CKAD Exam 2026: Certified Kubernetes Application Developer
Practice Test — Application Design, Deployment, Observability,
Configuration, Security & Networking — 190 Scenario-Based
Questions with Answers & Detailed Rationales
DOMAIN 1: APPLICATION DESIGN AND BUILD (20% — Questions 1–38)
Question 1
A developer needs a container to generate a configuration file that will be consumed by the
main application at startup. The generator process runs for approximately 15 seconds, writes
the file to a shared volume, and then exits. Which pattern should be used?
A. A sidecar container running concurrently with the main application
B. An init container that completes before the main container starts
C. A separate Job in the same namespace with a shared PersistentVolume
D. A postStart lifecycle hook on the main application container
Correct Answer: B
Explanation: Init containers run sequentially to completion before app containers start and
share volumes, guaranteeing the file exists at startup.
Question 2
A multi-stage Dockerfile is being reviewed. The first stage uses a full language runtime image
with build tools, while the second stage uses a minimal base image. What is the primary
benefit of this approach?
A. The final image runs faster because it has fewer layers to decompress
B. The final image is significantly smaller and excludes build-time dependencies
,C. Multi-stage builds eliminate the need for a container registry
D. The build stage produces reusable layers that are cached across all environments
Correct Answer: B
Explanation: Multi-stage builds copy only artifacts into a minimal runtime image,
dramatically reducing size and attack surface.
Question 3
A Pod manifest specifies restartPolicy: Never inside the template of a Job with completions:
5. What behavior should be expected?
A. The Job is rejected because restartPolicy: Never is invalid in Job templates
B. The Job runs five Pods sequentially, and each Pod that fails is not restarted
C. The Job runs five Pods in parallel and restarts any that fail until completion
D. The Job creates one Pod that runs five times in a loop within the same container
Correct Answer: B
Explanation: Jobs require Never or OnFailure; Never means failed Pods are not restarted,
and completions count successful Pods.
Question 4
A CronJob is configured with concurrencyPolicy: Replace. A scheduled run is still executing
when the next schedule time arrives. What happens?
A. The new run is skipped until the current run completes
,B. The current run is terminated, and the new run starts
C. Both runs execute concurrently with separate Job objects
D. The new run is queued and starts immediately after the current run finishes
Correct Answer: B
Explanation: Replace terminates the currently running Job and starts the new one, ensuring
only the latest scheduled run executes.
Question 5
Two containers in the same Pod need to exchange files during runtime. The data is
temporary and should not survive Pod restart. Which volume type is most appropriate?
A. persistentVolumeClaim
B. hostPath
C. emptyDir
D. configMap
Correct Answer: C
Explanation: emptyDir is created when the Pod is scheduled and deleted when the Pod is
removed, perfect for intra-Pod temporary sharing.
Question 6
A container image uses a distroless base. A developer attempts to kubectl exec -it into the
running container to debug an issue but receives an error. Why?
, A. Distroless images do not support kubectl exec by design
B. Distroless images contain no shell or debugging utilities
C. The container must be restarted with a debug sidecar first
D. RBAC permissions prevent exec into distroless containers
Correct Answer: B
Explanation: Distroless images contain only the application and runtime dependencies, no
shell or package manager, making exec debugging impossible.
Question 7
A Job manifest specifies backoffLimit: 3 and activeDeadlineSeconds: 60. The Job's Pod fails
repeatedly. What happens after 60 seconds?
A. The Job retries three more times before terminating
B. The Job is terminated and marked as failed regardless of backoff count
C. The backoff limit resets, and the Job continues retrying
D. The Job is suspended until manually resumed
Correct Answer: B
Explanation: activeDeadlineSeconds caps total Job runtime; when exceeded, the Job is
terminated and marked failed regardless of remaining backoff.
Question 8
A developer creates a Pod using kubectl run nginx --image=nginx --restart=Never. What is the
resource type created?
Practice Test — Application Design, Deployment, Observability,
Configuration, Security & Networking — 190 Scenario-Based
Questions with Answers & Detailed Rationales
DOMAIN 1: APPLICATION DESIGN AND BUILD (20% — Questions 1–38)
Question 1
A developer needs a container to generate a configuration file that will be consumed by the
main application at startup. The generator process runs for approximately 15 seconds, writes
the file to a shared volume, and then exits. Which pattern should be used?
A. A sidecar container running concurrently with the main application
B. An init container that completes before the main container starts
C. A separate Job in the same namespace with a shared PersistentVolume
D. A postStart lifecycle hook on the main application container
Correct Answer: B
Explanation: Init containers run sequentially to completion before app containers start and
share volumes, guaranteeing the file exists at startup.
Question 2
A multi-stage Dockerfile is being reviewed. The first stage uses a full language runtime image
with build tools, while the second stage uses a minimal base image. What is the primary
benefit of this approach?
A. The final image runs faster because it has fewer layers to decompress
B. The final image is significantly smaller and excludes build-time dependencies
,C. Multi-stage builds eliminate the need for a container registry
D. The build stage produces reusable layers that are cached across all environments
Correct Answer: B
Explanation: Multi-stage builds copy only artifacts into a minimal runtime image,
dramatically reducing size and attack surface.
Question 3
A Pod manifest specifies restartPolicy: Never inside the template of a Job with completions:
5. What behavior should be expected?
A. The Job is rejected because restartPolicy: Never is invalid in Job templates
B. The Job runs five Pods sequentially, and each Pod that fails is not restarted
C. The Job runs five Pods in parallel and restarts any that fail until completion
D. The Job creates one Pod that runs five times in a loop within the same container
Correct Answer: B
Explanation: Jobs require Never or OnFailure; Never means failed Pods are not restarted,
and completions count successful Pods.
Question 4
A CronJob is configured with concurrencyPolicy: Replace. A scheduled run is still executing
when the next schedule time arrives. What happens?
A. The new run is skipped until the current run completes
,B. The current run is terminated, and the new run starts
C. Both runs execute concurrently with separate Job objects
D. The new run is queued and starts immediately after the current run finishes
Correct Answer: B
Explanation: Replace terminates the currently running Job and starts the new one, ensuring
only the latest scheduled run executes.
Question 5
Two containers in the same Pod need to exchange files during runtime. The data is
temporary and should not survive Pod restart. Which volume type is most appropriate?
A. persistentVolumeClaim
B. hostPath
C. emptyDir
D. configMap
Correct Answer: C
Explanation: emptyDir is created when the Pod is scheduled and deleted when the Pod is
removed, perfect for intra-Pod temporary sharing.
Question 6
A container image uses a distroless base. A developer attempts to kubectl exec -it into the
running container to debug an issue but receives an error. Why?
, A. Distroless images do not support kubectl exec by design
B. Distroless images contain no shell or debugging utilities
C. The container must be restarted with a debug sidecar first
D. RBAC permissions prevent exec into distroless containers
Correct Answer: B
Explanation: Distroless images contain only the application and runtime dependencies, no
shell or package manager, making exec debugging impossible.
Question 7
A Job manifest specifies backoffLimit: 3 and activeDeadlineSeconds: 60. The Job's Pod fails
repeatedly. What happens after 60 seconds?
A. The Job retries three more times before terminating
B. The Job is terminated and marked as failed regardless of backoff count
C. The backoff limit resets, and the Job continues retrying
D. The Job is suspended until manually resumed
Correct Answer: B
Explanation: activeDeadlineSeconds caps total Job runtime; when exceeded, the Job is
terminated and marked failed regardless of remaining backoff.
Question 8
A developer creates a Pod using kubectl run nginx --image=nginx --restart=Never. What is the
resource type created?
