CKA Services and Networking Practice Test 5 — 15 Questions

Question 1

Which three of the following are true about IngressClass?

Accepted Answer

An IngressClass can be marked as default by adding the annotation 'ingressclass.kubernetes.io/is-default-class: true'.. The annotation 'ingressclass.kubernetes.io/is-default-class' set to 'true' on an IngressClass resource marks it as the default class. When no IngressClass is specified in an Ingress resource, the default IngressClass is used automatically. This annotation is defined in the Kubernetes networking API and is honored by the ingress controller.

Answer

IngressClass is a namespaced resource.

Answer

Each cluster can only have one IngressClass.

Question 2

Which two of the following are correct statements about EndpointSlices?

Accepted Answer

EndpointSlices are automatically created by the EndpointSlice controller.. The EndpointSlice controller is responsible for creating and managing EndpointSlice objects. It monitors Services and their backing Pods, then automatically generates EndpointSlices that group endpoints (IP addresses, ports, topology information) into manageable slices, typically up to 100 endpoints per slice by default.

Answer

EndpointSlices are only used for services of type LoadBalancer.

Answer

EndpointSlices replace the Endpoints resource entirely.

Answer

EndpointSlices are an alpha feature and must be enabled via feature gate.

Question 3

Which Kubernetes Service type exposes the Service on a static port on each Node's IP address, allowing external access without a LoadBalancer?

Accepted Answer

NodePort. A NodePort Service exposes the Service on a static port (in the range 30000-32767) on every Node's IP address. This allows external traffic to reach the Service by targeting any cluster node's IP and the assigned NodePort, without requiring a cloud LoadBalancer. The kube-proxy component on each node creates iptables or IPVS rules to forward traffic from that port to the corresponding ClusterIP Service and then to the selected Pods.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 4

An administrator creates a Service of type ClusterIP named 'my-svc' in the namespace 'default'. A pod in the same namespace tries to resolve the hostname 'my-svc' but fails. The pod's resolv.conf shows 'search default.svc.cluster.local svc.cluster.local cluster.local'. What is the most likely cause?

Accepted Answer

The Service does not exist or is in a different namespace. The pod's resolv.conf includes 'default.svc.cluster.local' as a search domain, meaning the pod will attempt to resolve 'my-svc' as 'my-svc.default.svc.cluster.local'. If the Service does not exist in the 'default' namespace, or if it exists in a different namespace, CoreDNS will return NXDOMAIN, causing resolution to fail. The search domains are automatically appended based on the pod's namespace, so a missing Service in the same namespace is the most likely cause.

Answer

The pod's DNS policy is set to 'None'

Answer

The pod is using hostNetwork and bypasses CoreDNS

Answer

The Service type is ExternalName

Question 5

A cluster administrator applies the following NetworkPolicy. What is the effect on pods matching the podSelector?

Accepted Answer

All ingress and egress traffic is denied. The NetworkPolicy shown has a `podSelector` that matches specific pods, but it has no `ingress` or `egress` rules defined under the `spec` (the rules arrays are empty). According to Kubernetes NetworkPolicy semantics, if a policy selects a pod, that pod's traffic is isolated: any empty `ingress` rules block all ingress traffic, and any empty `egress` rules block all egress traffic. Since both `ingress` and `egress` are present with empty rules, all ingress and egress traffic to/from the matched pods is denied.

Answer

All ingress traffic is denied, but egress is allowed

Answer

All ingress and egress traffic is allowed

Answer

Only traffic from pods in the same namespace is allowed

Question 6

A cluster has kube-proxy running in ipvs mode. An administrator creates a Service of type ClusterIP. Which of the following is true about how traffic is forwarded to the pods?

Accepted Answer

kube-proxy creates IPVS virtual servers that use scheduling algorithms like round-robin. When kube-proxy runs in ipvs mode, it creates IPVS virtual servers for each ClusterIP Service. These virtual servers use kernel-level scheduling algorithms (e.g., round-robin, least connections) to forward traffic directly to the selected backend pods, bypassing iptables for per-packet decisions. This provides better performance and more sophisticated load-balancing policies compared to iptables mode.

Answer

kube-proxy uses userspace mode to proxy traffic

Answer

kube-proxy uses iptables rules to randomly select a pod

Answer

kube-proxy does nothing; the cluster DNS does the load balancing

Question 7

An Ingress resource is defined with the following spec snippet. What is the minimal requirement for this Ingress to work correctly?

Accepted Answer

An IngressClass named 'nginx' must be defined and a compatible Ingress controller must be running. For an Ingress to work, an Ingress controller must be running and the referenced IngressClass must exist (if specified). Additionally, the backend Service must be in the same namespace as the Ingress. Both are required; the controller is often the overlooked part, but the namespace constraint is also a mandatory condition.

Answer

The Ingress must have a TLS section configured

Answer

A Service named 'api-svc' of type NodePort must exist

Question 8

Which DNS record does CoreDNS create for a headless Service named 'headless-svc' in the namespace 'default'?

Accepted Answer

A records for each pod IP backing the Service. CoreDNS creates A records for each pod IP backing a headless Service because headless Services (with clusterIP set to None) are designed to return pod IPs directly via DNS, rather than a single Service IP. For a headless Service named 'headless-svc' in the 'default' namespace, CoreDNS performs a DNS lookup that returns multiple A records, one for each ready pod endpoint, enabling direct pod-to-pod communication without load balancing.

Answer

No DNS record

Answer

A CNAME record pointing to an external DNS

Answer

An A record for the Service IP (ClusterIP)

Question 9

A NetworkPolicy allows ingress traffic from pods with label 'app: frontend' in any namespace. Which selector is used?

Accepted Answer

spec.ingress[0].from[0].namespaceSelector: {} and spec.ingress[0].from[0].podSelector: { matchLabels: { app: frontend } }. To allow ingress traffic from pods with label 'app: frontend' in any namespace, you must combine an empty namespaceSelector (which selects all namespaces) with a podSelector that matches the pod label. This combination tells Kubernetes to allow traffic from any pod matching the label, regardless of which namespace it resides in. Without the namespaceSelector, the podSelector would only apply to pods in the same namespace as the NetworkPolicy.

Answer

spec.ingress[0].from[0].podSelector: { matchLabels: { app: frontend } }

Answer

spec.ingress[0].from[0].ipBlock: { cidr: 0.0.0.0/0 }

Answer

spec.ingress[0].from[0].namespaceSelector: { matchLabels: { app: frontend } }

Question 10

An administrator wants to expose an application running in a pod on port 3000 using a Service of type LoadBalancer. Which command creates the Service?

Accepted Answer

kubectl expose pod my-pod --type=LoadBalancer --port=80 --target-port=3000. It uses `kubectl expose pod` with `--type=LoadBalancer` to create a Service that exposes the pod's application on port 3000 (specified via `--target-port=3000`) and maps it to port 80 on the LoadBalancer. This command directly creates a Service of the requested type, targeting the correct container port.

Answer

kubectl expose pod my-pod --type=NodePort --port=3000

Answer

kubectl run my-pod --expose --port=80 --image=nginx

Answer

kubectl create service loadbalancer my-svc --tcp=80:3000

Question 11

Which of the following is a valid use case for a Headless Service?

Accepted Answer

To enable DNS-based service discovery for stateful applications like StatefulSets. A Headless Service (with clusterIP: None) is used to enable DNS-based service discovery, returning the IP addresses of all backing pods rather than a single virtual IP. This is essential for stateful applications like StatefulSets, where each pod requires a stable network identity and direct pod-to-pod communication without load balancing.

Answer

To provide a stable IP address for a deployment

Answer

To load balance traffic across pods using iptables

Answer

To allow external traffic to reach pods without a load balancer

Question 12

A pod is unable to communicate with a Service in the same namespace. The administrator checks kube-proxy logs and finds no errors. Which command would help diagnose whether the iptables rules for the Service are correctly programmed?

Accepted Answer

iptables-save | grep . `iptables-save` dumps the entire iptables rule set from the kernel, and piping it to `grep ` allows you to verify whether the specific NAT rules (e.g., DNAT, REDIRECT) for the Service’s ClusterIP and port are present. Unlike `kubectl exec` into the kube-proxy pod, this command runs directly on the node and shows the actual programmed rules, which is essential when kube-proxy logs show no errors but connectivity fails.

Answer

ss -tuln

Answer

kubectl describe svc

Answer

kubectl exec -n kube-system <kube-proxy-pod> -- iptables -L

Question 13

Which TWO statements are true about Ingress in Kubernetes?

Accepted Answer

Ingress can terminate TLS connections. Ingress can terminate TLS connections by specifying a TLS section in the Ingress spec that references a Kubernetes Secret containing the certificate and private key. This allows HTTPS traffic to be decrypted at the Ingress controller, offloading TLS termination from backend Services. Ingress can also expose multiple Services under the same IP address by defining routing rules based on hostnames or paths; the Ingress controller directs traffic to the appropriate backend Service while using a single load balancer IP. Options C and E are false because IngressClass is optional (a default can be used) and an Ingress controller is required for Ingress to work.

Answer

IngressClass is a mandatory field in Ingress spec

Answer

Ingress is the only way to expose Services externally

Answer

Ingress works without an Ingress controller

Question 14

Which Service type exposes a Service externally via a cloud provider's load balancer?

Accepted Answer

LoadBalancer. (LoadBalancer) is correct because the LoadBalancer Service type automatically provisions an external load balancer from the underlying cloud provider (e.g., AWS ELB, GCP TCP/UDP Load Balancer, Azure Load Balancer) and assigns a public IP or DNS name to expose the Service externally. This is achieved by the cloud-controller-manager component, which watches for Services of type LoadBalancer and creates the corresponding cloud resource.

Answer

ExternalName

Answer

ClusterIP

Answer

NodePort

Question 15

An admin runs `kubectl run nginx --image=nginx --restart=Never` and then runs `kubectl expose pod nginx --port=80 --target-port=80`. Another pod in the same namespace tries to curl http://nginx:80 but gets connection refused. What is the most likely cause?

Accepted Answer

The pod is not running because it was created with --restart=Never and may have completed.. The explanation states that because `--restart=Never` is used, the nginx container 'runs once and exits' and the pod enters a Completed state. This is incorrect. The official `nginx` image runs a web server in the foreground (`daemon off;`) as its entrypoint. It does not exit. Therefore, even with `--restart=Never`, the pod will remain in the `Running` state indefinitely, the endpoints will be populated, and the curl command would succeed, not fail with connection refused.

Answer

The Service port is incorrectly set to 80 but the container listens on 8080.

Answer

The Service type defaults to ClusterIP, so it cannot be accessed from inside the cluster.

Answer

The Service selector does not match the pod's labels.