CKAD Services and Networking Practice Test 10 — 15 Questions

Question 1

A Service of type NodePort is created with 'spec.ports[0].nodePort: 30080'. The cluster nodes have IPs 10.0.0.1, 10.0.0.2. Which command can be used to test connectivity to the Service from outside the cluster?

Accepted Answer

curl 10.0.0.1:30080. Option B is correct. NodePort Services are reachable on any node's IP at the nodePort port. 'curl 10.0.0.1:30080' will hit the Service.

Answer

curl 10.0.0.1:80 --header 'Host: service.namespace.svc.cluster.local'

Answer

curl 10.0.0.1:80

Answer

curl 10.96.0.1:30080

Question 2

A NetworkPolicy named 'deny-all' is applied in a namespace. Which YAML snippet correctly implements a default-deny-all ingress policy?

Accepted Answer

spec:
  podSelector: {}
  policyTypes:
  - Ingress. Option A is correct. A default-deny ingress policy has an empty podSelector (meaning all pods) and no ingress rules, blocking all incoming traffic.

Answer

spec:
  podSelector: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  ingress:
  - from: []

Answer

spec:
  podSelector:
    matchLabels: {}
  policyTypes:
  - Ingress

Question 3

You have a Service named 'app-service' in namespace 'default'. You want a pod in namespace 'monitoring' to resolve the service DNS name. What is the correct fully qualified domain name (FQDN)?

Accepted Answer

app-service.default.svc.cluster.local. Option A is correct. The standard DNS format for a Service is '..svc.cluster.local'.

Answer

app-service.default.cluster.local

Answer

app-service.svc.default.cluster.local

Answer

app-service.cluster.local.default.svc

Question 4

You have a headless Service for a StatefulSet. What is the DNS resolution behavior for the StatefulSet pods?

Accepted Answer

Each pod gets a DNS A record pointing to its individual IP.. Option A is correct. Headless Services (clusterIP: None) enable DNS to return pod IPs directly, allowing each pod to be reachable via its own DNS name (pod-name.service-name.namespace.svc.cluster.local).

Answer

DNS is disabled for headless Services.

Answer

The Service name resolves to the IP of the first pod only.

Answer

All pods share a single cluster IP via the Service.

Question 5

Which Service type is used to expose a Service externally using a cloud provider's load balancer?

Accepted Answer

LoadBalancer. Option B is correct. LoadBalancer Service provisions an external load balancer (if supported by the cloud provider) to expose the Service.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 6

An Ingress resource is configured with TLS. Which field in the Ingress YAML specifies the secret containing the TLS certificate and key?

Accepted Answer

spec.tls[].secretName. Option A is correct. The TLS configuration in an Ingress includes a 'secretName' field in the 'tls' array that references a secret in the same namespace.

Answer

metadata.annotations['tls-secret']

Answer

spec.tls[].secret

Answer

spec.secretName

Question 7

You need to allow ingress traffic to pods with label 'app: web' from pods with label 'role: frontend' in the same namespace, and also from any pod in namespace 'monitoring'. Which NetworkPolicy egress/ingress rule correctly implements this?

Accepted Answer

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
    - namespaceSelector:
        matchLabels:
          name: monitoring. Option A is correct. The ingress rule has two from entries: one for pods with label 'role: frontend' (namespaceSelector with empty namespaceSelector means current namespace) and another for all pods in namespace 'monitoring' (namespaceSelector with matchLabels).

Answer

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring
    - podSelector:
        matchLabels:
          role: frontend

Answer

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
      namespaceSelector:
        matchLabels:
          name: monitoring

Answer

spec:
  podSelector:
    matchLabels:
      app: web
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
  - from:
    - namespaceSelector:
        matchLabels:
          name: monitoring

Question 8

Which kubectl command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. Option B is correct. The format is 'kubectl port-forward

:'.

Answer

kubectl port-forward pod/web-pod 80:8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Answer

kubectl proxy pod/web-pod 8080:80

Question 9

You have a Service named 'api' with selectors that match pods. However, curl to the Service cluster IP times out. 'kubectl get endpoints api' shows no endpoints. What is the most likely cause?

Accepted Answer

The Service's selector does not match any pod labels.. Option B is correct. If endpoints are empty, the Service's selector does not match any pods, so no endpoints are created.

Answer

The Service is of type ExternalName.

Answer

The pods are not listening on the target port.

Answer

The Service is in a different namespace than the pods.

Question 10

An Ingress resource uses host-based routing. Which field in the Ingress YAML specifies the host header to match?

Accepted Answer

spec.rules[].host. Option A is correct. In an Ingress rule, the 'host' field under 'spec.rules[].host' specifies the fully qualified domain name to match.

Answer

metadata.annotations['nginx.ingress.kubernetes.io/rewrite-target']

Answer

spec.tls[].hosts

Answer

spec.rules[].http.paths[].host

Question 11

You have a Deployment with 3 replicas. You create a Service with 'clusterIP: None'. What is the effect on pod DNS?

Accepted Answer

DNS returns the IPs of all matching pods.. Option B is correct. A headless Service (clusterIP: None) causes DNS to return the IP addresses of all pods that match the selector, enabling DNS-based pod discovery.

Answer

Each pod gets its own DNS record in the form ...svc.cluster.local

Answer

The Service name does not resolve to any IP; DNS fails.

Answer

The Service name resolves to a single virtual IP that load balances across pods.

Question 12

Which TWO statements about Ingress are correct? (Select 2)

Accepted Answer

Ingress can terminate TLS.. Options A and D are correct. Ingress can provide host-based routing and TLS termination. Option B is false because Ingress is not for TCP/UDP. Option C is false because Ingress does not provide a default ClusterIP. Option E is false because Ingress does not directly assign external IPs.

Answer

Ingress provides a ClusterIP for internal access.

Answer

Ingress can load balance TCP traffic.

Answer

Ingress automatically assigns an external IP to the Service.

Question 13

Which THREE statements about NetworkPolicy are correct? (Select 3)

Accepted Answer

NetworkPolicy follows an allow-list model; if no policy matches, traffic is denied.. Options A, C, and E are correct. NetworkPolicy can allow traffic from specific namespaces, it can restrict egress, and it is an allow-list model (default deny, then allow). Option B is false because NetworkPolicy is namespace-scoped. Option D is false because NetworkPolicy cannot block traffic to external IPs directly; it can only control traffic to/from pods.

Answer

NetworkPolicy can block traffic to specific external IP addresses using ipBlock.

Answer

NetworkPolicy is a cluster-scoped resource.

Question 14

Which TWO Service types allow external access to pods from outside the Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. Options C and D are correct. NodePort and LoadBalancer Services expose the Service on node IPs or via a cloud load balancer, making them accessible externally.

Answer

Headless

Answer

ClusterIP

Answer

ExternalName

Question 15

You have a Deployment named 'web-app' with 3 replicas. You want to expose the pods on port 80 internally within the cluster using a ClusterIP service. Which kubectl command should you use?

Accepted Answer

kubectl expose deployment web-app --port=80 --target-port=8080. The 'kubectl expose' command with appropriate flags creates a ClusterIP service by default. Option B is the correct command.

Answer

kubectl create service clusterip web-app --tcp=80:8080

Answer

kubectl create service nodeport web-app --tcp=80:8080

Answer

kubectl expose pod web-app --port=80 --target-port=8080