Certified Kubernetes Application Developer practice questions

Question 1

A developer is being asked to extend the Kubernetes API with a new application kind. Per the Custom Resources concept page, which statement captures what a custom resource is and how clusters use it?

Accepted Answer

Custom resources are extensions of the Kubernetes API; once a custom resource is installed, users can create and access its objects using kubectl, just as they do for built-in resources like Pods.

Answer

Custom resources are stored in a separate database from the rest of the Kubernetes API and require their own auth tokens to query, distinct from the cluster's RBAC.

Answer

Custom resources are immutable once installed and cannot be modified or removed without re-installing the entire cluster control plane from scratch.

Answer

Custom resources are deprecated in favour of inline JSON Patch annotations on built-in objects, which is the documented modern way to add new kinds in v1.30+.

Question 2

A developer is rolling out an updated Deployment image and asks how the new Pods land on cluster Nodes during a rolling update. Per the rolling-update tutorial, which statement is correct?

Accepted Answer

The new Pods are scheduled on Nodes with available resources, and Kubernetes waits for those new Pods to start before removing the old Pods.

Answer

The new Pods always replace the old Pods in place on the same Node, which is why a rolling update never frees up any node-level resources.

Answer

The new Pods are scheduled randomly without consideration of resources and the kube-scheduler skips its scoring phase entirely during a rolling update.

Answer

The new Pods are created only after every old Pod has terminated; a rolling update incurs full downtime by design until the rollout completes.

Question 3

A platform team is migrating a stateless image-resizing service to Kubernetes, and a developer is configuring a ReplicaSet directly to keep a fixed number of identical Pods running. They need to know what the ReplicaSet consults whenever it must bring up a replacement Pod after one is deleted. Which statement matches the ReplicaSet concept page?

Accepted Answer

When it must create Pods to reach the desired count, the ReplicaSet uses the pod template defined in its own spec.

Answer

When a replica goes missing, the ReplicaSet clones the live spec of an existing healthy Pod that matches its selector.

Answer

When it drops below the desired count, the ReplicaSet asks its parent Deployment to replay an earlier saved revision.

Answer

When more Pods are needed, the scheduler rebuilds the last terminated Pod's manifest straight from the etcd data store.

Question 4

Debugging why a short name like data resolves to data.test.svc.cluster.local, a developer is asked what drives that suffix expansion inside a Pod. Per the DNS for Services and Pods page, which mechanism explains it?

Accepted Answer

kubelet writes the Pod resolv.conf so search-domain values expand a short query into a fully qualified name

Answer

The kube-proxy daemon rewrites the destination host to the Service FQDN before any DNS query is ever sent

Answer

CoreDNS issues a CNAME for every short name, redirecting it to the matching ExternalName Service hostname

Answer

The container runtime appends the suffix because Pods inherit the node /etc/hosts entries automatically too

Question 5

A platform team is being asked why Kubernetes encourages stdout/stderr-based logging for containerized apps. Per the logging architecture page, which statement captures the recommended logging method?

Accepted Answer

The easiest and most adopted logging method for containerized applications is writing to standard output and standard error streams.

Answer

The recommended logging method is writing rotated log files into a hostPath volume on every node and shipping them with a privileged init container.

Answer

The only supported logging method is sending logs over UDP to the kube-apiserver, which forwards them to etcd for permanent storage.

Answer

The recommended logging method is calling the syslog daemon on the underlying host through a Unix socket exposed inside the container's namespace.

Question 6

A platform team is rolling out the restricted Pod Security Standard to an existing namespace and wants to see which running Pods would violate it before actually enforcing the policy. Which approach matches the documented mechanism?

Accepted Answer

Apply the enforce label with the --dry-run flag, which runs the Pod Security checks and reports how the policy would treat existing Pods without enforcing.

Answer

Delete and recreate every Pod in the namespace, because the admission plugin only evaluates the new policy against Pods created after the label changes.

Answer

Set the enforce label to a warn-only value, which permanently downgrades all violations to warnings and never blocks any future Pod admission request.

Answer

Add the label with no flag at all, because the admission plugin silently skips pre-existing Pods and only checks each one at its next scheduling event.

Question 7

A platform team is rolling out a new service via blue-green and needs to understand how the Argo Rollouts controller manages the active and preview Service routing. Which statement is true per the BlueGreen feature docs?

Accepted Answer

The Rollout spec has users specify a reference to active service and optionally a preview service in the same namespace, and the controller injects a ReplicaSet hash into the Service selectors to route traffic.

Answer

The Rollout spec uses a single Service for both active and preview, which the controller toggles by changing the Service type from ClusterIP to LoadBalancer mid-rollout.

Answer

The Rollout spec deletes the active Service entirely during the cut-over, leaving traffic routed only to the preview backend until the rollout completes.

Answer

The Rollout spec requires manual editing of node iptables rules at every cut-over because the BlueGreen strategy bypasses Kubernetes Services entirely by design.

Question 8

An application has a Python API process that needs a reliable place to write a working file that survives the container restarting but does not need to outlive Pod deletion. The developer is choosing between Pod-scoped storage and persistent storage. Which option correctly describes a PersistentVolume in this trade-off?

Accepted Answer

A PersistentVolume is a piece of cluster storage with a lifecycle independent of any individual Pod that uses it, suited for data that must outlive Pod deletion.

Answer

A PersistentVolume is destroyed automatically the moment its mounting Pod is rescheduled, making it equivalent to an emptyDir volume in practice.

Answer

A PersistentVolume can only be backed by NFS storage, so it is not a good fit when the cluster runs on a public cloud provider's managed disk.

Answer

A PersistentVolume must be created inline in the Pod spec and cannot be provisioned ahead of time by an administrator or storage class.

Question 9

To trim cross-zone data-transfer charges, a team needs to make a busy ClusterIP Service keep request traffic on the same node it originated from. Per the Service Internal Traffic Policy page, which setting achieves this?

Accepted Answer

Set .spec.internalTrafficPolicy to Local so kube-proxy only routes to endpoints on the originating node

Answer

Set .spec.externalTrafficPolicy to Local so kube-proxy preserves the external client source IP across nodes

Answer

Set .spec.sessionAffinity to ClientIP so repeated requests from a client always land on the same backend Pod

Answer

Set .spec.type to ExternalName so the Service resolves to a CNAME and skips the kube-proxy data hop entirely

Question 10

A developer is migrating a legacy app to Kubernetes and needs to wire health checks. Per the probes concept page, what is the kubelet's role with respect to probes?

Accepted Answer

Kubernetes lets you define probes to continuously monitor the health of containers in a Pod, and a probe is a diagnostic performed periodically by the kubelet on a container.

Answer

Kubernetes runs probes only at Pod startup, after which the kubelet stops checking and never re-evaluates the container's health for the rest of the Pod's lifetime.

Answer

Kubernetes probes are an external Prometheus-only feature and the kubelet itself does not perform any periodic diagnostics on Pods running on its node.

Answer

Kubernetes probes require the application to expose an admin port equal to the kubelet's metrics-server port, otherwise probes are silently ignored on every node.

Question 11

An engineer is tasked with explaining why one client call to the API server returns HTTP 401 while a second, nearly identical call returns HTTP 403. Per the request lifecycle, which explanation is correct?

Accepted Answer

The 401 call could not be authenticated at all, while the 403 call authenticated but every authorization module denied the requested action.

Answer

The 401 call failed an admission control check, while the 403 call was rejected during the TLS transport-security handshake on port 6443 first.

Answer

The 401 call was denied by an authorization module, while the 403 call presented an expired client certificate during the authentication step.

Answer

The 401 call was rejected by a mutating admission webhook, while the 403 call exceeded a ResourceQuota that was defined on its target namespace.

Question 12

A developer is rolling out a new revision of a stateless web service and must decide which workload object to use for declarative updates that reconcile to a desired state at a controlled rate. Which Kubernetes resource matches this description?

Accepted Answer

A Deployment, which provides declarative updates for Pods and ReplicaSets, with the controller changing actual state to desired state at a controlled rate.

Answer

A bare ReplicaSet edited in place, which the developer should manage directly without a Deployment in front to avoid extra abstraction layers.

Answer

A DaemonSet, which provides declarative updates by running one Pod per node and is the recommended primitive for stateless web services.

Answer

A Job, which performs declarative rolling updates over time by retrying its single Pod until the new desired image hash is reached.

Question 13

An architect is designing a Pod where a sidecar must reformat the main container's heterogeneous log output into one schema that an external monitoring system expects. They are evaluating the documented multi-container patterns to name this one. Which statement matches the kubernetes.io page?

Accepted Answer

This is the adapter pattern, a sidecar that transforms the container's output into a format external systems expect.

Answer

This is the ambassador pattern, where the sidecar proxies the main container's outbound connections to external services.

Answer

This is an init container, which runs to completion before the main container starts in order to generate its configs.

Answer

This is the ephemeral container pattern, a temporary container attached to reformat the output during live debugging.

Question 14

A developer is being designed onto an Ingress object that needs HTTPS termination at the cluster edge. Per the Ingress concept page, which protocol-aware capability is part of Ingress per the docs?

Accepted Answer

Make your HTTP (or HTTPS) network service available using a protocol-aware configuration mechanism that understands web concepts like URIs, hostnames, paths, and more.

Answer

Ingress understands only TCP packets and never inspects the inner HTTP layer at the cluster edge for any backend Service in any cluster.

Answer

Ingress is a UDP-only protocol and provides protocol-aware load balancing exclusively for QUIC-based applications running on cluster Pods.

Answer

Ingress is incompatible with HTTPS and SSL termination must be performed by an external NLB on the cloud provider's side outside the cluster.

Question 15

A developer is migrating a stateful service to Kubernetes and asks why cluster-level logging is recommended over node-local files alone. Per the logging architecture page, which statement captures the documented motivation?

Accepted Answer

In a cluster, logs should have a separate storage and lifecycle independent of nodes, pods, or containers; this concept is called cluster-level logging.

Answer

In a cluster, logs should be erased on every Pod deletion to satisfy GDPR, so cluster-level logging is the documented kubelet feature for hard-deleting old logs.

Answer

In a cluster, logs should be embedded into the container image at build time so every Pod has a self-contained record; cluster-level logging is unnecessary.

Answer

In a cluster, logs should be served by the kubelet as a single API endpoint per node and never centralized into a separate storage system.

Certified Kubernetes Application Developer

Sample questions

Sources

Similar exams