CKA Services and Networking Practice Test 4 — 15 Questions

Question 1

Which Ingress resource field is used to specify the hostname for which traffic should be routed?

Accepted Answer

spec.rules[].host. In Kubernetes Ingress resources, host-based routing is defined under `spec.rules[].host`. Each rule can specify a hostname, and the Ingress controller uses this field to match the `Host` header of incoming HTTP requests, directing traffic to the appropriate backend service. This is the standard field for routing traffic based on hostname as defined in the Kubernetes Ingress API.

Answer

spec.tls[].hosts

Answer

spec.defaultBackend

Answer

spec.host

Question 2

You deploy a pod named 'app' that listens on port 3000. You create a Service named 'app-svc' with selector 'app: app'. From another pod in the same namespace, which command will successfully reach the service?

Accepted Answer

curl app-svc:80. When connecting to a Kubernetes Service, clients must send traffic to the Service's own port (`port`), not the Pod's port (`targetPort`). The Service (via kube-proxy) then routes and translates this traffic to the Pod's `targetPort`. Since the Service 'app-svc' is configured with `port: 80` and `targetPort: 3000`, other pods in the cluster must access it using the Service's port (80), making `curl app-svc:80` the correct command.

Answer

curl app-svc.default.svc.cluster.local:3000

Answer

curl app-svc:3000

Answer

curl app:3000

Question 3

After creating a NetworkPolicy that selects pods with label 'role: db' and allows ingress on TCP port 3306 from pods with label 'role: api', you notice that pods with label 'role: db' are still reachable on port 3306 from pods without 'role: api' label. What is the most likely cause?

Accepted Answer

The NetworkPolicy is not in the same namespace as the pods.. NetworkPolicies are namespaced resources. If the NetworkPolicy is created in a different namespace than the pods with label 'role: db', it will not apply to those pods. The policy must reside in the same namespace as the pods it targets; otherwise, the default behavior (allow all ingress) remains in effect for those pods.

Answer

The NetworkPolicy uses the wrong protocol.

Answer

The NetworkPolicy has an egress rule that overrides ingress.

Answer

The NetworkPolicy requires an explicit 'deny all' rule.

Question 4

You are designing an Ingress to expose multiple services on the same hostname based on path. Which Ingress specification is valid?

Accepted Answer

spec.rules[0].host: example.com; spec.rules[0].http.paths[0].path: /api; backend.service.name: api-svc; spec.rules[0].http.paths[1].path: /web; backend.service.name: web-svc. It defines a single rule with multiple paths under the same host, which is the standard method for path-based routing to multiple services. Option B is incorrect because it uses separate rules for each path; this is not the recommended approach and can lead to unpredictable behavior, as Ingress controllers may only evaluate the first matching rule, potentially ignoring later paths. Therefore, the proper specification is to consolidate all paths under one rule for the same host.

Answer

spec.rules[0].host: example.com; spec.rules[0].http.paths[0].path: /api; backend.service.name: api-svc; spec.rules[1].host: example.com; spec.rules[1].http.paths[0].path: /web; backend.service.name: web-svc

Question 5

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster running on-premises (no cloud provider)?

Accepted Answer

NodePort. NodePort is a valid method to expose a Service externally in an on-premises cluster because it opens a high-port (30000-32767) on every node's IP address, routing traffic to the Service's ClusterIP. This allows external clients to reach the Service by targeting any node's IP and the assigned NodePort, without requiring a cloud load balancer.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 6

Which THREE of the following statements about Kubernetes DNS are correct?

Accepted Answer

A pod's hostname is set to its pod name by default.. By default, the hostname of a Pod is set to its Pod name (C). This is managed by the kubelet, which sets the hostname field in the container's UTS namespace to the Pod's `metadata.name`.

A Service's DNS name resolves to its ClusterIP (D). For example, `my-svc.my-namespace.svc.cluster.local` resolves to the ClusterIP of `my-svc`.

SRV records are created for Services that have named ports (E). These records take the form `_port-name._port-protocol.my-svc.my-namespace.svc.cluster.local` and are used to discover port numbers and protocols.

Option A is incorrect because Services can be resolved across namespaces using their FQDN (e.g., `service.namespace.svc.cluster.local`).
Option B is incorrect because Pods have A records that resolve to their Pod IP (formatted as `a-b-c-d.namespace.pod.cluster.local`), not a 'container IP'.

Answer

Services are only resolvable within their own namespace.

Answer

Pods have A records that resolve to their container IP.

Question 7

Which TWO of the following are valid IngressClass annotations or fields?

Accepted Answer

spec.ingressClassName. `spec.ingressClassName` is a field in the Ingress spec that references the name of an IngressClass resource. This field is used to associate an Ingress with a specific controller, such as nginx or Traefik, and is the standard way to specify the Ingress class in Kubernetes 1.18+.

Answer

spec.rules

Answer

spec.tls

Answer

spec.defaultBackend

Question 8

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Accepted Answer

my-svc.default.svc.cluster.local. The standard FQDN for a Kubernetes service in the default namespace is `..svc.cluster.local`. This is the DNS record created by CoreDNS (or kube-dns) for ClusterIP services, allowing pods to resolve the service by its fully qualified domain name. The pod can also use the shorter form `my-svc` because the DNS search path includes the service's namespace and the `svc.cluster.local` suffix, but the FQDN ensures unambiguous resolution.

Answer

my-svc.default.svc.cluster

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Question 9

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

Accepted Answer

kubectl expose deployment web-app --type=NodePort --port=80. The `kubectl expose deployment web-app --type=NodePort --port=80` command creates a Service from an existing Deployment named 'web-app', setting the service type to NodePort and mapping port 80 on the node to the target port on the pods. This is the standard way to expose a Deployment as a NodePort service in Kubernetes.

Answer

kubectl expose pod web-app --type=NodePort --port=80

Answer

kubectl create deployment web-app --expose --port=80

Answer

kubectl create service nodeport web-app --port=80

Question 10

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

Accepted Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend. A NetworkPolicy ingress rule with a `podSelector` matches pods in the same namespace as the policy. By specifying `matchLabels: role: frontend`, it allows inbound traffic from any pod in the same namespace that has that label, which is exactly what the question requires.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

egress:
- to:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 11

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

Accepted Answer

The service will route traffic to the IPs defined in the Endpoints object.. A Kubernetes Service without a selector relies on a manually created Endpoints object to define the backend targets. The Service's ClusterIP will route traffic to the IP addresses and ports specified in the Endpoints object, as long as the Endpoints object has the same name as the Service and the Service's ports match the Endpoints' ports. This is a common pattern for routing traffic to external resources or services not managed by Kubernetes.

Answer

The service will automatically create an Endpoints object based on the service ports.

Answer

The Endpoints object must have the same labels as the service.

Answer

The service must be of type ExternalName to use manually created Endpoints.

Question 12

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

Accepted Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80. It follows the exact structure required by the Kubernetes Ingress v1 API (networking.k8s.io/v1). It specifies the host `example.com`, defines an HTTP rule with a path of `/` and `pathType: Prefix`, and correctly references the backend service `web-svc` on port 80 using the `service.name` and `port.number` fields. This configuration ensures that traffic for `example.com` is routed to the target service.

Answer

spec:
  rules:
  - http:
      paths:
      - backend:
          service:
            name: web-svc
            port:
              number: 80

Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: web-svc
          servicePort: 80

Answer

spec:
  rules:
  - host: example.com
    backend:
      serviceName: web-svc
      servicePort: 80

Question 13

A pod is unable to resolve DNS names of services in other namespaces. Which DNS configuration is most likely missing?

Accepted Answer

The pod's dnsPolicy is set to 'Default'.. When a pod's `dnsPolicy` is set to `Default`, the pod inherits the node's DNS resolution configuration, which typically points to the host's `/etc/resolv.conf` and does not include the cluster's DNS service (CoreDNS). This prevents the pod from resolving service DNS names like `..svc.cluster.local`, which are only resolvable via the cluster's DNS. Setting `dnsPolicy` to `ClusterFirst` (the default if not specified) ensures the pod uses CoreDNS for DNS queries, enabling cross-namespace service discovery.

Answer

CoreDNS is not deployed in the cluster.

Answer

The pod is in a different namespace than the service.

Answer

The service does not have a ClusterIP assigned.

Question 14

You need to expose a service named 'my-svc' on a static port 30080 on every node. Which service type should you use?

Accepted Answer

NodePort. NodePort is the correct service type because it exposes the service on a static port (30080) on every node's IP address. When you create a NodePort service, Kubernetes allocates a port from the range 30000-32767 (by default) and opens that port on all nodes, forwarding traffic to the service's ClusterIP and then to the pods. This allows external access to the service via any node's IP and the specified NodePort.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP

Question 15

Which two of the following are valid methods for service discovery in Kubernetes?

Accepted Answer

Environment variables injected into pods. Kubernetes can inject environment variables into pods at creation time that contain the cluster IP and port of services. This is a built-in service discovery mechanism that requires no additional components, though it has limitations such as only working for services created before the pod and not updating if the service changes.

Answer

Ingress controller

Answer

Consul agent running on each node

Answer

kubectl proxy