CKAD CKAD 3 — Questions and Answers
Question 1: Which resource type limits the total CPU and memory that all Pods in a namespace can consume?
- LimitRange
- ResourceQuota (Correct answer)
- PodDisruptionBudget
- NetworkPolicy
Correct answer: ResourceQuota
ResourceQuota enforces aggregate resource limits across all objects in a namespace.
Question 2: A Pod must run on nodes labeled 'disktype=ssd'. Which feature achieves this without requiring tolerations?
- Node affinity (Correct answer)
- Taints and tolerations
- PodAntiAffinity
- DaemonSet
Correct answer: Node affinity
Node affinity uses node labels to constrain which nodes a Pod can be scheduled on, without needing tolerations.
Question 3: Which init container behavior is correct?
- Init containers run in parallel with app containers
- Init containers share the same network namespace as app containers
- Init containers run to completion before app containers start (Correct answer)
- Init containers restart independently if the app container crashes
Correct answer: Init containers run to completion before app containers start
Init containers must run and complete successfully in sequence before any application containers in the Pod start.
Question 4: You want to expose an application to external traffic using a hostname-based routing rule. Which object should you create?
- ClusterIP Service
- NodePort Service
- Ingress (Correct answer)
- LoadBalancer Service
Correct answer: Ingress
An Ingress resource defines HTTP/HTTPS routing rules based on hostnames and paths, routing traffic to backend Services.
Question 5: What is the purpose of a readiness probe?
- Restart the container when the application is unhealthy
- Delay container startup until dependencies are available
- Remove the Pod from Service endpoints when it cannot serve traffic (Correct answer)
- Prevent a Pod from being scheduled on an overloaded node
Correct answer: Remove the Pod from Service endpoints when it cannot serve traffic
A failing readiness probe causes the kubelet to remove the Pod's IP from Service endpoint lists so traffic is not routed to it.
Question 6: Which field in a Pod spec mounts a Secret as environment variables in a container?
- env[].valueFrom.secretKeyRef
- envFrom[].secretRef
- Both A and B are valid (Correct answer)
- volumeMounts with secretName
Correct answer: Both A and B are valid
Both env[].valueFrom.secretKeyRef (individual key) and envFrom[].secretRef (all keys) are valid ways to inject Secret data as environment variables.
Question 7: When using 'kubectl rollout undo deployment/my-app', what is rolled back by default?
- All previous revisions are cleared
- The Deployment is rolled back to the immediately previous revision (Correct answer)
- The Deployment is rolled back to revision 1
- Only the image tag is reverted
Correct answer: The Deployment is rolled back to the immediately previous revision
Without specifying --to-revision, kubectl rollout undo reverts the Deployment to the previous revision (revision N-1).
CKAD CKAD 3
Which resource type limits the total CPU and memory that all Pods in a namespace can consume?