CKAD CKAD 4 — Questions and Answers
Question 1: A container needs read-only access to a Secret value as a file. Which volume type should be used?
- configMap
- emptyDir
- secret (Correct answer)
- persistentVolumeClaim
Correct answer: secret
A secret volume mounts Secret data as files in the container's filesystem, and can be made read-only.
Question 2: Which kubectl command lets you test a Pod manifest for validity without creating the resource?
- kubectl apply -f pod.yaml --validate=true
- kubectl apply -f pod.yaml --dry-run=client (Correct answer)
- kubectl create -f pod.yaml --check
- kubectl diff -f pod.yaml
Correct answer: kubectl apply -f pod.yaml --dry-run=client
kubectl apply --dry-run=client processes the manifest locally and reports errors without sending a request to the API server.
Question 3: A CronJob is set to schedule '0 * * * *'. How often will it run?
- Every minute
- Every hour at minute 0 (Correct answer)
- Every day at midnight
- Every 0 seconds
Correct answer: Every hour at minute 0
The cron expression '0 * * * *' means 'at minute 0 of every hour', so the job runs once per hour.
Question 4: What does setting 'runAsNonRoot: true' in a Pod's securityContext enforce?
- The container image must have a non-root user defined
- Kubernetes rejects the Pod if the container would run as UID 0 (Correct answer)
- The container drops all Linux capabilities automatically
- The Pod runs in a read-only filesystem
Correct answer: Kubernetes rejects the Pod if the container would run as UID 0
runAsNonRoot: true causes the kubelet to reject the Pod at startup if the container process would run as root (UID 0).
Question 5: Which command generates a Pod manifest for an nginx container without creating it?
- kubectl run nginx --image=nginx --output=yaml
- kubectl run nginx --image=nginx --dry-run=client -o yaml (Correct answer)
- kubectl create pod nginx --image=nginx --dry-run
- kubectl generate pod nginx --image=nginx
Correct answer: kubectl run nginx --image=nginx --dry-run=client -o yaml
kubectl run with --dry-run=client -o yaml prints the generated manifest without creating the Pod in the cluster.
Question 6: A NetworkPolicy selects Pods with label 'app=db' and specifies an empty podSelector in ingress rules. What is the effect?
- No traffic is allowed into the selected Pods
- All Pods in the cluster can send traffic to the selected Pods
- All Pods in the same namespace can send traffic to the selected Pods (Correct answer)
- The policy has no effect
Correct answer: All Pods in the same namespace can send traffic to the selected Pods
An empty podSelector ({}) in an ingress from clause matches all Pods in the same namespace as the NetworkPolicy.
Question 7: Which field in a container spec sets the maximum memory a container can use before being OOMKilled?
- resources.requests.memory
- resources.limits.memory (Correct answer)
- resources.maxMemory
- spec.memoryLimit
Correct answer: resources.limits.memory
resources.limits.memory sets the hard ceiling; exceeding it causes the Linux OOM killer to terminate the container.
CKAD CKAD 4
A container needs read-only access to a Secret value as a file.
Which volume type should be used?