CKA Services and Networking Practice Test 8 — 15 Questions

Question 1

Which TWO of the following are valid modes for kube-proxy? (Select 2)

Accepted Answer

iptables. In Kubernetes, kube-proxy supports multiple modes for handling service traffic. The iptables mode (option A) is the default, using iptables rules to direct traffic to backend pods. The ipvs mode (option C) uses Linux IPVS (IP Virtual Server) for load balancing, offering higher performance and more scheduling algorithms. Both are valid and supported. Deprecated userspace mode and nftables/eBPF are not standard kube-proxy modes.

Answer

nftables

Answer

userspace

Answer

ebpf

Question 2

You need to expose a Deployment named 'web' on port 80 inside the cluster. Which kubectl command creates a ClusterIP service?

Accepted Answer

kubectl expose deployment web --port=80. The `kubectl expose deployment web --port=80` command creates a ClusterIP service by default, which exposes the deployment on port 80 within the cluster. The `expose` command without specifying `--type` defaults to ClusterIP, making it the appropriate choice for internal cluster access.

Answer

kubectl expose deployment web --type=NodePort --port=80

Answer

kubectl create service clusterip web --tcp=80

Answer

kubectl port-forward deployment/web 80:80

Question 3

A ClusterIP service named 'svc' in namespace 'default' is not reachable from a pod in the same namespace. The service selector matches the pod's labels. Which command should you run first to verify the endpoint list?

Accepted Answer

kubectl get endpoints svc. To resolve the ambiguity and create a better test of knowledge, Option A should be changed to 'kubectl get svc svc'. The 'kubectl get svc' command only shows the Service's ClusterIP, type, and ports, but does not display the backend endpoints. To verify the actual backend endpoint IPs, you must query the endpoints resource directly using 'kubectl get endpoints svc' (or 'kubectl get ep svc').

Answer

kubectl describe svc svc

Answer

kubectl get endpoints svc -n kube-system

Answer

kubectl describe pod <pod-name>

Question 4

You have an Ingress resource with TLS configured. You verify that the TLS secret exists in the same namespace. However, accessing the service via HTTPS returns a certificate error. What is the most likely cause?

Accepted Answer

The certificate in the TLS secret is self-signed, not signed by a trusted CA.. A self-signed certificate is not trusted by any public Certificate Authority (CA). When a browser or client accesses the service via HTTPS, it validates the certificate against its trust store. Since a self-signed certificate is not in that store, the client displays a certificate error. The Ingress controller serves the certificate correctly, but the client rejects it due to lack of trust.

Answer

The TLS secret name in the Ingress spec does not match the actual secret name.

Answer

The TLS secret's certificate does not match the hostname used in the Ingress rule.

Answer

The Ingress controller must be configured with the --default-ssl-certificate flag.

Question 5

Which Service type is used to expose a service externally with a cloud provider's load balancer?

Accepted Answer

LoadBalancer. The LoadBalancer service type provisions an external load balancer from the underlying cloud provider (e.g., AWS ELB, GCP TCP/UDP Load Balancer, Azure Load Balancer) and assigns a public IP or DNS name to route external traffic to the Kubernetes service. It is the only built-in service type that directly integrates with a cloud provider's infrastructure to expose a service externally with a managed load balancer.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 6

A pod in namespace 'ns1' cannot resolve the DNS name 'svc.ns2.svc.cluster.local'. What is the most likely cause?

Accepted Answer

The service 'svc' does not exist in namespace 'ns2'.. In Kubernetes, CoreDNS dynamically creates DNS records for Services using the format '..svc.'. If a pod attempts to resolve the fully qualified domain name (FQDN) 'svc.ns2.svc.cluster.local' and fails, the most likely cause is that the Service named 'svc' does not exist in the namespace 'ns2', meaning no DNS record exists for it.

Answer

The pod's DNS policy is set to None.

Answer

The pod is trying to resolve using only the short service name 'svc' without the namespace.

Answer

The pod's DNS policy is set to Default.

Question 7

Which TWO statements about Ingress in Kubernetes are correct?

Accepted Answer

Ingress can terminate TLS connections for backend Services.. Ingress operates at Layer 7 (HTTP/HTTPS) and can terminate TLS connections by referencing a Secret containing the certificate and private key in the spec.tls field. This allows the Ingress controller to decrypt incoming HTTPS traffic and forward it as HTTP to backend Services, offloading TLS processing from the pods.

Answer

Setting spec.ingressClassName to 'nginx' disables the default Ingress controller.

Answer

Ingress natively supports gRPC services without any additional configuration.

Answer

Ingress can provide Layer 4 (TCP/UDP) load balancing.

Question 8

Which TWO statements about Headless Services are correct?

Accepted Answer

A Headless Service is created by setting clusterIP: None.. A Headless Service is explicitly created by setting `clusterIP: None` in the Service specification. This tells Kubernetes not to allocate a ClusterIP, which disables the kube-proxy load balancing and allows direct pod-to-pod communication via DNS.

Answer

A Headless Service does not require a selector.

Answer

A Headless Service provides round-robin load balancing across pods.

Answer

A Headless Service is used to provide a stable network identity for pods.

Question 9

Which THREE of the following are valid methods for service discovery in Kubernetes?

Accepted Answer

Environment variables (e.g., SERVICE_NAME_SERVICE_HOST). Kubernetes supports multiple methods for service discovery:

1. **Environment variables**: When a Pod is run on a Node, the kubelet adds environment variables for each active Service (e.g., `{SVCNAME}_SERVICE_HOST` and `{SVCNAME}_SERVICE_PORT`).
2. **DNS (CoreDNS)**: A DNS server (usually CoreDNS) watches the Kubernetes API for new Services and creates a set of DNS records for each. If DNS is enabled, Pods can resolve Services by their DNS names.
3. **Kubernetes API**: Applications can query the Kubernetes API server directly (using a client library or REST calls) to discover Services and Endpoints. This is often used by microservice frameworks for dynamic service discovery.

`kubectl port-forward` is a debugging tool to forward local ports to a pod, not a service discovery mechanism. Ingress rules are used to expose HTTP and HTTPS routes from outside the cluster to services within the cluster, not for internal service discovery.

Answer

kubectl port-forward

Answer

Ingress rules

Question 10

Which THREE components are part of the Gateway API?

Accepted Answer

Gateway. The Gateway API is a Kubernetes API extension that defines a set of resources for configuring service networking, including Gateway, GatewayClass, and HTTPRoute. Gateway represents the point where traffic is received and processed, GatewayClass defines a class of gateways (similar to StorageClass for storage), and HTTPRoute specifies how HTTP traffic is routed from a Gateway to backend services. These three resources form the core of the Gateway API's role-based, expressive networking model.

Answer

Service

Answer

Ingress

Question 11

Which TWO statements about EndpointSlices are correct?

Accepted Answer

EndpointSlices improve scalability compared to Endpoints.. EndpointSlices are designed to overcome the scalability limitations of the older Endpoints API. A single Endpoint object stores all endpoints for a Service, which can become a large, monolithic object that causes performance issues in the control plane and etcd when a Service has many pods. EndpointSlices break this into smaller, manageable slices, each containing up to 100 endpoints by default, reducing the impact of updates and improving overall cluster scalability.

Answer

EndpointSlices are created manually by the user.

Answer

Each EndpointSlice can contain only one endpoint.

Answer

EndpointSlices are only used with ClusterIP services.

Question 12

Which TWO of the following are valid kube-proxy modes?

Accepted Answer

ipvs. The two valid and supported kube-proxy modes on Linux in modern Kubernetes versions (v1.26+) are **iptables** and **ipvs**.

- **iptables** (D) is the default mode where kube-proxy programs iptables rules to redirect traffic destined for Service ClusterIPs directly to backend Pods.
- **ipvs** (C) uses IPVS (IP Virtual Server) to handle routing, which provides much greater scalability and performance for clusters with thousands of services.

**Why other options are incorrect:**
- **userspace** (B) was a legacy proxy mode that has been completely removed as of Kubernetes v1.26.
- **eBPF** (A) is used by some third-party CNI plugins (like Cilium) to replace kube-proxy functionality, but it is not a native kube-proxy mode.
- **kernelnet** (E) is a fictitious term.

Answer

eBPF

Answer

userspace

Answer

kernelnet

Question 13

A Kubernetes cluster has a Service of type ClusterIP named 'my-svc' in the 'default' namespace. You deploy a pod and want it to resolve the service's cluster IP using DNS. What FQDN should the pod use?

Accepted Answer

my-svc.default.svc.cluster.local. The standard FQDN for a Kubernetes Service is `..svc.cluster.local`. This DNS record resolves to the ClusterIP of the Service, allowing pods to reach it via DNS. The `svc` subdomain is a fixed part of the cluster domain, distinguishing Service records from pod records.

Answer

my-svc.default.pods.cluster.local

Answer

my-svc.cluster.local

Answer

my-svc.default.svc.cluster.com

Question 14

An administrator creates a NetworkPolicy in namespace 'app' with the following YAML. Which statement is true about the policy?

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress

Accepted Answer

The policy denies all ingress traffic to all pods in the 'app' namespace.. The NetworkPolicy uses an empty `podSelector: {}`, which selects all pods in the namespace, and specifies `policyTypes: [Ingress]` with no ingress rules. By default, Kubernetes NetworkPolicy denies all ingress traffic that is not explicitly allowed, so this policy effectively blocks all incoming traffic to every pod in the 'app' namespace.

Answer

The policy denies all ingress traffic to no pods because no podSelector is specified.

Answer

The policy denies all egress traffic from all pods in the 'app' namespace.

Answer

The policy allows all ingress traffic to all pods in the 'app' namespace.

Question 15

You are troubleshooting a Service connectivity issue. A pod in namespace 'frontend' cannot reach a Service in namespace 'backend' by its DNS name. CoreDNS is running. Which statements are true? (Select TWO.)

Accepted Answer

Cross-namespace DNS resolution requires the pod to use the full FQDN of the service.. Kubernetes DNS resolution for cross-namespace access requires the full FQDN of the Service, which includes the namespace name. Without the namespace qualifier, DNS resolution will fail because CoreDNS only resolves short names (e.g., 'backend-service') within the same namespace as the querying pod. The full FQDN format is '..svc.cluster.local'.

Answer

Service DNS is automatically disabled in Kubernetes; pods must use environment variables.

Answer

The default cluster domain for Kubernetes services is 'cluster'.

Answer

NetworkPolicy cannot affect service DNS resolution.