CKAD: Certified Kubernetes Application Developer Practice Exam

What the CKAD exam covers

• Application Design and Build147 questions
• Application Deployment146 questions
• Application Observability and Maintenance113 questions
• Application Environment, Configuration and Security180 questions
• Services and Networking105 questions

Free CKAD sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 691.

1. Question 1Application Design and Build

   You need to run a one-off batch job that processes a queue and must run to completion exactly 5 times, with up to 2 pods running in parallel. Which command-line flags create the correct Job?

   • Akubectl create job q --image=worker && kubectl scale job q --replicas=5
   • BCreate a Job manifest with spec.completions: 5 and spec.parallelism: 2Correct
   • Ckubectl create job q --image=worker -- --completions=5 --parallelism=2
   • Dkubectl run q --image=worker --restart=Always --completions=5
   ✓ Correct answer: B

   A Job uses spec.completions to define how many successful pod completions are required before the Job is considered done, and spec.parallelism to cap how many pods may run at the same time. Setting completions: 5 with parallelism: 2 means the Job will run pods until 5 finish successfully, never running more than 2 concurrently. These two fields together give precise control over both total work and concurrency, which is exactly what a queue-processing batch job needs.

   Why the other options are wrong

   • Akubectl create job q --image=worker && kubectl scale job q --replicas=5 is incorrect because Jobs do not have a replicas field and kubectl scale does not operate on Jobs to set completions; parallelism for a Job is adjusted via kubectl scale --replicas, not completions, and this approach never sets completions to 5.
   • Ckubectl create job q --image=worker -- --completions=5 --parallelism=2 is incorrect because everything after the -- is passed as arguments to the container's command, not interpreted as Job spec flags, so completions and parallelism remain at their defaults of 1.
   • Dkubectl run q --image=worker --restart=Always --completions=5 is incorrect because --restart=Always creates a Deployment (not a Job), and kubectl run has no --completions flag, so this neither creates a Job nor sets completions.
2. Question 2Application Design and Build

   An emptyDir volume is declared with no 'medium' set. Where is it backed?

   • AIt is not provisioned at all until a medium value is set explicitly on the emptyDir volume
   • BIn node RAM as a tmpfs filesystem, which is the default backing when no medium is set
   • COn a dynamically provisioned network PersistentVolume bound to the pod by the StorageClass
   • DOn the node's local disk (the kubelet's storage), counted against ephemeral storageCorrect
   ✓ Correct answer: D

   When an emptyDir is declared without medium (or with medium: ""), it is backed by whatever storage medium the kubelet uses for the node, typically the node's local disk. The space it consumes counts against the pod's ephemeral-storage usage and limits. The directory is created when the pod is scheduled to the node and deleted permanently when the pod is removed from that node. Only by setting medium: Memory does the emptyDir become a tmpfs RAM-backed volume.

   Why the other options are wrong

   • AemptyDir is created regardless of medium; omitting medium simply defaults it to disk-backed storage.
   • Btmpfs (RAM) backing only happens when medium: Memory is set, not by default.
   • CemptyDir never uses a network PV; it lives on the node and is tied to the pod's lifecycle.
3. Question 3Application Deployment

   When you scale a StatefulSet down from 5 to 3, which pods are removed and in what order?

   • AThe highest-ordinal pods first (web-4, then web-3), in reverse orderCorrect
   • BAll extra pods simultaneously
   • CThe lowest-ordinal pods first (web-0, web-1)
   • DRandom pods
   ✓ Correct answer: A

   A StatefulSet assigns stable, monotonically increasing ordinal names to its pods (web-0 through web-N-1) and enforces strict ordering. When scaling down, the StatefulSet controller terminates pods in reverse ordinal order - one at a time - waiting for each pod to fully terminate before proceeding to the next. Scaling from 5 to 3 therefore deletes web-4 first, then web-3, leaving web-0 through web-2 intact. This mirrors the ordered scale-up direction (lowest to highest) and preserves the stable identities of the lower-numbered, typically primary or leader, pods.

   Why the other options are wrong

   • BAll extra pods simultaneously is incorrect; StatefulSets always scale down sequentially, one pod at a time in reverse ordinal order, never in parallel.
   • CThe lowest-ordinal pods first (web-0, web-1) is incorrect; removal proceeds from the highest ordinal downward, specifically to preserve the lowest-numbered pods which are typically the primary or most critical instances.
   • DRandom pods is incorrect; StatefulSet termination order is strictly deterministic by descending ordinal and is never random.
4. Question 4Application Observability and Maintenance

   A liveness httpGet probe must hit an HTTPS endpoint and send a custom Host header. Which probe fields support this?

   • Aan exec probe running curl is the only way to send headers
   • BhttpGet with scheme: HTTPS and httpHeaders: [{ name: Host, value: ... }]Correct
   • Can httpsGet probe field that accepts a host header value
   • DhttpGet with tls: true and a headers: {...} map of values
   ✓ Correct answer: B

   An httpGet probe natively supports a scheme field that accepts HTTP or HTTPS. Setting scheme: HTTPS causes the kubelet to connect over TLS, skipping certificate verification. The httpHeaders field accepts a list of name/value objects, allowing arbitrary request headers including a custom Host header needed for name-based virtual hosting. Together, scheme: HTTPS and httpHeaders satisfy an HTTPS endpoint that also requires a specific Host value, all expressed declaratively in the probe spec without resorting to an exec probe.

   Why the other options are wrong

   • AhttpGet supports scheme HTTPS and httpHeaders directly, so an exec curl is not the only option.
   • CThere is no httpsGet probe type; you set scheme: HTTPS inside httpGet instead.
   • DhttpGet has no tls field, and headers are set via httpHeaders, not a headers map.
5. Question 5Application Environment, Configuration and Security

   You must mount a single ConfigMap key as /etc/nginx/nginx.conf WITHOUT hiding the other files already in /etc/nginx. Which mount setting achieves this?

   • AUse a volumeMount with subPath: nginx.conf (and mountPath: /etc/nginx/nginx.conf)Correct
   • BSet readOnly: true on the mount so existing files under it are preserved
   • CSet defaultMode: 0644 on the volume so only nginx.conf is written
   • DMount the configMap volume at /etc/nginx so all keys appear beside the files
   ✓ Correct answer: A

   When a volumeMount specifies subPath pointing to a specific key in the ConfigMap, only that single file is projected to the exact mountPath, leaving all other files already present in the parent directory (/etc/nginx) intact. Without subPath, mounting a ConfigMap volume at /etc/nginx would replace the entire directory contents with only the ConfigMap's keys, hiding existing files.

   Why the other options are wrong

   • BreadOnly controls writability, not whether the mount hides sibling files in the directory.
   • CdefaultMode only sets file permissions; it does not scope the mount to one file.
   • DMounting at /etc/nginx replaces the whole directory and hides the pre-existing files.
6. Question 6Application Environment, Configuration and Security

   A container requests CPU as '0.5'. What is this equivalent to?

   • A50m
   • B5000m
   • C500m (half a CPU core)Correct
   • DIt is invalid; CPU must use the 'm' suffix
   ✓ Correct answer: C

   Kubernetes CPU resources are measured in cores, where 1 core equals 1000 millicores (m). A decimal value of 0.5 is therefore exactly 500 millicores, representing half a CPU core. Both forms - 0.5 and 500m - are valid and interchangeable in pod specs; Kubernetes accepts decimal notation without requiring the m suffix.

   Why the other options are wrong

   • A50m equals 0.05 CPU cores, which is one-tenth of the actual value. This would represent 5% of a single CPU core, not half a core.
   • B5000m equals 5 CPU cores, which is ten times the actual value. This would request five full CPU cores, not half a core.
   • DIt is invalid; CPU must use the 'm' suffix is incorrect. Kubernetes accepts CPU values as either millicores (e.g., 500m) or decimal core counts (e.g., 0.5); both forms are valid and documented in the Kubernetes resource model.
7. Question 7Services and Networking

   An Ingress path uses pathType: ImplementationSpecific. What does that mean?

   • AIt is an invalid pathType value in networking.k8s.io/v1 and the API server will reject the Ingress object
   • BPath matching semantics are left to the specific ingress controller (which may support regex/other behavior)Correct
   • CIt matches every incoming request path unconditionally, acting as a guaranteed catch-all default route
   • DIt always behaves identically to the Exact pathType, requiring a full case-sensitive match of the path
   ✓ Correct answer: B

   The networking.k8s.io/v1 Ingress API defines three pathType values: Exact, Prefix, and ImplementationSpecific. ImplementationSpecific explicitly delegates the interpretation of the path string to the ingress controller, allowing controllers like ingress-nginx to apply regex matching or other proprietary rules. This provides flexibility at the cost of portability between different controller implementations.

   Why the other options are wrong

   • AImplementationSpecific is a valid pathType in networking.k8s.io/v1.
   • CIt does not blanket-match all paths; behavior is controller-defined.
   • DIt is not fixed to Exact semantics; the controller decides how it matches.
8. Question 8Application Design and Build

   Your team uses Kustomize and wants a base manifest reused across dev and prod overlays, with prod patching the replica count to 5. Which kustomization.yaml field in the prod overlay applies a strategic-merge patch to the base Deployment?

   • ApatchesStrategicMerge (or patches:) referencing a partial Deployment manifestCorrect
   • Breplicas: entry naming the Deployment and count 5 as a base override
   • Ccomponents: importing a shared partial Deployment overlay
   • Dtransformers: applying an inline replica count adjustment
   ✓ Correct answer: A

   The overlay references a small patch document containing just the Deployment name and the changed replicas value; Kustomize merges it onto the base. This keeps shared structure in the base while overlays express only their differences.

   Why the other options are wrong

   • BThe replicas field sets a count declaratively but is not a strategic-merge patch of the base Deployment.
   • Ccomponents pulls in reusable kustomization units; it is not the field that applies a strategic-merge patch.
   • Dtransformers reference external transformer configs, not an inline strategic-merge patch on the Deployment.
9. Question 9Application Deployment

   A Deployment 'web' has progressDeadlineSeconds set to 600. A new rollout has not made progress for 700 seconds. Which Deployment condition reflects this state?

   • AA condition of type Progressing with status False and reason ProgressDeadlineExceededCorrect
   • BA condition of type Available with status False and reason MinimumReplicasUnavailable
   • CA condition of type ReplicaFailure with status True and reason FailedCreate
   • DA condition of type Progressing with status True and reason NewReplicaSetAvailable
   ✓ Correct answer: A

   The Deployment controller tracks rollout progress via the Progressing condition. If no progress is observed within progressDeadlineSeconds, it flips that condition's status to False and sets reason=ProgressDeadlineExceeded, which is what 'kubectl rollout status' interprets as a failed rollout. The other conditions are not the ones used to report a stalled rollout deadline.

   Why the other options are wrong

   • BThe Available condition reflects minimum availability, not whether the rollout exceeded its progress deadline.
   • CReplicaFailure/FailedCreate indicates the ReplicaSet could not create pods (e.g., quota), not a generic lack of rollout progress.
   • DNewReplicaSetAvailable with status True signals a successful, completed rollout, the opposite of an exceeded deadline.
10. Question 10Application Environment, Configuration and Security

    You want pods of a Deployment to avoid co-locating on the same node as each other for high availability, but still schedule if no spread is possible. Which construct fits best?

    • ApodAntiAffinity using preferredDuringSchedulingIgnoredDuringExecutionCorrect
    • BpodAffinity using requiredDuringSchedulingIgnoredDuringExecution
    • CnodeSelector with a unique label per node
    • DA NoSchedule taint on every node
    ✓ Correct answer: A

    podAntiAffinity with preferredDuringSchedulingIgnoredDuringExecution expresses a soft preference to keep matching pods apart (e.g., by hostname topology key), improving availability while not blocking scheduling if every node is already occupied. The 'required' variant would leave pods Pending when spread cannot be satisfied.

    Why the other options are wrong

    • BpodAffinity attracts pods together, the opposite of the goal, and required would hard-fail scheduling.
    • CnodeSelector forces specific nodes and does not express spreading across replicas.
    • DA NoSchedule taint blocks scheduling entirely unless tolerated and does not spread replicas.

Related Cloud Native resources

• CKAD study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• KCSA practice examRelated
• CKS practice examRelated
• CKA practice examRelated

CKAD practice exam FAQ