CKAD Services and Networking Practice Test 10 — 15 Questions

Question 1

Which THREE of the following are true about NetworkPolicy? (Select 3)

Accepted Answer

Multiple NetworkPolicies are additive. Kubernetes NetworkPolicy rules are additive: if multiple policies select the same pod, the effective network rules are the union of all rules from all policies. This means that if any policy allows ingress or egress traffic on a given port/protocol, that traffic is permitted, even if another policy does not explicitly allow it. This additive behavior is defined in the Kubernetes networking specification and is critical for correctly combining policies from different teams or layers.

Answer

NetworkPolicy can control traffic to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 2

You create a headless service with 'clusterIP: None' for a StatefulSet. How does a client discover the individual pod IPs?

Accepted Answer

DNS returns multiple A records for the service name, each pointing to a pod IP. A is correct because a headless service (clusterIP: None) does not provide a virtual IP or load balancing. Instead, DNS is configured to return multiple A records directly for the service name, each pointing to the IP address of a pod in the StatefulSet. This allows clients to discover and connect to individual pod IPs, which is essential for stateful applications where each pod has a unique identity.

Answer

The service returns the pod's hostname from the StatefulSet

Answer

An Ingress controller must be configured to expose each pod

Answer

The service provides a virtual IP that load balances among pods

Question 3

Which annotation is used to specify the IngressClass for an Ingress resource in Kubernetes v1.18+?

Accepted Answer

kubernetes.io/ingress.class. In Kubernetes v1.18+, the `kubernetes.io/ingress.class` annotation is the standard way to specify which Ingress controller should process an Ingress resource. This annotation tells the cluster which IngressClass (e.g., 'nginx', 'traefik') to use, enabling multiple controllers to coexist without conflict. It was the primary method before the `spec.ingressClassName` field was introduced in v1.18 and remains widely used for backward compatibility.

Answer

nginx.ingress.kubernetes.io/rewrite-target

Answer

ingress.kubernetes.io/class

Answer

kubernetes.io/ingress-controller

Question 4

What is the default type of a Kubernetes Service when no type is specified in the YAML manifest?

Accepted Answer

ClusterIP. When no `type` field is specified in a Kubernetes Service YAML manifest, the default type is `ClusterIP`. This is defined in the Kubernetes API specification: the `spec.type` field defaults to `ClusterIP` if omitted. A ClusterIP service exposes the service on a cluster-internal IP address, making it only reachable from within the cluster, which is the fundamental behavior for internal service discovery.

Answer

NodePort

Answer

LoadBalancer

Answer

ExternalName

Question 5

You have an Ingress with the following spec:

spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

How does the Ingress controller route a request to http://app.example.com/api/v1/users?

Accepted Answer

It matches but the host is app.example.com, so it goes to api-service. The Ingress rule specifies host app.example.com and a path prefix of /api, so the request to http://app.example.com/api/v1/users matches both the host and the prefix (since /api/v1/users starts with /api). Therefore, the Ingress controller routes the request to api-service on port 80. Option D is also correct as it describes the matching logic: the path /api/v1/users begins with /api, satisfying the Prefix pathType. Options A and C are incorrect: pathType Prefix does not require a trailing slash and does not require an exact match.

Answer

The request is rejected because pathType Prefix requires trailing /

Answer

It does not match because the path is exactly /api

Question 6

A NetworkPolicy named 'default-deny-all' is applied to a namespace. It has no rules. Which statement is true?

Accepted Answer

All ingress and egress traffic is denied for pods matching the selector. A NetworkPolicy with no rules (empty spec) and a pod selector that matches all pods (e.g., `{}`) defaults to denying all ingress and egress traffic. This is because Kubernetes NetworkPolicy rules are additive: if no ingress or egress rules are defined, the policy implicitly denies all traffic of that type. The `default-deny-all` pattern is a common security baseline to enforce zero-trust networking.

Answer

Only ingress traffic is denied; egress is allowed by default

Answer

Only traffic from pods in the same namespace is allowed

Answer

Traffic is allowed because no rules are defined

Question 7

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` requires the resource type and name, and for a pod, the syntax is `pod/<pod-name>`. The command `kubectl port-forward pod/web-pod 8080:80` forwards local port 8080 to port 80 of the pod, matching the question's requirement exactly.

Answer

kubectl port-forward service/web-service 8080:80

Answer

kubectl port-forward deployment/web-deployment 8080:80

Answer

kubectl port-forward pod/web-pod 80:8080

Question 8

What is the purpose of the 'spec.externalName' field in a Service of type ExternalName?

Accepted Answer

To return a CNAME record pointing to an external domain. The 'spec.externalName' field in a Service of type ExternalName is used to map the service to a DNS name (e.g., 'api.example.com') rather than to a set of pods. When a client resolves the service's DNS name, Kubernetes returns a CNAME record pointing to the external domain, effectively aliasing the service to an external endpoint. This allows internal applications to access external services using a local Kubernetes service name without needing to manage endpoints manually.

Answer

To expose the service on a static port on each node

Answer

To expose the service using an external load balancer

Answer

To assign a static cluster IP

Question 9

You have a Deployment with pods labeled 'tier: frontend'. You create a Service with selector 'tier: frontend'. However, the Service has no endpoints. What is the MOST likely cause?

Accepted Answer

The pod labels do not match the service selector. The most likely cause is that the pod labels do not match the service selector. A Service uses its `selector` field to identify which Pods to target based on label key-value pairs. If the Pods have labels like `tier: frontend` but the Service's selector is misspelled or uses a different key (e.g., `tier: front-end`), the Service will not discover any Pods, resulting in zero endpoints. This is a common misconfiguration where label matching is case-sensitive and must be exact.

Answer

The service has multiple ports defined

Answer

The service port does not match the container port

Answer

The service and pods are in different namespaces

Question 10

An Ingress resource specifies TLS termination using a secret. The secret must contain which keys?

Accepted Answer

tls.crt and tls.key. Kubernetes Ingress resources require TLS termination secrets to contain exactly two keys: `tls.crt` (the TLS certificate) and `tls.key` (the private key). The Ingress controller reads these specific key names from the Secret's `data` or `stringData` field to configure HTTPS termination, as defined by the Kubernetes API specification.

Answer

username and password

Answer

cert.pem and key.pem

Answer

ca.crt and tls.crt

Question 11

When using 'kubectl expose', which flag creates a NodePort service?

Accepted Answer

--type=NodePort. The `--type=NodePort` flag explicitly sets the service type to NodePort when using `kubectl expose`. This creates a service that exposes the application on a static port (30000-32767) on each cluster node, making it accessible externally via `:`. Without this flag, the default service type is ClusterIP, which is only reachable within the cluster.

Answer

--node-port

Answer

--type=ClusterIP

Answer

--port

Question 12

Which THREE of the following are valid Ingress pathTypes in Kubernetes networking.k8s.io/v1?

Accepted Answer

Prefix. In Kubernetes networking.k8s.io/v1, the valid Ingress pathTypes are `Prefix`, `Exact`, and `ImplementationSpecific`. `Prefix` matches URL paths based on a prefix (e.g., `/api` matches `/api/v1`), `Exact` matches the path exactly (e.g., `/api` only matches `/api`), and `ImplementationSpecific` allows the ingress controller to define its own path matching logic. All three are defined in the v1 API.

Answer

Wildcard

Answer

Suffix

Question 13

Which THREE of the following are valid fields in a NetworkPolicy spec?

Accepted Answer

podSelector. `podSelector` is a required field in a NetworkPolicy spec that defines which pods the policy applies to, using standard Kubernetes label selectors. It must be present to target specific pods within a namespace, and if set to an empty selector (e.g., `{}`), it selects all pods in the namespace. The CKAD exam often tests the distinction between top-level spec fields and nested rule fields, so candidates mistakenly select `namespaceSelector` or `ipBlock` as valid spec fields when they are only valid within `ingress` or `egress` rules.

Answer

namespaceSelector

Answer

ipBlock

Question 14

Which TWO of the following are correct statements about DNS in Kubernetes?

Accepted Answer

Pod DNS records are created by default with format pod-ip.namespace.pod.cluster.local. Kubernetes automatically creates DNS records for Pods using the default Cluster Domain (cluster.local). The record format is ..pod.cluster.local, which resolves to the Pod's IP address. This is enabled by default via the kubelet's `--cluster-domain` flag and the CoreDNS Pod DNS configuration.

Answer

DNS resolution works only for ClusterIP services

Answer

Headless services return a single A record for the service IP

Answer

A service's fully qualified domain name is service.namespace.cluster.local

Question 15

You have a Deployment running three replicas of a web application. You need to expose the application on port 80 of all cluster nodes. Which Service type should you use?

Accepted Answer

NodePort. The explanation correctly describes NodePort as using a static port in the 30000-32767 range, but the stem specifically requires port 80. There is no Service type among the options that exposes on port 80 of all cluster nodes. LoadBalancer exposes on port 80 but only on a cloud load balancer, not on each node. The question needs rewording.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP