CKAD Configuration and Secrets 2 — Questions and Answers
Question 1: Which field in a container spec sets the CPU resource request?
- resources.limits.cpu
- resources.requests.cpu (Correct answer)
- resources.cpu.request
- spec.cpu.min
Correct answer: resources.requests.cpu
'resources.requests.cpu' defines the minimum CPU the scheduler guarantees for the container.
Question 2: A pod has CPU limit of '500m'. What does '500m' represent?
- 500 megabytes of CPU
- 0.5 CPU cores (500 millicores) (Correct answer)
- 500 MHz of CPU frequency
- 5 CPU cores
Correct answer: 0.5 CPU cores (500 millicores)
In Kubernetes, 'm' stands for millicores; 500m equals 0.5 CPU cores.
Question 3: What happens to a container that exceeds its memory limit in Kubernetes?
- It is throttled to the limit
- It is OOMKilled and restarted (Correct answer)
- It receives an eviction warning
- Nothing — limits are soft caps
Correct answer: It is OOMKilled and restarted
When a container exceeds its memory limit, the Linux kernel's OOM killer terminates it, and Kubernetes restarts it per the restart policy.
Question 4: Which Kubernetes resource type sets default resource requests and limits for all containers in a namespace?
- ResourceQuota
- LimitRange (Correct answer)
- PodDisruptionBudget
- PriorityClass
Correct answer: LimitRange
A LimitRange enforces default and maximum resource requests/limits for pods and containers in a namespace.
Question 5: A container spec has 'securityContext.runAsNonRoot: true'. What does this enforce?
- The container runs with UID 0 forbidden (Correct answer)
- The container cannot write to the filesystem
- The container has no network access
- The container runs in a separate namespace
Correct answer: The container runs with UID 0 forbidden
'runAsNonRoot: true' causes Kubernetes to reject the container if its image runs as root (UID 0).
Question 6: What does 'securityContext.readOnlyRootFilesystem: true' do to a container?
- Makes the container image read-only for pulling
- Mounts the container's root filesystem as read-only (Correct answer)
- Prevents the container from reading secrets
- Prevents changes to the container spec
Correct answer: Mounts the container's root filesystem as read-only
Setting 'readOnlyRootFilesystem: true' mounts the container's root filesystem read-only, preventing writes to it.
CKAD Configuration and Secrets 2
Which field in a container spec sets the CPU resource request?