CKAD (Certified Kubernetes Application Developer) is the CNCF and Linux Foundation certification for people who build and run applications on Kubernetes. Unlike most cloud exams, it has no multiple-choice questions: for 2 hours you solve hands-on tasks in a live cluster from the command line. The exam now runs on Kubernetes v1.37, and the curriculum includes Helm, Kustomize, deployment strategies, security contexts and network policies.
This guide follows the official CKAD curriculum: the five domains with weights, the kubectl speed habits that matter, a 6-week plan and 15 original practice tasks with answers.
Quick facts (Linux Foundation, November 2026)
| Item | Detail |
|---|---|
| Format | Online, proctored, performance-based tasks on the command line |
| Duration | 2 hours |
| Kubernetes version | v1.37 (the exam moves to each new minor version within about 4–8 weeks of release) |
| Price | USD 445 exam only; USD 645 with the LFD259 Kubernetes for Developers course |
| Retake | One free retake included |
| Simulator | Two killer.sh sessions, 36 hours each, 17 questions per session |
| Validity | 2 years |
Read the official CKAD page and the CNCF curriculum before booking. Prices and bundles change often, and Linux Foundation runs frequent discounts.
CKAD, CKA or CKS?
| Exam | Focus | Best for |
|---|---|---|
| CKAD | Deploying, configuring and debugging apps | Developers, DevOps freshers, platform users |
| CKA | Installing, upgrading and troubleshooting clusters | DevOps, SRE and platform engineers |
| CKS | Cluster and supply-chain security | Security-focused engineers (CKA required first) |
For CKA and CKS, see our CKA and CKS roadmap. Many freshers take CKAD first because it focuses on the workloads they deal with every day.
Domains and weights (CKAD v1.37)
| Domain | Weight |
|---|---|
| Application Design and Build | 20% |
| Application Deployment | 20% |
| Application Observability and Maintenance | 15% |
| Application Environment, Configuration and Security | 25% |
| Services and Networking | 20% |
What each domain covers
- Design and build (20%): define, build and modify container images; choose the right workload (Deployment, DaemonSet, CronJob and others); multi-container Pod patterns (sidecar, init); persistent and ephemeral volumes.
- Deployment (20%): blue/green and canary with Kubernetes primitives; Deployments and rolling updates; Helm to deploy existing packages; Kustomize.
- Observability and maintenance (15%): API deprecations; probes and health checks; built-in CLI monitoring; container logs; debugging.
- Environment, configuration and security (25%): CRDs and Operators; authentication, authorisation and admission control; requests, limits and quotas; ConfigMaps; Secrets; ServiceAccounts; SecurityContexts and capabilities.
- Services and networking (20%): NetworkPolicies; Services and troubleshooting access; Ingress rules.
Speed habits that pass the exam
Most people who fail CKAD know Kubernetes but run out of time. Generate YAML instead of typing it:
# Short alias and dry-run output
alias k=kubectl
export do="--dry-run=client -o yaml"
# Generate, then edit
k create deployment web --image=nginx:1.27 --replicas=3 $do > web.yaml
k create cronjob report --image=busybox --schedule="*/15 * * * *" $do -- date > cj.yaml
k create configmap app-cfg --from-literal=MODE=prod
k create secret generic db --from-literal=PASSWORD=change-me
k expose deployment web --port=80 --target-port=80 --type=ClusterIP
# Rolling update and rollback
k set image deployment/web nginx=nginx:1.28
k rollout status deployment/web
k rollout undo deployment/web
# Always switch to the context the task names
k config use-context <context-from-task>You can use the official Kubernetes documentation during the exam. Practise finding pages quickly (NetworkPolicy, probes, SecurityContext) instead of memorising YAML.
6-week study plan
| Week | Focus | Practice |
|---|---|---|
| 1 | Pods, Deployments, labels, Services; kubectl generators | Create 20 objects using only imperative commands |
| 2 | Images, multi-container Pods, init containers, volumes, Jobs and CronJobs | Sidecar that tails a log file from a shared emptyDir |
| 3 | ConfigMaps, Secrets, ServiceAccounts, requests and limits, quotas, SecurityContext | Run a Pod as non-root with dropped capabilities |
| 4 | Rolling updates, rollbacks, blue/green and canary, Helm, Kustomize | Canary with two Deployments behind one Service |
| 5 | Probes, logs, debugging, API deprecations, NetworkPolicy, Ingress | Fix five broken Pods; lock down a namespace with NetworkPolicy |
| 6 | Timed drills; both killer.sh sessions | Review every wrong answer; book the exam |
15 practice tasks with answers
These are original practice tasks written for this guide, not exam questions.
1. Run a Deployment with 3 replicas of nginx and expose it inside the cluster on port 80.k create deployment web --image=nginx --replicas=3 then k expose deployment web --port=80.
2. A task must run every night at 01:30. Which resource?
A CronJob with schedule 30 1 * * *.
3. A database must be ready before the app container starts. What do you add?
An init container that waits for the database.
4. A log shipper must read files written by the main container. Which pattern?
A sidecar container sharing an emptyDir volume.
5. Roll back a Deployment after a bad image update.k rollout undo deployment/web (add --to-revision=N for a specific revision).
6. Send about 20% of traffic to a new version without a service mesh.
Run a second Deployment with the same Service selector label and size the replicas 4:1.
7. Install a packaged app from a chart repository.helm repo add, helm repo update, then helm install <release> <repo/chart>.
8. The same manifests need a different replica count and image tag in prod. Which tool?
Kustomize overlays (k apply -k overlays/prod).
9. Traffic reaches a Pod before the app is ready. What fixes it?
A readinessProbe.
10. A container hangs but never exits. How does Kubernetes restart it?
A livenessProbe that fails when the app hangs.
11. Inject a database password as an environment variable without putting it in the Pod spec.
Create a Secret and use valueFrom.secretKeyRef (or envFrom).
12. A container must not run as root and must not escalate privileges.
Set runAsNonRoot: true, allowPrivilegeEscalation: false and drop capabilities in the securityContext.
13. Pods in a namespace keep getting OOMKilled. What do you check?
Memory limits in the Pod spec and actual usage (k top pod, k describe pod).
14. Only Pods labelled app=frontend may reach the API Pods on port 8080.
A NetworkPolicy on the API Pods with an ingress rule from podSelector: app=frontend on port 8080.
15. Expose shop.example.com/api to the api Service.
An Ingress with a host rule for shop.example.com and a path /api pointing to Service api.
After CKAD
- Practise Kubernetes interview questions, Docker interview questions and GitOps interview questions.
- Go deeper with the CKA and CKS roadmap or a cloud exam like AWS DOP-C02.
- See live DevOps and cloud jobs.
Cloud Soft Solutions in Ameerpet, Hyderabad teaches Docker, Kubernetes, Helm and multi-cloud DevOps with real-time projects. See the APEX program and all courses.
📞 Call +91 96660 19191 · WhatsApp · Flat No. 513, 5th Floor, Nilagiri Block, Aditya Enclave, Ameerpet, Hyderabad
Frequently Asked Questions
Is CKAD multiple choice?
No. It is a 2-hour, online-proctored, performance-based exam: you solve tasks in live Kubernetes clusters from the command line.
Which Kubernetes version does CKAD use?
Kubernetes v1.37. The exam moves to each new minor version within about 4–8 weeks of its release.
How much does CKAD cost?
USD 445 for the exam only, with one free retake and two killer.sh simulator sessions included.
Which CKAD domain has the most weight?
Application Environment, Configuration and Security, at 25%.
How long is CKAD valid?
2 years.
Should I take CKAD or CKA first?
Developers and DevOps freshers often start with CKAD because it covers deploying and debugging apps. CKA covers installing and running clusters.
