CKAD Cheat Sheet 2026

The 30 highest-yield CKAD facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What does a pod status of 'OOMKilled' indicate? → The container exceeded its memory limit and was killed by the OS
2. How do you create a ConfigMap named 'app-config' from a literal key-value pair 'APP_ENV=production'? → kubectl create configmap app-config --from-literal=APP_ENV=production
3. Which kubectl command shows the endpoints (pod IPs) backing a Service named 'myservice'? → Both B and C show endpoint IPs
4. What is the purpose of a volumeMount entry in a container spec? → To specify the path inside the container where the volume will be accessible
5. Which volume type mounts a file or directory from the host node's filesystem directly into a Pod? → hostPath
6. Which kubectl command lists all PersistentVolumeClaims along with their status and capacity? → kubectl get pvc
7. Which multi-container pattern uses a helper container to normalize or transform the main container's output? → Adapter
8. In a multi-container pod, how do containers share network communication? → Via shared loopback interface — they share the same network namespace
9. Which access mode allows a PersistentVolume to be mounted as read-only by multiple nodes simultaneously? → ReadOnlyMany (ROX)
10. For what organization is the CKAD program in development? → Cloud Native Computing Foundation
11. What type of deployment is now the norm for modern applications? → Containerized
12. What is the purpose of a headless Service (clusterIP: None) in Kubernetes? → To allow direct DNS-based discovery of individual pod IPs instead of a virtual IP
13. What does a Network Policy 'policyTypes: [Ingress]' with no 'ingress' rules do to the selected pods? → Blocks all ingress traffic to the selected pods
14. A container spec has 'securityContext.runAsNonRoot: true'. What does this enforce? → The container runs with UID 0 forbidden
15. What is the default reclaim policy for dynamically provisioned PersistentVolumes? → Delete
16. Which volume type is automatically destroyed when all containers in a Pod exit? → emptyDir
17. What does a Liveness Probe do when it fails? → Restarts the container
18. Which Service type exposes a pod on each node's IP at a static port? → NodePort
19. A sidecar container in a pod runs a log forwarder. Which volume type allows it to read logs written by the main container? → emptyDir
20. Which Kubernetes resource type sets default resource requests and limits for all containers in a namespace? → LimitRange
21. What is a key difference between Init Containers and regular containers regarding running simultaneously? → Init containers run sequentially to completion before any app container starts
22. How can you create an emptyDir volume backed by node RAM instead of disk? → Set emptyDir.medium: Memory
23. How do you update a ConfigMap value and automatically reflect it in a pod using a mounted volume? → The mounted ConfigMap volume updates automatically after a short sync period
24. Which access mode restricts a PersistentVolume to be mounted as read-write by only a single node at a time? → ReadWriteOnce (RWO)
25. Which 'kubectl create secret' subcommand creates a TLS secret from a certificate and key file? → kubectl create secret tls my-tls --cert=tls.crt --key=tls.key
26. What is the purpose of 'kubectl port-forward pod/mypod 8080:80'? → Forwards local port 8080 to port 80 on the pod for direct testing
27. How do you mount a Secret as a volume so each key becomes a file in the pod? → Use 'volumes.secret.secretName' and mount it with 'volumeMounts'
28. What is the valid port range for NodePort Services in Kubernetes? → 30000-32767
29. A Startup Probe is used for containers with slow startup times. What happens while the Startup Probe has not yet succeeded? → Liveness and Readiness Probes are disabled until the Startup Probe succeeds
30. Which DNS name format allows a pod to reach a ClusterIP Service named 'myservice' in namespace 'prod'? → myservice.prod.svc.cluster.local