CKAD Certified Kubernetes Application Developer Exam — Questions and Answers

Question 1: An Ingress uses 'pathType: Prefix'. What does this mean for path matching?

Regex patterns are supported
The path is case-insensitive
Only exact path matches are routed
Any URL starting with the specified path prefix is routed to the backend (Correct answer)

Correct answer: Any URL starting with the specified path prefix is routed to the backend

'pathType: Prefix' routes requests where the URL path begins with the specified prefix, including the exact path and any sub-paths.

Question 2: A readiness probe has 'successThreshold: 3'. What does this mean?

The probe must fail 3 times before the pod is removed from endpoints
3 pods must be ready for the deployment to proceed
The probe must succeed 3 consecutive times before the container is considered ready (Correct answer)
The probe runs 3 times per second

Correct answer: The probe must succeed 3 consecutive times before the container is considered ready

'successThreshold' requires that many consecutive successes before Kubernetes marks the container as ready and adds it to service endpoints.

Question 3: In the Sidecar pattern, which describes the relationship between the sidecar and main container?

The sidecar intercepts all incoming traffic before it reaches the main container
The sidecar replaces the main container on failure
The sidecar enhances or extends the main container's functionality while running alongside it (Correct answer)
The sidecar runs only during startup and exits

Correct answer: The sidecar enhances or extends the main container's functionality while running alongside it

A sidecar runs concurrently with the main container in the same pod, extending its capabilities (e.g., log shipping, proxying).

Question 4: Which resource defines the minimum number of Pods that must be available during voluntary disruptions like node drains?

ResourceQuota
HorizontalPodAutoscaler
LimitRange
PodDisruptionBudget (Correct answer)

Correct answer: PodDisruptionBudget

A PodDisruptionBudget (PDB) specifies minAvailable or maxUnavailable to protect application availability during voluntary disruptions.

Question 5: You need a container to run only once after another container is ready. Which Pod feature should you use?

Init containers (Correct answer)
Pause containers
Ephemeral containers
Sidecar containers

Correct answer: Init containers

Init containers run sequentially and must complete before app containers start, making them ideal for one-time setup tasks.

Question 6: A NetworkPolicy selects Pods with label 'app=db' and specifies an empty podSelector in ingress rules. What is the effect?

All Pods in the cluster can send traffic to the selected Pods
All Pods in the same namespace can send traffic to the selected Pods (Correct answer)
No traffic is allowed into the selected Pods
The policy has no effect

Correct answer: All Pods in the same namespace can send traffic to the selected Pods

An empty podSelector ({}) in an ingress from clause matches all Pods in the same namespace as the NetworkPolicy.

Question 7: Which 'kubectl logs' flag shows logs from the previously terminated container instance?

--last
--previous (Correct answer)
--history
--terminated

Correct answer: --previous

'kubectl logs --previous' retrieves the logs of the last terminated container, useful for diagnosing crash causes.

Question 8: An Init Container needs to clone a Git repo before the main app starts. Which volume type is best for sharing the cloned files?

hostPath
PersistentVolumeClaim
emptyDir (Correct answer)
nfs

Correct answer: emptyDir

An emptyDir volume is ideal for passing data from an init container to app containers since it's shared within the pod and cleaned up automatically.

Question 9: What is the valid port range for NodePort Services in Kubernetes?

30000-32767 (Correct answer)
1024-65535
8000-9000
0-65535

Correct answer: 30000-32767

By default, Kubernetes allocates NodePort values in the range 30000-32767 to avoid conflicts with well-known ports.

Question 10: Which Service type exposes an application externally using a cloud provider's load balancer?

NodePort
ExternalName
ClusterIP
LoadBalancer (Correct answer)

Correct answer: LoadBalancer

LoadBalancer type provisions an external load balancer from the cloud provider, assigning a public IP that routes traffic to the service.

Question 11: A pod spec sets resource requests but no limits. What happens if the node becomes memory-constrained?

The pod is immediately evicted
The container is OOM-killed if it consumes more than the request (Correct answer)
Nothing; requests without limits have no enforcement
The pod is throttled to its request value

Correct answer: The container is OOM-killed if it consumes more than the request

Without limits, containers can use memory beyond their request; when the node is under pressure, these pods (BestEffort or Burstable QoS) are evicted first.

Question 12: What is the purpose of a Readiness Probe?

To restart a container that is stuck
To check if the node has sufficient resources
To determine if a container is ready to receive traffic (Correct answer)
To initialize a container before app code runs

Correct answer: To determine if a container is ready to receive traffic

Readiness probes tell Kubernetes when a container is ready to serve requests; failing pods are removed from Service endpoints.

Question 13: Which annotation is required on a Deployment to enable revision history tracking for rollbacks?

kubernetes.io/rollback-cause
deployment.kubernetes.io/revision
kubectl.kubernetes.io/last-applied
kubernetes.io/change-cause (Correct answer)

Correct answer: kubernetes.io/change-cause

The 'kubernetes.io/change-cause' annotation records a human-readable reason for each revision, visible in 'kubectl rollout history'.

Question 14: Which field in a PVC spec declares the minimum storage capacity the claim requires?

capacity.storage
volumeSize
storage under resources.requests (Correct answer)
storage under resources.limits

Correct answer: storage under resources.requests

The resources.requests.storage field in a PVC spec declares the minimum storage capacity required for the claim to be satisfied.

Question 15: Which Service type exposes a pod on each node's IP at a static port?

NodePort (Correct answer)
LoadBalancer
ClusterIP
ExternalName

Correct answer: NodePort

NodePort allocates a static port (30000-32767) on every node and routes external traffic to the service's ClusterIP.

Question 16: What does a Network Policy's 'podSelector: {}' (empty selector) in the 'spec' match?

No pods
All pods in the namespace (Correct answer)
Only pods with no labels
All pods in the cluster

Correct answer: All pods in the namespace

An empty podSelector '{}' matches all pods in the namespace where the NetworkPolicy is applied.

CKAD Certified Kubernetes Application Developer Exam

The CKAD is a hands-on, performance-based exam from the Linux Foundation and CNCF that certifies your ability to design, build, and deploy applications on Kubernetes. Candidates solve real-world tasks in a live Kubernetes environment within 2 hours. A score of 66% or higher is required to pass.

Questions

120 min

Time Limit

66%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds