Certified Kubernetes Application Developer (CKAD) - Concept Practice Exam 1

1. A container image supports non-root execution, but the team wants Kubernetes to reject attempts to run it as UID zero. Which securityContext field directly requires non-root execution?
2. A container needs no privileged Linux capabilities. Which container securityContext setting explicitly removes its default capability set?
3. A data migration must run to successful completion once, with failed Pods retried under controller policy. Which workload resource best expresses that requirement?
4. A Deployment consumes a ConfigMap value through an environment variable. The ConfigMap changes, but existing containers still see the old value. What normally makes those containers receive the new environment value?
5. A Deployment rollout introduced a bad image, and its previous successful ReplicaSet is retained in revision history. Which command requests the previous Deployment revision?
6. A Deployment update must create at most one extra Pod and tolerate no unavailable replicas. Cluster capacity is sufficient. Which fields express these limits?
7. A developer base64-encodes a password in a Secret manifest and concludes that the manifest is safe to commit publicly. Which statement corrects that conclusion?
8. A distributed application requires stable per-replica identities and separate persistent storage that follows each replica's identity across replacement. Which controller is the best match?
9. A Go application needs a compiler during the build but not while running. The team wants a small runtime image without build tools. Which image-build approach fits?
10. A namespace applies default-deny egress. Application Pods must resolve cluster DNS through the DNS Service. What additional rule is typically required?
11. A namespace quota caps total requested CPU. A new Pod's request would exceed the remaining quota even though a node has spare CPU. What should the developer expect?
12. A namespace should provide default CPU requests and limits when developers omit them from container specifications. Which resource supplies these defaults?
13. A NetworkPolicy has two separate ingress from entries: one with namespaceSelector team=blue, another with podSelector app=client. How are those peers combined?
14. A platform installs a namespaced Widget CRD. Developers need to inspect the fields accepted for Widget objects. Which command uses the API's published schema for this purpose?
15. A Pod contains containers api and metrics. A developer needs the api container's logs, but the Pod has no default-container annotation. Which command is unambiguous?
16. A Pod must authenticate to an external service using a short-lived Kubernetes service account token with a specific audience. Which mechanism is designed for this?
17. A production container has no shell or diagnostic utilities. The application must remain running while an authorized developer investigates its network namespace. Which Kubernetes capability supports adding a temporary debugging container to that Pod?
18. A scheduled report sometimes runs longer than its schedule interval. New runs should be skipped while a previous run from the same CronJob is active. Which setting fits?
19. A Service's targetPort is the name http. Its selected Pods expose a container port named web instead. Which change directly makes the named targetPort resolve?
20. A team uses a Kustomize base for an API. Staging must add an environment-specific annotation without editing the base. What should be added?
21. A team wants a small canary release alongside a stable Deployment using one ordinary Service. Which arrangement allows both versions to receive traffic without claiming precise percentage control?
22. An application can take two minutes to initialize. Once started, it should restart if it becomes unhealthy and stop receiving Service traffic while temporarily unready. Which probe design fits?
23. An application Pod fails readiness checks. Its Service uses the normal default behavior and does not publish unready addresses. What is the expected effect on ordinary Service traffic?
24. An application requires a generated configuration file before its main container starts. Both containers share a volume. Which pattern ensures the preparation step completes first?
25. An existing Helm release needs a changed replicaCount value supported by its chart. The team wants the change recorded in release history. Which action is appropriate?
26. An Ingress in namespace storefront references a TLS Secret named shop-cert. Where should that Secret normally exist?
27. An Ingress rule routes host shop.example and path /cart to a backend. Requests with a different Host header reach the same controller but do not match that rule. What should the developer check first?
28. An older manifest uses an API version removed from the target cluster. What is the appropriate preparation before deployment?
29. Blue and green Deployments are healthy and labeled with different version values. A Service currently selects version=blue. How can the team switch all Service traffic to green without changing either Deployment's image?
30. Two containers in one Pod need temporary shared scratch files. The files may survive a container restart but may be lost when the Pod is replaced. Which volume fits?

Comments — 0