CKA Services and Networking Practice Test 10 — 15 Questions

Question 1

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

Accepted Answer

NetworkPolicy egress rules deny all traffic by default unless explicitly allowed. NetworkPolicy in Kubernetes follows a default-deny model for traffic. When any egress rule is added to a NetworkPolicy, it implicitly denies all egress traffic that is not explicitly allowed by that rule. Therefore, if the egress rule does not include a rule allowing traffic to external IPs (e.g., via an IPBlock or a namespace selector), those destinations become unreachable. This is by design, as NetworkPolicies are additive whitelists.

Answer

The egress rule has a typo in the IP block

Answer

The pods are not running

Answer

The CNI plugin does not support egress rules

Question 2

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Accepted Answer

NodePort. A NodePort service exposes the application on a static port (30000–32767) on every node's IP address, making it accessible externally via `:`. A LoadBalancer service provisions an external load balancer (e.g., from a cloud provider) that routes traffic to the service, typically using a public IP. Both are explicitly designed for external access, unlike ClusterIP which is internal only.

Answer

Headless

Answer

ExternalName

Answer

ClusterIP

Question 3

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Accepted Answer

Forwards local port 8080 to port 80 on the Service. `kubectl port-forward` creates a tunnel from a local port to a pod (or service) in the cluster. When targeting a Service, it selects one of the Service's endpoints (a pod) and forwards traffic from localhost:8080 to port 80 on that pod. This allows direct access to the Service without exposing it externally.

Answer

Creates a new Service with port mapping 8080:80

Answer

Forwards port 8080 from the Service to port 80 on the local machine

Answer

Forwards port 80 from the local machine to port 8080 on the Service

Question 4

What is the default kube-proxy mode in modern Kubernetes clusters?

Accepted Answer

iptables. In modern Kubernetes clusters (v1.30+), the default kube-proxy mode is `iptables`. This mode uses Linux Netfilter rules to intercept and redirect traffic to backend pods, offering better performance and scalability than the legacy `userspace` mode while remaining the default for broad compatibility across distributions.

Answer

kernelspace

Answer

userspace

Answer

ipvs

Question 5

A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?

Accepted Answer

from.podSelector. In a Kubernetes NetworkPolicy, the `from.podSelector` field under `ingress` specifies the source pods from which traffic is allowed. When you set `from.podSelector.matchLabels` with `role: frontend`, only pods with that label can send ingress traffic to the pods selected by `spec.podSelector`. This is defined in the Kubernetes networking API under `networking.k8s.io/v1`.

Answer

spec.podSelector

Answer

ingress.podSelector

Answer

to.podSelector

Question 6

What is the DNS name for a Service named 'api' in the 'default' namespace?

Accepted Answer

api.default.svc.cluster.local. The correct DNS name for a Service in Kubernetes follows the pattern `..svc.cluster.local`. For a Service named 'api' in the 'default' namespace, this resolves to `api.default.svc.cluster.local`. The `svc` subdomain is a fixed part of the cluster domain, and `cluster.local` is the default cluster domain suffix configured in kubelet and CoreDNS.

Answer

default.api.svc.cluster.local

Answer

api.svc.default.cluster.local

Answer

api.default.cluster.local

Question 7

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

Accepted Answer

IPVS supports multiple load balancing algorithms.. IPVS (IP Virtual Server) supports multiple load balancing algorithms, such as round-robin, least-connection, source-hashing, and others, which is a key advantage over iptables mode. This allows kube-proxy to distribute traffic across pods more flexibly and efficiently, especially in high-traffic environments.

Answer

IPVS uses iptables rules for service discovery.

Answer

IPVS is the default kube-proxy mode since Kubernetes 1.0.

Answer

IPVS cannot handle large numbers of services.

Question 8

Which DNS record type does Kubernetes use to resolve a Service's ClusterIP?

Accepted Answer

A record. Kubernetes uses A records to resolve a Service's ClusterIP. When a DNS query is made for a Service name (e.g., `my-svc.my-namespace.svc.cluster.local`), the cluster's DNS server (typically CoreDNS) returns an A record containing the Service's ClusterIP address. This allows pods to reach the Service via its stable virtual IP.

Answer

PTR record

Answer

SRV record

Answer

CNAME record

Question 9

Which component is responsible for implementing the NetworkPolicy rules?

Accepted Answer

CNI plugin. NetworkPolicy rules are enforced by the Container Network Interface (CNI) plugin, not by kube-proxy or any other Kubernetes control plane component. The CNI plugin (e.g., Calico, Cilium, Weave Net) implements the actual network policy by programming iptables, eBPF, or other data-plane mechanisms to allow or deny traffic between pods based on the policy selectors and rules defined in the NetworkPolicy resource.

Answer

CoreDNS

Answer

kube-controller-manager

Answer

kube-proxy

Question 10

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Accepted Answer

No pods match the service selector, so the service has no endpoints.. B is correct because if no pods match the service selector 'app: my-app', the service will have no endpoints. Without endpoints, the service cannot route traffic, and kubectl port-forward will fail to establish a connection to localhost:8080. The port-forward command relies on the service having at least one endpoint to forward traffic to.

Answer

The service type is ClusterIP, which does not support port forwarding.

Answer

kubectl port-forward cannot forward to services, only to pods.

Answer

The port forward command requires the --address flag to bind to localhost.

Question 11

You apply the following NetworkPolicy to namespace 'ns1':
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []
What effect does this policy have?

Accepted Answer

Denies all ingress traffic to all pods in namespace ns1.. This NetworkPolicy selects all pods in namespace 'ns1' (via empty `podSelector: {}`), specifies `policyTypes: [Ingress]`, and defines an empty `ingress: []` rule list. In Kubernetes, an empty `ingress: []` explicitly denies all ingress traffic because no allow rules are present, overriding the default allow-all behavior. Therefore, all ingress traffic to any pod in ns1 is denied.

Answer

Denies all egress traffic as well.

Answer

Allows ingress traffic only from pods in the same namespace.

Answer

Allows all ingress traffic because no explicit deny rules are defined.

Question 12

Which kube-proxy mode uses iptables rules to handle service traffic?

Accepted Answer

iptables. Kube-proxy's iptables mode uses Linux iptables rules to handle service traffic. In this mode, kube-proxy watches the Kubernetes API server for Service and Endpoint changes and programs iptables rules in the NAT table (specifically the PREROUTING and OUTPUT chains) to redirect traffic destined for a Service's ClusterIP to the backend Pod IPs via DNAT. This is the default mode in most Kubernetes distributions due to its reliability and moderate performance.

Answer

ipvs

Answer

nftables

Answer

userspace

Question 13

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Accepted Answer

DNS returns the IP addresses of all pods that match the selector.. A headless service (clusterIP: None) does not allocate a ClusterIP. Instead, DNS returns the IP addresses of all pods matching the label selector via A/AAAA records. This allows direct pod-to-pod communication without load balancing, commonly used for stateful workloads like databases.

Answer

DNS does not resolve the service name at all.

Answer

DNS returns the service name as a CNAME to the pod names.

Answer

DNS resolves the service name to a single ClusterIP.

Question 14

Which of the following is a valid CNI plugin for Kubernetes networking?

Accepted Answer

Calico. Calico is a valid CNI plugin that implements the Container Network Interface specification to provide networking and network policy for Kubernetes clusters. It uses BGP (Border Gateway Protocol) to route packets between nodes and supports overlay or non-overlay networking modes, making it a widely adopted choice for production environments.

Answer

etcd

Answer

Docker

Answer

Kubelet

Question 15

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` creates a direct tunnel from a local port to a specified port on a pod, allowing access to the pod's service without exposing it externally. The syntax `pod/web-pod 8080:80` forwards localhost:8080 to port 80 of the pod named 'web-pod'.

Answer

kubectl exec -it web-pod -- nc -l -p 8080

Answer

kubectl proxy --port=8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80