8 CKAD Practice Questions That Mirror the Real Exam
Welcome to this CKAD practice quiz. These 8 questions are designed to mirror the difficulty, ambiguity, and multi-domain focus of the real CNCF exam. You will be tested on core concepts like multi-container pods, resource management, network policies, troubleshooting, and more. Unlike the performance-based exam (where you type commands), these questions test your decision-making and conceptual understanding under pressure. Read each option carefully—in the real exam, the "best" answer is often the one that requires the fewest steps or follows best practices.
Question 1
You need to run a web application and a separate sidecar container that fetches configuration from an external API every 5 minutes. Which pod specification element is most appropriate to ensure the sidecar runs continuously alongside the main container? We cover this in depth in 8 AI-102 Practice Questions That Mirror the Real Exam.
A. A single pod with two containers, both with restartPolicy: Always
B. A single pod with two containers, the sidecar using initContainers
C. A single pod with two containers, the sidecar using a postStart hook
D. Two separate pods with a Service to connect them
Answer: A
Explanation: The core requirement is that both containers run for the pod's lifetime. A pod with multiple regular containers is the standard pattern for sidecars. initContainers (B) run to completion before the main container starts, so they cannot fetch continuously. A postStart hook (C) runs a command once after container start, not on a loop. Two separate pods (D) would require complex networking and is not the sidecar pattern.
Question 2
A pod is failing to schedule. The kubectl describe pod output shows 0/3 nodes are available: 3 Insufficient cpu. You check the node and see that all three nodes have 1 CPU core, and the pod requests 2 CPU cores. Which action will immediately resolve the scheduling failure without affecting other workloads?
A. Delete the pod and recreate it with resources.limits.cpu: 1
B. Edit the pod to set resources.requests.cpu: 1
C. Delete the pod and recreate it with resources.requests.cpu: 1
D. Add a node selector to target a specific node
Answer: C
Explanation: The scheduler uses requests (not limits) to determine if a node has enough capacity. Since the request is 2 CPU but nodes have 1, you must lower the request to 1. You cannot edit the pod spec of an existing pod (B is invalid for a running pod—you must delete/recreate). Setting only limits (A) doesn't change the request, so the pod still won't schedule. A node selector (D) doesn't change the resource request.
Question 3
You are asked to expose a deployment named web (port 80) on port 30080 on all cluster nodes, using a NodePort service. Which command is correct?
A. kubectl expose deployment web --type=NodePort --port=80 --target-port=30080
B. kubectl expose deployment web --type=NodePort --port=30080 --target-port=80
C. kubectl create service nodeport web --tcp=80:30080
D. kubectl expose pod web --type=NodePort --port=80 --node-port=30080
Answer: B
Explanation: In kubectl expose, --port is the service port (which will be mapped to the NodePort), and --target-port is the container port. To access the container on 80 via a NodePort of 30080, the service port should be 30080 (or you can use --node-port=30080 with --port=80). Option A reverses the ports (service port 80, target 30080—incorrect). Option C uses the wrong syntax (--tcp is not valid for create service nodeport). Option D targets a pod, not a deployment, and --node-port is not a valid flag for expose.
Question 4
You have a ConfigMap named app-config with a key database.url. You need to inject this value into a pod as an environment variable named DB_URL. Which pod spec snippet is correct?
A.
```yaml
env:
- name: DB_URL
valueFrom:
configMapKeyRef: You can explore this further in 8 AWS CloudOps Engineer Practice Questions That Mirror the Real Exam.
name: app-config
key: database.url
```
B.
```yaml
env:
- name: DB_URL
value: "{{ database.url }}"
```
C.
```yaml
envFrom:
- configMapRef:
name: app-config
```
D.
```yaml
env:
- name: database.url
valueFrom:
configMapKeyRef:
name: app-config
key: DB_URL
```
Answer: A
Explanation: The configMapKeyRef explicitly maps a specific key from a named ConfigMap to a custom environment variable name. Option B uses template syntax which is not valid in pod specs. Option C (envFrom) imports all keys as env vars, but the variable name would be database.url (not valid as an env var name in most shells) and you can't rename it. Option D reverses the key and env name, which is incorrect.
Question 5
You need to provide persistent storage to a pod using a pre-provisioned PersistentVolume (PV) that has storageClassName: slow. The PV is available. Which resource must you create first to use this PV in a pod?
A. A PersistentVolumeClaim with storageClassName: slow You might also find 8 AWS Developer Associate Practice Questions That Mirror the Real Exam helpful.
B. A StorageClass named slow
C. A PersistentVolumeClaim with storageClassName: fast
D. A pod directly referencing the PV name
Answer: A
Explanation: To bind to a specific PV, you must create a PVC that requests storage and matches the PV's storageClassName (and access modes/size). A PVC with slow will bind to the existing PV. Creating a StorageClass (B) is only needed if the PV is dynamically provisioned; here it's pre-provisioned. A mismatch (C) will not bind. Pods cannot directly reference a PV (D); they must use a PVC.
Question 6
A pod is in CrashLoopBackOff state. You run kubectl logs pod and see Error: unable to connect to database at db-service:5432. Which is the most likely cause and the first troubleshooting step?
A. The database container is not running; check kubectl get pods for the database
B. The pod's liveness probe is failing; check kubectl describe pod
C. The db-service Kubernetes Service has no endpoints; check kubectl get endpoints db-service
D. The pod's image is broken; pull a new image
Answer: C
Explanation: The error indicates a network/DNS resolution issue to db-service. The most common cause is that the Service exists but has no backing pods (endpoints). Checking endpoints is the direct, fast way to confirm. Option A is possible but less direct—you'd still need to check the service. Option B (liveness probe) would show a different error (probe failure). Option D (broken image) would show an ImagePullBackOff error, not a connection error.
Question 7
You need to audit all changes to ConfigMaps and Secrets in the cluster. Which RBAC resource should you create to allow a user to list and watch these resources cluster-wide?
A. A Role in the default namespace with get, list, watch on configmaps and secrets
B. A ClusterRole with get, list, watch on configmaps and secrets
C. A RoleBinding in each namespace
D. A ClusterRoleBinding with get, list, watch on pods
Answer: B
Explanation: To list/watch resources across all namespaces, you need a ClusterRole (which is not namespaced) and bind it via a ClusterRoleBinding. A Role (A) is namespaced and only applies to one namespace. Option C (RoleBinding per namespace) is possible but inefficient and not the best answer for "cluster-wide". Option D (ClusterRoleBinding on pods) gives access to the wrong resource.
Question 8
You have a Deployment with 3 replicas. You need to perform a rolling update to a new image tag, but you want to ensure that at least 2 pods are always available during the update. Which strategy configuration achieves this?
A. strategy: type: RollingUpdate, rollingUpdate: maxUnavailable: 1, maxSurge: 1
B. strategy: type: Recreate
C. strategy: type: RollingUpdate, rollingUpdate: maxUnavailable: 0, maxSurge: 1
D. strategy: type: RollingUpdate, rollingUpdate: maxUnavailable: 2, maxSurge: 0
Answer: C
Explanation: maxUnavailable: 0 ensures that no pods are taken down below the desired count, and maxSurge: 1 allows 1 extra pod to be created first. This guarantees at least 3 (or 2, depending on surge) are always running. Option A allows 1 pod to be unavailable, which could drop to 2 (still OK, but not "at least 2" if you have 3—yes, it's 2, but C is safer). Option B (Recreate) kills all pods first. Option D allows 2 unavailable, which could drop to 1 pod.
These questions cover key concepts but the real CKAD is 100% hands-on. The biggest trap is not knowing the exact imperative commands or the subtle differences between requests and limits, and Role vs ClusterRole. In the exam, always read the question twice—look for keywords like "cluster-wide," "without downtime," or "pre-provisioned." Memorize the kubectl imperative forms (run, expose, create) to save time, as you can always generate YAML with --dry-run=client -o yaml and edit it.
To see which CKAD topics need more review, try a free CKAD readiness check that gives you a quick score and explains the correct answer for each question.
A few hours with Certified Kubernetes Application Developer (CKAD) practice exam questions can save you the cost and stress of a failed attempt.
To make the most of your remaining time, use a free CKAD study plan that lays out a week-by-week review schedule built around your schedule.