CKA Services and Networking Practice Test 9 — 15 Questions

Question 1

You create a Service of type LoadBalancer in a Kubernetes cluster that does not have an external load balancer provider (e.g., bare-metal). What will be the state of the EXTERNAL-IP field when you run 'kubectl get svc'?

Accepted Answer

. When no external load balancer is provisioned, the EXTERNAL-IP remains indefinitely.

Answer

The ClusterIP

Answer

The node's IP address

Answer

<none>

Question 2

Which command creates a temporary pod and forwards port 8080 from your local machine to port 80 of an existing pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. kubectl port-forward pod/web-pod 8080:80 forwards local port 8080 to pod port 80.

Answer

kubectl exec -it web-pod -- nc -l -p 8080

Answer

kubectl proxy --port=8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Question 3

You have a NetworkPolicy that selects pods with label 'app: db'. The policy has an ingress rule allowing traffic from pods with label 'app: frontend'. A pod with label 'app: frontend' is in a different namespace. No namespaceSelector is specified in the ingress rule. Will traffic from that pod be allowed?

Accepted Answer

No, because the frontend pod is in a different namespace and no namespaceSelector is specified. When no namespaceSelector is specified, the rule applies only to pods in the same namespace as the NetworkPolicy.

Answer

Yes, because podSelector selects pods across all namespaces

Answer

No, because NetworkPolicy only works within the same namespace

Answer

Yes, because all ingress traffic is allowed by default

Question 4

You run 'kubectl run nginx --image=nginx --expose --port=80'. What resources are created?

Accepted Answer

A Deployment named nginx and a Service named nginx. kubectl run with --expose creates a Deployment (or Pod depending on version) and a Service.

Answer

A Pod named nginx and a Service named nginx

Answer

A Pod named nginx and an Endpoints resource named nginx

Answer

A ReplicaSet named nginx and a Service named nginx

Question 5

Which Service type exposes a Service on each Node's IP at a static port in the range 30000-32767?

Accepted Answer

NodePort. A NodePort Service exposes the Service on each Node's IP at a static port in the range 30000-32767. When you create a NodePort Service, Kubernetes allocates a port from that range (or you can specify one) and opens that port on every node in the cluster, forwarding traffic to the Service's ClusterIP and then to the selected Pods.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 6

In a Kubernetes cluster using CoreDNS, what is the DNS name for a Service named 'api' in namespace 'backend'?

Accepted Answer

api.backend.svc.cluster.local. The FQDN format is ..svc.cluster.local.

Answer

backend.api.svc.cluster.local

Answer

api.backend.cluster.local

Answer

api.svc.backend.cluster.local

Question 7

You have an Ingress resource with a TLS section specifying a secret named 'tls-secret'. The certificate in 'tls-secret' is expired. What happens when a client connects via HTTPS to the Ingress host?

Accepted Answer

TLS handshake succeeds but the client receives a warning about the expired certificate. Kubernetes Ingress controllers will serve the certificate even if expired; TLS termination still occurs but browsers will warn.

Answer

The Ingress controller returns an error and refuses to terminate TLS

Answer

The Ingress controller automatically renews the certificate

Answer

The secret is ignored and HTTP is used instead

Question 8

Which kube-proxy mode uses iptables rules to handle service traffic and is the default in many distributions?

Accepted Answer

iptables. The iptables mode is the default for kube-proxy.

Answer

userspace

Answer

ipvs

Answer

nftables

Question 9

What is the purpose of a Headless Service (clusterIP: None)?

Accepted Answer

To allow DNS queries to return all pod IPs for a StatefulSet. A Headless Service allows direct pod-to-pod DNS resolution without load balancing.

Answer

To expose the Service externally via a cloud load balancer

Answer

To provide load balancing across pods

Answer

To assign a static ClusterIP

Question 10

A NetworkPolicy named 'default-deny-ingress' is applied to all pods in a namespace. The policy has no rules. An administrator then creates a new NetworkPolicy that allows ingress traffic to pods with label 'app: web' from any source using a podSelector with '{}'. Will traffic be allowed to pods labeled 'app: web'?

Accepted Answer

Yes, because the new policy allows traffic to pods with label 'app: web'. An empty podSelector {} selects all pods, but rules are still evaluated. However, the default-deny policy denies all ingress unless allowed. The new policy explicitly allows ingress to 'app: web' pods, so they become allowed.

Answer

No, because the new policy's empty podSelector selects all pods but does not specify a source

Answer

Yes, because the default-deny policy is ignored when a new policy exists

Answer

No, because the default-deny policy takes precedence

Question 11

You want to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates a ClusterIP Service?

Accepted Answer

kubectl expose deployment web --port=80 --type=ClusterIP. kubectl expose deployment web --port=80 creates a ClusterIP Service by default.

Answer

kubectl create deployment web --image=nginx --port=80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80

Question 12

Which resource is used to configure TLS termination and path-based routing for HTTP(S) traffic into a cluster?

Accepted Answer

Ingress. An Ingress resource provides HTTP and HTTPS routing to services within a Kubernetes cluster, enabling TLS termination and path-based routing. It acts as a layer 7 load balancer, directing external traffic to the appropriate backend Service based on hostnames and paths defined in its rules.

Answer

Service

Answer

NetworkPolicy

Answer

Gateway

Question 13

Which TWO statements about EndpointSlices are true? (Choose 2)

Accepted Answer

EndpointSlices are automatically created and managed by the EndpointSlice controller. EndpointSlices are more scalable and support dual-stack, and are the default since v1.21.

Answer

EndpointSlices are only used for Services of type ClusterIP

Answer

EndpointSlices replace Endpoints in all Kubernetes versions

Answer

EndpointSlices can contain up to 100 endpoints each

Question 14

Which THREE are correct ways to configure a default deny all ingress traffic NetworkPolicy? (Choose 3)

Accepted Answer

A NetworkPolicy with podSelector: {} and ingress: []. A policy with an empty podSelector that allows no ingress. Options with rules allow some traffic. Correct ways are those with no ingress rules.

Answer

A NetworkPolicy with podSelector: {} and an ingress rule with from: []

Answer

A NetworkPolicy with podSelector: {} and an ingress rule with from: [{}]

Question 15

Which TWO commands can be used to test DNS resolution for a Service named 'my-svc' in namespace 'default' from within a temporary pod? (Choose 2)

Accepted Answer

kubectl run test --image=busybox --rm -it --restart=Never -- nslookup my-svc. nslookup and dig are standard DNS tools. curl can test HTTP but not DNS. ping tests connectivity but not DNS resolution directly.

Answer

kubectl run test --image=busybox --rm -it --restart=Never -- wget my-svc

Answer

kubectl run test --image=busybox --rm -it --restart=Never -- ping my-svc

Answer

kubectl run test --image=busybox --rm -it --restart=Never -- curl my-svc