Services and Networking

Which of the following service types exposes a service on a static port on each node's IP address?

You run 'kubectl get svc my-service -o yaml' and see 'type: ClusterIP'. The service has no endpoints. What is the most likely cause?

An administrator runs 'kubectl run nginx --image=nginx --port=80' and then 'kubectl expose pod nginx --port=80 --type=NodePort'. Later, they run 'kubectl get svc nginx' and see that the NodePort is set to 0. What is the most likely reason?

You have a Service named 'my-service' in namespace 'ns1'. Another pod in namespace 'ns2' needs to resolve 'my-service' using DNS. What FQDN should the pod use?

An Ingress resource is created with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 The backend service 'api-service' is in the same namespace as the Ingress. What must be true for the Ingress to route traffic to the service?

A cluster has a NetworkPolicy that denies all ingress traffic by default. An administrator wants to allow TCP traffic on port 8080 from pods with label 'app: web' in the same namespace. Which NetworkPolicy egress rule is needed?

What is the default DNS name for a service named 'my-svc' in namespace 'default'?

A developer runs 'kubectl port-forward service/my-service 8080:80'. What does this command do?

A pod cannot resolve a service DNS name. The cluster uses CoreDNS. Which of the following is the most likely cause if the pod's /etc/resolv.conf contains 'nameserver 10.96.0.10' and the CoreDNS pod is running?

Which of the following commands can be used to check the endpoints of a service named 'my-service'?

What is the default kube-proxy mode in Kubernetes v1.29?

You have a headless service named 'my-headless' with clusterIP: None. A pod in the same namespace queries the DNS name 'my-headless'. What will the DNS response contain?

Which TWO of the following are valid ways to expose a Deployment named 'web' as a service?

Which THREE of the following are requirements for an Ingress resource to work?

Which TWO of the following statements about NetworkPolicy are true?

Which kubectl command creates a service of type NodePort that exposes a deployment named 'web' on port 80?

A developer runs 'kubectl run nginx --image=nginx --expose --port=80'. What Kubernetes resources are created?

You have a NetworkPolicy that selects pods with label 'role: db' in the 'default' namespace. The policy has no ingress rules defined. What is the effect on traffic to the selected pods?

An ingress resource is defined with the following snippet: ```yaml spec: tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app-service port: number: 80 ``` The secret 'app-tls' exists and contains a valid certificate. However, accessing https://app.example.com returns a certificate warning in the browser. What is the most likely cause?

Which of the following is a valid ClusterIP service definition that exposes port 80 and targets container port 8080?

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

You apply the following NetworkPolicy: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress - Egress ``` What is the result?

Which kube-proxy mode uses IP Virtual Server (IPVS) for load balancing and supports more algorithms than the default mode?

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

You have three pods selected by a service. One pod is in 'CrashLoopBackOff' state. How does the service's endpoints behave?

Which annotation is commonly used with the ExternalDNS project to manage DNS records for a Kubernetes service?

Which TWO statements about Headless services are correct? (Select TWO)

Which THREE components are part of the Gateway API resource model? (Select THREE)

Which TWO network plugins (CNI) are commonly used in Kubernetes clusters? (Select TWO)

Which of the following Service types exposes a Service on a static port on each node's IP address?

You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?

A NetworkPolicy named 'deny-all' has only a podSelector matching all pods and no rules. What is the effect?

You create a Deployment with 3 replicas and a ClusterIP Service. You notice that some pods are not receiving traffic. What is the most likely cause?

You want to expose an application running in the cluster on a public IP address. Which Service type should you use?

You run `kubectl get endpoints my-service` and see no endpoints listed. The Service's selector matches labels on pods that are running. What is the most likely cause?

You have an Ingress resource with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 A client sends a request to http://example.com/api/v1/users. Which path is matched?

You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?

What is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

A developer asks you to create a Service that resolves to an external database at 'db.example.com'. Which Service type should you use?

You have a Service with endpoints for pods in different zones. You want kube-proxy to use a mode that provides better performance for large clusters and supports scheduling algorithms like least-connection. Which mode should you use?

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Which THREE of the following are true about NetworkPolicy? (Select THREE.)

Which TWO of the following are components of the Ingress API? (Select TWO.)

Which of the following Service types exposes a Service on a static port on each node's IP?

A developer runs `kubectl run nginx --image=nginx --port=80` and then `kubectl expose pod nginx --port=80 --target-port=80 --type=NodePort`. What is the name of the created Service?

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

Which of the following is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

What is the purpose of a headless Service (clusterIP: None)?

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Which of the following CNI plugins typically uses BGP to distribute routing information across nodes?

What is the default kube-proxy mode in modern Kubernetes clusters?

Which resource type is used to configure HTTP/HTTPS routing to Services?

A pod cannot resolve a Service name 'my-svc' in the same namespace. The DNS pod is running. What is a likely cause?

Which of the following is true about IngressClass resources?

A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?

Which two statements are true about EndpointSlices? (Choose two.)

Which three components are part of the Gateway API? (Choose three.)

Which two of the following are valid service discovery methods in Kubernetes? (Choose two.)

Which of the following Service types does NOT assign a ClusterIP to the Service?

You run `kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort` and the Service is created. What is the effect of this command?

A NetworkPolicy named 'deny-all' is applied to a namespace with podSelector: {}. The policy has no ingress rules. What is the effect?

What is the DNS name for a Service named 'api' in the 'default' namespace?

You want to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 9090. Which command should you use?

Which Ingress resource field is used to specify the hostname for which traffic should be routed?

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

You deploy a pod named 'app' that listens on port 3000. You create a Service named 'app-svc' with selector 'app: app'. From another pod in the same namespace, which command will successfully reach the service?

Which DNS record type does Kubernetes use to resolve a Service's ClusterIP?

After creating a NetworkPolicy that selects pods with label 'role: db' and allows ingress on TCP port 3306 from pods with label 'role: api', you notice that pods with label 'role: db' are still reachable on port 3306 from pods without 'role: api' label. What is the most likely cause?

You are designing an Ingress to expose multiple services on the same hostname based on path. Which Ingress specification is valid?

Which component is responsible for implementing the NetworkPolicy rules?

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster running on-premises (no cloud provider)?

Which THREE of the following statements about Kubernetes DNS are correct?

Which TWO of the following are valid IngressClass annotations or fields?

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

You apply the following NetworkPolicy to namespace 'ns1': apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-ingress spec: podSelector: {} policyTypes: - Ingress ingress: [] What effect does this policy have?

A pod is unable to resolve DNS names of services in other namespaces. Which DNS configuration is most likely missing?

Which kube-proxy mode uses iptables rules to handle service traffic?

You need to expose a service named 'my-svc' on a static port 30080 on every node. Which service type should you use?

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Which of the following is a valid CNI plugin for Kubernetes networking?

Which two of the following are valid methods for service discovery in Kubernetes?

Which three of the following are true about IngressClass?

Which two of the following are correct statements about EndpointSlices?

Which Kubernetes Service type exposes the Service on a static port on each Node's IP address, allowing external access without a LoadBalancer?

An administrator creates a Service of type ClusterIP named 'my-svc' in the namespace 'default'. A pod in the same namespace tries to resolve the hostname 'my-svc' but fails. The pod's resolv.conf shows 'search default.svc.cluster.local svc.cluster.local cluster.local'. What is the most likely cause?

A cluster administrator applies the following NetworkPolicy. What is the effect on pods matching the podSelector?

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

A cluster has kube-proxy running in ipvs mode. An administrator creates a Service of type ClusterIP. Which of the following is true about how traffic is forwarded to the pods?

An Ingress resource is defined with the following spec snippet. What is the minimal requirement for this Ingress to work correctly?

Which kubectl command correctly retrieves the list of EndpointSlices for a Service named 'my-svc' in the 'default' namespace?

Which DNS record does CoreDNS create for a headless Service named 'headless-svc' in the namespace 'default'?

A NetworkPolicy allows ingress traffic from pods with label 'app: frontend' in any namespace. Which selector is used?

An administrator wants to expose an application running in a pod on port 3000 using a Service of type LoadBalancer. Which command creates the Service?

Which of the following is a valid use case for a Headless Service?

A pod is unable to communicate with a Service in the same namespace. The administrator checks kube-proxy logs and finds no errors. Which command would help diagnose whether the iptables rules for the Service are correctly programmed?

Which TWO statements are true about Ingress in Kubernetes?

Which THREE components are required for a pod to resolve a Service DNS name?

Which TWO of the following are valid ways to isolate a set of pods from all ingress traffic except from monitoring pods?

Which Service type exposes a Service externally via a cloud provider's load balancer?

An admin runs `kubectl run nginx --image=nginx --restart=Never` and then runs `kubectl expose pod nginx --port=80 --target-port=80`. Another pod in the same namespace tries to curl http://nginx:80 but gets connection refused. What is the most likely cause?

Which annotation is commonly used with ExternalDNS to specify the DNS hostname for a Service?

A NetworkPolicy with podSelector: {} and policyTypes: [Ingress] is applied to a namespace. What is the effect on pods in that namespace?

Which kube-proxy mode supports connection-based load balancing using Linux IPVS?

You create a Service with clusterIP: None. What is this called and what is its purpose?

An Ingress resource defines a TLS section with hosts: ["example.com"] and secretName: tls-secret. What must be true for TLS to work correctly?

What is the default DNS name for a Service named 'my-service' in namespace 'my-ns'?

A cluster uses Flannel as the CNI plugin. Which of the following best describes Flannel's networking model?

You run `kubectl port-forward service/my-svc 8080:80`. What does this command do?

You want to allow ingress traffic from pods with label 'app: frontend' in namespace 'web' to pods with label 'app: backend' in namespace 'api'. Which NetworkPolicy matches this requirement?

Which of the following is a core component of the Gateway API?

Which two of the following are valid methods for exposing a Service externally in Kubernetes? (Select TWO.)

Which three of the following are features of EndpointSlices compared to Endpoints? (Select THREE.)

Which two of the following are valid Ingress path types in networking.k8s.io/v1? (Select TWO.)

You create a Service of type LoadBalancer in a Kubernetes cluster that does not have an external load balancer provider (e.g., bare-metal). What will be the state of the EXTERNAL-IP field when you run 'kubectl get svc'?

Which command creates a temporary pod and forwards port 8080 from your local machine to port 80 of an existing pod named 'web-pod'?

You have a NetworkPolicy that selects pods with label 'app: db'. The policy has an ingress rule allowing traffic from pods with label 'app: frontend'. A pod with label 'app: frontend' is in a different namespace. No namespaceSelector is specified in the ingress rule. Will traffic from that pod be allowed?

You run 'kubectl run nginx --image=nginx --expose --port=80'. What resources are created?

Which Service type exposes a Service on each Node's IP at a static port in the range 30000-32767?

In a Kubernetes cluster using CoreDNS, what is the DNS name for a Service named 'api' in namespace 'backend'?

You have an Ingress resource with a TLS section specifying a secret named 'tls-secret'. The certificate in 'tls-secret' is expired. What happens when a client connects via HTTPS to the Ingress host?

Which kube-proxy mode uses iptables rules to handle service traffic and is the default in many distributions?

What is the purpose of a Headless Service (clusterIP: None)?

A NetworkPolicy named 'default-deny-ingress' is applied to all pods in a namespace. The policy has no rules. An administrator then creates a new NetworkPolicy that allows ingress traffic to pods with label 'app: web' from any source using a podSelector with '{}'. Will traffic be allowed to pods labeled 'app: web'?

You want to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates a ClusterIP Service?

Which resource is used to configure TLS termination and path-based routing for HTTP(S) traffic into a cluster?

Which TWO statements about EndpointSlices are true? (Choose 2)

Which THREE are correct ways to configure a default deny all ingress traffic NetworkPolicy? (Choose 3)

Which TWO commands can be used to test DNS resolution for a Service named 'my-svc' in namespace 'default' from within a temporary pod? (Choose 2)

You need to create a Service that exposes port 80 on each node's IP at a static port (30080). Which Service type should you use?

A developer reports that a pod can resolve 'my-service.my-namespace.svc.cluster.local' but not 'my-service'. Both the pod and the Service are in the same namespace. What is the most likely cause?

You run: kubectl expose deployment web --port=80 --target-port=8080 --type=LoadBalancer --name=web-svc. What is the effect of this command?

You are implementing NetworkPolicies. You have a namespace 'db' with a pod running PostgreSQL. You want to allow only pods with label 'role: frontend' in namespace 'app' to connect to PostgreSQL on TCP port 5432. What is the correct Ingress rule?

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

Which of the following is the default DNS name for a Service named 'api' in namespace 'production'?

You create a Deployment with replicas=3 and a Service of type ClusterIP. You notice that traffic to the Service is not evenly distributed. What is the most likely cause?

You want to forward local port 8080 to port 80 of a pod named 'nginx-pod'. Which command should you use?

You have a NetworkPolicy that denies all ingress traffic by default, and you want to allow traffic only from pods with label 'app: monitoring' in the same namespace. What should the policy spec look like?

Which of the following is NOT a valid Service type in Kubernetes?

You need to expose a Service externally using an Ingress. The Ingress controller requires a specific IngressClass. How do you specify the IngressClass in the Ingress resource?

You have a Service 'my-svc' with ClusterIP None (headless). You create a StatefulSet with 3 replicas and a headless Service. How do you reach individual pods?

Which TWO of the following are valid CNI plugins used in Kubernetes? (Select 2)

Which THREE of the following are true about NetworkPolicy in Kubernetes? (Select 3)

Which TWO of the following are valid modes for kube-proxy? (Select 2)

You need to expose a Deployment named 'web' on port 80 inside the cluster. Which kubectl command creates a ClusterIP service?

A ClusterIP service named 'svc' in namespace 'default' is not reachable from a pod in the same namespace. The service selector matches the pod's labels. Which command should you run first to verify the endpoint list?

You apply the following NetworkPolicy: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress What effect does this policy have?

You have an Ingress resource with TLS configured. You verify that the TLS secret exists in the same namespace. However, accessing the service via HTTPS returns a certificate error. What is the most likely cause?

Which Service type is used to expose a service externally with a cloud provider's load balancer?

A pod in namespace 'ns1' cannot resolve the DNS name 'svc.ns2.svc.cluster.local'. What is the most likely cause?

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

Which TWO statements about Ingress in Kubernetes are correct?

Which TWO statements about Headless Services are correct?

Which TWO statements about NetworkPolicy are correct?

Which THREE of the following are valid methods for service discovery in Kubernetes?

Which THREE components are part of the Gateway API?

Which TWO statements about EndpointSlices are correct?

Which THREE of the following are CNI plugins?

Which TWO of the following are valid kube-proxy modes?

A Kubernetes cluster has a Service of type ClusterIP named 'my-svc' in the 'default' namespace. You deploy a pod and want it to resolve the service's cluster IP using DNS. What FQDN should the pod use?

An administrator creates a NetworkPolicy in namespace 'app' with the following YAML. Which statement is true about the policy? apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress

You are troubleshooting a Service connectivity issue. A pod in namespace 'frontend' cannot reach a Service in namespace 'backend' by its DNS name. CoreDNS is running. Which statements are true? (Select TWO.)

Which of the following can be used to expose a set of pods externally to the internet in a Kubernetes cluster? (Select THREE.)