to run them.
⬜ Kubernetes builds container images internally and does not use any image format standard.
⬜ OCI images can only be pulled from Docker Hub.

A developer wants to reduce a container image’s final size by excluding build-time tools and intermediate build artifacts from the image that actually gets deployed. Which Docker/OCI build technique is designed for this?

⬜ A multi-stage build, where a builder stage compiles the application and only the necessary artifacts are copied into a smaller final stage.
⬜ Running docker pull twice.
⬜ Setting a higher CPU limit in the Pod spec.
⬜ Adding more init containers to the Pod.

A Pod requires a specific container runtime feature and the cluster supports multiple container runtimes. Which Kubernetes interface standardizes how the kubelet communicates with any compliant container runtime (such as containerd or CRI-O)?

⬜ The Container Storage Interface (CSI)
⬜ The Container Runtime Interface (CRI)
⬜ The Container Network Interface (CNI)
⬜ The Custom Resource Definition (CRD) interface

A Pod has two containers: a main web server container and a helper container that must successfully fetch a TLS certificate before the web server starts. Which pattern correctly enforces this ordering?

⬜ Define the certificate-fetching container as a sidecar container.
⬜ Define the certificate-fetching container as an init container, since init containers run to completion, in order, before app containers start.
⬜ Put both containers in the same container image.
⬜ Use a NetworkPolicy to delay the web server’s start.

Which of these is a valid, commonly used multi-container Pod design pattern for adding functionality to a main application container without modifying its code?

⬜ The ‘ambassador’ pattern, where a helper container proxies network connections on behalf of the main container.
⬜ Running the same image twice with identical names in the same Pod.
⬜ Deploying two unrelated applications randomly into one Pod for convenience.
⬜ Disabling all containers except one at runtime.

A developer wants their application Pod to automatically restart failed containers, following the Pod’s restart policy. Which field controls this at the Pod level?

⬜ spec.restartPolicy
⬜ metadata.labels
⬜ spec.nodeName
⬜ spec.serviceAccountName

A developer needs to deploy a stateless REST API with 5 replicas and wants Kubernetes to automatically replace any replica that crashes, while supporting rolling updates. Which object should they create?

⬜ A bare Pod, repeated 5 times manually.
⬜ A Deployment with replicas: 5.
⬜ A StatefulSet with replicas: 5.
⬜ A Job with completions: 5.

A team is deploying a clustered database where each replica needs a stable, unique network identity (e.g., db-0, db-1, db-2) and its own dedicated persistent storage that survives Pod rescheduling. Which object should they use?

⬜ Deployment
⬜ DaemonSet
⬜ StatefulSet
⬜ ReplicaSet

A team wants a monitoring agent Pod to run on every node in the cluster (including future nodes added later), rather than a fixed replica count. Which object is the correct choice?

⬜ Deployment
⬜ DaemonSet
⬜ Job
⬜ CronJob

A batch report-generation script needs to run to completion once a day at midnight, and Kubernetes should retry it if it fails. Which object combination is correct?

⬜ A Deployment with replicas: 1
⬜ A CronJob, which creates a Job on the defined schedule
⬜ A DaemonSet with a schedule field
⬜ A bare Pod with restartPolicy: Always

Domain 2: Application Deployment (20%)

---

A developer updates a Deployment’s container image to a new version, and Kubernetes gradually replaces old Pods with new ones while keeping the application available throughout. Which Deployment strategy is being used by default?

⬜ Recreate strategy
⬜ RollingUpdate strategy
⬜ Blue-green deployment, natively built into Deployment objects
⬜ Canary deployment, natively built into Deployment objects

After rolling out a new Deployment revision, the application starts failing. Which command lets the developer revert the Deployment to its previous working revision?

⬜ kubectl rollout undo deployment/
⬜ kubectl delete deployment/
⬜ kubectl scale deployment/ –replicas=0
⬜ kubectl cordon deployment/

A developer wants to control how many Pods can be unavailable at once during a Deployment’s rolling update, to balance rollout speed against maintaining capacity. Which Deployment fields control this?

⬜ replicas and selector
⬜ maxUnavailable and maxSurge under the RollingUpdate strategy
⬜ readinessProbe and livenessProbe
⬜ resources.requests and resources.limits

Which command correctly updates only the container image of an existing Deployment named web, triggering a new rollout, without editing the full YAML manifest?

⬜ kubectl set image deployment/web web-container=myapp:v2
⬜ kubectl get deployment web
⬜ kubectl label deployment web app=web
⬜ kubectl top deployment web

A developer wants to temporarily pause an in-progress Deployment rollout to make several changes without triggering multiple separate rollouts, then resume it as a single rollout. Which commands support this workflow?

⬜ kubectl rollout pause deployment/ … kubectl rollout resume deployment/
⬜ kubectl delete deployment/ then kubectl apply -f
⬜ kubectl cordon deployment/
⬜ kubectl drain deployment/

A StatefulSet named db with 3 replicas is being scaled down. In which order does Kubernetes terminate the Pods by default?

⬜ In random order, to maximize speed.
⬜ In reverse ordinal order — the highest-numbered Pod (e.g., db-2) is terminated first.
⬜ All Pods are terminated simultaneously regardless of ordinal.
⬜ In alphabetical order of the node names they’re running on.

Domain 3: Application Observability and Maintenance (15%)

---

A container in a Pod is running but the application inside has deadlocked and stopped responding, though the process itself hasn’t exited. Which probe should be configured so Kubernetes detects this and restarts the container?

⬜ A startup probe only
⬜ A liveness probe
⬜ A readiness probe only, with no liveness probe
⬜ No probe is needed; Kubernetes detects deadlocks automatically

A Pod’s container is fully running but the application takes 30 seconds to warm up before it can serve traffic. Without any additional configuration, a naive liveness probe with a short timeout might kill the container before it finishes starting. Which probe type is specifically designed to solve this?

⬜ A readiness probe only
⬜ A startup probe, which disables liveness and readiness checks until it succeeds
⬜ A NetworkPolicy
⬜ A ResourceQuota

A Pod is Running, but a Service is not sending it any traffic. kubectl describe pod shows the container is not passing a certain probe. Which probe type, when failing, causes a Pod to be removed from a Service’s list of active endpoints without restarting the container?

⬜ Liveness probe
⬜ Readiness probe
⬜ Startup probe
⬜ Exec probe (as a category, unrelated to readiness)

A developer needs to see the last 50 lines of a currently running container’s logs, and then continue streaming new log lines as they’re generated. Which kubectl command accomplishes this?

⬜ kubectl logs –tail=50 -f
⬜ kubectl describe pod
⬜ kubectl top pod
⬜ kubectl get pod -o wide

A Pod has two containers, app and sidecar. Which command retrieves the logs specifically from the sidecar container?

⬜ kubectl logs -c sidecar
⬜ kubectl logs
⬜ kubectl exec – logs sidecar
⬜ kubectl describe pod -c sidecar

Which command displays real-time CPU and memory usage for all Pods in the current namespace, assuming the Metrics Server is installed?

⬜ kubectl get events
⬜ kubectl top pods
⬜ kubectl describe namespace
⬜ kubectl get componentstatuses

A developer wants their application to expose custom metrics (like request count or queue depth) in a format that a Prometheus-compatible monitoring stack can scrape. What is the standard approach?

⬜ Expose the metrics on an HTTP endpoint (commonly /metrics) in the Prometheus text exposition format, using a client library, so a Prometheus server can scrape it.
⬜ Write metrics directly into etcd from the application.
⬜ Metrics must be emailed to the monitoring team manually.
⬜ Use a NetworkPolicy to broadcast metrics to all Pods.

A Pod keeps restarting and kubectl get pods shows CrashLoopBackOff. Which command shows the logs from the PREVIOUS (already-terminated) instance of the container, which is often essential for diagnosing the crash?

⬜ kubectl logs –previous
⬜ kubectl logs –since=1h
⬜ kubectl get pod -o yaml
⬜ kubectl rollout status deployment/

Domain 4: Application Environment, Configuration and Security (25%)

---

A developer building a container image wants to follow best practice by NOT running the application process as the root user inside the container. Where is this enforced at the Kubernetes Pod/container level?

⬜ In the Pod or container securityContext, using fields like runAsNonRoot and runAsUser.
⬜ In the container image’s file system permissions only, with no Kubernetes-level control.
⬜ In a NetworkPolicy.
⬜ In a StorageClass.

A development team wants to store their application container images in a private registry and have Kubernetes authenticate to pull them. Which Kubernetes object is used to hold registry credentials referenced by a Pod’s imagePullSecrets?

⬜ A ConfigMap
⬜ A Secret of type kubernetes.io/dockerconfigjson
⬜ A ResourceQuota
⬜ A PodDisruptionBudget

A developer wants to inject a non-sensitive configuration value (such as a feature flag) into a container as an environment variable, sourced from a Kubernetes object that can be updated independently of the container image. Which object should they use?

⬜ A Secret
⬜ A ConfigMap
⬜ A PersistentVolumeClaim
⬜ A ResourceQuota

A developer needs to inject a database password into a container as an environment variable, but must avoid storing it in plain text within the Pod spec’s YAML or the container image. Which approach correctly meets this requirement?

⬜ Hardcode the password directly in the Deployment YAML’s env field.
⬜ Store the password in a Secret, and reference it in the container’s env using valueFrom.secretKeyRef.
⬜ Store the password in a public ConfigMap.
⬜ Bake the password into the container image at build time.

A developer wants an entire ConfigMap’s key-value pairs to appear as individual files inside a container, where each key becomes a filename and its value becomes the file’s content. Which approach achieves this?

⬜ Mount the ConfigMap as a volume in the Pod spec.
⬜ Reference the ConfigMap only via envFrom.
⬜ This is not possible; ConfigMaps can only be used as environment variables.
⬜ Use a StorageClass referencing the ConfigMap.

A Pod needs to make authenticated calls to the Kubernetes API server itself (for example, to list Pods in its own namespace) using an identity Kubernetes manages, rather than a human user’s credentials. Which object provides this identity?

⬜ A ServiceAccount
⬜ A ConfigMap
⬜ A NetworkPolicy
⬜ A PersistentVolume

A Pod’s ServiceAccount needs permission to list and get Secrets, but only within its own namespace, following least privilege. Which combination of objects correctly grants this?

⬜ A ClusterRole and ClusterRoleBinding scoped to the whole cluster.
⬜ A Role (scoped to the namespace) bound to the ServiceAccount via a RoleBinding.
⬜ No RBAC object is needed; ServiceAccounts have full access by default.
⬜ A NetworkPolicy allowing traffic to the Secrets API.

A security team wants to enforce that containers in a certain namespace cannot run as the root user and cannot escalate privileges, using a cluster-wide, built-in policy mechanism (rather than a third-party admission controller). Which Kubernetes-native feature should they use?

⬜ Pod Security Standards, enforced via Pod Security Admission at the namespace level.
⬜ A ConfigMap labeled security=enforced.
⬜ A ResourceQuota with a CPU limit.
⬜ A headless Service.

Which securityContext field, when set to true, prevents a container’s root filesystem from being written to, reducing the impact of certain container escape or tampering attempts?

⬜ runAsNonRoot
⬜ readOnlyRootFilesystem
⬜ allowPrivilegeEscalation
⬜ privileged

A namespace administrator wants to cap the total amount of CPU and memory that can be requested across ALL Pods in a namespace, to prevent one team from consuming the entire cluster’s capacity. Which object should they create?

⬜ A LimitRange
⬜ A ResourceQuota
⬜ A NetworkPolicy
⬜ A PodDisruptionBudget

A developer wants a Pod’s container to automatically pick up environment variables named after EVERY key in a ConfigMap, without listing each key individually. Which field should they use in the container spec?

⬜ env, listing each key one at a time
⬜ envFrom, referencing the ConfigMap
⬜ volumeMounts, with no ConfigMap reference
⬜ resources.requests

Which of these is generally considered a best practice regarding Secrets in Kubernetes?

⬜ Store Secrets in plain-text ConfigMaps to simplify management.
⬜ Limit which ServiceAccounts, Roles, and namespaces can access a given Secret using RBAC, and avoid printing Secret values into logs.
⬜ Commit raw Secret manifests containing plain-text sensitive values directly into a public source-code repository.
⬜ Grant every ServiceAccount in the cluster access to every Secret by default.

A developer wants to prevent a container from being able to escalate its privileges beyond its parent process, as an additional hardening measure alongside running as a non-root user. Which securityContext field controls this directly?

⬜ allowPrivilegeEscalation, set to false
⬜ readOnlyRootFilesystem, set to true
⬜ runAsUser, set to 0
⬜ hostNetwork, set to true

Domain 5: Services and Networking (20%)

---

A security team wants to restrict a group of Pods labeled tier=backend so they can only receive traffic from Pods labeled tier=frontend, denying all other ingress traffic. Which object correctly enforces this?

⬜ A NetworkPolicy with an ingress rule that selects podSelector: {tier: backend} and allows from Pods matching tier: frontend.
⬜ A ResourceQuota restricting Pod count.
⬜ A ConfigMap labeled tier=backend.
⬜ A ServiceAccount bound to the backend Pods.

A developer has a Deployment of backend Pods and wants other Pods in the same cluster to reach them at a stable internal address, without exposing them outside the cluster. Which Service type is appropriate?

⬜ ClusterIP
⬜ NodePort
⬜ LoadBalancer
⬜ ExternalName

A developer wants a single external HTTP entry point that routes /api requests to one backend Service and /web requests to a different backend Service, based on URL path. Which object should they configure?

⬜ A ClusterIP Service
⬜ An Ingress resource with path-based routing rules
⬜ A headless Service
⬜ A PersistentVolumeClaim

A developer’s Pod tries to reach another Service by its short name (e.g., payments) instead of the fully qualified domain name, and it works correctly when calling from within the same namespace. What makes this possible?

⬜ Kubernetes cluster DNS automatically appends the Pod’s own namespace and cluster domain suffix through its configured search domains, resolving the short name.
⬜ Kubernetes requires the fully qualified name always; short names never work.
⬜ The Pod must have a hard-coded IP address for every Service it calls.
⬜ Short names only work if NetworkPolicy explicitly allows DNS.

A developer wants to test connectivity to a Service directly from their local machine during development, without modifying the Service type or deploying an Ingress. Which kubectl command temporarily forwards a local port to a Service or Pod?

⬜ kubectl port-forward svc/ 8080:80
⬜ kubectl expose service
⬜ kubectl cordon svc/
⬜ kubectl taint svc/

Which statement about Kubernetes NetworkPolicy behavior is correct when NO NetworkPolicy selects a given Pod?

⬜ All traffic to and from that Pod is denied by default.
⬜ All traffic to and from that Pod is allowed by default (Kubernetes networking is permissive unless a NetworkPolicy restricts it).
⬜ Only traffic from the same namespace is allowed.
⬜ Only traffic on port 80 is allowed.

A developer needs their application Pod to discover the individual Pod IPs backing a StatefulSet (for peer discovery in a clustered application) rather than a single load-balanced address. Which Service configuration is designed for this?

⬜ A LoadBalancer Service
⬜ A Headless Service (clusterIP: None)
⬜ A NodePort Service
⬜ An Ingress resource

A Service’s selector is app: cart, but no existing Pods currently carry the label app: cart. What happens to the Service’s Endpoints/EndpointSlices?

⬜ The Service automatically creates new Pods matching the selector.
⬜ The Service exists but has no active Endpoints, so it will not route traffic to any Pod until matching Pods appear.
⬜ The Service throws a validation error and cannot be created.
⬜ The Service falls back to routing traffic to any random Pod in the namespace.

Which Service type builds on NodePort and additionally provisions an external load balancer (typically from a cloud provider) to distribute traffic to the Service?

⬜ ClusterIP
⬜ NodePort
⬜ LoadBalancer
⬜ ExternalName

A developer wants an Ingress resource to route based on the incoming request’s hostname (e.g., api.example.com vs. shop.example.com) to two different backend Services. Which Ingress feature supports this?

⬜ Path-based routing only, with no support for hostnames.
⬜ Host-based (name-based virtual hosting) routing rules within the Ingress spec.
⬜ A separate LoadBalancer Service per hostname is strictly required instead.
⬜ NetworkPolicy hostname matching.

A developer’s application needs to reach a Service in a DIFFERENT namespace (billing) named invoices. Which is the correct fully qualified DNS name to use from a Pod in another namespace?

⬜ invoices.svc.cluster.local
⬜ invoices.billing.svc.cluster.local
⬜ billing.invoices.svc.cluster.local
⬜ invoices://billing