How are Kubernetes CKAD questions generated?

dotCreds builds Kubernetes CKAD practice questions from public exam objectives and Linux Foundation exam and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start Kubernetes CKAD practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free Kubernetes CKAD Practice Test

Kubernetes CKAD Practice Test

Start today’s free 10-question Kubernetes CKAD set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 23, 2026, 8:12 PM CDT

Unlock the full CKAD bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Unlock the full CKAD bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Why candidates miss this

Running is not the same as Ready. A selector match makes a Pod a candidate backend, but readiness is reflected in EndpointSlice conditions and normally determines whether the endpoint is ready for Service traffic. The failed readiness probes are the decisive clue. Likely wrong answer: Services can contain at most two endpoints by default. Review focus: Service

Interview question

Q: A Service selector matches four Running Pods, but only two appear as ready backends. What would you inspect, and how does readiness affect normal Service routing? Strong answer: I would compare the Service selector with Pod labels, then inspect each Pod's Ready condition and the Service's EndpointSlices. A Running Pod can still be unready. Under normal endpoint publication, unready Pods are not treated as ready Service backends, so failed readiness probes can explain the missing endpoints even when labels match. I would fix the readiness failure rather than changing the selector. `publishNotReadyAddresses` is a special-purpose exception for workloads that deliberately need unready addresses published.

Service selector
Pod Ready condition
readiness probe
EndpointSlice
publishNotReadyAddresses

Caution: A strong answer distinguishes Pod phase from readiness and does not assume that a matching label alone guarantees normal traffic eligibility.

Why this matters

Readiness is what connects application health to normal Service traffic eligibility. A Pod can be Running yet intentionally excluded from ready endpoints, so this distinction is central to diagnosing 'the Pods are up but the Service cannot reach them' failures.

Question 1 A Service selects four Pods, but only two appear as ready endpoints. The missing Pods are Running and their labels match; both fail readiness probes. Why are they excluded?

Answer choices

A. Services can contain at most two endpoints by default, for the described technical objective and its associated operational control requirements, for the stated services and networking (20%) requirement.
B. The missing Pods need unique ServiceAccounts, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.
C. The Service type must be NodePort for more than two replicas, for the described technical objective and its associated operational control requirements.
D. Normal Service endpoint publication considers Pod readiness, so unready Pods are not eligible backends unless special publish behavior is configured, as the primary implementation for the described business requirement.

Correct answer

Normal Service endpoint publication considers Pod readiness, so unready Pods are not eligible backends unless special publish behavior is configured, as the primary implementation for the described business requirement.

Readiness is the mechanism for keeping a running but unavailable Pod out of normal traffic distribution.

Wrong-answer review

A. Services can contain at most two endpoints by default, for the described technical objective and its associated operational control requirements, for the stated services and networking (20%) requirement.: There is no universal two-endpoint limit.
B. The missing Pods need unique ServiceAccounts, for the described technical objective and its associated operational control requirements, within the defined security and accountability boundaries.: ServiceAccount identity does not determine normal endpoint readiness.
C. The Service type must be NodePort for more than two replicas, for the described technical objective and its associated operational control requirements.: ClusterIP Services support many endpoints.

Extra learning features

Objective/domain: Services and Networking (20%)

Source: Service

Question 2 A Service selects label `app=api`. The stable Deployment has 9 ready Pods and a canary Deployment has 1 ready Pod; both carry `app=api`, and there are no topology or session-affinity effects. Approximately what traffic share should the canary receive?

A. Exactly 1 percent because a canary Deployment receives a fixed low weight, under the organization’s defined implementation and exception-management process.
B. About 10 percent, because the Service distributes across the ten ready backend endpoints rather than weighting Deployments.
C. Exactly 50 percent because there are two Deployments, for the described technical objective and its associated operational control requirements.
D. No traffic until the stable Deployment is scaled to zero, under the organization’s defined implementation and exception-management process.

About 10 percent, because the Service distributes across the ten ready backend endpoints rather than weighting Deployments.

Objective/domain: Application Deployment (20%)

Question 3 A Service of type ExternalName points `legacy-db` to `db.example.net`. Clients expect a proxying virtual IP and NetworkPolicy enforcement on selected backend Pods, but the Service has no selector or endpoints. What does ExternalName actually provide?

A. DNS aliasing to the configured external name; it does not proxy traffic through a ClusterIP or select Pods, under organization-wide implementation-governance requirements.
B. A StatefulSet automatically mirroring the external database, for the described technical objective and its associated operational control requirements.
C. A cloud load balancer with the external hostname as its backend, for the described technical objective and its associated operational control requirements, within this context.
D. A NodePort that resolves the external hostname on each connection, for the described technical objective and its associated operational control requirements.

DNS aliasing to the configured external name; it does not proxy traffic through a ClusterIP or select Pods, under organization-wide implementation-governance requirements.

Question 4 A proxy sidecar listens on `127.0.0.1:15001`, and the application container must send outbound requests through it. No Service should expose the proxy. Which address should the application use?

A. A ClusterIP Service selecting only the sidecar container, for evaluation.
B. `127.0.0.1:15001` (or `localhost:15001`), as the selected response to the described condition.
C. The sidecar container name as a DNS hostname, under organization-wide implementation-governance requirements.
D. The node IP and a NodePort assigned to 15001, under the stated technical, operational, and governance constraints.

`127.0.0.1:15001` (or `localhost:15001`), as the selected response to the described condition.

Objective/domain: Application Design and Build (20%)

Source: Pods

Question 5 An HPA is not scaling and `kubectl top pods` returns `Metrics API not available`. Pods are healthy and requests are set. What missing cluster capability is the most direct explanation?

A. The Pods need a LoadBalancer Service before CPU metrics can be read, under the organization’s defined implementation and exception-management process.
B. Every container must write CPU usage to stdout, under the described application observability and maintenance (15%) criteria.
C. The resource metrics pipeline, commonly provided by Metrics Server, is unavailable or unhealthy, as the organization’s selected response.
D. The Deployment must enable `revisionHistoryLimit`, for the stated security, delivery, and accountability requirements.

The resource metrics pipeline, commonly provided by Metrics Server, is unavailable or unhealthy, as the organization’s selected response.

Objective/domain: Application Observability and Maintenance (15%)

Source: Resource Metrics Pipeline

Question 6 A ConfigMap is marked `immutable: true`. A release attempts to patch its data and receives a forbidden validation error. How should the release update configuration?

A. Patch the ConfigMap status subresource instead of data, for the described technical objective and its associated operational control requirements, in the described situation.
B. Temporarily set immutable to false on the same object, for the described technical objective and its associated operational control requirements, under organization-wide implementation-governance requirements.
C. Add a RoleBinding granting update on immutable ConfigMaps, for the described technical objective and its associated operational control requirements, under the stated technical, operational, and governance constraints.
D. Create a new ConfigMap name containing the new data and update the workload reference, then remove the old object when no longer used, under the described application environment, configuration and security (25%) criteria.

Create a new ConfigMap name containing the new data and update the workload reference, then remove the old object when no longer used, under the described application environment, configuration and security (25%) criteria.

Objective/domain: Application Environment, Configuration and Security (25%)

Source: ConfigMaps

Question 7 An upgrade must fail safely if its resources do not become ready, automatically restoring the previous successful release instead of leaving the failed state active. Which current Helm upgrade option is designed for this?

A. Use `--reuse-values`, for the described technical objective and its associated operational control requirements, in the described situation.
B. Use `--no-hooks`, for the described technical objective and its associated operational control requirements, within the stated policy framework.
C. Use `--take-ownership`, for the described technical objective and its associated operational control requirements, as the recommended response to this scenario.
D. Use `--rollback-on-failure` with an appropriate timeout; Helm also waits for completion when that option is enabled.

Use `--rollback-on-failure` with an appropriate timeout; Helm also waits for completion when that option is enabled.

Source: helm upgrade

Question 8 Ingress policy allows client Pods to connect to server Pods on TCP 8443. The server's response packets are not separately listed in an egress policy on the server. Should responses to the allowed connection work?

A. No, every response packet needs a symmetric egress rule with the client Pod IP, for the described technical objective and its associated operational control requirements, under organization-wide implementation-governance requirements.
B. Only if the Service uses sessionAffinity, for the described technical objective and its associated operational control requirements, as the selected response to the described condition.
C. Only if both Pods use hostNetwork, for the described technical objective and its associated operational control requirements, for the described technical objective.
D. Yes, reply traffic for an allowed connection is implicitly permitted; a separate reverse-direction rule is not required merely for the response packets, within organization-wide risk-and-accountability boundaries.

Yes, reply traffic for an allowed connection is implicitly permitted; a separate reverse-direction rule is not required merely for the response packets, within organization-wide risk-and-accountability boundaries.

Source: Network Policies

Question 9 A Deployment mounts a ConfigMap key using `subPath` at `/etc/app/config.yaml`. The ConfigMap is updated, but the running container continues reading the old file indefinitely. What is the expected repair?

A. Increase `terminationGracePeriodSeconds` so kubelet has more time to update the file, for the described technical objective and its associated operational control requirements, for this task.
B. Add a PVC with `ReadWriteMany` access mode beneath the subPath mount, as the recommended implementation across the complete governed service lifecycle.
C. Restart or roll out the Pods, or mount the ConfigMap directory without `subPath` if live projected updates are required, within organization-wide risk-and-accountability boundaries.
D. Change the ConfigMap to a Secret while retaining subPath, as the selected approach for the stated technical and business outcome.

Restart or roll out the Pods, or mount the ConfigMap directory without `subPath` if live projected updates are required, within organization-wide risk-and-accountability boundaries.

Question 10 A readiness probe fails for 40 seconds during a cache refresh. The container remains Running and its restart count stays unchanged, but the Pod disappears from normal Service endpoints. Is this expected?

A. No. Any failed probe immediately restarts the container, for the described technical objective and its associated operational control requirements.
B. Yes. Readiness failure removes the Pod from ready endpoint selection without restarting the container, for this task.
C. Yes, but only because the Deployment was paused, for the stated implementation and support requirements.
D. No. Readiness is evaluated only once at container startup, as the proposed application observability and maintenance (15%) approach.

Yes. Readiness failure removes the Pod from ready endpoint selection without restarting the container, for this task.

Source: Liveness, Readiness, and Startup Probes

Kubernetes CKAD Practice Test

Unlock the full CKAD bank

Practice with explanations that teach.

What you get with free practice

A Service selects four Pods, but only two appear as ready endpoints. The missing Pods are Running and their labels match; both fail readiness probes. Why are they excluded?

A Service selects label `app=api`. The stable Deployment has 9 ready Pods and a canary Deployment has 1 ready Pod; both carry `app=api`, and there are no topology or session-affinity effects. Approximately what traffic share should the canary receive?

A Service of type ExternalName points `legacy-db` to `db.example.net`. Clients expect a proxying virtual IP and NetworkPolicy enforcement on selected backend Pods, but the Service has no selector or endpoints. What does ExternalName actually provide?

A proxy sidecar listens on `127.0.0.1:15001`, and the application container must send outbound requests through it. No Service should expose the proxy. Which address should the application use?

An HPA is not scaling and `kubectl top pods` returns `Metrics API not available`. Pods are healthy and requests are set. What missing cluster capability is the most direct explanation?

A ConfigMap is marked `immutable: true`. A release attempts to patch its data and receives a forbidden validation error. How should the release update configuration?

An upgrade must fail safely if its resources do not become ready, automatically restoring the previous successful release instead of leaving the failed state active. Which current Helm upgrade option is designed for this?

Ingress policy allows client Pods to connect to server Pods on TCP 8443. The server's response packets are not separately listed in an egress policy on the server. Should responses to the allowed connection work?

A Deployment mounts a ConfigMap key using `subPath` at `/etc/app/config.yaml`. The ConfigMap is updated, but the running container continues reading the old file indefinitely. What is the expected repair?

A readiness probe fails for 40 seconds during a cache refresh. The container remains Running and its restart count stays unchanged, but the Pod disappears from normal Service endpoints. Is this expected?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full CKAD bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Why candidates miss this

Interview question

Why this matters

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are Kubernetes CKAD questions generated?

How are explanations sourced?

What score do I get?

Why use this site?