CKA Services and Networking Practice Test 4 — 15 Questions

Question 1

A developer runs 'kubectl port-forward service/my-service 8080:80'. What does this command do?

Accepted Answer

It forwards incoming traffic on local port 8080 to port 80 on the service's ClusterIP.. `kubectl port-forward` creates a tunnel from a local port on the client machine to a specified port on a Kubernetes resource, in this case a Service. It forwards traffic received on localhost:8080 to the Service's ClusterIP on port 80, allowing the developer to access the service without exposing it externally.

Answer

It creates a proxy that routes traffic from the service's ClusterIP to the local machine on port 8080.

Answer

It exposes the service as a NodePort on port 8080.

Answer

It creates a new service of type LoadBalancer on port 8080.

Question 2

A pod cannot resolve a service DNS name. The cluster uses CoreDNS. Which of the following is the most likely cause if the pod's /etc/resolv.conf contains 'nameserver 10.96.0.10' and the CoreDNS pod is running?

Accepted Answer

The CoreDNS ConfigMap does not have the correct cluster domain.. If the CoreDNS ConfigMap does not specify the correct cluster domain (e.g., `cluster.local`), CoreDNS will not respond to queries for service DNS names within that domain. The pod's `resolv.conf` shows the correct ClusterIP of the CoreDNS service (10.96.0.10), and the CoreDNS pod is running, so the issue is likely a misconfiguration in the CoreDNS plugin settings, specifically the `kubernetes` plugin's `clusterDomain` parameter.

Answer

The pod's DNS policy is set to 'Default'.

Answer

The CoreDNS pod is in CrashLoopBackOff.

Answer

The service's DNS name is misspelled.

Question 3

Which of the following commands can be used to check the endpoints of a service named 'my-service'?

Accepted Answer

kubectl get endpoints my-service. The `kubectl get endpoints my-service` command directly retrieves the Endpoints object associated with the service, which lists the IP addresses and ports of the pods that match the service's selector. This is the standard and most direct way to check the active endpoints for a service in Kubernetes.

Answer

kubectl get pod my-service

Answer

kubectl get service my-service -o yaml

Answer

kubectl get svc my-service --show-endpoints

Question 4

What is the default kube-proxy mode in Kubernetes v1.29?

Accepted Answer

iptables. In Kubernetes v1.29, the default kube-proxy mode is `iptables`. This mode uses Linux iptables rules to handle service traffic, providing better performance and reliability than the older userspace mode. It is the default because it balances simplicity and efficiency for most cluster configurations.

Answer

nftables

Answer

userspace

Answer

ipvs

Question 5

You have a headless service named 'my-headless' with clusterIP: None. A pod in the same namespace queries the DNS name 'my-headless'. What will the DNS response contain?

Accepted Answer

A list of A records for each pod matching the service selector.. A headless service (clusterIP: None) does not have a ClusterIP or load-balance traffic. Instead, DNS queries for the service name return A records for the individual pod IPs that match the service's selector. This allows direct pod-to-pod communication without a proxy, as defined by Kubernetes DNS specification.

Answer

An error because headless services cannot be queried by DNS.

Answer

A single A record with the service's IP.

Answer

The ClusterIP of the service (which is None).

Question 6

A developer runs 'kubectl run nginx --image=nginx --expose --port=80'. What Kubernetes resources are created?

Accepted Answer

A pod named 'nginx' and a ClusterIP service named 'nginx'. The `kubectl run nginx --image=nginx --expose --port=80` command creates a pod named 'nginx' and automatically generates a ClusterIP service named 'nginx' that exposes port 80. The `--expose` flag triggers the creation of a service of type ClusterIP (the default service type) to provide stable network access to the pod.

Answer

Only a pod named 'nginx'

Answer

A pod named 'nginx' and a LoadBalancer service named 'nginx'

Answer

A deployment named 'nginx' and a NodePort service named 'nginx'

Question 7

You have a NetworkPolicy that selects pods with label 'role: db' in the 'default' namespace. The policy has no ingress rules defined. What is the effect on traffic to the selected pods?

Accepted Answer

All ingress traffic is denied. A NetworkPolicy with no ingress rules defaults to denying all ingress traffic to the selected pods. This is because Kubernetes NetworkPolicies are whitelist-based: if no ingress rules are specified, the policy implicitly denies all incoming traffic, even if other policies allow it. The selected pods with label 'role: db' will therefore receive no ingress traffic.

Answer

Only traffic from pods with label 'role: frontend' is allowed

Answer

Both ingress and egress traffic are denied

Answer

All ingress traffic is allowed

Question 8

An ingress resource is defined with the following snippet:
```yaml
spec:
  tls:
  - hosts:
    - app.example.com
    secretName: app-tls
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: app-service
            port:
              number: 80
```
The secret 'app-tls' exists and contains a valid certificate. However, accessing https://app.example.com returns a certificate warning in the browser. What is the most likely cause?

Accepted Answer

The TLS secret is in a different namespace than the ingress resource. The TLS secret must reside in the same namespace as the Ingress resource because the Ingress controller reads the secret from the Ingress's namespace. If the secret is in a different namespace, the controller cannot access it, causing it to fall back to its default (untrusted) certificate or fail to serve the correct certificate, which results in a browser certificate warning.

Answer

The ingress controller does not support TLS termination

Answer

The path type is Prefix but should be Exact

Answer

The secret name does not match the TLS section host

Question 9

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

Accepted Answer

db-service.production.svc.cluster.local. Kubernetes DNS resolves services across namespaces using the fully qualified domain name (FQDN) format `..svc.cluster.local`. Since 'my-pod' is in the 'default' namespace and 'db-service' is in the 'production' namespace, the short name 'db-service' will not resolve; the FQDN must include the namespace and the cluster domain suffix to reach the service.

Answer

db-service

Answer

db-service.production.pod.cluster.local

Answer

production.db-service.svc.cluster.local

Question 10

You apply the following NetworkPolicy:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
```
What is the result?

Accepted Answer

All ingress and egress traffic to/from all pods in the namespace is denied. This NetworkPolicy uses an empty `podSelector: {}` which selects all pods in the namespace. By specifying both `Ingress` and `Egress` in `policyTypes` without any rules, the policy defaults to denying all ingress and egress traffic for those pods. This is the standard Kubernetes behavior: a NetworkPolicy with no rules under a given `policyTypes` entry acts as a deny-all for that direction.

Answer

All traffic is allowed because no ingress/egress rules are specified

Answer

Only ingress traffic is denied; egress traffic is allowed

Answer

The policy is invalid because podSelector is empty

Question 11

Which kube-proxy mode uses IP Virtual Server (IPVS) for load balancing and supports more algorithms than the default mode?

Accepted Answer

ipvs. The IP Virtual Server (IPVS) mode in kube-proxy leverages the Linux kernel's IPVS module, which is built on the Netfilter framework and operates in the kernel space. Unlike the default iptables mode, IPVS supports a variety of load-balancing algorithms (e.g., round-robin, least-connection, source-hashing) and provides better scalability and performance for large clusters by using a hash table for service-to-endpoint mapping.

Answer

userspace

Answer

iptables

Answer

kube-proxy

Question 12

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. `kubectl port-forward` creates a direct tunnel from a local port to a specific pod, allowing you to access the pod's HTTP endpoint on port 8080 from your local machine on port 8080. This command targets the pod directly (`pod/my-pod`) and maps local port 8080 to the pod's port 8080, which is exactly what the question requires for temporary, ad-hoc access without creating a Service.

Answer

kubectl expose pod my-pod --port=8080

Answer

kubectl proxy --port=8080

Answer

kubectl port-forward service/my-service 8080:8080

Question 13

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

Accepted Answer

spec.rules. In the 'networking.k8s.io/v1' Ingress API, the 'spec.rules' field is where you define an array of routing rules, each containing a 'host' field for the hostname and an 'http' subfield with 'paths' that specify path-based routing to backend services. This is the primary mechanism for directing traffic based on hostname and path.

Answer

spec.ingress

Answer

spec.tls

Answer

spec.backend

Question 14

You have three pods selected by a service. One pod is in 'CrashLoopBackOff' state. How does the service's endpoints behave?

Accepted Answer

The service endpoints include only the two healthy pods. B is correct because Kubernetes services use endpoints (or endpoint slices) to track which pods are ready to receive traffic. The readiness probe determines pod readiness; a pod in CrashLoopBackOff fails its readiness probe, so it is removed from the service's endpoints. Only the two healthy pods remain in the endpoint list, ensuring traffic is routed only to healthy pods.

Answer

The service removes all endpoints to avoid partial connectivity

Answer

The service endpoints include the unhealthy pod but traffic is not routed to it

Answer

The service includes all three pods in its endpoints

Question 15

Which annotation is commonly used with the ExternalDNS project to manage DNS records for a Kubernetes service?

Accepted Answer

external-dns.alpha.kubernetes.io/hostname. The ExternalDNS project synchronizes exposed Kubernetes Services and Ingresses with DNS providers. The annotation `external-dns.alpha.kubernetes.io/hostname` is used to explicitly specify the DNS hostname that ExternalDNS should manage for a Service of type LoadBalancer or NodePort, overriding the default naming logic.

Answer

prometheus.io/scrape

Answer

kubernetes.io/ingress.class

Answer

cert-manager.io/cluster-issuer