Linux Foundation / CNCF CKAD: Certified Kubernetes Application Developer

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Application Environment, Configuration and Security

   Which two approaches keep a database password out of a container image? (Choose two.)

   1. AHard-code the password in the Dockerfile
   2. BStore the password in a ConfigMap and print it in the logs
   3. CBake the password into the image's environment variables
   4. DReference the password through a Secret object managed outside the image
   5. EMount the password from a Secret as an environment variable or a file
   Show answer and explanationHide answer

   Correct answer: D, E

   Secrets injected at runtime, either as environment variables or files, keep credentials out of images. Dockerfiles, ConfigMaps used for secrets, and baked-in variables all embed the password in artifacts or logs.

2. Question 2Application Observability and Maintenance

   A pod is running but the team wants Kubernetes to restart it automatically if the application stops responding to HTTP requests. Which feature should be configured?

   1. AA liveness probe that checks the HTTP endpoint
   2. BA readiness probe that drops traffic, with no restart
   3. CA label on the pod that the Service selector matches
   4. DA larger memory request for the container
   Show answer and explanationHide answer

   Correct answer: A

   A liveness probe checks whether the container is healthy and restarts it when the check fails. A readiness probe only controls traffic routing, and memory requests and labels do not detect unresponsive apps.

3. Question 3Services and Networking

   A pod inside the cluster must reach a backend that runs in other pods behind a stable name and virtual IP. Which resource provides this?

   1. AA NodePort Service on a random port only
   2. BA pod with a changing IP address that others call directly
   3. CAn Ingress resource with no backend Service
   4. DA ClusterIP Service
   Show answer and explanationHide answer

   Correct answer: D

   A ClusterIP Service gives a stable name and virtual IP that load-balances to matching pods. Direct pod IPs change when pods are replaced, and an Ingress needs a backend Service to route to.

4. Question 4Application Design and Build

   A developer needs a container that runs to completion once to prepare data before the main application starts. Which Kubernetes construct fits best?

   1. AA ReplicaSet with three replicas
   2. BA second long-running container in the same pod
   3. CA DaemonSet that runs on every node
   4. DAn init container in the pod spec
   Show answer and explanationHide answer

   Correct answer: D

   Init containers run to completion before the app containers start, which suits one-time preparation. A second long-running container runs alongside the app, a DaemonSet targets nodes, and a ReplicaSet maintains replicas of a long-running pod.

5. Question 5Application Deployment

   A deployment must update its pods gradually so that some replicas always remain available during the update. Which strategy should be configured?

   1. ARecreate, which stops all pods before starting new ones
   2. BRollingUpdate with maxUnavailable and maxSurge settings
   3. CDeleting the deployment and creating it again
   4. DEditing each pod by hand
   Show answer and explanationHide answer

   Correct answer: B

   RollingUpdate replaces pods gradually, and maxUnavailable and maxSurge control how many can be down or extra. Recreate causes downtime, and deleting or hand-editing pods is error-prone and disruptive.