CKAD Cheat Sheet 2026

The 30 highest-yield CKAD facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does a pod status of 'OOMKilled' indicate? → The container exceeded its memory limit and was killed by the OS
2. A container needs read-only access to a Secret. What is the recommended method? → Mount the Secret as a read-only volume
3. Which field in a CronJob spec controls how many successful job completions are retained? → spec.successfulJobsHistoryLimit
4. Which field makes a container's root filesystem read-only? → spec.containers[].securityContext.readOnlyRootFilesystem: true
5. Which command scales a Deployment named 'web' to 3 replicas immediately? → kubectl scale deployment web --replicas=3
6. How do you create a ConfigMap named 'app-config' from a literal key-value pair 'APP_ENV=production'? → kubectl create configmap app-config --from-literal=APP_ENV=production
7. Which kubectl command shows the endpoints (pod IPs) backing a Service named 'myservice'? → Both B and C show endpoint IPs
8. What is the purpose of a volumeMount entry in a container spec? → To specify the path inside the container where the volume will be accessible
9. Which volume type mounts a file or directory from the host node's filesystem directly into a Pod? → hostPath
10. What does a liveness probe do when it repeatedly fails for a container? → Restarts the container
11. Which Kubernetes object automatically restarts failed pods and maintains a desired number of replicas without managing rollouts? → ReplicaSet
12. How do you expose port 8080 of a pod named 'myapp' as a ClusterIP Service named 'myapp-svc' imperatively? → kubectl expose pod myapp --port=80 --target-port=8080 --name=myapp-svc
13. Which kubectl command lists all PersistentVolumeClaims along with their status and capacity? → kubectl get pvc
14. Which Kubernetes object enforces that a namespace cannot exceed a specified total amount of CPU across all pods? → ResourceQuota
15. Which command creates a ConfigMap named 'app-config' from a literal key-value pair KEY=value? → kubectl create configmap app-config --from-literal=KEY=value
16. Which multi-container pattern uses a helper container to normalize or transform the main container's output? → Adapter
17. A Deployment rollout is failing. Which command pauses the rollout so you can investigate? → kubectl rollout pause deployment/myapp
18. In a multi-container pod, how do containers share network communication? → Via shared loopback interface — they share the same network namespace
19. Which access mode allows a PersistentVolume to be mounted as read-only by multiple nodes simultaneously? → ReadOnlyMany (ROX)
20. For what organization is the CKAD program in development? → Cloud Native Computing Foundation
21. What type of deployment is now the norm for modern applications? → Containerized
22. You need a persistent volume that survives pod deletion and can be reused. Which reclaimPolicy achieves this? → Retain
23. What is the purpose of a headless Service (clusterIP: None) in Kubernetes? → To allow direct DNS-based discovery of individual pod IPs instead of a virtual IP
24. What does a Network Policy 'policyTypes: [Ingress]' with no 'ingress' rules do to the selected pods? → Blocks all ingress traffic to the selected pods
25. A container spec has 'securityContext.runAsNonRoot: true'. What does this enforce? → The container runs with UID 0 forbidden
26. Which kubectl command streams logs from all pods matching a label selector? → kubectl logs -l app=web
27. What is the default reclaim policy for dynamically provisioned PersistentVolumes? → Delete
28. Which volume type is automatically destroyed when all containers in a Pod exit? → emptyDir
29. You need a Pod to have access to the Kubernetes API server using a specific ServiceAccount. Which field in the Pod spec assigns it? → spec.serviceAccountName
30. What does a Liveness Probe do when it fails? → Restarts the container