CKAD Practice Test

CKAD practice test: what's covered

• Certified Kubernetes Application Developer

Free CKAD sample questions

1. Your application image must run a one-time schema migration that completes before the main API server container accepts traffic. Which Pod construct guarantees the migration finishes successfully before the API container starts?

   • A. Add the migration command as an initContainer in the same Pod spec
   • B. Run the migration in a sidecar container alongside the API container
   • C. Set a postStart lifecycle hook on the API container
   • D. Add the migration as an ephemeral debug container
   Show answer

   Correct: A. initContainers run to completion sequentially before any app container starts, so a failed migration blocks the API container from starting, which is exactly the guarantee required. A sidecar runs concurrently and does not block startup, so it is incorrect. A postStart hook fires after the container has already started and its failure does not reliably gate readiness. Ephemeral debug containers are for troubleshooting a running Pod and cannot be declared in the original spec.

2. A teammate wrote a Dockerfile ending with FROM ubuntu and ENTRYPOINT app, tagged as myapp:latest. Reviewing it for production readiness, which change most improves reproducibility and reduces attack surface?

   • A. Pin a semantic version tag and use a minimal base image such as distroless or alpine
   • B. Add the --privileged flag to the container runtime command
   • C. Always pull with imagePullPolicy: Always to force fresh images
   • D. Increase the container memory limit to avoid OOM kills
   Show answer

   Correct: A. A pinned semantic version makes pulls deterministic, and a minimal base image shrinks the package footprint and CVE exposure, directly improving reproducibility and security. The :latest tag is unpredictable because it can change underneath you. Running --privileged increases risk rather than reducing it and is not a Dockerfile concern. imagePullPolicy: Always does not fix the mutable-tag problem, and raising memory limits is unrelated to reproducibility or attack surface.

3. You are designing a multi-container Pod where a logging agent and the main app share data. Which statements about containers in the same Pod are accurate? (Choose TWO)

   • A. They share the same network namespace and can reach each other on localhost
   • B. They can share files through a volume mounted into both containers
   • C. Each container in the Pod receives its own distinct IP address
   • D. Containers in a Pod are always scheduled onto different nodes for resilience
   • E. Restarting one container automatically deletes the entire Pod
   Show answer

   Correct: A and B. Containers in a Pod share one network namespace, so they reach each other over localhost, and they can exchange data via a shared volume such as emptyDir, which is the basis of sidecar patterns. A Pod has a single IP shared by all containers, so the per-container-IP option is incorrect. A Pod is an atomic scheduling unit on one node, not split across nodes, and a single container restart does not delete the Pod, so those options are wrong.

4. A Pod sets resources.requests.memory: 256Mi and resources.limits.memory: 256Mi, with cpu request 250m and limit 500m. The container's memory usage grows past 256Mi. What does the kubelet do?

   • A. The container is OOM-killed because it exceeded its memory limit
   • B. The container is CPU-throttled until memory frees up
   • C. The Pod is rescheduled to a node with more memory
   • D. Nothing happens because requests already reserved the memory
   Show answer

   Correct: A. Memory is a non-compressible resource, so exceeding the memory limit causes the kernel OOM killer to terminate the container, after which the kubelet restarts it per the restart policy. CPU throttling applies to CPU limits, not memory, so that option is wrong. Kubernetes does not live-migrate a running Pod to another node when it exceeds a limit. Requests only guarantee scheduling capacity and do not prevent enforcement of the limit, so the last option is incorrect.

5. A Cassandra cluster needs stable, predictable Pod names like cassandra-0, cassandra-1 and its own persistent volume per replica. Which workload resource should you use to deploy it?

   • A. A StatefulSet with a volumeClaimTemplate and a headless Service
   • B. A Deployment with a shared ReadWriteMany PVC
   • C. A DaemonSet so one Cassandra Pod runs on every node
   • D. A Job with completions set to the number of replicas
   Show answer

   Correct: A. A StatefulSet provides stable ordinal Pod identities (cassandra-0, cassandra-1), ordered rollout, and a per-replica PersistentVolume via volumeClaimTemplates, which is exactly what clustered stateful systems need. A Deployment gives random Pod names and a single shared PVC, breaking per-replica state. A DaemonSet ties Pod count to nodes rather than to the desired replica count. A Job runs to completion and is not meant for long-running database Pods.

Last updated: 2026-10-19

CKAD practice test FAQ