Certified Kubernetes Application Developer (CKAD) practice questions

Question 1 · Application Design and Build

A developer at Thornbury Logistics packages a report generator that must run once, write a CSV to object storage, and exit. If the container exits non-zero, Kubernetes should retry it up to 4 times before giving up. Which workload object and field combination satisfies this?

1. A.A ReplicaSet with `spec.replicas: 1` and an `activeDeadlineSeconds` of 4
2. B.A Job with `spec.backoffLimit: 4` and `spec.template.spec.restartPolicy: OnFailure`
3. C.A Deployment with `spec.replicas: 1` and `spec.template.spec.restartPolicy: OnFailure`
4. D.A CronJob with `spec.schedule: "@once"` and `spec.failedJobsHistoryLimit: 4`

Question 2 · Application Deployment

After running `kubectl set image deployment/beacon-web web=beacon:5.2`, a developer sees the rollout stall with 3 of 6 pods updated. She wants to return to the previously running revision immediately. Which command does this?

1. A.`kubectl rollout pause deployment/beacon-web`
2. B.`kubectl delete deployment/beacon-web --cascade=orphan`
3. C.`kubectl rollout undo deployment/beacon-web`
4. D.`kubectl scale deployment/beacon-web --replicas=0`

Question 3 · Application Observability and Maintenance

A container in the `dunmore-gateway` pod takes about 90 seconds to warm its cache at boot, and the team does not want a liveness probe killing it during that window, while still keeping a 10-second liveness check afterwards. What is the cleanest configuration?

1. A.Add a `startupProbe` with a generous `failureThreshold` × `periodSeconds` budget; liveness checks begin only after it succeeds
2. B.Set the liveness probe's `successThreshold` to 9
3. C.Add a readiness probe with `initialDelaySeconds: 90` and remove the liveness probe
4. D.Set the liveness probe's `timeoutSeconds` to 90

Question 4 · Application Environment, Configuration and Security

The `kingsmere-api` container must read a database password from a Secret named `db-creds` (key `password`) as the environment variable `DB_PASSWORD`. Which snippet is correct?

1. A.```yaml envFrom: - secretKeyRef: name: db-creds key: password ```
2. B.```yaml env: - name: DB_PASSWORD secret: db-creds/password ```
3. C.```yaml env: - name: DB_PASSWORD valueFrom: configMapKeyRef: name: db-creds key: password ```
4. D.```yaml env: - name: DB_PASSWORD valueFrom: secretKeyRef: name: db-creds key: password ```

Question 5 · Services and Networking

The `bellhaven-api` Deployment has 4 pods labeled `app=bellhaven,tier=api` listening on container port 9000. Other pods in the cluster must reach it at `bellhaven-api:80`. Which Service definition works?

1. A.A ClusterIP Service with `selector: {app: bellhaven, tier: api}` and `ports: [{port: 9000, targetPort: 80}]`
2. B.A headless Service with `clusterIP: None` and `ports: [{port: 80}]`
3. C.A NodePort Service with `ports: [{port: 80, nodePort: 9000}]`
4. D.A ClusterIP Service with `selector: {app: bellhaven, tier: api}` and `ports: [{port: 80, targetPort: 9000}]`

Question 6 · Application Design and Build

The `invoice-sweeper` CronJob at Calder Mutual is scheduled every 5 minutes, but each run occasionally takes 12 minutes. The team wants a late run to be skipped entirely if the previous one is still going. Which field setting achieves that?

1. A.`spec.suspend: true`
2. B.`spec.concurrencyPolicy: Forbid`
3. C.`spec.startingDeadlineSeconds: 0`
4. D.`spec.concurrencyPolicy: Replace`

Question 7 · Application Deployment

The `harlow-frontend` Deployment runs 10 replicas. Operations requires that during an update the service never drops below full capacity, and no more than 2 extra pods exist at any moment. Which strategy block matches?

1. A.`maxUnavailable: 2` and `maxSurge: 2`
2. B.`maxUnavailable: 2` and `maxSurge: 0`
3. C.`type: Recreate` with `maxSurge: 2`
4. D.`maxUnavailable: 0` and `maxSurge: 2`

Question 8 · Application Observability and Maintenance

`kubectl get pod ashcombe-worker` reports `CrashLoopBackOff` with 6 restarts. The current container has already restarted, so its logs show only the newest attempt. Which command shows output from the attempt that crashed?

1. A.`kubectl logs ashcombe-worker --since=0s`
2. B.`kubectl logs ashcombe-worker --previous`
3. C.`kubectl logs ashcombe-worker --tail=-1`
4. D.`kubectl describe pod ashcombe-worker --show-events=all`