Get Latest Mar-2026 Conduct effective penetration tests using Exams4sures CKAD [Q93-Q117]

Posted On March 8, 2026

Get Latest [Mar-2026] Conduct effective penetration tests using Exams4sures CKAD

Penetration testers simulate CKAD exam PDF

To prepare for the CKAD certification exam, an individual should have hands-on experience in Kubernetes application development. Additionally, the Linux Foundation offers a CKAD training course that provides individuals with the necessary knowledge and skills to pass the certification exam. There are also various online resources and practice exams available that can be used to prepare for the exam.

The CKAD exam is a performance-based exam that requires candidates to complete a set of tasks within a given time frame. CKAD exam is conducted online and candidates are required to use a terminal and a web browser to complete the tasks. CKAD exam is designed to test the candidate’s ability to work with Kubernetes in a hands-on environment and to complete tasks that are similar to those encountered in real-world Kubernetes application development scenarios.

NO.93 You are running a web application within a Kubernetes cluster. The application consists of two pods, each with a resource request of 1CPU core and I GiB of memory. However, you’ve noticed that the application experiences performance issues during peak traffic hours. To mitigate these issues, you decide to implement resource quotas tor the namespace where the application runs. You want to ensure that the application pods receive adequate resources while preventing other applications from consuming excessive resources. Design and implement a resource quota for the namespace that sets limits for CPU and memory resources.

NO.94 Context

Task
A Deployment named backend-deployment in namespace staging runs a web application on port 8081.

NO.95 You must connect to the correct host . Failure to do so may result in a zero score.
[candidate@base] $ ssh ckad00044
Task:
Update the existing Deployment busybox running in the namespace rapid-goat .
First, change the container name to musl.
Next, change the container image to busybox:musl .
Finally, ensure that the changes to the busybox Deployment, running in the namespace rapid-goat, are rolled out.

NO.96 You are working on a Kubernetes cluster where you have a Deployment named ‘web-app’ running an application. The application has a sensitive configuration file named ‘config.jsons that is mounted as a volume to each pod. You need to ensure that this configuration file is not accessible by any user or process running within the pod, except for the application itselt Describe how you would implement this security best practice, using specific Kubernetes configurations, to protect the sensitivity of the ‘config.json’ file.

NO.97 You have a Deployment named that runs 3 replicas of a Wordpress container. You need to implement a rolling update strategy that allows for a maximum or two pods to be unavailable at any given time during the update process. Additionally, you want to ensure that the update process is triggered automatically whenever a new image is pushed to the Docker Hub repository ‘wordpress/wordpress:latest’.

NO.98 You have a stateful set named ‘mysql-statefulset’ that runs a MySQL database. The database data is stored in a PersistentV01umeClaim (PVC) named ‘mysql-pvc’ _ You want to ensure that the PVC is always mounted to the same pod, even after a pod restart or replacement. Additionally, you want to configure the PVC to use a specific storage class tor data persistence.

NO.99 You have a Kubernetes cluster With a Deployment named ‘my-app’ running multiple replicas of your application. You need to ensure that only authorized users can access the application’s pods through the Kubernetes APL Implement a role-based access control (RBAC) policy that allows only users in the “developers’ group to access the pods of the ‘my-app’ Deployment.

NO.100 Exhibit:

Context
You have been tasked with scaling an existing deployment for availability, and creating a service to expose the deployment within your infrastructure.
Task
Start with the deployment named kdsn00101-deployment which has already been deployed to the namespace kdsn00101 . Edit it to:
* Add the func=webFrontEnd key/value label to the pod template metadata to identify the pod for the service definition
* Have 4 replicas
Next, create ana deploy in namespace kdsn00l01 a service that accomplishes the following:
* Exposes the service on TCP port 8080
* is mapped to me pods defined by the specification of kdsn00l01-deployment
* Is of type NodePort
* Has a name of cherry

Solution:

NO.101 You have a Kubernetes cluster running a critical application. To enhance security, you need to implement a NetworkPolicy that restricts ingress traffic to your application pods only from specific allowed IP addresses and ports. Furthermore, you want to allow egress traffic to all external services.

NO.102 Context

Task:
The pod for the Deployment named nosql in the craytisn namespace fails to start because its container runs out of resources.
Update the nosol Deployment so that the Pod:
1) Request 160M of memory for its Container
2) Limits the memory to half the maximum memory constraint set for the crayfah name space.

NO.103 You have a web application that requires a specific sidecar container to perform certain tasks like logging and monitoring. You need to ensure that this sidecar container iS always running alongside your application pod, even it the main application pod restarts or iS deleted and recreated. How would you achieve this using a DaemonSet in Kubernetes?

NO.104

Task:
Create a Deployment named expose in the existing ckad00014 namespace running 6 replicas of a Pod. Specify a single container using the ifccncf/nginx: 1.13.7 image Add an environment variable named NGINX_PORT with the value 8001 to the container then expose port
8001

NO.105 You are building a web application that requires environment-specific configurations, such as database connection details and API keys. You want to use ConfigMaps to manage these configurations in a secure and efficient way You have the following environment variables defined in your deployment YAML:

Create a ConfigMap named ‘my-app-config’ containing the following data: – ‘database host: ‘db.example.com’ – ‘api_key’:

NO.106 You are tasked with setting up a secure Kubernetes cluster for a web application. The application has sensitive data that must be protected. You need to configure a mecnanism to restrict access to the application’s pods based on user identities. Describe a method to achieve this using Kubernetes RBAC and Service Accounts, ensuring that only authorized users can access specific pods.

NO.107 You have a Kubernetes cluster with a Deployment named ‘my-app’ that runs a web application. You want to restrict access to this application to only specific users within your organization. How would you use Service Accounts and RBAC to implement this?

NO.108 Refer to Exhibit.

Set Configuration Context:
[student@node-1] $ | kubectl
Config use-context k8s
Context
A pod is running on the cluster but it is not responding.
Task
The desired behavior is to have Kubemetes restart the pod when an endpoint returns an HTTP 500 on the /healthz endpoint. The service, probe-pod, should never send traffic to the pod while it is failing. Please complete the following:
* The application has an endpoint, /started, that will indicate if it can accept traffic by returning an HTTP 200. If the endpoint returns an HTTP 500, the application has not yet finished initialization.
* The application has another endpoint /healthz that will indicate if the application is still working as expected by returning an HTTP 200. If the endpoint returns an HTTP 500 the application is no longer responsive.
* Configure the probe-pod pod provided to use these endpoints
* The probes should use port 8080

NO.109 Exhibit:

Context
A container within the poller pod is hard-coded to connect the nginxsvc service on port 90 . As this port changes to 5050 an additional container needs to be added to the poller pod which adapts the container to connect to this new port. This should be realized as an ambassador container within the pod.
Task
* Update the nginxsvc service to serve on port 5050.
* Add an HAproxy container named haproxy bound to port 90 to the poller pod and deploy the enhanced pod. Use the image haproxy and inject the configuration located at /opt/KDMC00101/haproxy.cfg, with a ConfigMap named haproxy-config, mounted into the container so that haproxy.cfg is available at /usr/local/etc/haproxy/haproxy.cfg. Ensure that you update the args of the poller container to connect to localhost instead of nginxsvc so that the connection is correctly proxied to the new service endpoint. You must not modify the port of the endpoint in poller’s args . The spec file used to create the initial poller pod is available in /opt/KDMC00101/poller.yaml

Solution:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
selector:
matchLabels:
run: my-nginx
replicas: 2
template:
metadata:
labels:
run: my-nginx
spec:
containers:
– name: my-nginx
image: nginx
ports:
– containerPort: 90
This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:
kubectl apply -f ./run-my-nginx.yaml
kubectl get pods -l run=my-nginx -o wide
NAME READY STATUS RESTARTS AGE IP NODE
my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m
my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd
Check your pods’ IPs:
kubectl get pods -l run=my-nginx -o yaml | grep podIP
podIP: 10.244.3.4
podIP: 10.244.2.5

Solution:
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-nginx
spec:
selector:
matchLabels:
run: my-nginx
– name: my-nginx
image: nginx
ports:
– containerPort: 90
This makes it accessible from any node in your cluster. Check the nodes the Pod is running on:
kubectl apply -f ./run-my-nginx.yaml
kubectl get pods -l run=my-nginx -o wide
NAME READY STATUS RESTARTS AGE IP NODE
my-nginx-3800858182-jr4a2 1/1 Running 0 13s 10.244.3.4 kubernetes-minion-905m
my-nginx-3800858182-kna2y 1/1 Running 0 13s 10.244.2.5 kubernetes-minion-ljyd
Check your pods’ IPs:
kubectl get pods -l run=my-nginx -o yaml | grep podIP
podIP: 10.244.3.4
podIP: 10.244.2.5

NO.110 You have a Kubernetes cluster with a Deployment that runs a critical web application. The application’s codebase is in a Git repository, and you want to automatically deploy a new version of the application whenever a new commit is pushed to the ‘master branch ot the repository. You need to ensure that the deployment process iS seamless and doesn’t result in downtime for the web application.

NO.111 You are building a web application with two microservices: a frontend service (‘frontend’) and a backend service ( ‘ backend’). The frontend service requires access to the backend service, which iS exposed on port 8080 within the Kubernetes cluster. How would you configure an Ingress resource to direct traffic to the correct service based on the hostname, ensuring that the frontend service can access the backend service internally without exposing the backend service to the public internet?

NO.112 You are developing a service that uses a custom configuration file called ‘service.properties’. You want to use ConfigMaps to store and manage this file in a secure and efficient manner. The ‘service-properties’ file contains sensitive information such as database credentials and API keys.
How would you create a ConfigMap that securely stores the ‘service-properties’ file, ensuring that the file is accessible only to the service’s container?

NO.113 You have a microservice application that relies on a Redis cacne for data retrieval. Design a multi-container Pod that incorporates a Redis sidecar container to provide local caching within the Pod. Ensure that the main application container can access the Redis sidecar container within the same Pod Namespace Without needing to communicate with an external Redis cluster.

NO.114 You have a Kustomization file that uses a resource patch to modify the deployment of an Nginx service. The patch uses the field to set the CPLJ request for the container to 500m. However, you’ve noticed that this patch is no longer working as expected. You’ve been informed that the field has been deprecated and replaced with a new field structure in newer Kubernetes API versions. Explain how to update the Kustomization file to accommodate this change, ensuring compatibility with both older and newer Kubernetes versions.

NO.115 You have a multi-container Pod that runs a web server (Nginx) and a database (MySQL) container. The database container requires data to be initialized before the web server container can Stan. How would you configure the Pod to ensure the database container is initialized before tne web server container starts?

NO.116

Task
You are required to create a pod that requests a certain amount of CPU and memory, so it gets scheduled to-a node that has those resources available.
* Create a pod named nginx-resources in the pod-resources namespace that requests a minimum of 200m CPU and 1Gi memory for its container
* The pod should use the nginx image
* The pod-resources namespace has already been created

NO.117 You nave a microservice tnat iS constantly updated With new features and bug fixes. You want to deploy new versions of this service in a way that minimizes downtime and avoids disrupting the existing application. Explain how you can use Kubernetes features to achieve this goal.

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Use a Deployment:
– Create a ‘Deployment’ object to manage your microservice.
– Specify the desired number of replicas and the container image.
– Use a ‘rollinglJpdate’ strategy to control the update process.

2. Control Rollout Pace: – Use the maxSurge’ and ‘maxlJnavailable’ parameters to control the number of pods that can be unavailable or created during the update process. – For example, ‘maxi-Inavailable: ensures that no pods are unavailable during tne update, while ‘maxSurge: 1’ allows for one extra pod to be created during the update. 3. Trigger Automatic Updates: – Use a ‘Deployment’s ‘spec-template-spec-imagePullPolicy’ to trigger updates automatically when a new image is available. – Set imagePullPolicy: Always’ to force a pull of the image each time the deployment is updated. 4. Monitor Rollout Progress: – Use kubectl get pods -l app=my-microservice’ to monitor the rollout progress. – You can also use tne ‘kubectl rollout status deployment/my-microservice’ command to get detailed information about the rollout. 5. Use Liveness and Readiness Probes: – Define liveness and readiness probes to ensure that containers are healthy and ready to serve traffic. – The ‘Deployment’ will automatically restart unhealthy containers, while readiness probes will ensure that new pods are only considered ready for traffic once they are healtny. 6. Traffic Routing: – Use a ‘Service’ to expose your ‘Deployment’ to external clients. – Configure the ‘Service’ to use a ‘LoadBalancer’ or ‘NodePort’ to make the service accessible from outside the cluster. Note: This approach ensures a smooth rollout with minimal downtime. New pods are created with the new image, and traffic is gradually shifted to the updated pods while the old pods are gracefully terminated. The liveness and readiness probes ensure that only healthy pods receive traffic, and the automatic updates triggered by ‘imagePullPolicy: Always’ keep the service up-to-date.