CKAD Certified CKAD 5 — Questions and Answers
Question 1: Which kubectl command updates the image of a container named 'web' in a Deployment named 'frontend' to 'nginx:1.25'?
- kubectl edit deployment frontend --image nginx:1.25
- kubectl set image deployment/frontend web=nginx:1.25 (Correct answer)
- kubectl update deployment frontend --container web --image nginx:1.25
- kubectl patch deployment frontend --image web=nginx:1.25
Correct answer: kubectl set image deployment/frontend web=nginx:1.25
kubectl set image updates a specific container's image in a Deployment, triggering a rolling update.
Question 2: A Pod needs read access to a Secret without exposing it as an environment variable. What is the preferred approach?
- Mount the Secret as a volume and read from the file (Correct answer)
- Hardcode the value in the Dockerfile
- Store the value in a ConfigMap instead
- Use base64-encode the value directly in the pod spec
Correct answer: Mount the Secret as a volume and read from the file
Mounting Secrets as files reduces exposure versus env vars, which can be leaked via process inspection or logging.
Question 3: Which command shows the rollout history of a Deployment and lists previous revisions?
- kubectl history deployment/myapp
- kubectl rollout history deployment/myapp (Correct answer)
- kubectl describe rollout deployment/myapp
- kubectl get revisions deployment/myapp
Correct answer: kubectl rollout history deployment/myapp
kubectl rollout history shows all tracked revisions; add --revision=N for details of a specific revision.
Question 4: A pod spec sets resource requests but no limits. What happens if the node becomes memory-constrained?
- The pod is immediately evicted
- The container is OOM-killed if it consumes more than the request (Correct answer)
- The pod is throttled to its request value
- Nothing; requests without limits have no enforcement
Correct answer: The container is OOM-killed if it consumes more than the request
Without limits, containers can use memory beyond their request; when the node is under pressure, these pods (BestEffort or Burstable QoS) are evicted first.
Question 5: You need a persistent volume that survives pod deletion and can be reused. Which reclaimPolicy achieves this?
- Delete
- Recycle
- Retain (Correct answer)
- Preserve
Correct answer: Retain
Retain keeps the PersistentVolume and its data after the PVC is deleted, requiring manual cleanup before rebinding.
Question 6: What does the kubectl top pod command display?
- CPU and memory requests configured in the pod spec
- Real-time CPU and memory usage metrics for pods (Correct answer)
- Network I/O statistics for pod containers
- Historical resource usage from Prometheus
Correct answer: Real-time CPU and memory usage metrics for pods
kubectl top pod queries the metrics-server to show current CPU and memory consumption for running pods.
Question 7: Which Kubernetes object enforces that a namespace cannot exceed a specified total amount of CPU across all pods?
- LimitRange
- ResourceQuota (Correct answer)
- PodDisruptionBudget
- PriorityClass
Correct answer: ResourceQuota
ResourceQuota sets aggregate limits on resource consumption per namespace, including total CPU, memory, and object counts.
CKAD Certified CKAD 5
Which kubectl command updates the image of a container named 'web' in a Deployment named 'frontend' to 'nginx:1.25'?