Updated Aug-2026 Exam Engine for CKAD Exam Free Demo & 365 Day Updates [Q118-Q139]

QUESTION 118

Context
You have been tasked with scaling an existing deployment for availability, and creating a service to expose the deployment within your infrastructure.
Task
Start with the deployment named kdsn00101-deployment which has already been deployed to the namespace kdsn00101 . Edit it to:
* Add the func=webFrontEnd key/value label to the pod template metadata to identify the pod for the service definition
* Have 4 replicas
Next, create ana deploy in namespace kdsn00l01 a service that accomplishes the following:
* Exposes the service on TCP port 8080
* is mapped to me pods defined by the specification of kdsn00l01-deployment
* Is of type NodePort
* Has a name of cherry

QUESTION 119
You have a Deployment named ‘web-app-deployments that runs a web application in a containerized environment. The application is designed for high availability and scalability, but you need to ensure that no more than two pods are ever terminated simultaneously during a rolling update process. This is to minimize the impact on service availability during the update. How would you implement this rolling update strategy using Deployment resources?

QUESTION 120
You have a Deployment named ‘my-app-deployment running a Flask application. You want to add a liveness probe that checks if the Flask application is responding on port ‘5000’ and a readiness probe that checks if the application is ready to receive requests. Implement these probes using Kustomize.

QUESTION 121
You have a Kubernetes cluster with a Deployment named ‘wordpress-deployment running 3 replicas of a WordPress container. You want to expose this deployment as a service and ensure that the service only forwards traffic to the pods With the label ‘version: v?. You need to create a service with the following requirements:
– The service name should be swordpress-service’
– The service should be of type ‘Load8alancer’ for external access.
– The service should only target pods with the label ‘version: v?
– The service should expose port 80 on tne service, wmch maps to port 8080 in the WordPress container.

QUESTION 122
You have a Kubernetes deployment tnat uses a ConfigMap to provide configuration settings to your application. You need to update tne ConfigMap with new settings without restarting the deployment.

QUESTION 123

Context
A container within the poller pod is hard-coded to connect the nginxsvc service on port 90 . As this port changes to 5050 an additional container needs to be added to the poller pod which adapts the container to connect to this new port. This should be realized as an ambassador container within the pod.
Task
* Update the nginxsvc service to serve on port 5050.
* Add an HAproxy container named haproxy bound to port 90 to the poller pod and deploy the enhanced pod.
Use the image haproxy and inject the configuration located at /opt/KDMC00101/haproxy.cfg, with a ConfigMap named haproxy-config, mounted into the container so that haproxy.cfg is available at
/usr/local/etc/haproxy/haproxy.cfg. Ensure that you update the args of the poller container to connect to localhost instead of nginxsvc so that the connection is correctly proxied to the new service endpoint. You must not modify the port of the endpoint in poller’s args . The spec file used to create the initial poller pod is available in /opt/KDMC00101/poller.yaml See the solution below.

QUESTION 124
You have a Deployment for a web application that uses a separate Redis cache pod for session management. You want to ensure that each web application pod can access a dedicated Redis instance for session management and avoid contention. Explain how you can use a PersistentVolumeClaim and StatetulSet to achieve this.

QUESTION 125
Exhibit:

Context
It is always useful to look at the resources your applications are consuming in a cluster.
Task
* From the pods running in namespace cpu-stress , write the name only of the pod that is consuming the most CPU to file /opt/KDOBG030l/pod.txt, which has already been created.

Solution:

QUESTION 126
You have a Kubernetes cluster running a critical application. To enhance security, you need to implement a NetworkPolicy that restricts ingress traffic to your application pods only from specific allowed IP addresses and ports. Furthermore, you want to allow egress traffic to all external services.

QUESTION 127
You have a Kubernetes cluster with a deployment named ‘myapp’. This deployment utilizes a service account named ‘my-sas to access a private registry. You need to grant this service account access to pull images from the registry, which requires an image pull secret named ‘my-secret How would you configure the service account to use this image pull secret and ensure your myapp’ deployment can successfully pull images?

QUESTION 128
Exhibit:

Context
You are tasked to create a ConfigMap and consume the ConfigMap in a pod using a volume mount.
Task
Please complete the following:
* Create a ConfigMap named another-config containing the key/value pair: key4/value3
* start a pod named nginx-configmap containing a single container using the
nginx image, and mount the key you just created into the pod under directory /also/a/path

Solution:

QUESTION 129
You have a Deployment named ‘database-deployment’ that runs a PostgreSQL database container. You want to enforce the following security restrictions:
– The container should only be allowed to run with the I-IID 1000.
– The container should be able to access a specific hostPath volume mounted at ‘/db-data’ for storing database data.
– The container should not be allowed to escalate privileges.
– The container should only have the ‘NET BIND SERVICE capability, allowing it to listen on specific ports.
You need to define a SecurityContext in the Deployment configuration to enforce these restrictions.

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define the SecurityContext
– Create a ‘securitycontext’ section within the ‘spec-template-spec-containers’ block for your ‘database-deployment container-
– Set ‘runAsIJsers to ‘1000’ to enforce running as UID 1000.
– Set ‘allowPrivilegeEscalation’ to ‘false’ to disable privilege escalation-
– In the ‘capabilities’ sectiom
– Set ‘drop’ to an array containing all capabilities except ‘NET BIND_SERVICE’
– Set ‘add’ to an array containing ‘NET BIND SERVICE
– Define a ‘volumeMount’ to mount the ‘/db-data’ hostPath volume.
Solution (Step by Step) :
1. Define the SecurityContext:
– Create a ‘securityContext’ section within the block for your ‘database-deployment container.
– Set ‘runAslJser’ to “1000′ to enforce running as UID 1000.
– Set ‘allowPriviIegeEscaIation’ to ‘false’ to disable privilege escalation.
– In the ‘capabilities’ section:
– Set ‘drop’ to an array containing all capabilities except ‘NET BIND SERVICE
– Set ‘add’ to an array containing
– Define a ‘volumeMount’ to mount the ‘/db-data’ hostPath volume.

2. Create the Deployment: – Apply the Deployment YAML file using ‘kubectl apply -f database-deployment.yaml. – The ‘securityContext’ restricts the container’s benavior and capabilities. – Setting ‘runAslJser’ to ‘1000’ forces the container to run as the specified UID. – ‘allowPrivilegeEscalation’ set to ‘false’ prevents tne container from gaining higner privileges. – The ‘capabilities’ section controls specific capabilities. ‘drop’ removes unwanted capabilities, while ‘add’ grants specific capabilities. In this case, the container is allowed to use the capability, enabling it to bind to specific ports. – The ‘volumeMount defines the mount point for the hostPath volume, providing access to the specified directory tor database data. This configuration ensures that the ‘database-deployment container runs with the specific IJID, cannot escalate privileges, and only has the ‘NET BIND SERVICE’ capability, while accessing the hostPath volume for database data. This provides a secure environment for your database container.,

QUESTION 130
You are building a web application that uses a set of environment variables for configuration. These variables are stored in a ConfigMap named ‘app-config’ . How would you ensure that the web application pods always use the latest version of the ConfigMap even when the ConfigMap is updated?

QUESTION 131
You’re building a microservice architecture that uses a load balancer to distribute traffic across multiple instances of a service. You want to implement a health check mechanism that ensures only healthy instances receive traffic. Design a solution using Kubernetes Liveness probes and a service With a health check configuration.

QUESTION 132
You are deploying a sensitive application that requires strong security measures. You need to implement a solution to prevent unauthorized access to the container’s runtime environment. How would you use Seccomp profiles to enforce security policies at the container level?

QUESTION 133
Context

Context
Your application’s namespace requires a specific service account to be used.
Task
Update the app-a deployment in the production namespace to run as the restrictedservice service account. The service account has already been created.

QUESTION 134
You are building a Kubernetes application that manages a fleet of autonomous vehicles. Each vehicle is represented by a custom resource called ‘Vehicle’. You need to implement a CRD that defines the ‘Vehicle’ resource, including its required fields (like ‘location’, and ‘status’), and ensures that the ‘status’ field can only be updated by the controller managing the vehicles.

See the solution below with Step by Step Explanation.
Explanation:
Solution (Step by Step) :
1. Define the Vehicle Custom Resource Definition (CRD):
– Create a YAML file named ‘vehicle-crd-yaml with the following content:

2. create the CRD: – Apply the CRD definition using ‘kubectl apply -f vehicle.crd.yaml’. 3. Validate the CRD: – Verity that the CRD is created successfully by running kubectl get crd vehicles-example.com’. 4. Create a Vehicle Resource: – Create a YAML file named ‘vehicle-yamr with the following content:

5. Create the Vehicle Resource: – Apply the vehicle resource definition using ‘kubectl apply -f vehicle-yamr 6. Verify the Vehicle Resource: – Ensure that the vehicle resource is created successfully by running ‘kubectl get vehicles -n default 7. Update the ‘status’ Field: – Attempt to update tne ‘status’ field directly using ‘kubectl patch vehicle vehicle-I -n default -p ‘{“spec”: {“status”: “driving”))” – Observe that the update fails because the ‘status’ field is considered immutable and can only be updated by the controller managing the vehicles. 8. Implement a Controller: – Create a controller that reads the ‘Vehicles resources, updates the ‘status’ field based on the vehicle’s state, and handles any errors. This controller should have read-only access to the ‘spec’ field and write access to the ‘status’ field. 9. Deploy the Controller: – Deploy the controller as a Deployment or a StatefulSet in Kubernetes- 10. IJpdate the ‘status’ Field through the Controller. – Trigger the controller to update the ‘status’ field of the ‘vehicle-1’ resource. – Verot that the ‘status’ field is updated successfully without violating the immutability rule. Key Points: – The CRD defines the ‘Vehicle’ resource schema and its required fields. – The ‘status’ field is marked as immutable to prevent direct updates by users- -A controller is responsible for updating the ‘status’ field based on the vehicle’s state and ensuring data integrity. – This setup ensures that the ‘status’ field is always consistent and updated by the designated controller, maintaining data integrity and preventing accidental modifications.,

QUESTION 135
You are tasked with deploying a complex application using Helm. The application consists of multiple microservices, each with its own deployment and service. To simplify the deployment and management of these microservices, you need to implement a mecnanism that allows you to automatically create and manage namespaces based on the name of the Helm release.

QUESTION 136
Refer to Exhibit.

Set Configuration Context:
[student@node-1] $ | kubectl
Config use-context k8s
Task
You have rolled out a new pod to your infrastructure and now you need to allow it to communicate with the web and storage pods but nothing else. Given the running pod kdsn00201 -newpod edit it to use a network policy that will allow it to send and receive traffic only to and from the web and storage pods.

QUESTION 137
You have a container image that contains a Python application. The application depends on specific libraries that are not included in the base image used for the container. Describe the steps involved in modifying the image to install the necessary libraries Without rebuilding the entire application.

QUESTION 138
You nave a Deployment running a web application tnat uses secrets to store sensitive information like database credentials. To improve security, you want to use a secret injection mechanism to provide the secret to the pod without exposing it in the deployment YAML.

QUESTION 139
You are running a multi-container application on Kubernetes, and you need to update the image of a specific container within the pod without affecting the other containers. You are using a Deployment resource to manage the pods. How can you achieve this update using imperative commands?