CKA Services and Networking Practice Test 2 — 15 Questions

Question 1

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

Accepted Answer

db-service.production.svc.cluster.local. Kubernetes DNS resolves services across namespaces using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since 'my-pod' is in the 'default' namespace and 'db-service' is in the 'production' namespace, the short name 'db-service' will not resolve; the FQDN must include the namespace and the cluster domain suffix to reach the service.

Answer

db-service

Answer

db-service.production.pod.cluster.local

Answer

production.db-service.svc.cluster.local

Question 2

You apply the following NetworkPolicy:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
```
What is the result?

Accepted Answer

All ingress and egress traffic to/from all pods in the namespace is denied. This NetworkPolicy uses an empty `podSelector: {}` which selects all pods in the namespace. By specifying both `Ingress` and `Egress` in `policyTypes` without any rules, the policy defaults to denying all ingress and egress traffic for those pods. This is the standard Kubernetes behavior: a NetworkPolicy with no rules under a given `policyTypes` entry acts as a deny-all for that direction.

Answer

All traffic is allowed because no ingress/egress rules are specified

Answer

Only ingress traffic is denied; egress traffic is allowed

Answer

The policy is invalid because podSelector is empty

Question 3

Which kube-proxy mode uses IP Virtual Server (IPVS) for load balancing and supports more algorithms than the default mode?

Accepted Answer

ipvs. The IP Virtual Server (IPVS) mode in kube-proxy leverages the Linux kernel's IPVS module, which is built on the Netfilter framework and operates in the kernel space. Unlike the default iptables mode, IPVS supports a variety of load-balancing algorithms (e.g., round-robin, least-connection, source-hashing) and provides better scalability and performance for large clusters by using a hash table for service-to-endpoint mapping.

Answer

userspace

Answer

iptables

Answer

kube-proxy

Question 4

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. `kubectl port-forward` creates a direct tunnel from a local port to a specific pod, allowing you to access the pod's HTTP endpoint on port 8080 from your local machine on port 8080. This command targets the pod directly (`pod/my-pod`) and maps local port 8080 to the pod's port 8080, which is exactly what the question requires for temporary, ad-hoc access without creating a Service.

Answer

kubectl expose pod my-pod --port=8080

Answer

kubectl proxy --port=8080

Answer

kubectl port-forward service/my-service 8080:8080

Question 5

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

Accepted Answer

spec.rules. In the 'networking.k8s.io/v1' Ingress API, the 'spec.rules' field is where you define an array of routing rules, each containing a 'host' field for the hostname and an 'http' subfield with 'paths' that specify path-based routing to backend services. This is the primary mechanism for directing traffic based on hostname and path.

Answer

spec.ingress

Answer

spec.tls

Answer

spec.backend

Question 6

Which annotation is commonly used with the ExternalDNS project to manage DNS records for a Kubernetes service?

Accepted Answer

external-dns.alpha.kubernetes.io/hostname. The ExternalDNS project synchronizes exposed Kubernetes Services and Ingresses with DNS providers. The annotation `external-dns.alpha.kubernetes.io/hostname` is used to explicitly specify the DNS hostname that ExternalDNS should manage for a Service of type LoadBalancer or NodePort, overriding the default naming logic.

Answer

prometheus.io/scrape

Answer

kubernetes.io/ingress.class

Answer

cert-manager.io/cluster-issuer

Question 7

Which TWO statements about Headless services are correct? (Select TWO)

Accepted Answer

DNS queries for a headless service return the IP addresses of the backing pods. When a headless service (clusterIP: None) has a selector, DNS queries for the service name return the IP addresses of the backing pods (A records) rather than a single ClusterIP. This allows direct pod-to-pod communication without a proxy or load balancer.

Answer

A headless service assigns a ClusterIP to the service

Answer

Headless services provide round-robin load balancing across pods

Answer

Headless services require a selector that matches at least one pod

Question 8

You create a Deployment with 3 replicas and a ClusterIP Service. You notice that some pods are not receiving traffic. What is the most likely cause?

Accepted Answer

The Service's selector does not match the pod labels. The most likely cause is that the Service's selector does not match the pod labels. A ClusterIP Service uses label selectors to identify which pods should receive traffic; if the selector does not match the labels defined on the pods, the Service's endpoints controller will not populate the endpoints object, and traffic will not be forwarded to any pod. This is a common misconfiguration that results in some or all pods not receiving traffic, even though the pods themselves are healthy.

Answer

The pods are in CrashLoopBackOff

Answer

The Deployment has a revision history limit set too low

Answer

The Service type is NodePort instead of ClusterIP

Question 9

You run `kubectl get endpoints my-service` and see no endpoints listed. The Service's selector matches labels on pods that are running. What is the most likely cause?

Accepted Answer

The pods are not passing their readiness probes. When a Service's selector matches running pods but no endpoints are listed, the most common cause is that the pods are failing their readiness probes. Kubernetes only includes a pod's IP address as an endpoint if the pod's readiness probe (if defined) succeeds. If the readiness probe fails, the pod is considered not ready to receive traffic, and its IP is removed from the endpoints list, even though the pod is running and its labels match the Service selector.

Answer

The kube-proxy is not running

Answer

The Service is in a different namespace

Answer

The Service type is ExternalName

Question 10

What is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

Accepted Answer

my-svc.my-ns.svc.cluster.local. Kubernetes constructs the default DNS name for a Service using the format `..svc.cluster.local`. This is defined by the cluster DNS specification (CoreDNS or kube-dns) and allows Pods to resolve the Service by its fully qualified domain name (FQDN) within the cluster. For 'my-svc' in namespace 'my-ns', the FQDN is 'my-svc.my-ns.svc.cluster.local'.

Answer

my-svc.svc.cluster.local

Answer

my-svc.my-ns.cluster.local

Answer

my-svc.cluster.local

Question 11

A developer asks you to create a Service that resolves to an external database at 'db.example.com'. Which Service type should you use?

Accepted Answer

ExternalName. An ExternalName Service type maps a Service to a DNS name (e.g., 'db.example.com') by returning a CNAME record, allowing pods to resolve the Service name to an external endpoint without a proxy or selector. This is the only Service type that directly resolves to an external DNS name without requiring endpoints or a backend selector.

Answer

LoadBalancer

Answer

NodePort

Answer

ClusterIP

Question 12

You have a Service with endpoints for pods in different zones. You want kube-proxy to use a mode that provides better performance for large clusters and supports scheduling algorithms like least-connection. Which mode should you use?

Accepted Answer

ipvs mode. IPVS (IP Virtual Server) mode is correct because it uses the LVS (Linux Virtual Server) kernel module to provide a transport-layer load balancer that supports multiple scheduling algorithms, including least-connection (lc), round-robin (rr), and source hashing (sh). Unlike iptables, IPVS uses a hash table as the underlying data structure, which scales linearly with the number of services and endpoints, making it far more performant in large clusters with thousands of services.

Answer

userspace mode

Answer

iptables mode

Answer

kernelspace mode

Question 13

Which THREE of the following are true about NetworkPolicy? (Select THREE.)

Accepted Answer

NetworkPolicy requires a CNI plugin that supports it. NetworkPolicy relies on the CNI plugin to enforce its rules. The Kubernetes API only stores the policy definition; the actual packet filtering is performed by the underlying network plugin (e.g., Calico, Cilium, Weave Net). Without a CNI plugin that supports NetworkPolicy, the policy objects are created but have no effect on traffic.

Answer

NetworkPolicy is a cluster-scoped resource

Answer

NetworkPolicy can only allow traffic, not deny

Question 14

Which TWO of the following are components of the Ingress API? (Select TWO.)

Accepted Answer

rules. `rules` is a core field in the Ingress spec that defines how incoming traffic is routed based on host and path conditions. Each rule can specify a host (e.g., `example.com`) and a list of paths, each pointing to a backend service. Without `rules`, the Ingress resource cannot direct traffic to any backend, making it the essential routing logic of the API.

Answer

IngressClass

Answer

Service

Answer

Endpoints

Question 15

Which of the following Service types exposes a Service on a static port on each node's IP?

Accepted Answer

NodePort. NodePort is the correct answer because it exposes a Service on a static port (in the range 30000–32767) on every node's IP address. Traffic sent to any node's IP on that port is forwarded to the Service's ClusterIP and then to the backing pods. This is defined in the Service's `spec.ports[].nodePort` field.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer