CKAD: Certified Kubernetes Application Developer Practice Exam

What the CKAD exam covers

• Application Design and Build134 questions
• Application Deployment139 questions
• Application Observability and Maintenance109 questions
• Application Environment, Configuration and Security169 questions
• Services and Networking103 questions

Free CKAD practice test questions

A sample of 10 questions with answers and explanations. A free account includes a fixed set of 20 practice questions for this exam, retryable anytime. Paid access unlocks the full 654-question bank.

1. Question 1Application Design and Build

   You need to run a one-off batch Job that processes a queue and must finish successfully exactly 5 times, with no more than 2 pods running at once. Which approach creates the correct Job?

   • Akubectl create job q --image=worker && kubectl scale job q --replicas=5
   • BCreate a Job manifest with spec.completions: 5 and spec.parallelism: 2Correct
   • Ckubectl create job q --image=worker -- --completions=5 --parallelism=2
   • Dkubectl run q --image=worker --restart=Always --completions=5
   ✓ Correct answer: B

   A Job uses spec.completions to set how many pods must finish successfully before the Job is complete, and spec.parallelism to cap how many pods run at the same time. With completions: 5 and parallelism: 2 the controller keeps starting pods until 5 have succeeded, never running more than 2 at once. kubectl create job has no flags for either field, so a manifest (or an edited copy of the generated YAML) is the way to set them.

   Why the other options are wrong

   • Akubectl scale works on Deployments, ReplicaSets, ReplicationControllers and StatefulSets, not on Jobs, and a Job has no replicas field, so this never sets 5 completions or a parallelism of 2.
   • CEverything after -- becomes the container command and its arguments, so --completions=5 --parallelism=2 are handed to the worker process instead of the Job; with both fields unset the Job defaults completions and parallelism to 1.
   • Dkubectl run creates a single Pod and has no --completions flag; --restart=Always only sets that Pod's restartPolicy, so no Job is created at all.
2. Question 2Application Deployment

   A rollout appears stuck. Which command shows the live status and blocks until it finishes or fails?

   • Akubectl rollout watch deployment/web
   • Bkubectl rollout status deployment/webCorrect
   • Ckubectl get deployment web --watch-status
   • Dkubectl describe rollout web
   ✓ Correct answer: B

   kubectl rollout status deployment/web reports the live progress of a rollout and, by default, blocks (watches) until the Deployment finishes successfully or fails, making it ideal for diagnosing a stuck rollout. It streams updates such as how many replicas are updated and available and returns a non-zero exit code if the rollout does not complete. This blocking behavior is exactly what the question asks for. It is the standard command in CI/CD pipelines to gate on rollout completion.

   Why the other options are wrong

   • Akubectl rollout watch deployment/web is incorrect because 'watch' is not a valid kubectl rollout subcommand (the valid ones are status, history, undo, pause, resume, restart).
   • Ckubectl get deployment web --watch-status is incorrect because there is no --watch-status flag; the watch flag is --watch/-w and it does not block until completion the way rollout status does.
   • Dkubectl describe rollout web is incorrect because 'rollout' is not a Kubernetes resource type that kubectl describe can target.
3. Question 3Application Observability and Maintenance

   A distroless container has no shell, so 'kubectl exec -it pod -- sh' fails. Which feature lets you attach a temporary debugging container with tools to the running pod?

   • Akubectl debug -it pod --image=busybox --target=app (ephemeral container)Correct
   • Bkubectl run busybox --attach --image=busybox into the pod
   • Ckubectl exec -it pod -- sh --force-shell to inject one
   • Dkubectl attach -it pod --debug to open a debug shell
   ✓ Correct answer: A

   kubectl debug injects an ephemeral container into a running pod using the provided --image (here busybox, which includes a shell and tools), and --target=app shares the process namespace of the existing 'app' container so you can inspect its processes and filesystem via /proc. This works even for distroless containers that have no shell of their own, because the debugging tools come from the ephemeral container's image rather than the application image. The -it flags give an interactive TTY into that ephemeral container.

   Why the other options are wrong

   • Bkubectl run creates a separate pod; it cannot attach a tooling container into the existing pod.
   • Cexec cannot conjure a shell that the image lacks; there is no --force-shell flag.
   • Dkubectl attach connects to an existing container's streams; it cannot add a debug container.
4. Question 4Application Environment, Configuration and Security

   A container needs its own pod name and namespace available as environment variables at runtime. Which mechanism provides them?

   • AA ConfigMap auto-created by Kubernetes for each pod
   • Bkubectl set env --from=pod
   • CThe Downward API via valueFrom.fieldRefCorrect
   • DHardcoding them in the image
   ✓ Correct answer: C

   The Kubernetes Downward API allows pods to consume their own metadata without making API server calls. By using env.valueFrom.fieldRef.fieldPath in the container spec, fields such as metadata.name and metadata.namespace are projected as environment variables at pod start time. This makes the pod name and namespace available to the application without hardcoding or external tooling.

   Why the other options are wrong

   • AKubernetes does not automatically create per-pod ConfigMaps; ConfigMaps must be explicitly created by a user or controller, and even if they existed, they would not dynamically reflect the pod's own name or namespace.
   • Bkubectl set env --from=pod is not a valid kubectl command syntax; there is no --from=pod source for kubectl set env.
   • DHardcoding pod name and namespace in the container image makes the image non-portable and incorrect - the image would embed a fixed name that would conflict with every other pod using the same image.
5. Question 5Application Environment, Configuration and SecuritySelect all that apply

   Which TWO objects constrain resource usage within a namespace? (Choose TWO)

   • ANetworkPolicy
   • BResourceQuotaCorrect
   • CLimitRangeCorrect
   • DPodDisruptionBudget
   ✓ Correct answer: B, C

   Kubernetes provides two complementary namespace-scoped objects for controlling resource consumption. ResourceQuota enforces aggregate limits across the namespace - capping total CPU, memory, storage, and object counts for all resources combined. LimitRange enforces per-container or per-pod constraints, setting minimum, maximum, and default request/limit values for individual containers. Together they provide both macro and micro-level control over resource usage within a namespace.

   Why the other options are wrong

   • ANetworkPolicy defines rules that control which pods can communicate with each other and with external endpoints based on labels and ports. It governs network traffic flow, not compute resource consumption, and has no effect on CPU, memory, or storage usage.
   • DPodDisruptionBudget (PDB) specifies the minimum number of pods of a given set that must remain available during voluntary disruptions such as node drains or rolling updates. It governs availability during maintenance operations, not resource consumption levels.
6. Question 6Application Design and Build

   You want a sidecar container to share a writable directory with the main container, but the data must not persist if the pod is deleted. Which volume type meets this?

   • AemptyDirCorrect
   • BpersistentVolumeClaim
   • CconfigMap
   • DhostPath
   ✓ Correct answer: A

   emptyDir provides a writable directory that both containers can mount at the same time, and its lifetime is tied to the pod, so the data is removed when the pod is deleted. This is the standard ephemeral sharing mechanism for sidecars. The kubelet creates the directory on the node when the pod is assigned to it, and both containers see the same underlying directory even when they mount it at different paths.

   Why the other options are wrong

   • BA PVC binds to durable storage that survives pod deletion, the opposite of the requirement.
   • CA configMap volume is read-only and projects ConfigMap keys, not arbitrary writable data.
   • DhostPath persists on the node's filesystem beyond pod deletion and ties the pod to a specific node.
7. Question 7Application DeploymentSelect all that apply

   A Deployment 'web' uses strategy RollingUpdate. Which TWO fields under spec.strategy.rollingUpdate control how many pods are added or removed during the update? (Choose TWO)

   • AmaxSurgeCorrect
   • BmaxUnavailableCorrect
   • Cpartition
   • DminReadySeconds
   ✓ Correct answer: A, B

   maxSurge sets how many pods above the desired count can be created during the update, and maxUnavailable sets how many can be unavailable at once. Together they shape the pace and capacity of the rollout. Both accept either an absolute number or a percentage of the desired replicas, and both default to 25% when the strategy is RollingUpdate.

   Why the other options are wrong

   • Cpartition is a StatefulSet RollingUpdate field, not a Deployment field.
   • DminReadySeconds delays counting a pod as available but is a top-level Deployment field, not under rollingUpdate, and it does not control surge/unavailable counts.
8. Question 8Application Environment, Configuration and SecuritySelect all that apply

   Which TWO statements about a LimitRange object are correct? (Choose TWO)

   • AIt can set default CPU/memory requests and limits applied to containers that omit themCorrect
   • BIt can enforce minimum and maximum resource values per container or podCorrect
   • CIt caps the total aggregate resource usage across all pods in the namespace
   • DIt is a cluster-scoped object that applies to every namespace
   ✓ Correct answer: A, B

   LimitRange operates at the individual container/pod level within a namespace: it injects `default`/`defaultRequest` values when omitted and rejects objects violating `min`/`max` (and `maxLimitRequestRatio`). It is namespaced, not cluster-wide.

   Why the other options are wrong

   • CAggregate namespace totals are enforced by ResourceQuota, not LimitRange.
   • DLimitRange is a namespaced object; it applies only to the namespace it is created in.
9. Question 9Application Deployment

   You performed a blue-green deployment with two Deployments (blue, green) and one Service. To cut traffic over to green instantly, what do you change?

   • AUpdate the Service's spec.selector to match green's pod labelsCorrect
   • BDelete the Service and recreate it pointing at green
   • CChange green's image to match blue
   • DAdd green's pod labels to the Service's metadata.labels
   ✓ Correct answer: A

   Both versions run at the same time, and one Service routes traffic to whichever pods its label selector matches. Changing spec.selector to match green's pod labels, for example version: green, makes the endpoint controllers rebuild the Service's EndpointSlices with green's pods, so traffic moves without restarting pods or changing DNS. Switching the selector back to blue reverses the cutover.

   Why the other options are wrong

   • BDeleting the Service drops its ClusterIP and causes an outage while it is recreated; editing the selector is not disruptive.
   • CMaking green identical to blue defeats the purpose of cutting over to the new version.
   • Dmetadata.labels only label the Service object itself; the pods a Service targets come from spec.selector.
10. Question 10Application Environment, Configuration and Security

    A pod's only container has a memory limit of 512Mi. The pod also has a RAM-backed (tmpfs) emptyDir volume named scratch with sizeLimit: 64Mi. The app then tries to write 128Mi of files into that volume. What happens?

    • AThe container is OOMKilled as soon as the files reach 64Mi
    • BThe kubelet evicts the pod once the volume usage passes 64Mi
    • CWrites fail with a no-space error once the 64Mi tmpfs is fullCorrect
    • DThe tmpfs grows past 64Mi until the 512Mi memory limit is reached
    ✓ Correct answer: C

    A RAM-backed emptyDir is a tmpfs mounted for the pod. The sizeLimit also applies to a RAM-backed emptyDir: the maximum usage is the smaller of the sizeLimit and the sum of the memory limits of the pod's containers, here 64Mi. Since the SizeMemoryBackedVolumes behaviour became stable (on by default since 1.22, locked in 1.32), the kubelet sizes the tmpfs to that value, so usage cannot exceed 64Mi and further writes fail with no space left on the device. The kubelet tracks tmpfs emptyDir volumes as container memory rather than ephemeral storage, so the sizeLimit eviction path for disk-backed emptyDir does not apply.

    Why the other options are wrong

    • AThe 64Mi of tmpfs pages count toward the container's 512Mi memory limit, which is not reached, so there is no OOM kill.
    • BEviction for exceeding sizeLimit applies to disk-backed emptyDir measured as ephemeral storage; a memory-backed emptyDir is a tmpfs capped at 64Mi, so usage never passes the limit.
    • DThe tmpfs is sized to the smaller of the sizeLimit and the summed container memory limits, so it stays at 64Mi rather than growing toward 512Mi.

Who this CKAD practice exam is for

This practice set is for anyone preparing for the CKAD: Certified Kubernetes Application Developer exam at the intermediate level - from first-time candidates building a foundation to experienced Cloud Native practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CKAD practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Treat your readiness score as knowledge readiness, then validate it with hands-on practice in a real environment before booking the CKAD exam.

Related Cloud Native resources

• CKAD study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Best CKA Practice Exams (2026)Comparison
• CKA vs CKADComparison
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Hands-on ckad labsLearn
• Hands-on kubernetes labsLearn
• CKAD command cheat sheetCheat sheet
• kubeadm and node operations cheat sheetCheat sheet
• kubectl cheat sheetCheat sheet
• Manifest field cheat sheetCheat sheet
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• CKS practice examRelated
• Istio Certified Associate (ICA) practice examRelated
• KCNA practice examRelated

CKAD practice exam FAQ