ckad exam questions Intermediate Practice Exam: Medium Difficulty 2025

You are containerizing a web API. The app must read its configuration from environment variables, and the config should be reusable across multiple Deployments while allowing a few keys to be overridden per environment (dev/prod). Which approach best fits this requirement?

You need to run a one-off database migration job that should stop the application Deployment from starting until the migration completes successfully. The migration should not run again if Pods restart. What is the most appropriate Kubernetes pattern?

A Deployment has 6 replicas and must maintain at least 5 available Pods during voluntary disruptions (e.g., node drain) while still allowing rolling updates. Which resource best enforces this requirement?

You are updating a Deployment and want to ensure that if the new Pods fail readiness, Kubernetes automatically stops progressing the rollout and allows you to revert. What should you rely on to meet this behavior?

A node is low on memory. Your Pod is OOMKilled repeatedly. You want the scheduler to avoid placing this workload on nodes that cannot accommodate it and also enforce an upper bound to prevent noisy-neighbor impact. What should you configure?

A Pod contains two containers: an app and a metrics sidecar. You need to inspect logs for only the sidecar, and also quickly check the app container's recent restarts and last termination reason. Which combination of kubectl actions best meets this goal?

You want to expose an HTTP /health endpoint for Kubernetes to determine when to restart a stuck process vs when to stop sending traffic during startup. The app sometimes takes 30 seconds to warm up, and during that time it should not receive traffic but also should not be restarted. Which probe setup is most appropriate?

A Pod must read a TLS private key and certificate. The key must not be exposed via environment variables, and file permissions should be restricted so only the container process can read them. Which solution is most appropriate?

A namespace should enforce that all Pods run as non-root and should prevent privilege escalation. You want this enforced even if developers forget to set securityContext in their manifests. What is the best approach?

You have a backend Deployment exposing port 8080 in its Pods. You need stable in-cluster access and also want to route HTTP traffic by URL path (/api) from an ingress controller to that Service. Which set of objects is required?