CKAD Dump 5 — Questions and Answers
Question 1: Which resource limits the total CPU and memory that all pods in a namespace can consume?
- LimitRange
- ResourceQuota (Correct answer)
- NetworkPolicy
- PodDisruptionBudget
Correct answer: ResourceQuota
ResourceQuota enforces aggregate resource consumption limits across all objects in a namespace.
Question 2: You need a stable network identity for each pod in a stateful application. Which resource provides this?
- Deployment with ClusterIP
- StatefulSet with Headless Service (Correct answer)
- DaemonSet with NodePort
- ReplicaSet with ExternalName
Correct answer: StatefulSet with Headless Service
StatefulSet paired with a Headless Service gives each pod a stable DNS name like pod-0.service.namespace.svc.cluster.local.
Question 3: Which init container rule is true?
- Init containers run in parallel with app containers
- Init containers share the same image as app containers
- All init containers must complete successfully before app containers start (Correct answer)
- Init containers are optional and ignored if they fail
Correct answer: All init containers must complete successfully before app containers start
Init containers run sequentially to completion before any app containers in the pod start.
Question 4: How do you add a taint to a node named 'node1' that prevents scheduling unless tolerated?
- kubectl label node node1 key=value:NoSchedule
- kubectl taint node node1 key=value:NoSchedule (Correct answer)
- kubectl annotate node node1 taint=key:value:NoSchedule
- kubectl cordon node1 --taint=key=value:NoSchedule
Correct answer: kubectl taint node node1 key=value:NoSchedule
kubectl taint node applies a taint; NoSchedule effect prevents pods without a matching toleration from being scheduled.
Question 5: A ConfigMap key-value is projected into a pod as an environment variable. Which syntax is correct in the pod spec?
- env: [{name: MY_VAR, value: configMapRef.key}]
- env: [{name: MY_VAR, valueFrom: {configMapKeyRef: {name: mycm, key: mykey}}}] (Correct answer)
- envFrom: [{name: MY_VAR, configMap: mycm}]
- env: [{name: MY_VAR, from: {configMap: mycm, key: mykey}}]
Correct answer: env: [{name: MY_VAR, valueFrom: {configMapKeyRef: {name: mycm, key: mykey}}}]
valueFrom.configMapKeyRef references a specific key from a named ConfigMap to populate an environment variable.
Question 6: Which command streams live logs from all pods matching label 'app=frontend' in namespace 'prod'?
- kubectl logs -l app=frontend -n prod --follow (Correct answer)
- kubectl logs --selector=frontend -n prod -f
- kubectl get logs -n prod -l app=frontend --stream
- kubectl watch logs app=frontend -n prod
Correct answer: kubectl logs -l app=frontend -n prod --follow
kubectl logs -l <selector> --follow streams live logs from all pods matching the label selector.
Question 7: Which field makes a container's root filesystem read-only?
- spec.containers[].securityContext.readOnlyRootFilesystem: true (Correct answer)
- spec.containers[].volumeMounts[].readOnly: true
- spec.securityContext.readOnlyFs: true
- spec.containers[].filesystem.readOnly: true
Correct answer: spec.containers[].securityContext.readOnlyRootFilesystem: true
securityContext.readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, improving security posture.
CKAD Dump 5
Which resource limits the total CPU and memory that all pods in a namespace can consume?