100 ckad exam questions Practice Questions: Full Question Bank 2025

You need to create a Deployment that runs an nginx container with 3 replicas. The container should expose port 80 and have a resource limit of 200Mi memory. Which YAML configuration correctly defines this?

A Pod is failing to start with an 'ImagePullBackOff' error. You verify the image name is correct and exists in Docker Hub. What is the most likely cause and solution?

You need to expose application configuration that contains database connection details including a password. What is the recommended approach following Kubernetes best practices?

Your application requires a storage volume that persists data even when the Pod is deleted and can be reattached to a new Pod. Which Kubernetes resource should you use?

You have a web application Deployment and need to make it accessible to other applications within the cluster using a stable DNS name. The application should be load-balanced across all Pod replicas. What should you create?

Your application Pod needs to access the Kubernetes API to list other Pods in its namespace. What is the proper way to grant these permissions following the principle of least privilege?

You need to perform a rolling update of your application Deployment with zero downtime. The new version must be verified as healthy before old Pods are terminated. Which strategy and configuration should you use?

Your multi-container Pod has an init container that needs to download configuration files before the main application container starts. The init container is failing. How can you view its logs to troubleshoot?

You need to implement a canary deployment pattern where 10% of traffic goes to the new version and 90% to the stable version. Your cluster doesn't have a service mesh. What is the most effective approach using native Kubernetes resources?

Your application requires a sidecar container for logging that must start before the main application container and continue running throughout the Pod's lifecycle. The sidecar should share the same network namespace and be able to access the same volumes. What is the correct implementation?

You need to expose a Pod's environment variables to a configuration file that the application reads at startup. The file should be mounted at /config/app.conf and contain the DATABASE_URL value. Which approach should you use?

A Deployment is experiencing high CPU usage. You need to automatically scale the number of replicas based on CPU utilization, targeting 70% CPU usage with a minimum of 2 replicas and maximum of 10. What command accomplishes this?

You are deploying a financial application that requires all traffic between Pods to be encrypted. The application consists of a frontend service and a backend database. Network policies are already in place. What additional component is required to encrypt Pod-to-Pod traffic?

Your application logs are being written to stdout, but you need to view logs from a container that crashed 10 minutes ago. What command should you use?

You need to deploy a stateful application that requires each Pod to have a stable network identity and persistent storage. The application needs to scale to 3 replicas, and each replica must retain its data even if the Pod is rescheduled. Which resource should you use?

An application needs to access the Kubernetes API to list Pods in its namespace. You need to grant the minimum necessary permissions following the principle of least privilege. What should you create?

You are troubleshooting a Service that is not routing traffic correctly to its Pods. The Service selector is app=frontend, but traffic isn't reaching the Pods. What is the most likely cause?

Your application consists of multiple microservices that need to communicate. Service A in namespace prod-a needs to call Service B in namespace prod-b. What is the correct DNS name Service A should use to reach Service B?

You need to perform a rolling update of a Deployment with zero downtime. The application requires at least 80% of desired Pods to be available during the update. Which strategy configuration should you use?

An application requires different configuration values for development and production environments. The configuration includes both non-sensitive data (API endpoints) and sensitive data (API keys). You want to follow Kubernetes best practices. How should you manage this configuration?

You need to create a NetworkPolicy that allows incoming traffic to pods labeled 'app=frontend' only from pods labeled 'app=backend' within the same namespace. Which policy specification achieves this?

An application pod is crashing with an error indicating it cannot connect to a required database before starting. What is the BEST way to ensure the pod waits for the database service to be available before the main application starts?

You need to expose a web application running on port 8080 in your pods to external users via a cloud load balancer. The application should be accessible on port 80. What is the simplest approach?

A deployment has been updated with a new container image, but the new pods are not starting correctly. You need to roll back to the previous version immediately. What command should you use?

You are deploying a StatefulSet for a database cluster that requires each pod to have a stable network identity and persistent storage. Which combination of features does StatefulSet provide specifically for this use case?

An application needs to authenticate with an external API using a bearer token. The token should be injected into the container as an environment variable but must be stored securely. How should this be implemented?

You need to debug a pod that is running but not behaving correctly. The pod has multiple containers. How can you view the logs specifically from the container named 'app-container' in a pod named 'myapp-pod'?

A DaemonSet is being used to run a logging agent on all nodes. A new node pool with specific hardware (GPU nodes) has been added, and the logging agent should NOT run on these GPU nodes. How can you prevent the DaemonSet pods from being scheduled on GPU nodes?

You need to implement a security policy where pods in the 'frontend' namespace can only run containers as non-root users and cannot use privilege escalation. Which Kubernetes feature should you configure?

An application consists of a web frontend and a backend API. The frontend needs to communicate with the backend, but the backend should not be accessible from outside the cluster. Both deployments are in the same namespace. What is the correct Service configuration?

You need to expose a web application running in a Kubernetes cluster to external users. The application consists of multiple pods behind a service and requires load balancing across all pods. What type of Service should you create?

A developer needs to inject database credentials into a containerized application without hardcoding them in the image. The credentials should be stored securely and mounted as environment variables. Which Kubernetes resource should be used?

An application deployed in Kubernetes is experiencing intermittent connectivity issues. You need to check the logs of a specific container named 'api-server' in a pod named 'backend-7d9f8b-x4k2l' that has multiple containers. What command should you use?

You are deploying a stateless microservice that requires exactly 5 replicas running at all times with rolling updates. Which Kubernetes workload resource is most appropriate?

A microservice needs to communicate with a database service running in the same Kubernetes cluster. The database service is exposed via a Service named 'postgres-service' in the 'database' namespace, and your application is in the 'application' namespace. What DNS name should your application use to connect?

You need to ensure that a pod only runs on nodes that have SSD storage. The nodes are labeled with 'disktype=ssd'. Which pod specification should you use?

An application pod is failing health checks and being restarted repeatedly. You need to investigate the issue by examining the environment variables and running diagnostic commands inside the container. The pod name is 'webapp-pod' and container name is 'nginx'. What is the correct approach?

You are building a multi-container pod where a main application container needs configuration files prepared by an initialization container before starting. The init container should download files to a shared location. How should you implement this?

A production application requires that sensitive API tokens be rotated monthly and updated in the cluster without pod restarts. The tokens are currently stored in a Secret and mounted as files in the pod. What configuration ensures automatic updates without restarts?

You need to implement network policies to restrict traffic so that only pods with the label 'role=frontend' in the 'web' namespace can access pods with the label 'role=backend' in the 'api' namespace on port 8080. All other ingress traffic to backend pods should be denied. What NetworkPolicy configuration is required?

You need to create a Job that processes a queue of 50 items, with 5 items processed in parallel at any time, and each item processed exactly once. Which Job configuration should you use?

A Pod is failing with 'CreateContainerConfigError' status. Upon investigation, you find the Pod references a Secret that doesn't exist in the namespace. What is the BEST immediate action to resolve this issue?

Your application needs to make authenticated requests to the Kubernetes API from within a Pod to list ConfigMaps in its namespace. What is the recommended approach using RBAC?

You want to ensure that your Deployment's Pods are distributed across different nodes for high availability. Which approach should you use?

An application Pod needs to resolve the IP address of a specific Pod in a StatefulSet named 'database' in the same namespace. The StatefulSet has a headless Service. What DNS name should the application use to reach the first Pod (database-0)?

You need to temporarily debug a running container in a Pod without modifying the Pod specification. The container doesn't have debugging tools installed. What is the BEST approach?

A StatefulSet manages 3 Pods. You need to perform maintenance on one Pod (pod-1) without affecting the others or losing its PersistentVolume data. What is the correct approach?

Your application uses a ConfigMap mounted as a volume. The ConfigMap is updated, but the application still sees the old values. The Pod is using the subPath option in the volume mount. What is the reason for this behavior?

You need to expose an application running on port 8080 in your Pods to external traffic with SSL termination. Which combination of Kubernetes resources should you use?

You need to run a container as a non-root user with a specific UID (1000) and prevent privilege escalation. Which securityContext configuration should you use?