Services and Networking

Which of the following service types exposes a service on a static port on each node's IP address?

You run 'kubectl get svc my-service -o yaml' and see 'type: ClusterIP'. The service has no endpoints. What is the most likely cause?

You have a Service named 'my-service' in namespace 'ns1'. Another pod in namespace 'ns2' needs to resolve 'my-service' using DNS. What FQDN should the pod use?

An Ingress resource is created with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 The backend service 'api-service' is in the same namespace as the Ingress. What must be true for the Ingress to route traffic to the service?

What is the default DNS name for a service named 'my-svc' in namespace 'default'?

A developer runs 'kubectl port-forward service/my-service 8080:80'. What does this command do?

A pod cannot resolve a service DNS name. The cluster uses CoreDNS. Which of the following is the most likely cause if the pod's /etc/resolv.conf contains 'nameserver 10.96.0.10' and the CoreDNS pod is running?

Which of the following commands can be used to check the endpoints of a service named 'my-service'?

What is the default kube-proxy mode in Kubernetes v1.29?

You have a headless service named 'my-headless' with clusterIP: None. A pod in the same namespace queries the DNS name 'my-headless'. What will the DNS response contain?

A developer runs 'kubectl run nginx --image=nginx --expose --port=80'. What Kubernetes resources are created?

You have a NetworkPolicy that selects pods with label 'role: db' in the 'default' namespace. The policy has no ingress rules defined. What is the effect on traffic to the selected pods?

An ingress resource is defined with the following snippet: ```yaml spec: tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app-service port: number: 80 ``` The secret 'app-tls' exists and contains a valid certificate. However, accessing https://app.example.com returns a certificate warning in the browser. What is the most likely cause?

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

You apply the following NetworkPolicy: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress - Egress ``` What is the result?

Which kube-proxy mode uses IP Virtual Server (IPVS) for load balancing and supports more algorithms than the default mode?

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

You have three pods selected by a service. One pod is in 'CrashLoopBackOff' state. How does the service's endpoints behave?

Which annotation is commonly used with the ExternalDNS project to manage DNS records for a Kubernetes service?

Which TWO statements about Headless services are correct? (Select TWO)

Which THREE components are part of the Gateway API resource model? (Select THREE)

Which TWO network plugins (CNI) are commonly used in Kubernetes clusters? (Select TWO)

You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?

A NetworkPolicy named 'deny-all' has only a podSelector matching all pods and no rules. What is the effect?

You create a Deployment with 3 replicas and a ClusterIP Service. You notice that some pods are not receiving traffic. What is the most likely cause?

You want to expose an application running in the cluster on a public IP address. Which Service type should you use?

You have an Ingress resource with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 A client sends a request to http://example.com/api/v1/users. Which path is matched?

You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?

What is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

A developer asks you to create a Service that resolves to an external database at 'db.example.com'. Which Service type should you use?

You have a Service with endpoints for pods in different zones. You want kube-proxy to use a mode that provides better performance for large clusters and supports scheduling algorithms like least-connection. Which mode should you use?

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Which TWO of the following are components of the Ingress API? (Select TWO.)

Which of the following Service types exposes a Service on a static port on each node's IP?

A developer runs `kubectl run nginx --image=nginx --port=80` and then `kubectl expose pod nginx --port=80 --target-port=80 --type=NodePort`. What is the name of the created Service?

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

Which of the following is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

What is the purpose of a headless Service (clusterIP: None)?

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Which of the following CNI plugins typically uses BGP to distribute routing information across nodes?

What is the default kube-proxy mode in modern Kubernetes clusters?

Which resource type is used to configure HTTP/HTTPS routing to Services?

A pod cannot resolve a Service name 'my-svc' in the same namespace. The DNS pod is running. What is a likely cause?

A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?

Which three components are part of the Gateway API? (Choose three.)

Which two of the following are valid service discovery methods in Kubernetes? (Choose two.)

Which of the following Service types does NOT assign a ClusterIP to the Service?

You run `kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort` and the Service is created. What is the effect of this command?

A NetworkPolicy named 'deny-all' is applied to a namespace with podSelector: {}. The policy has no ingress rules. What is the effect?

What is the DNS name for a Service named 'api' in the 'default' namespace?

You want to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 9090. Which command should you use?

Which Ingress resource field is used to specify the hostname for which traffic should be routed?

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

Which DNS record type does Kubernetes use to resolve a Service's ClusterIP?

After creating a NetworkPolicy that selects pods with label 'role: db' and allows ingress on TCP port 3306 from pods with label 'role: api', you notice that pods with label 'role: db' are still reachable on port 3306 from pods without 'role: api' label. What is the most likely cause?

Which component is responsible for implementing the NetworkPolicy rules?

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster running on-premises (no cloud provider)?

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

You apply the following NetworkPolicy to namespace 'ns1': apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-ingress spec: podSelector: {} policyTypes: - Ingress ingress: [] What effect does this policy have?

A pod is unable to resolve DNS names of services in other namespaces. Which DNS configuration is most likely missing?

Which kube-proxy mode uses iptables rules to handle service traffic?

You need to expose a service named 'my-svc' on a static port 30080 on every node. Which service type should you use?

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Which of the following is a valid CNI plugin for Kubernetes networking?

Which two of the following are valid methods for service discovery in Kubernetes?

Which two of the following are correct statements about EndpointSlices?

Which Kubernetes Service type exposes the Service on a static port on each Node's IP address, allowing external access without a LoadBalancer?

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

A cluster has kube-proxy running in ipvs mode. An administrator creates a Service of type ClusterIP. Which of the following is true about how traffic is forwarded to the pods?

Which kubectl command correctly retrieves the list of EndpointSlices for a Service named 'my-svc' in the 'default' namespace?

Which DNS record does CoreDNS create for a headless Service named 'headless-svc' in the namespace 'default'?

A NetworkPolicy allows ingress traffic from pods with label 'app: frontend' in any namespace. Which selector is used?

Which of the following is a valid use case for a Headless Service?

Which TWO statements are true about Ingress in Kubernetes?

Which THREE components are required for a pod to resolve a Service DNS name?

Which Service type exposes a Service externally via a cloud provider's load balancer?

Which annotation is commonly used with ExternalDNS to specify the DNS hostname for a Service?

A NetworkPolicy with podSelector: {} and policyTypes: [Ingress] is applied to a namespace. What is the effect on pods in that namespace?

Which kube-proxy mode supports connection-based load balancing using Linux IPVS?

You create a Service with clusterIP: None. What is this called and what is its purpose?

What is the default DNS name for a Service named 'my-service' in namespace 'my-ns'?

A cluster uses Flannel as the CNI plugin. Which of the following best describes Flannel's networking model?

You run `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Which of the following is a core component of the Gateway API?

Which two of the following are valid methods for exposing a Service externally in Kubernetes? (Select TWO.)

You create a Service of type LoadBalancer in a Kubernetes cluster that does not have an external load balancer provider (e.g., bare-metal). What will be the state of the EXTERNAL-IP field when you run 'kubectl get svc'?

You have a NetworkPolicy that selects pods with label 'app: db'. The policy has an ingress rule allowing traffic from pods with label 'app: frontend'. A pod with label 'app: frontend' is in a different namespace. No namespaceSelector is specified in the ingress rule. Will traffic from that pod be allowed?

Which Service type exposes a Service on each Node's IP at a static port in the range 30000-32767?

In a Kubernetes cluster using CoreDNS, what is the DNS name for a Service named 'api' in namespace 'backend'?

You have an Ingress resource with a TLS section specifying a secret named 'tls-secret'. The certificate in 'tls-secret' is expired. What happens when a client connects via HTTPS to the Ingress host?

Which kube-proxy mode uses iptables rules to handle service traffic and is the default in many distributions?

A NetworkPolicy named 'default-deny-ingress' is applied to all pods in a namespace. The policy has no rules. An administrator then creates a new NetworkPolicy that allows ingress traffic to pods with label 'app: web' from any source using a podSelector with '{}'. Will traffic be allowed to pods labeled 'app: web'?

You want to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates a ClusterIP Service?

Which resource is used to configure TLS termination and path-based routing for HTTP(S) traffic into a cluster?

Which TWO statements about EndpointSlices are true? (Choose 2)

Which FOUR are correct ways to configure a default deny all ingress traffic NetworkPolicy? (Choose 4)

Which TWO commands can be used to test DNS resolution for a Service named 'my-svc' in namespace 'default' from within a temporary pod? (Choose 2)

You need to create a Service that exposes port 80 on each node's IP at a static port (30080). Which Service type should you use?

You run: kubectl expose deployment web --port=80 --target-port=8080 --type=LoadBalancer --name=web-svc. What is the effect of this command?

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

Which of the following is the default DNS name for a Service named 'api' in namespace 'production'?

You want to forward local port 8080 to port 80 of a pod named 'nginx-pod'. Which command should you use?

You have a NetworkPolicy that denies all ingress traffic by default, and you want to allow traffic only from pods with label 'app: monitoring' in the same namespace. What should the policy spec look like?

Which of the following is NOT a valid Service type in Kubernetes?

You need to expose a Service externally using an Ingress. The Ingress controller requires a specific IngressClass. How do you specify the IngressClass in the Ingress resource?

You have a Service 'my-svc' with ClusterIP None (headless). You create a StatefulSet with 3 replicas and a headless Service. How do you reach individual pods?

Which THREE of the following are true about NetworkPolicy in Kubernetes? (Select 3)

You need to expose a Deployment named 'web' on port 80 inside the cluster. Which kubectl command creates a ClusterIP service?

You apply the following NetworkPolicy: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress What effect does this policy have?

Which Service type is used to expose a service externally with a cloud provider's load balancer?

A pod in namespace 'ns1' cannot resolve the DNS name 'svc.ns2.svc.cluster.local'. What is the most likely cause?

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

Which TWO statements about Ingress in Kubernetes are correct?

Which THREE statements about NetworkPolicy are correct?

Which THREE of the following are valid methods for service discovery in Kubernetes?

Which THREE components are part of the Gateway API?

Which TWO statements about EndpointSlices are correct?

Which THREE of the following are CNI plugins?

Which TWO of the following are valid kube-proxy modes?

A Kubernetes cluster has a Service of type ClusterIP named 'my-svc' in the 'default' namespace. You deploy a pod and want it to resolve the service's cluster IP using DNS. What FQDN should the pod use?

An administrator creates a NetworkPolicy in namespace 'app' with the following YAML. Which statement is true about the policy? apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress

Which of the following can be used to expose a set of pods externally to the internet in a Kubernetes cluster? (Select THREE.)

A cluster administrator needs to allow pods labeled 'app=web' in namespace 'frontend' to receive TCP traffic on port 443 only from pods labeled 'app=proxy' in namespace 'backend'. The cluster uses the default CNI plugin that enforces NetworkPolicy. The administrator creates a NetworkPolicy in the 'frontend' namespace with podSelector matching 'app=web', policyTypes: ['Ingress'], and an ingress rule with from: [{namespaceSelector: {matchLabels: {name: 'backend'}}, podSelector: {matchLabels: {app: 'proxy'}}}], ports: [{protocol: 'TCP', port: 443}]. However, the namespace 'backend' is not labeled with 'name=backend'. What is the effect of this policy?

A Kubernetes cluster uses kube-proxy in iptables mode. A Service named 'web-svc' of type ClusterIP has three endpoints: pod A (10.244.1.5:8080), pod B (10.244.2.6:8080), and pod C (10.244.3.7:8080). A client pod repeatedly sends requests to the Service's ClusterIP. The administrator observes that all requests from a single client pod are being routed to pod A, even though pod B and pod C are healthy. Which of the following is the most likely explanation?