KUBERNETES APPLICATION DEVELOPER (CKAD) –QUESTIONS AND CORRECT ANSWERS
(VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
*Core Domains*
Core Concepts
Configuration
Multi-Container Pods
Observability
Pod Design
Services and Networking
State Persistence
Security and Regulatory Compliance
Ethics and Professional Standards
*Introduction*
,The purpose of this examination is to rigorously assess the technical proficiency and operational
knowledge required to design, build, and deploy cloud-native applications within Kubernetes
environments. This assessment evaluates essential skills, including resource configuration, application
lifecycle management, and network policy implementation. Through a comprehensive blend of multiple-
choice and complex scenario-based questions, candidates demonstrate their ability to apply theoretical
concepts to real-world deployment challenges. Emphasis is placed on secure development practices,
regulatory adherence, and effective decision-making under pressure. This tool serves as a critical
benchmark for validating the expertise necessary for professional success in modern containerized
infrastructure management.
SECTION ONE: QUESTIONS 1–100
Question 1
Which Kubernetes object is best suited for ensuring that a specific number of pod replicas are running at
any given time?
A. Deployment
B. StatefulSet
C. DaemonSet
D. Job
🟢 A. Deployment
🔴 RATIONALE: A Deployment provides declarative updates for Pods and ReplicaSets, ensuring the
desired state of replicas is maintained.
Question 2
When configuring a liveness probe, what is the expected outcome if the probe fails?
A. The container is immediately deleted from the node.
B. The kubelet kills the container and restarts it according to its restart policy.
C. The node is marked as NotReady.
D. Traffic is diverted to another service.
🟢 B. The kubelet kills the container and restarts it according to its restart policy.
,🔴 RATIONALE: Liveness probes are used to detect if an application is deadlocked or crashed; failure
triggers a restart to restore service.
Question 3
Which of the following is considered a best practice for maintaining security compliance in image
management?
A. Using the latest tag for all production images.
B. Running containers as the root user.
C. Implementing image scanning for vulnerabilities before deployment.
D. Using public, unverified third-party registries.
🟢 C. Implementing image scanning for vulnerabilities before deployment.
🔴 RATIONALE: Scanning images identifies known vulnerabilities, ensuring that only secure, compliant
code is executed within the cluster.
Question 4
What is the primary function of a Kubernetes NetworkPolicy?
A. Managing external storage access.
B. Defining communication rules between pods and external endpoints.
C. Controlling access to the Kubernetes API server.
D. Managing cluster-wide resource quotas.
🟢 B. Defining communication rules between pods and external endpoints.
🔴 RATIONALE: NetworkPolicies function as firewalls at the Pod level, controlling ingress and egress
traffic based on labels and namespaces.
Question 5
Which command should be used to troubleshoot a pod that is failing to start due to an image pull error?
A. kubectl describe pod
B. kubectl get nodes
C. kubectl port-forward
D. kubectl top pod
, 🟢 A. kubectl describe pod
🔴 RATIONALE: The describe command displays detailed events and state information, which is
essential for diagnosing image pull back-off issues.
Question 6
In the context of professional ethics, what is the most appropriate action if a developer discovers a
hardcoded secret in a Git repository?
A. Ignore it since the code is already pushed.
B. Delete the file immediately and force-push to overwrite history.
C. Report the finding to the security team and initiate credential rotation.
D. Move the secret to a Kubernetes ConfigMap.
🟢 C. Report the finding to the security team and initiate credential rotation.
🔴 RATIONALE: Security incidents require formal reporting and immediate mitigation through secret
rotation, as simply deleting the file does not remove it from Git history.
Question 7
Which of the following volumes persists data even after the pod is deleted?
A. emptyDir
B. hostPath
C. PersistentVolume
D. ConfigMap
🟢 C. PersistentVolume
🔴 RATIONALE: A PersistentVolume (PV) exists independently of the pod lifecycle, providing long-term
storage that survives pod deletion.
Question 8
What defines a "headless" Service in Kubernetes?
A. A service without a ClusterIP.
B. A service without selectors.
C. A service without port mapping.
(VERIFIED ANSWERS) PLUS RATIONALES 2026 Q&A | INSTANT DOWNLOAD PDF.
*Core Domains*
Core Concepts
Configuration
Multi-Container Pods
Observability
Pod Design
Services and Networking
State Persistence
Security and Regulatory Compliance
Ethics and Professional Standards
*Introduction*
,The purpose of this examination is to rigorously assess the technical proficiency and operational
knowledge required to design, build, and deploy cloud-native applications within Kubernetes
environments. This assessment evaluates essential skills, including resource configuration, application
lifecycle management, and network policy implementation. Through a comprehensive blend of multiple-
choice and complex scenario-based questions, candidates demonstrate their ability to apply theoretical
concepts to real-world deployment challenges. Emphasis is placed on secure development practices,
regulatory adherence, and effective decision-making under pressure. This tool serves as a critical
benchmark for validating the expertise necessary for professional success in modern containerized
infrastructure management.
SECTION ONE: QUESTIONS 1–100
Question 1
Which Kubernetes object is best suited for ensuring that a specific number of pod replicas are running at
any given time?
A. Deployment
B. StatefulSet
C. DaemonSet
D. Job
🟢 A. Deployment
🔴 RATIONALE: A Deployment provides declarative updates for Pods and ReplicaSets, ensuring the
desired state of replicas is maintained.
Question 2
When configuring a liveness probe, what is the expected outcome if the probe fails?
A. The container is immediately deleted from the node.
B. The kubelet kills the container and restarts it according to its restart policy.
C. The node is marked as NotReady.
D. Traffic is diverted to another service.
🟢 B. The kubelet kills the container and restarts it according to its restart policy.
,🔴 RATIONALE: Liveness probes are used to detect if an application is deadlocked or crashed; failure
triggers a restart to restore service.
Question 3
Which of the following is considered a best practice for maintaining security compliance in image
management?
A. Using the latest tag for all production images.
B. Running containers as the root user.
C. Implementing image scanning for vulnerabilities before deployment.
D. Using public, unverified third-party registries.
🟢 C. Implementing image scanning for vulnerabilities before deployment.
🔴 RATIONALE: Scanning images identifies known vulnerabilities, ensuring that only secure, compliant
code is executed within the cluster.
Question 4
What is the primary function of a Kubernetes NetworkPolicy?
A. Managing external storage access.
B. Defining communication rules between pods and external endpoints.
C. Controlling access to the Kubernetes API server.
D. Managing cluster-wide resource quotas.
🟢 B. Defining communication rules between pods and external endpoints.
🔴 RATIONALE: NetworkPolicies function as firewalls at the Pod level, controlling ingress and egress
traffic based on labels and namespaces.
Question 5
Which command should be used to troubleshoot a pod that is failing to start due to an image pull error?
A. kubectl describe pod
B. kubectl get nodes
C. kubectl port-forward
D. kubectl top pod
, 🟢 A. kubectl describe pod
🔴 RATIONALE: The describe command displays detailed events and state information, which is
essential for diagnosing image pull back-off issues.
Question 6
In the context of professional ethics, what is the most appropriate action if a developer discovers a
hardcoded secret in a Git repository?
A. Ignore it since the code is already pushed.
B. Delete the file immediately and force-push to overwrite history.
C. Report the finding to the security team and initiate credential rotation.
D. Move the secret to a Kubernetes ConfigMap.
🟢 C. Report the finding to the security team and initiate credential rotation.
🔴 RATIONALE: Security incidents require formal reporting and immediate mitigation through secret
rotation, as simply deleting the file does not remove it from Git history.
Question 7
Which of the following volumes persists data even after the pod is deleted?
A. emptyDir
B. hostPath
C. PersistentVolume
D. ConfigMap
🟢 C. PersistentVolume
🔴 RATIONALE: A PersistentVolume (PV) exists independently of the pod lifecycle, providing long-term
storage that survives pod deletion.
Question 8
What defines a "headless" Service in Kubernetes?
A. A service without a ClusterIP.
B. A service without selectors.
C. A service without port mapping.
