CKA Services and Networking Practice Test 3 — 15 Questions

Question 1

A developer runs `kubectl run nginx --image=nginx --port=80` and then `kubectl expose pod nginx --port=80 --target-port=80 --type=NodePort`. What is the name of the created Service?

Accepted Answer

nginx. The `kubectl expose pod nginx --port=80 --target-port=80 --type=NodePort` command creates a Service that inherits its name from the resource being exposed, which is the pod named 'nginx'. By default, `kubectl expose` uses the name of the referenced resource (in this case, the pod) as the Service name, resulting in a Service named 'nginx'. This is consistent with Kubernetes behavior where the Service name is derived from the resource name unless overridden with the `--name` flag.

Answer

expose-nginx

Answer

nginx-service

Answer

nginx-pod

Question 2

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

Accepted Answer

Denies all ingress and egress traffic to all pods in the namespace. A NetworkPolicy with an empty `podSelector` selects all pods in the namespace. When no rules are specified, the policy defaults to denying all ingress and egress traffic because NetworkPolicy rules are whitelist-based: if no rule allows traffic, all traffic is denied. This effectively isolates the namespace by blocking all network traffic to and from every pod.

Answer

Has no effect because NetworkPolicy requires at least one rule

Answer

Denies only ingress traffic to pods labeled 'app: denied'

Answer

Allows all traffic because no rules are specified

Question 3

Which of the following is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

Accepted Answer

my-svc.my-ns.svc.cluster.local. A is correct because Kubernetes uses a built-in DNS system (CoreDNS) that automatically creates DNS records for Services. The fully qualified domain name (FQDN) for a Service follows the pattern `..svc.cluster.local`, where `svc` is a fixed label indicating it's a Service record, and `cluster.local` is the default cluster domain. This allows pods to resolve the Service by name within the cluster.

Answer

my-svc.my-ns.cluster.local

Answer

my-svc.my-ns.svc

Answer

my-svc.my-ns.pod.cluster.local

Question 4

What is the purpose of a headless Service (clusterIP: None)?

Accepted Answer

To allow direct DNS resolution to pod IPs. A headless Service (clusterIP: None) disables the virtual IP and load balancing, causing DNS queries to return the IP addresses of the backing pods directly. This allows clients to perform DNS-based service discovery and connect to specific pod IPs, which is essential for stateful applications like databases that require direct pod-to-pod communication.

Answer

To expose the Service externally via a cloud load balancer

Answer

To provide load balancing across pods

Answer

To map the Service to an external DNS name

Question 5

Which of the following CNI plugins typically uses BGP to distribute routing information across nodes?

Accepted Answer

Calico. Calico uses BGP (Border Gateway Protocol) to exchange routing information between nodes, enabling direct pod-to-pod communication without overlays. Each node runs a BGP client that advertises the pod CIDRs assigned to that node, allowing the underlying network infrastructure to route traffic at Layer 3.

Answer

Flannel

Answer

Weave

Answer

Cilium

Question 6

Which resource type is used to configure HTTP/HTTPS routing to Services?

Accepted Answer

Ingress. Ingress is the Kubernetes resource that provides HTTP and HTTPS routing from outside the cluster to Services within the cluster. It defines rules for host-based and path-based routing, TLS termination, and load balancing, making it the correct choice for configuring external HTTP/HTTPS access.

Answer

EndpointSlice

Answer

NetworkPolicy

Answer

Service

Question 7

A pod cannot resolve a Service name 'my-svc' in the same namespace. The DNS pod is running. What is a likely cause?

Accepted Answer

The Service 'my-svc' does not exist. If the Service 'my-svc' does not exist, the CoreDNS pod will not have an A/AAAA record for it, and DNS resolution will fail with NXDOMAIN. The pod's DNS resolver queries the cluster's DNS service (typically CoreDNS) for the Service name; if no matching Service object is defined, no DNS record is created, and the name cannot be resolved regardless of other components being healthy.

Answer

The kube-proxy is not running

Answer

The Service type is ExternalName

Answer

The pod is in a different namespace

Question 8

Which of the following is true about IngressClass resources?

Accepted Answer

IngressClass replaces the deprecated 'kubernetes.io/ingress.class' annotation. The IngressClass resource is a cluster-scoped resource that is the recommended way to specify which ingress controller should implement an Ingress, replacing the deprecated `kubernetes.io/ingress.class` annotation. It does not contain routing rules (which are defined in the Ingress resource itself via `spec.rules`).

Answer

IngressClass must have a controller field set to the name of the ingress controller

Answer

IngressClass is namespaced

Answer

IngressClass is automatically created by the ingress controller

Question 9

Which two statements are true about EndpointSlices? (Choose two.)

Accepted Answer

EndpointSlices can contain multiple endpoints per slice. EndpointSlices are designed to store multiple endpoint entries (IP addresses, ports, topology information) within a single slice, improving scalability and performance compared to the older Endpoints resource. This allows Kubernetes to distribute endpoint data across multiple slices, each containing a configurable maximum number of endpoints (default 100).

Answer

EndpointSlices are only used by headless Services

Answer

EndpointSlices replace the deprecated Endpoints resource

Answer

EndpointSlices cannot be created manually

Question 10

Which three components are part of the Gateway API? (Choose three.)

Accepted Answer

GatewayClass. GatewayClass is correct because it defines a set of gateways that share a common configuration and behavior, analogous to StorageClass in the storage ecosystem. It serves as a template for the underlying gateway implementation, allowing multiple Gateway resources to be instantiated from the same class.

Answer

Ingress

Answer

Service

Question 11

Which two of the following are valid service discovery methods in Kubernetes? (Choose two.)

Accepted Answer

Environment variables injected into pods. Kubernetes can inject environment variables into pods for each service that exists in the same namespace before the pod is created. These variables include the service's cluster IP (e.g., `MY_SERVICE_SERVICE_HOST`) and port (e.g., `MY_SERVICE_SERVICE_PORT`), enabling basic service discovery without DNS. However, this method only works for services that exist before the pod starts, and it does not update if services are added or removed later.

Answer

Manual /etc/hosts entries

Answer

Consul agent running as a sidecar

Answer

Using kubectl get endpoints

Question 12

Which of the following Service types does NOT assign a ClusterIP to the Service?

Accepted Answer

Headless. A Headless Service is created by setting the `clusterIP` field to `None` in the Service specification. This tells Kubernetes not to allocate a ClusterIP, making the Service headless. Instead of a virtual IP, DNS queries for the Service name return the IP addresses of all matching Pods directly, enabling stateful workloads like databases to discover individual Pod endpoints.

Answer

LoadBalancer

Answer

ClusterIP

Answer

NodePort

Question 13

You run `kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort` and the Service is created. What is the effect of this command?

Accepted Answer

It creates a NodePort Service, making the deployment accessible on each node's IP on a high port.. The `kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort` command creates a NodePort Service. This Service exposes the deployment on each node's IP address on a static port (in the range 30000-32767 by default), making it accessible from outside the cluster via `:`. The `--type=NodePort` flag explicitly overrides the default ClusterIP type, and the Service will also automatically allocate a ClusterIP for internal routing.

Answer

It creates a LoadBalancer Service and provisions a cloud load balancer.

Answer

It creates a ClusterIP Service that is only accessible within the cluster.

Answer

It creates an ExternalName Service that maps to an external DNS name.

Question 14

A NetworkPolicy named 'deny-all' is applied to a namespace with podSelector: {}. The policy has no ingress rules. What is the effect?

Accepted Answer

All ingress traffic to pods in the namespace is denied, but egress traffic is allowed.. A NetworkPolicy with `podSelector: {}` selects all pods in the namespace. With no ingress rules defined, the policy defaults to denying all ingress traffic to those pods, while egress traffic remains unrestricted unless explicitly denied by another policy. This is because Kubernetes NetworkPolicy is additive for ingress: if any policy selects a pod, the default allow for ingress is overridden, and only explicitly allowed ingress traffic is permitted.

Answer

All traffic to and from pods in the namespace is denied.

Answer

Only traffic from pods in the same namespace is allowed.

Answer

All traffic is allowed because podSelector: {} matches nothing.

Question 15

You want to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 9090. Which command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 9090:8080. `kubectl port-forward` creates a direct tunnel from a local port (9090) to a pod's port (8080) over the Kubernetes API server, enabling temporary access to a pod's HTTP endpoint without exposing a service. This is the standard method for debugging or testing a pod's network endpoint from a local machine.

Answer

kubectl exec -it my-pod -- /bin/bash

Answer

kubectl proxy --port=9090

Answer

kubectl expose pod my-pod --port=9090 --target-port=8080