CKA Services and Networking Practice Test 6 — 15 Questions

Question 1

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Accepted Answer

my-svc.default.svc.cluster.local. The FQDN for a service in Kubernetes is ..svc.cluster.local. For a service named 'my-svc' in the 'default' namespace, it is 'my-svc.default.svc.cluster.local'.

Answer

my-svc.default.svc.cluster

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Question 2

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

Accepted Answer

kubectl expose deployment web-app --type=NodePort --port=80. The 'kubectl expose' command with '--type=NodePort' and '--port=80' creates a service. The '--target-port' can specify the container port.

Answer

kubectl expose pod web-app --type=NodePort --port=80

Answer

kubectl create deployment web-app --expose --port=80

Answer

kubectl create service nodeport web-app --port=80

Question 3

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Accepted Answer

No pods match the service selector, so the service has no endpoints.. Port forwarding to a service works if the service has endpoints. If no pods match the service selector, the service has no endpoints and the port forward cannot forward traffic.

Answer

The service type is ClusterIP, which does not support port forwarding.

Answer

kubectl port-forward cannot forward to services, only to pods.

Answer

The port forward command requires the --address flag to bind to localhost.

Question 4

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

Accepted Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend. A NetworkPolicy ingress rule uses 'from' with a podSelector to select source pods. The podSelector must match the label of the source pods.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

egress:
- to:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 5

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

Accepted Answer

The service will route traffic to the IPs defined in the Endpoints object.. A service without a selector can have a manually created Endpoints object to route traffic to external endpoints. The service must have the same name as the Endpoints object.

Answer

The service will automatically create an Endpoints object based on the service ports.

Answer

The Endpoints object must have the same labels as the service.

Answer

The service must be of type ExternalName to use manually created Endpoints.

Question 6

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

Accepted Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80. An Ingress rule has a 'host' field and a 'http' path with a backend service. The backend specifies the service name and port.

Answer

spec:
  rules:
  - http:
      paths:
      - backend:
          service:
            name: web-svc
            port:
              number: 80

Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: web-svc
          servicePort: 80

Answer

spec:
  rules:
  - host: example.com
    backend:
      serviceName: web-svc
      servicePort: 80

Question 7

You apply the following NetworkPolicy to namespace 'ns1':
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-ingress
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []
What effect does this policy have?

Accepted Answer

Denies all ingress traffic to all pods in namespace ns1.. An empty 'ingress: []' rule combined with 'podSelector: {}' selects all pods in the namespace and denies all ingress traffic that is not explicitly allowed. This effectively creates a default deny ingress policy.

Answer

Denies all egress traffic as well.

Answer

Allows ingress traffic only from pods in the same namespace.

Answer

Allows all ingress traffic because no explicit deny rules are defined.

Question 8

A pod is unable to resolve DNS names of services in other namespaces. Which DNS configuration is most likely missing?

Accepted Answer

The pod's dnsPolicy is set to 'Default'.. By default, pods can resolve services in other namespaces using the FQDN '..svc.cluster.local'. If the pod's DNS policy is set to 'Default' (node's DNS) or 'None', it may not include the cluster domain. The default pod DNS policy is 'ClusterFirst' which uses CoreDNS for cluster DNS.

Answer

CoreDNS is not deployed in the cluster.

Answer

The pod is in a different namespace than the service.

Answer

The service does not have a ClusterIP assigned.

Question 9

Which kube-proxy mode uses iptables rules to handle service traffic?

Accepted Answer

iptables. kube-proxy can run in userspace, iptables, or ipvs mode. The iptables mode uses iptables rules to direct traffic to service backends.

Answer

ipvs

Answer

nftables

Answer

userspace

Question 10

You need to expose a service named 'my-svc' on a static port 30080 on every node. Which service type should you use?

Accepted Answer

NodePort. NodePort service exposes a port on every node's IP. The nodePort can be specified in the service spec.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP

Question 11

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Accepted Answer

DNS returns the IP addresses of all pods that match the selector.. A headless service returns DNS A/AAAA records for the individual pod IPs, not a single ClusterIP. This is used for stateful applications where each pod needs a stable network identity.

Answer

DNS does not resolve the service name at all.

Answer

DNS returns the service name as a CNAME to the pod names.

Answer

DNS resolves the service name to a single ClusterIP.

Question 12

Which of the following is a valid CNI plugin for Kubernetes networking?

Accepted Answer

Calico. Calico is a popular CNI plugin that provides networking and network policy enforcement.

Answer

etcd

Answer

Docker

Answer

Kubelet

Question 13

Which two of the following are valid methods for service discovery in Kubernetes?

Accepted Answer

Environment variables injected into pods. Kubernetes offers DNS-based service discovery and environment variables (e.g., MY_SVC_SERVICE_HOST, MY_SVC_SERVICE_PORT).

Answer

Ingress controller

Answer

Consul agent running on each node

Answer

kubectl proxy

Question 14

Which three of the following are true about IngressClass?

Accepted Answer

An IngressClass can be marked as default by adding the annotation 'ingressclass.kubernetes.io/is-default-class: true'.. IngressClass defines which controller should implement an Ingress. It can set a default IngressClass, and a cluster can have multiple IngressClasses. The IngressClass resource is cluster-scoped.

Answer

IngressClass is a namespaced resource.

Answer

Each cluster can only have one IngressClass.

Question 15

Which two of the following are correct statements about EndpointSlices?

Accepted Answer

EndpointSlices are automatically created by the EndpointSlice controller.. EndpointSlices were introduced to improve scalability over Endpoints. They can contain up to 100 endpoints by default and can be managed by a controller. They are not a replacement for Endpoints; both coexist.

Answer

EndpointSlices are only used for services of type LoadBalancer.

Answer

EndpointSlices replace the Endpoints resource entirely.

Answer

EndpointSlices are an alpha feature and must be enabled via feature gate.