CKA Services and Networking Practice Test 7 — 15 Questions

Question 1

A NetworkPolicy named 'deny-all' is applied to a namespace with podSelector: {}. The policy has no ingress rules. What is the effect?

Accepted Answer

All ingress traffic to pods in the namespace is denied, but egress traffic is allowed.. A NetworkPolicy with `podSelector: {}` selects all pods in the namespace. With no ingress rules defined, the policy defaults to denying all ingress traffic to those pods, while egress traffic remains unrestricted unless explicitly denied by another policy. This is because Kubernetes NetworkPolicy is additive for ingress: if any policy selects a pod, the default allow for ingress is overridden, and only explicitly allowed ingress traffic is permitted.

Answer

All traffic to and from pods in the namespace is denied.

Answer

Only traffic from pods in the same namespace is allowed.

Answer

All traffic is allowed because podSelector: {} matches nothing.

Question 2

What is the DNS name for a Service named 'api' in the 'default' namespace?

Accepted Answer

api.default.svc.cluster.local. The correct DNS name for a Service in Kubernetes follows the pattern `..svc.cluster.local`. For a Service named 'api' in the 'default' namespace, this resolves to `api.default.svc.cluster.local`. The `svc` subdomain is a fixed part of the cluster domain, and `cluster.local` is the default cluster domain suffix configured in kubelet and CoreDNS.

Answer

default.api.svc.cluster.local

Answer

api.svc.default.cluster.local

Answer

api.default.cluster.local

Question 3

You want to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 9090. Which command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 9090:8080. `kubectl port-forward` creates a direct tunnel from a local port (9090) to a pod's port (8080) over the Kubernetes API server, enabling temporary access to a pod's HTTP endpoint without exposing a service. This is the standard method for debugging or testing a pod's network endpoint from a local machine.

Answer

kubectl exec -it my-pod -- /bin/bash

Answer

kubectl proxy --port=9090

Answer

kubectl expose pod my-pod --port=9090 --target-port=8080

Question 4

Which Ingress resource field is used to specify the hostname for which traffic should be routed?

Accepted Answer

spec.rules[].host. In Kubernetes Ingress resources, host-based routing is defined under `spec.rules[].host`. Each rule can specify a hostname, and the Ingress controller uses this field to match the `Host` header of incoming HTTP requests, directing traffic to the appropriate backend service. This is the standard field for routing traffic based on hostname as defined in the Kubernetes Ingress API.

Answer

spec.tls[].hosts

Answer

spec.defaultBackend

Answer

spec.host

Question 5

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

Accepted Answer

IPVS supports multiple load balancing algorithms.. IPVS (IP Virtual Server) supports multiple load balancing algorithms, such as round-robin, least-connection, source-hashing, and others, which is a key advantage over iptables mode. This allows kube-proxy to distribute traffic across pods more flexibly and efficiently, especially in high-traffic environments.

Answer

IPVS uses iptables rules for service discovery.

Answer

IPVS is the default kube-proxy mode since Kubernetes 1.0.

Answer

IPVS cannot handle large numbers of services.

Question 6

Which DNS record type does Kubernetes use to resolve a Service's ClusterIP?

Accepted Answer

A record. Kubernetes uses A records to resolve a Service's ClusterIP. When a DNS query is made for a Service name (e.g., `my-svc.my-namespace.svc.cluster.local`), the cluster's DNS server (typically CoreDNS) returns an A record containing the Service's ClusterIP address. This allows pods to reach the Service via its stable virtual IP.

Answer

PTR record

Answer

SRV record

Answer

CNAME record

Question 7

After creating a NetworkPolicy that selects pods with label 'role: db' and allows ingress on TCP port 3306 from pods with label 'role: api', you notice that pods with label 'role: db' are still reachable on port 3306 from pods without 'role: api' label. What is the most likely cause?

Accepted Answer

The NetworkPolicy is not in the same namespace as the pods.. NetworkPolicies are namespaced resources. If the NetworkPolicy is created in a different namespace than the pods with label 'role: db', it will not apply to those pods. The policy must reside in the same namespace as the pods it targets; otherwise, the default behavior (allow all ingress) remains in effect for those pods.

Answer

The NetworkPolicy uses the wrong protocol.

Answer

The NetworkPolicy has an egress rule that overrides ingress.

Answer

The NetworkPolicy requires an explicit 'deny all' rule.

Question 8

Which component is responsible for implementing the NetworkPolicy rules?

Accepted Answer

CNI plugin. NetworkPolicy rules are enforced by the Container Network Interface (CNI) plugin, not by kube-proxy or any other Kubernetes control plane component. The CNI plugin (e.g., Calico, Cilium, Weave Net) implements the actual network policy by programming iptables, eBPF, or other data-plane mechanisms to allow or deny traffic between pods based on the policy selectors and rules defined in the NetworkPolicy resource.

Answer

CoreDNS

Answer

kube-controller-manager

Answer

kube-proxy

Question 9

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster running on-premises (no cloud provider)?

Accepted Answer

NodePort. NodePort (B) is correct because it exposes a Service on each node's IP at a static port in the 30000-32767 range, which works on any on-premises cluster without a cloud provider's load-balancer integration. Ingress (C) is correct because an Ingress resource plus an Ingress controller (e.g., NGINX, Traefik) provides HTTP/HTTPS routing from outside the cluster to internal Services, and it functions on-premises as long as the controller is deployed and reachable. LoadBalancer (A) is not valid here because it relies on a cloud provider's load-balancer implementation (or a bare-metal solution like MetalLB) to allocate an external IP, which is absent in a plain on-premises cluster. ClusterIP (D) only provides an internal virtual IP reachable within the cluster, so it does not expose the Service externally. ExternalName (E) merely returns a CNAME DNS record pointing to an external hostname and does not expose a Service running in the cluster.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 10

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Accepted Answer

my-svc.default.svc.cluster.local. The standard FQDN for a Kubernetes service in the default namespace is `..svc.cluster.local`. This is the DNS record created by CoreDNS (or kube-dns) for ClusterIP services, allowing pods to resolve the service by its fully qualified domain name. The pod can also use the shorter form `my-svc` because the DNS search path includes the service's namespace and the `svc.cluster.local` suffix, but the FQDN ensures unambiguous resolution.

Answer

my-svc.default.svc.cluster

Answer

my-svc.default.cluster.local

Answer

my-svc.svc.cluster.local

Question 11

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

Accepted Answer

kubectl expose deployment web-app --type=NodePort --port=80. The `kubectl expose deployment web-app --type=NodePort --port=80` command creates a Service from an existing Deployment named 'web-app', setting the service type to NodePort and mapping port 80 on the node to the target port on the pods. This is the standard way to expose a Deployment as a NodePort service in Kubernetes.

Answer

kubectl expose pod web-app --type=NodePort --port=80

Answer

kubectl create deployment web-app --expose --port=80

Answer

kubectl create service nodeport web-app --port=80

Question 12

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Accepted Answer

No pods match the service selector, so the service has no endpoints.. B is correct because if no pods match the service selector 'app: my-app', the service will have no endpoints. Without endpoints, the service cannot route traffic, and kubectl port-forward will fail to establish a connection to localhost:8080. The port-forward command relies on the service having at least one endpoint to forward traffic to.

Answer

The service type is ClusterIP, which does not support port forwarding.

Answer

kubectl port-forward cannot forward to services, only to pods.

Answer

The port forward command requires the --address flag to bind to localhost.

Question 13

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

Accepted Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend. A NetworkPolicy ingress rule with a `podSelector` matches pods in the same namespace as the policy. By specifying `matchLabels: role: frontend`, it allows inbound traffic from any pod in the same namespace that has that label, which is exactly what the question requires.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

egress:
- to:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 14

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

Accepted Answer

The service will route traffic to the IPs defined in the Endpoints object.. A Kubernetes Service without a selector relies on a manually created Endpoints object to define the backend targets. The Service's ClusterIP will route traffic to the IP addresses and ports specified in the Endpoints object, as long as the Endpoints object has the same name as the Service and the Service's ports match the Endpoints' ports. This is a common pattern for routing traffic to external resources or services not managed by Kubernetes.

Answer

The service will automatically create an Endpoints object based on the service ports.

Answer

The Endpoints object must have the same labels as the service.

Answer

The service must be of type ExternalName to use manually created Endpoints.

Question 15

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

Accepted Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: web-svc
            port:
              number: 80. It follows the exact structure required by the Kubernetes Ingress v1 API (networking.k8s.io/v1). It specifies the host `example.com`, defines an HTTP rule with a path of `/` and `pathType: Prefix`, and correctly references the backend service `web-svc` on port 80 using the `service.name` and `port.number` fields. This configuration ensures that traffic for `example.com` is routed to the target service.

Answer

spec:
  rules:
  - http:
      paths:
      - backend:
          service:
            name: web-svc
            port:
              number: 80

Answer

spec:
  rules:
  - host: example.com
    http:
      paths:
      - backend:
          serviceName: web-svc
          servicePort: 80

Answer

spec:
  rules:
  - host: example.com
    backend:
      serviceName: web-svc
      servicePort: 80