Free CKAD practice test: 30 questions with answers

Secrets injected at runtime, either as environment variables or files, keep credentials out of images. Dockerfiles, ConfigMaps used for secrets, and baked-in variables all embed the password in artifacts or logs.

Environment variables are read at container start, so pods must restart to pick up changes, while ConfigMap volumes are updated in place. Rebuilding the image is unnecessary, and deletion or real-time environment updates are incorrect.

A securityContext with a non-root user and privilege escalation disabled restricts the container. Privileged mode, host root mounts, and cluster-admin rights each expand the container's power dramatically.

A ResourceQuota caps aggregate resource requests and limits in a namespace. A LimitRange sets per-container defaults and bounds, labels are metadata, and ConfigMaps do not enforce limits.

Pod Security admission enforces standards at creation time, and the restricted level rejects root containers. Comments and documentation are advisory, and labels do not enforce runtime policy.

Requests guide scheduling by reserving a minimum, and limits cap usage at a maximum. Labels, image tags, and namespace names do not control resource reservation.

A liveness probe checks whether the container is healthy and restarts it when the check fails. A readiness probe only controls traffic routing, and memory requests and labels do not detect unresponsive apps.

A readiness probe determines when a pod is ready to receive traffic, which is the requirement here. Liveness probes restart unhealthy containers, and a startup probe delays other probes rather than gating traffic.

Describe shows events such as probe failures and OOM kills, and logs from the previous container show the crash output. Node listings, version, and kubeconfig views do not explain a pod's restarts.

kubectl top pods reports current resource usage when the metrics server is installed. Listing secrets, explaining fields, and labeling pods do not report usage.

Describe shows events and status, and get with YAML output shows the full object as stored. Deleting pods, draining, and cordoning change cluster state rather than inspect it.

The --previous flag shows logs from the last terminated container instance of a pod, which helps diagnose crashes. Listing pods, editing deployments, and draining nodes do not show earlier container output.

A ClusterIP Service gives a stable name and virtual IP that load-balances to matching pods. Direct pod IPs change when pods are replaced, and an Ingress needs a backend Service to route to.

An Ingress defines host-based routing and TLS termination in front of Services. ClusterIP Services are internal-only, ConfigMaps do not route traffic, and PersistentVolumeClaims provide storage.

NetworkPolicies use pod label selectors and are enforced only when the cluster's network plugin supports them. They apply to pods rather than nodes and do not replace Services.

Cluster DNS names for Services follow the service.namespace.svc pattern, which resolves across namespaces. A bare service name only resolves within its own namespace, and namespace names alone or IP words do not resolve a Service.

Services use label selectors to find pods, and NodePort exposes the service on a port on each node. Pod IPs change over time, ClusterIP is internal by default, and Services do not store images.

An ExternalName Service maps an in-cluster name to an external DNS name through cluster DNS. ConfigMaps do not perform name resolution, PersistentVolumes provide storage, and DaemonSets run node agents.

Init containers run to completion before the app containers start, which suits one-time preparation. A second long-running container runs alongside the app, a DaemonSet targets nodes, and a ReplicaSet maintains replicas of a long-running pod.

A Job runs pods until a specified number complete successfully and retries failures. Deployments keep pods running continuously, StatefulSets manage stateful identity, and ConfigMaps store configuration rather than run work.

An emptyDir volume is shared by containers in the same pod and survives container restarts while the pod exists. hostPath ties data to one node and exposes the host, and containers do not share their own filesystems.

StatefulSets give each replica a stable name and its own persistent storage across rescheduling. Deployments do not guarantee stable identities, Jobs run to completion, and DaemonSets place one pod per node.

Injecting configuration at deployment time keeps the image identical across environments. Separate hand-built images, hard-coded settings, and manual layer edits break that consistency.

Containers in the same pod share network and volumes, which lets a sidecar read the application's logs. Separate pods on different nodes add latency and complexity, combining processes removes the separation, and a Job after the app misses live logs.

RollingUpdate replaces pods gradually, and maxUnavailable and maxSurge control how many can be down or extra. Recreate causes downtime, and deleting or hand-editing pods is error-prone and disruptive.

kubectl rollout undo reverts a Deployment to its previous revision. Deleting all pods, scaling to zero, or recreating the deployment do not restore the previous revision cleanly.

Blue-green uses two versions and switches the Service selector after validation, which gives a fast, all-at-once cutover. A rolling update changes gradually, in-place edits are fragile, and deleting first causes an outage.

A DaemonSet runs one pod on each eligible node, which suits node-level agents like log collectors. A Job runs to completion, StatefulSets are for stable identity, and a single-replica ReplicaSet does not place a pod on every node.

kubectl scale changes the replica count of a Deployment directly. Deleting, exposing, and labeling do not change the number of replicas.

Running two Deployments with a Service that routes by replica proportion gives a simple canary, which can be stopped or expanded. Deleting pods, hand edits on nodes, and turning off the Service are disruptive or unsafe.