CKAD Certified CKAD 4 — Questions and Answers
Question 1: Which field in a container spec defines the command that overrides the Docker ENTRYPOINT?
- spec.containers[].run
- spec.containers[].entrypoint
- spec.containers[].command (Correct answer)
- spec.containers[].exec
Correct answer: spec.containers[].command
The command field overrides the container image's ENTRYPOINT, while args overrides the CMD.
Question 2: A ConfigMap stores a multi-line config file. Which volumeMount approach injects it as a file inside the container?
- envFrom with configMapRef
- env with valueFrom.configMapKeyRef
- volumes with configMap and volumeMounts (Correct answer)
- secretRef with configMapName
Correct answer: volumes with configMap and volumeMounts
Mounting a ConfigMap as a volume projects each key as a file, allowing the container to read it from the filesystem.
Question 3: What is the security risk of setting allowPrivilegeEscalation: true in a securityContext?
- The container runs as root automatically
- A process can gain more privileges than its parent via setuid binaries (Correct answer)
- The container bypasses NetworkPolicies
- Pod resource limits are ignored
Correct answer: A process can gain more privileges than its parent via setuid binaries
allowPrivilegeEscalation: true permits a child process to obtain higher privileges than its parent, enabling setuid exploits.
Question 4: You want a Job to retry failed pods up to 4 times before marking the Job as failed. Which field controls this?
- spec.maxRetries
- spec.backoffLimit (Correct answer)
- spec.restartLimit
- spec.failureThreshold
Correct answer: spec.backoffLimit
spec.backoffLimit specifies how many times a Job will retry by creating new pods before the Job is considered failed.
Question 5: A CronJob's schedule '*/15 * * * *' means the job runs at what frequency?
- Every 15 hours
- Every 15 seconds
- Every 15 minutes (Correct answer)
- On the 15th of every month
Correct answer: Every 15 minutes
The cron expression */15 in the minutes field triggers the job every 15 minutes throughout the day.
Question 6: Which resource limits field prevents a container from using more than a set amount of CPU?
- resources.requests.cpu
- resources.limits.cpu (Correct answer)
- resources.max.cpu
- resources.quota.cpu
Correct answer: resources.limits.cpu
resources.limits.cpu enforces a hard ceiling; exceeding it causes CPU throttling by the container runtime.
Question 7: Which probe type checks if a container is ready to serve traffic before routing requests to it?
- livenessProbe
- startupProbe
- readinessProbe (Correct answer)
- healthProbe
Correct answer: readinessProbe
readinessProbe controls when a pod is added to a Service's Endpoints; failing pods are removed from load balancing.
CKAD Certified CKAD 4
Which field in a container spec defines the command that overrides the Docker ENTRYPOINT?