CKAD sample questions

Question 1

A Go service is built from a Dockerfile that uses a 900 MB SDK base image, and the resulting image ships the whole toolchain alongside a 20 MB binary.

Which Dockerfile change produces the smallest final image while still compiling inside the build?

Accepted Answer

Compile in an SDK-based first stage, then COPY --from that stage only the binary into a minimal final stage. A multi-stage build leaves the toolchain in an intermediate stage and copies only the artefacts into the final stage, so the SDK never reaches the shipped image. Deleting the SDK in a later RUN step is tempting, but the files still exist in the earlier layers, so the image does not shrink.

Question 2

A backup must run every day at 02:30. If the previous run is still going, the new run must be skipped rather than interrupting the running one.

Which CronJob spec meets the requirement?

Accepted Answer

schedule: "30 2 * * *" with concurrencyPolicy: Forbid. Cron fields are minute then hour, so 30 2 means 02:30, and Forbid skips a new run while the previous Job is still active. Replace is tempting because it also prevents overlap, but it does so by cancelling the running Job, which the requirement rules out.

Question 3

Minutes after switching Service web from version: blue to version: green, error rates spike. The web-blue Deployment has not been scaled down.

What is the fastest safe way to roll back?

Accepted Answer

Point the Service selector back to version: blue, which is still running. Keeping the blue Deployment running is what makes blue/green rollback instant: you only repoint the Service selector. rollout undo is tempting, but it changes the green Deployment's own Pod template and leaves the Service pointing at green while new Pods roll out.

Question 4

A service takes an exclusive schema lock on start-up and crashes if two versions of it run at once. Brief downtime during upgrades is acceptable.

Which Deployment strategy guarantees that old and new versions never run at the same time?

Accepted Answer

strategy.type: Recreate. Recreate terminates all existing Pods before creating any new ones, so versions never overlap, at the cost of downtime. maxSurge: 0 is tempting, but a rolling update still replaces Pods one at a time, so old and new Pods run side by side during the rollout.

Question 5

kubectl logs api-5d8 reports that a container name must be specified; the Pod has containers app and proxy.

Which command shows the proxy container's logs?

Accepted Answer

kubectl logs api-5d8 -c proxy. In a multi-container Pod you choose the container with -c (--container), or use --all-containers to see every one. The pod/container form is tempting, but kubectl logs does not accept that syntax for container names.

Question 6

livenessProbe: {httpGet: {path: /healthz, port: 8080}, periodSeconds: 5, timeoutSeconds: 1, failureThreshold: 4}

Roughly how long after the app hangs will the kubelet restart the container?

Accepted Answer

About 20 seconds. The container is restarted after failureThreshold consecutive failures, and probes run every periodSeconds, so 4 failures x 5 seconds is about 20 seconds. Five seconds is the tempting answer, but a single failed probe is not enough when failureThreshold is 4.

Question 7

What does resources.requests.cpu: 250m mean?

Accepted Answer

A quarter of one CPU core. CPU is measured in cores, and the m suffix means thousandths, so 250m is 0.25 CPU. Reading m as megabytes or megahertz is the tempting confusion; memory quantities use suffixes such as Mi or M instead.

Question 8

Pods fail with ErrImagePull because registry.example.com requires authentication.

What lets the Pods pull the image?

Accepted Answer

A docker-registry Secret listed under imagePullSecrets in the Pod spec. Image pulls are done by the kubelet before the container exists, so credentials must come from imagePullSecrets (directly or through the ServiceAccount). Mounting credentials into the container is tempting, but the container cannot start until the image has been pulled.

Question 9

Which NetworkPolicy denies all incoming traffic to every Pod in its namespace?

Accepted Answer

podSelector: {} with policyTypes: [Ingress] and no ingress rules. An empty podSelector selects every Pod in the namespace, and listing Ingress with no ingress rules allows nothing in. ingress: [{}] is the tempting near-miss, but an empty rule matches all sources, so it allows all incoming traffic instead.

Question 10

A NetworkPolicy's ingress rule contains: from: [ {namespaceSelector: {matchLabels: {team: a}}}, {podSelector: {matchLabels: {role: client}}} ] — two separate list items.

Which sources may reach the selected Pods?

Accepted Answer

Pods in namespaces labelled team: a, or role: client Pods in its own namespace. Each list item under from is a separate peer and peers are ORed, so a namespaceSelector item and a podSelector item allow either source. The AND reading is the tempting one, but that requires both selectors in the same list item, without a second dash.

CKAD sample questions with answers

CKAD sample questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

More practice