Practice round

{{ summaryValue }}

{{ summaryLine }}

CKAD · Kubernetes v1.37 · English

Unofficial, independently authored concept practice for the Certified Kubernetes Application Developer exam. The official CKAD is a hands-on performance exam; choosing answers here does not test cluster skills or predict passing. Official target · curriculum v1.37 verified 17 October 2026.

Optional. Leave blank to use the disclosed snapshot, or require minor 1.37 (v1.37 also works). Other versions, patches and ranges are unavailable.
Optional. Leave blank or require 2026-10-17, the locally verified curriculum snapshot. This is not an exam sitting date or provider effective date; blank does not check for provider updates.

{{ examTargetValidation }}

{{ conflict.key }} — all requested values:
  • {{ JSON.stringify(value) }}

{{ params.curriculum_date || params.kubernetes_version ? 'The available snapshot meets these requirements.' : 'No snapshot requirements: use the disclosed available snapshot.' }}

Both actions discard any saved attempt. Pin the available version and date, or clear the requirements; then start a new round.
Available snapshot
Foundation focuses on direct facts and commands. Applied reasoning combines requirements, lifecycle effects or troubleshooting. These are editorial study labels, not official or calibrated exam ratings.
Keep the seed to replay the same questions and option order.

{{ examSetupValidation }}

48 original items cover all 24 curriculum objectives at a conceptual level. Rounds sample uniformly; they do not reproduce official domain weights, timing or tasks. Your current answers are stored in the share URL. Share it only if you want to share those responses.

{{ progressPercent }}%
{{ answeredCount }} of {{ questionCount }} answered

{{ progressStatusLine }}

Question {{ examCursor + 1 }} of {{ questionCount }}

{{ currentQuestion.stem }}

{{ currentQuestion.accessible_clue }}

Answer recorded. Corrections will appear after you finish the round.

Review this practice round

{{ resultLead }} Difficulty: {{ difficultyLabel }} (editorial study label).

{{ resolvedTargetLabel }}

Readiness review

These results describe only this authored round. They do not measure hands-on Kubernetes work or predict the official CKAD result. Continue practical manifest, deployment and troubleshooting exercises.

{{ readinessReviewTitle }}

{{ readinessReviewLine }}

{{ card.label }}
{{ card.value }}
{{ card.note }}

Missed answer review

  1. {{ item.prompt }}

    Your answer: {{ item.selected_answer_label }}

    Correct answer: {{ item.correct_answer_label }}

    {{ item.explanation }}

    Primary reference · {{ item.source.version }}

Next hands-on practice

  • {{ domain.label }}: {{ domain.study }}

Domain performance

Correct and missed answers from this round, grouped by the five curriculum domains. These counts are not an official score or a weighted assessment.

Not tested in this round: {{ untestedDomains.join('; ') }}. Zero bars mean no evidence for these domains.

Loading domain-performance chart…

{{ examChartStatus }}

  • {{ domain.label }}: {{ domain.weight }}% of the official curriculum. Practice selection does not enforce these weights.

{{ examChartExportStatus }}

Answer ledger

Question ID Prompt Topic Your answer Correct answer Outcome Explanation Source Copy
{{ row.question_id }} {{ row.prompt }} {{ row.category_label }} {{ row.selected_answer_label }} {{ row.correct_answer_label }} {{ row.outcome_label }} {{ row.explanation }} —

{{ examLedgerExportStatus }}

Kubernetes and Cloud Native Associate Exam Prep Practise KCNA concepts with original questions and blueprint-weighted rounds, then use explanations to review mistakes across four domains.
Certified Kubernetes Administrator Concepts Exam Prep Practise CKA v1.37 concepts with unofficial multiple-choice rounds and sourced explanations that help focus your next hands-on study session.
Kubernetes NetworkPolicy Generator Build Kubernetes NetworkPolicy YAML from pod labels and allow rules with selector checks, rollout guidance, and security review warnings.
Kubernetes Pod Security Context Checker Check Kubernetes workload YAML for inherited security contexts, Pod Security gaps, weighted findings, and a reviewable hardening patch.

A scheduled report and a continuously available web service need different Kubernetes workloads. A Job represents work that should finish, a CronJob schedules recurring Jobs, and a Deployment manages replaceable Pods for a stateless service. A DaemonSet instead places a workload on eligible nodes. Choosing by lifecycle prevents mistakes such as treating a scheduled report as a permanent service or assuming a replica count guarantees one Pod per node.

The Certified Kubernetes Application Developer (CKAD) exam focuses on designing, building and deploying applications on Kubernetes. It is a Linux Foundation and Cloud Native Computing Foundation certification examination with practical tasks completed at a command line. Candidates must work with resource definitions and application behavior, not simply recognize the names of Kubernetes objects.

Pod
One or more containers scheduled together. They share networking and can share volumes, making a Pod a unit for closely related processes rather than a collection of independent replicas.
Deployment
A workload resource that manages replaceable application Pods and controlled updates to their configuration. A replica is another running instance, while a rollout changes the Pod template used for those instances.
Service
A stable way to reach application backends over the network. A selector-based Service finds Pods through labels, so its existence alone does not establish that it has usable backends.

Application requirements are commonly written in a manifest, a resource definition expressed in YAML. The definition describes the desired configuration, while controllers work to bring running resources into that state. Acceptance by the application programming interface (API) is therefore only one checkpoint. The application still needs the right image, configuration, storage and network connections to do useful work.

A container can be running while its application remains unreachable. A Service might select the wrong Pods, a process may still have its old configuration, or a health check may keep it out of normal traffic. Kubernetes application development involves connecting those definitions and checking the resulting behavior, rather than treating a started container as a finished deployment.

Pod replacement also changes how application data should be handled. Temporary working files can belong to a Pod's lifetime, but data needed by its replacement requires an appropriate persistent-storage arrangement. Configuration has a different concern: changing a stored setting does not necessarily change an already-running process. The way the application receives and reloads that setting determines when it takes effect.

Health checks require a similar distinction. Readiness concerns whether an application should receive traffic; liveness concerns whether its container needs to be restarted. Confusing a temporary inability to serve requests with an unrecoverable process failure can cause unnecessary restarts. Slow initialization, dependencies and the application's own recovery behavior all affect that choice.

Concept questions can reveal a mistaken assumption about these relationships and help identify a useful lab exercise. They cannot establish that someone can edit a valid manifest, apply it in the intended namespace, diagnose a failure and verify the repair under exam conditions. Practical CKAD preparation needs that direct cluster work as well as an understanding of the rules.

How to Use This Tool:

This is unofficial, independently authored, untimed concept practice in English for Kubernetes v1.37, using a local curriculum snapshot dated 17 October 2026. The official CKAD page and v1.37 curriculum were checked against this bank on 17 October 2026. This concept practice does not simulate the official performance exam.

  1. Check the snapshot requirements before starting. Required Kubernetes version accepts a blank value, 1.37 or v1.37. Required curriculum snapshot date accepts a blank value or 2026-10-17. The date identifies the local verification snapshot, not an exam appointment or a provider effective date. Blank requirements accept this same snapshot without checking for updates.
    Other versions, patch-specific requests, ranges and other snapshot dates are unavailable. For an invalid or incompatible saved attempt, Pin available snapshot sets the supported version and date, while Use available snapshot clears those requirements. Both discard the saved attempt and its answers; neither migrates answers or updates the question bank.
  2. Choose a Domain and Mode. Mixed application practice combines the two question types. Concepts focuses on conceptual prompts, while Command and manifest reasoning focuses on interpreting commands and resource definitions. All three use single-choice answers; no command is executed and no cluster is connected.
  3. Set Difficulty, then choose an offered Question count. Foundation emphasizes direct facts and commands; Applied reasoning combines requirements, lifecycle effects or troubleshooting. These are editorial study labels, not official or calibrated exam ratings. The default is eight questions across all five domains, mixed practice and all difficulty levels. That combination offers 4, 8, 12, 24 or 48 questions; narrower selections have smaller menus, sometimes just one question.
  4. Choose when to see corrections through Feedback. After each answer, the default, shows the outcome and explanation immediately. After the whole round records the answer without revealing corrections until the round is finished. Under Advanced, keep the prefilled Replay seed of ckad-135 or enter nonblank text within the 128-character limit for a different repeatable selection. Surrounding spaces are ignored; some emoji use two character positions.
  5. Select Start concept practice and answer each question. Choosing one of the four options records and locks that response immediately. Use Next question to continue and View results after the last answer. Reset this attempt returns to setup and clears the current responses rather than reopening an answer for editing.
  6. Review Missed answer review and the related Next hands-on practice suggestions. After studying an explanation, use Retry missed for a round containing only incorrect items. Replay same seed repeats the same round, while Try a new seed requests another seeded selection from the available scope.

Interpreting Results:

During practice, the main summary counts answers recorded. After the completed round is opened, it shows correct answers out of all questions. Reaching 100% progress means every question has been answered, not that every answer was correct. The Answer ledger supplies the selected answer, correct answer, outcome, explanation and reference for each item.

Domain performance groups correct and missed answers into the five curriculum domains. Compare the counts with how many questions were actually sampled. A domain with no questions is marked Not tested; its zero bars provide no evidence of either strength or weakness. Unequal numbers of questions also make raw miss counts an unsuitable ranking of ability across domains. If the chart is unavailable, select Retry chart; the Answer ledger still provides the results.

The heading Readiness review names a study review, not a validated readiness assessment. There is no pass prediction, official scaled score or mastery threshold. A high result establishes only how many answers matched this authored round, especially when the items or option order are already familiar.

Next hands-on practice lists domains containing missed answers, or all five domains when there are no misses. Use those suggestions to reproduce the relevant behavior in a disposable Kubernetes lab. A completed deployment, an observed configuration change or a verified connection supplies practical evidence that a selected answer cannot.

Technical Details:

Application reasoning often depends on which object changes and when that change reaches a running process. A new declaration, a container restart, a replacement Pod and a traffic-routing change have different consequences. The following Kubernetes v1.37 rules explain several of the distinctions tested by this practice.

When application changes take effect

Condition Governing behavior Important boundary
An unpaused Deployment's Pod template changes A change under spec.template, such as a container-image change, triggers a rollout. Changing only the replica count or top-level metadata does not create a new Pod-template revision.
A ConfigMap used through an environment variable changes The existing process keeps its previously supplied environment value. Updating the ConfigMap alone does not roll out new Pods. A suitable restart or rollout is needed to consume the new value.
A ConfigMap used through a normal volume projection changes Projected files can receive the update eventually. Delivery is not instantaneous, and the application must reread or reload the file.
A ConfigMap file mounted with subPath changes The mount does not receive subsequent ConfigMap updates. Changing the mount design or recreating the Pod is necessary; waiting longer does not remove this limitation.
A container crashes within the same Pod using emptyDir The volume's data survives that container restart. Removal of the Pod removes its temporary data. A replacement Pod has no durability guarantee from that volume.
A readiness probe fails The Pod becomes not ready for normal Service traffic. Readiness failure does not itself restart the container.
A configured startup probe has not succeeded Liveness and readiness probes wait for startup success. The startup probe's own failure threshold still applies; startup protection is not unlimited.
Liveness failures reach the configured failure threshold Kubernetes terminates the affected container, which is then subject to its restart policy. A restart is not a repair for an incorrect image reference, Service selector or unavailable external dependency.

A Deployment rollback restores a retained Pod-template revision. Restarting its current Pods does not restore the previous image or configuration. That distinction matters after a bad image rollout: recreating the same faulty template can reproduce the failure instead of correcting it.

Service routing and NetworkPolicy rules

For a selector-based Service, labels determine which Pods supply backends, while ports determine where traffic is sent. A Service exposing port 80 to clients can forward to a process listening on 8080 through port: 80 and targetPort: 8080. Omitting targetPort defaults it to the Service port; it does not discover the application's listener. EndpointSlices describe the selected backends. An Ingress resource adds routing declarations but needs an appropriate Ingress controller to implement them.

NetworkPolicy has a separate permission check. With a network plugin that enforces these policies, a new connection between an egress-isolated source Pod and an ingress-isolated destination Pod needs permission in both directions. Ingress means incoming traffic and egress means outgoing traffic. Policies add allowed traffic within each direction rather than applying a first-match rule.

Within one ingress rule, this peer fragment requires a source Pod labeled role=client inside a namespace labeled team=payments. The two selectors belong to the same list entry, so both must match.

from:
  - namespaceSelector:
      matchLabels:
        team: payments
    podSelector:
      matchLabels:
        role: client

Putting the selectors in separate peer entries creates alternatives instead. A namespace-only entry matches all Pods in matching namespaces; a Pod-only entry matches labeled Pods in the policy's own namespace. Other applicable policies can also broaden the allowed traffic. This is a peer fragment, not a complete policy or proof that traffic restrictions are enforced.

Resource and security assumptions

Resource requests describe declared demand used for scheduling, rather than current consumption. A namespace quota on CPU requests can therefore reject a new Pod even while observed CPU use is low. Reducing requests merely to pass admission can leave the declaration disconnected from the application's real needs; the appropriate correction depends on the workload and the available quota.

A ServiceAccount supplies a namespaced identity, while authorization determines what that identity may do. Similarly, base64 encoding in a Secret is not encryption or access control. Correctly identifying the resource type does not establish that its permissions, storage protection or subsequent handling are safe.

Curriculum mapping and sampling

The bank maps 48 original questions to 24 objectives in the v1.37 snapshot, with a concept item and an application or command-reasoning item for each. That intended mapping is not a guarantee that every task under an objective is covered. The counts below describe the complete bank before domain, mode or difficulty filters.

Curriculum domain v1.37 curriculum weight Practice questions Examples in the bank
Application Design and Build 20% 8 Images, workload choice, multi-container Pods and volumes
Application Deployment 20% 8 Release strategies, rollouts, Helm 3 and Kustomize
Application Observability and Maintenance 15% 10 API changes, probes, metrics, logs and debugging
Application Environment, Configuration and Security 25% 16 Custom resources, access checks, quotas, configuration, Secrets and workload identity
Services and Networking 20% 6 NetworkPolicy, Service selection and ports, and Ingress

Selection is uniform without replacement within the chosen question pool. No question repeats within that round, but no domain quota is enforced either. Even a 48-question round follows the authored item counts rather than the official curriculum percentages. The two individual content modes each contain 24 items; difficulty filters further change the eligible pool.

The same seed reproduces question and option order only when the domain, mode, difficulty, count, replay scope and question-bank revision also remain the same. A different seed can still select familiar questions. Selecting the entire available pool cannot produce unseen content, and incompatible saved rounds are not silently converted into a newer bank.

Points and percentages within a practice round

Each correct answer earns one point and each incorrect answer earns zero. There is no negative marking, partial credit or domain weighting. Let C be the number of correct answers, A the number of answered questions and N the total number of questions in the current round.

Points=C Possible points=N

Progress measures how much of the round has been answered, regardless of correctness.

Progress (%)=100×AN

Round accuracy uses all round questions as its denominator, not just questions answered so far.

Round accuracy (%)=100×CN

Unanswered questions remain in N, but do not enter the incorrect-answer count or missed-item list. For valid rounds, N is positive and C cannot exceed A or N. Raw accuracy and displayed progress are unrounded. The final correct/total summary uses exact whole-question counts. There is no conversion to an official CKAD score.

For example, four recorded responses in an eight-question round, with two correct, correspond to 50% progress and 25% round accuracy. Two answers are incorrect and four questions remain unanswered. The summary still reports 4/8 answered, not a final score.

Condition Summary or review Meaning
A < N Answered count; the round is incomplete Recorded responses are not a completed result.
A = N and C < N Start with the missed answers, after opening results Every question was answered and at least one answer was incorrect.
A = N and C = N Perfect round, after opening results No misses in this round, not a certification or competence finding.

Privacy Notes:

Answer evaluation runs in the browser, but the current attempt and its responses are encoded in the share URL without encryption. A compatible link can restore the questions, answers and position in the round. Anyone receiving that link can receive those responses too; the URL can remain in browser history and reach the site when reloaded.

Do not put credentials or other confidential information in a replay seed. Downloaded answer ledgers also contain responses. Page resources, chart or document features and opened references may use the network, so browser scoring should not be read as a promise of fully offline operation or that all activity stays on the device.

Worked Examples:

An eight-question round that leaves two domains untested

With the current bank, choose All five domains, Mixed application practice, All difficulty levels, eight questions and the seed ckad-135. This seeded round contains five configuration-and-security questions, two design-and-build questions and one deployment question. Even when all eight answers are correct and the summary shows 8/8, observability and networking remain Not tested. Choose a focused round in those domains to obtain evidence about them instead of treating the broad setup label as a guarantee that every domain was sampled.

Two networking misses become a two-question retry

Choose Services and Networking, mixed practice, all difficulty levels and six questions. Suppose four answers are correct and the two NetworkPolicy answers are incorrect. After the round, progress is complete but the score summary is 4/6, with four correct and two missed answers in networking. Retry missed creates a two-question round from those mistakes. Answering both correctly gives 2/2 for the retry. This is a separate result for repeated items, with a different denominator from the original 4/6 and no evidence about the other four domains. The useful follow-up is to verify the corrected policy reasoning with allowed and blocked connections in an appropriate lab.

References: