10 beginner questions on the CKAD curriculum v1.37: application design and build (init containers, CronJobs, volumes), application deployment (rolling updates, Helm), observability and maintenance (probes, debugging), environment, configuration and security (Secrets, securityContext) and services and networking (Service selectors). The real exam is hands-on; these questions check that you know the right field or command for each task.

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A developer needs a step that waits until a database is reachable before the main application container in a Pod starts. Which Pod feature is designed for this?

    • A. A startupProbe on the database
    • B. An entry in initContainers ✔ correct
    • C. A postStart lifecycle hook
    • D. A second replica of the Pod

    Answer: B. Init containers run to completion, one after another, before the app containers start, so they suit setup steps such as waiting for a dependency. A postStart hook runs only after the main container has already started.

    Source: kubernetes.io/docs/concepts/workloads/pods/init-containers/ · Domain: Application Design and Build

  2. A team needs a report job to run every night at 02:00 and then finish. Which workload resource should the developer create?

    • A. DaemonSet
    • B. Deployment
    • C. CronJob ✔ correct
    • D. StatefulSet

    Answer: C. A CronJob creates a Job on a repeating schedule written in cron format, for example 0 2 * * *, and each Job runs Pods to completion. Deployments, StatefulSets and DaemonSets keep long-running Pods alive.

    Source: kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ · Domain: Application Design and Build

  3. Data in an emptyDir volume is deleted permanently when its Pod is removed from the node.

    • A. True ✔ correct
    • B. False

    Answer: A. True. An emptyDir volume is created when the Pod is assigned to a node and lives as long as that Pod. A container crash does not remove it, but deleting the Pod does. Use a PersistentVolumeClaim for data that must persist.

    Source: kubernetes.io/docs/concepts/storage/volumes/ · Domain: Application Design and Build

  4. In a Deployment that uses the RollingUpdate strategy, which field sets how many Pods may be created above the desired number of replicas during an update?

    • A. maxUnavailable
    • B. revisionHistoryLimit
    • C. progressDeadlineSeconds
    • D. maxSurge ✔ correct

    Answer: D. maxSurge is the number or percentage of extra Pods allowed above the desired count during a rollout. maxUnavailable limits how many Pods can be unavailable; both default to 25%.

    Source: kubernetes.io/docs/concepts/workloads/controllers/deployment/ · Domain: Application Deployment

  5. A developer has added a chart repository named myrepo and wants to deploy its nginx chart as a release named web. Which command does this?

    • A. helm install web myrepo/nginx ✔ correct
    • B. helm create web myrepo/nginx
    • C. helm pull web myrepo/nginx
    • D. helm repo add web myrepo/nginx

    Answer: A. helm install [NAME] [CHART] installs a chart as a named release. helm create scaffolds a new chart, helm pull only downloads a chart, and helm repo add registers a repository.

    Source: helm.sh/docs/helm/helm_install/ · Domain: Application Deployment

  6. A container needs about 60 seconds to load its cache after starting, and the Service must not send it traffic before then. Which probe should the developer configure?

    • A. livenessProbe
    • B. readinessProbe ✔ correct
    • C. lifecycle.preStop
    • D. terminationGracePeriodSeconds

    Answer: B. A readiness probe decides when a container is ready to accept traffic; until it passes, the Pod is not added to Service endpoints. A liveness probe restarts a container that is unhealthy, which would not help here.

    Source: kubernetes.io/docs/concepts/workloads/pods/probes/ · Domain: Application Observability and Maintenance

  7. A developer's Pod web keeps restarting. Which two commands help find out why? (Select TWO)

    • A. kubectl describe pod web ✔ correct
    • B. kubectl logs web --previous ✔ correct
    • C. kubectl label pod web debug=true
    • D. kubectl scale deployment web --replicas=0
    • E. kubectl annotate pod web note=restart

    Answer: A, B. kubectl describe pod shows container states, restart counts and recent events, and kubectl logs --previous shows the crash log of the previous container instance. Labeling, annotating or scaling does not reveal the cause.

    Source: kubernetes.io/docs/tasks/debug/debug-application/debug-running-pod/ · Domain: Application Observability and Maintenance

  8. A container must read a database password from the key password of the Secret db-creds as an environment variable. Which field is used in the container spec?

    • A. env[].valueFrom.configMapKeyRef
    • B. env[].valueFrom.fieldRef
    • C. env[].valueFrom.secretKeyRef ✔ correct
    • D. envFrom[].prefix

    Answer: C. valueFrom.secretKeyRef with name: db-creds and key: password sets one environment variable from a Secret key. configMapKeyRef reads from a ConfigMap, and fieldRef exposes Pod fields.

    Source: kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure/ · Domain: Application Environment, Configuration and Security

  9. A security review requires that a container's processes run as user ID 1000 instead of root. Which setting does this?

    • A. securityContext.runAsUser: 1000 ✔ correct
    • B. resources.limits.user: 1000
    • C. serviceAccountName: 1000
    • D. metadata.labels.user: "1000"

    Answer: A. runAsUser in a Pod or container securityContext sets the user ID that the container processes run as. A ServiceAccount controls API identity, not the Linux user, and labels have no security effect.

    Source: kubernetes.io/docs/tasks/configure-pod-container/security-context/ · Domain: Application Environment, Configuration and Security

  10. A developer creates a Service for an app, but kubectl get endpointslices shows no endpoints for it although the Pods are running and ready. What is the most likely cause?

    • A. The Service type is ClusterIP instead of NodePort
    • B. The Pods have no resource limits
    • C. The Service has no annotations
    • D. The Service selector does not match the Pod labels ✔ correct

    Answer: D. A Service sends traffic to the Pods whose labels match its selector. If the selector and the labels differ, for example a typo, no endpoints are created. ClusterIP Services still get endpoints; the type only changes how the Service is exposed.

    Source: kubernetes.io/docs/tasks/debug/debug-application/debug-service/ · Domain: Services and Networking

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public CNCF / Linux Foundation exam objectives (CNCF CKAD Curriculum v1.37 (exam based on Kubernetes v1.37)), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by CNCF / Linux Foundation; exam names are trademarks of their owners. Official exam page: training.linuxfoundation.org/certification/certified-kubernetes-applic.

Last modified: Sunday, 25 October 2026, 9:57 PM