How are Kubernetes CKAD questions generated?

dotCreds builds Kubernetes CKAD practice questions from public exam objectives and Linux Foundation exam and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start Kubernetes CKAD practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Free Kubernetes CKAD Practice Test

Kubernetes CKAD Practice Test

Start today’s free 10-question Kubernetes CKAD set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 200 Verified Questions

Questions updated at Aug 23, 2026, 1:05 AM CDT

Unlock the full CKAD bank

200 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank

Detailed Explanations Learn with clear source-backed answers

Track Your Progress Daily history and performance insights

Upgrade Anytime Unlock the full bank when you are ready

Unlock the full CKAD bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

200 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 190 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

Interview question

Q: How would you expose `shop.example.com` so `/api` routes to Service `api` port 8080 while `/` routes to Service `web` port 80, and what dependencies would you verify if one path returned errors? Strong answer: I would define a `networking.k8s.io/v1` Ingress with a host rule for `shop.example.com` and two HTTP paths whose backends reference the two Services and ports. `Prefix` is commonly appropriate when subpaths should also match. I would verify that an Ingress controller is installed and handling the selected class, then verify the Service ports, selectors, and ready EndpointSlices. If TLS is required, I would also reference a TLS Secret in the Ingress namespace. Ingress handles the L7 host/path decision; the Services still select and route to Pods.

networking.k8s.io/v1
host and path routing
Service backend mapping
Ingress controller/class
ready endpoints
TLS Secret

Caution: Do not accept an answer that assumes creating an Ingress object alone provides an Ingress controller.

Question 1 For host `shop.example.com`, `/api` must route to Service `api` port 8080 and `/` must route to Service `web` port 80. Which design is correct?

Answer choices

A. Define both paths under the host rule, each with a Service backend and an appropriate Prefix path type.
B. Create a NetworkPolicy with ports 80 and 8080 and path labels.
C. Create one Service whose selector contains the HTTP path strings.
D. Set the Ingress TLS hosts array to `/api` and `/`.

Correct answer

Define both paths under the host rule, each with a Service backend and an appropriate Prefix path type.

Ingress rules map host and path matches to distinct Service backends, providing the requested L7 routing while Services continue to route to Pods.

Wrong-answer review

B. Create a NetworkPolicy with ports 80 and 8080 and path labels.: NetworkPolicy does not parse HTTP hosts or paths.
C. Create one Service whose selector contains the HTTP path strings.: Service selectors match Pod labels and cannot route by HTTP path.
D. Set the Ingress TLS hosts array to `/api` and `/`.: TLS hosts contain DNS hostnames, not URL paths or backend routing rules.

Extra learning features

Objective/domain: Services and Networking (20%)

Source: Ingress

Question 2 A security agent must run on every Linux worker, including workers added later. Control-plane nodes are tainted and must remain excluded. Each agent reads node-local logs through a hostPath mount. Which workload resource best matches the requirement?

A. A StatefulSet with one PVC per worker.
B. A DaemonSet with node selection for Linux workers and no toleration for the control-plane taint.
C. A Deployment with replicas equal to the current worker count.
D. A Job with parallelism equal to the node count.

A DaemonSet with node selection for Linux workers and no toleration for the control-plane taint.

Objective/domain: Application Design and Build (20%)

Source: DaemonSet

Question 3 A validating admission webhook protects production namespaces. During a webhook outage, the policy must prefer blocking new writes rather than silently allowing unvalidated objects. Which failure behavior is required?

A. Add a ClusterRoleBinding for every requester to the webhook ServiceAccount.
B. Set `sideEffects: Unknown` so the API server retries forever.
C. Configure the webhook with a fail-closed behavior such as `failurePolicy: Fail`, after testing availability and timeout settings.
D. Use `failurePolicy: Ignore`.

Configure the webhook with a fail-closed behavior such as `failurePolicy: Fail`, after testing availability and timeout settings.

Objective/domain: Application Environment, Configuration and Security (25%)

Source: Admission Control in Kubernetes

Question 4 A namespace contains many Pods. The responder needs a compact table containing Pod name, phase, node, and restart count of the first container. Which built-in approach avoids manually reading every full YAML document?

A. Use `kubectl rollout history pods`.
B. Use `kubectl get pods` with `-o custom-columns=...` or an equivalent JSONPath expression for the required fields.
C. Use `kubectl top pods --show-phase --show-node --show-restarts`.
D. Use `kubectl logs pods/*` and parse container headers.

Use `kubectl get pods` with `-o custom-columns=...` or an equivalent JSONPath expression for the required fields.

Objective/domain: Application Observability and Maintenance (15%)

Source: kubectl get

Question 5 An application requires a configuration file generated from cluster metadata before the main binary starts. The generator should run once, write to `/work/config.yaml`, and exit; the application then reads that file for the rest of the Pod lifetime. Which Pod design is correct?

A. A native sidecar with `restartPolicy: Always` that rewrites the file continuously.
B. A liveness probe that writes the file before each health check.
C. Two separate Pods sharing only `localhost`.
D. A regular init container and the application container mounting the same `emptyDir` volume at `/work`.

A regular init container and the application container mounting the same `emptyDir` volume at `/work`.

Source: Init Containers

Question 6 A repository has a reusable base and a production overlay. The overlay should add two replicas and a production-only annotation without modifying the base files. Which Kustomize structure is appropriate?

A. Copy the base YAML into the overlay and edit both copies whenever it changes.
B. Reference the base under `resources` in the overlay and apply overlay patches or transformers for the production changes.
C. Put Go-template expressions directly in the base manifests.
D. Apply the base first, then imperatively edit the live Deployment.

Reference the base under `resources` in the overlay and apply overlay patches or transformers for the production changes.

Objective/domain: Application Deployment (20%)

Source: Declarative Management of Kubernetes Objects Using Kustomize

Question 7 A Deployment's `.spec.selector` was created as `app=store`. The team now tries to change it to `app=store-v2` while preserving the same object name. The API rejects the update. What is the correct resolution?

A. Pause the Deployment, edit the selector, and resume it.
B. Create a new Deployment with the new selector, or retain the immutable selector and change only compatible Pod-template labels.
C. Patch the selector through the status subresource.
D. Delete only the current ReplicaSet; the Deployment selector will then become editable.

Create a new Deployment with the new selector, or retain the immutable selector and change only compatible Pod-template labels.

Source: Deployments

Question 8 A container does not declare `containerPort`, but its process listens on 8080. Can a Service with numeric `targetPort: 8080` still route to it?

A. Yes, but only with hostNetwork enabled.
B. No. EndpointSlices contain only ports declared under containerPort.
C. No. The API server creates a firewall deny whenever containerPort is omitted.
D. Yes. `containerPort` is not required for numeric Service forwarding; the process must actually listen on the target port.

Yes. `containerPort` is not required for numeric Service forwarding; the process must actually listen on the target port.

Source: Service

Question 9 A manifest for `kind: Database` in API group `data.example.com/v1` is applied before its CustomResourceDefinition. The server returns `no matches for kind "Database"`. What is the required ordering?

A. Create the custom resource first so Kubernetes infers and generates the CRD.
B. Change the custom resource to `apiVersion: v1` while keeping `kind: Database`.
C. Add a RoleBinding for the user and retry without the CRD.
D. Install the CRD, wait until it is established and discoverable, then create the `Database` custom resource.

Install the CRD, wait until it is established and discoverable, then create the `Database` custom resource.

Source: Extend the Kubernetes API with CustomResourceDefinitions

Question 10 A process in a container runs as PID 1, and the ephemeral debug container must inspect that process with `ps` and a debugger. The Pod was not created with process namespace sharing. Which `kubectl debug` option is relevant when runtime support permits targeting?

A. Use `--sort-by=.status.pid`.
B. Use `--target=<application-container>` so the debug container targets that container's process namespace.
C. Use `--service=<application-service>`.
D. Use `--previous` to join the previous PID namespace.

Use `--target=<application-container>` so the debug container targets that container's process namespace.

Source: Debug Running Pods

Kubernetes CKAD Practice Test

Unlock the full CKAD bank

Practice with explanations that teach.

What you get with free practice

For host `shop.example.com`, `/api` must route to Service `api` port 8080 and `/` must route to Service `web` port 80. Which design is correct?

A security agent must run on every Linux worker, including workers added later. Control-plane nodes are tainted and must remain excluded. Each agent reads node-local logs through a hostPath mount. Which workload resource best matches the requirement?

A validating admission webhook protects production namespaces. During a webhook outage, the policy must prefer blocking new writes rather than silently allowing unvalidated objects. Which failure behavior is required?

A namespace contains many Pods. The responder needs a compact table containing Pod name, phase, node, and restart count of the first container. Which built-in approach avoids manually reading every full YAML document?

An application requires a configuration file generated from cluster metadata before the main binary starts. The generator should run once, write to `/work/config.yaml`, and exit; the application then reads that file for the rest of the Pod lifetime. Which Pod design is correct?

A repository has a reusable base and a production overlay. The overlay should add two replicas and a production-only annotation without modifying the base files. Which Kustomize structure is appropriate?

A Deployment's `.spec.selector` was created as `app=store`. The team now tries to change it to `app=store-v2` while preserving the same object name. The API rejects the update. What is the correct resolution?

A container does not declare `containerPort`, but its process listens on 8080. Can a Service with numeric `targetPort: 8080` still route to it?

A manifest for `kind: Database` in API group `data.example.com/v1` is applied before its CustomResourceDefinition. The server returns `no matches for kind "Database"`. What is the required ordering?

A process in a container runs as PID 1, and the ephemeral debug container must inspect that process with `ps` and a debugger. The Pod was not created with process namespace sharing. Which `kubectl debug` option is relevant when runtime support permits targeting?

You are viewing today’s free 10. Unlock 190 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full CKAD bank.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Extra learning features

Interview question

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are Kubernetes CKAD questions generated?

How are explanations sourced?

What score do I get?

Why use this site?