CKAD Services and Networking Practice Test 11 — 15 Questions

Question 1

A developer wants to access a specific pod's port 8080 from their local machine using a temporary connection. Which command should they use?

Accepted Answer

kubectl port-forward pod/pod-name 8080:8080. `kubectl port-forward` creates a temporary, direct tunnel from a local port to a port on a specific pod, allowing the developer to access the pod's port 8080 from their local machine without exposing the pod via a service. This command forwards local port 8080 to the pod's port 8080, enabling debugging or testing with tools like curl or a browser.

Answer

kubectl exec -it pod-name -- sh

Answer

kubectl proxy

Answer

kubectl expose pod pod-name --port=8080

Question 2

A ClusterIP Service named 'db' in namespace 'data' is not reachable from a pod in namespace 'app'. Which DNS name should the pod use to resolve the service?

Accepted Answer

db.data.svc.cluster.local. A pod in namespace 'app' must use the fully qualified DNS name 'db.data.svc.cluster.local' to resolve a ClusterIP Service named 'db' in namespace 'data'. Kubernetes DNS appends the service's namespace before 'svc.cluster.local', so the format is ..svc.cluster.local. This allows cross-namespace service discovery.

Answer

data.db.svc.cluster.local

Answer

db.app.svc.cluster.local

Answer

db.svc.cluster.local

Question 3

You want to deny all incoming traffic to a set of pods except from pods with label 'role: frontend'. Which NetworkPolicy spec should you use?

Accepted Answer

spec: podSelector: matchLabels: app: myapp ingress: - from: - podSelector: matchLabels: role: frontend. It selects pods with label 'app: myapp' and defines an ingress rule that only allows traffic from pods with label 'role: frontend'. By default, NetworkPolicy denies all traffic not explicitly allowed, so this configuration ensures only frontend pods can reach the selected pods.

Answer

spec: podSelector: matchLabels: app: myapp ingress: - from: - namespaceSelector: matchLabels: role: frontend

Answer

spec: podSelector: matchLabels: app: myapp egress: - to: - podSelector: matchLabels: role: frontend

Answer

spec: podSelector: {} ingress: - from: - podSelector: matchLabels: role: frontend

Question 4

A StatefulSet is deployed with a headless service (clusterIP: None). The pods are named 'web-0', 'web-1', 'web-2'. What DNS name resolves to the specific IP of 'web-1'?

Accepted Answer

web-1.web.default.svc.cluster.local. A is correct because in a StatefulSet with a headless service (clusterIP: None), each pod gets a unique DNS name following the pattern `...svc.cluster.local`. For pod 'web-1' in the default namespace, this resolves to the pod's specific IP address via a DNS A record, not a service VIP.

Answer

web-1.default.svc.cluster.local

Answer

web-0.web.default.svc.cluster.local

Answer

web.web-1.default.svc.cluster.local

Question 5

You create a Service with the following manifest. What is the effect? service.yaml: apiVersion: v1 kind: Service metadata: name: ext-svc spec: type: ExternalName externalName: db.example.com

Accepted Answer

The service is a CNAME alias for db.example.com. A Service of type `ExternalName` creates a DNS CNAME record in the cluster's DNS (e.g., CoreDNS) that maps the Service name `ext-svc` to the external DNS name `db.example.com`. When a Pod resolves `ext-svc`, it receives the canonical name `db.example.com` directly, with no proxy, ClusterIP, or pod selection involved.

Answer

The service gets a ClusterIP and forwards to db.example.com

Answer

The service creates a load balancer pointing to db.example.com

Answer

The service selects pods with label app: ext

Question 6

A NetworkPolicy with the following spec is applied to a namespace. What is the effect? spec: podSelector: {} policyTypes: - Ingress - Egress ingress: - from: - ipBlock: cidr: 10.0.0.0/8 except: - 10.0.1.0/24 egress: - to: - ipBlock: cidr: 0.0.0.0/0

Accepted Answer

Deny all ingress traffic except from 10.0.0.0/8 excluding 10.0.1.0/24; allow all egress. The NetworkPolicy selects all pods in the namespace (empty podSelector matches all pods) and explicitly defines both Ingress and Egress policy types. The ingress rule allows traffic only from the 10.0.0.0/8 range, except 10.0.1.0/24, effectively denying all other ingress. The egress rule allows all outbound traffic to 0.0.0.0/0, so egress is unrestricted.

Answer

Deny all ingress and egress traffic

Answer

Allow all ingress and egress traffic

Answer

Allow ingress from 10.0.1.0/24 only

Question 7

An Ingress is configured for host-based routing with two hosts: 'app1.example.com' and 'app2.example.com'. A request to 'app1.example.com' should go to service 'svc1'. Which field in the Ingress spec specifies the host?

Accepted Answer

spec.rules.host. In Kubernetes Ingress, host-based routing is configured by specifying the `host` field directly under `spec.rules`. Each rule can define a `host` (e.g., `app1.example.com`) and the corresponding backend service. Option D correctly identifies `spec.rules.host` as the field that specifies the host for routing traffic to the appropriate service.

Answer

spec.rules.http.paths.host

Answer

spec.rules.http.host

Answer

spec.tls.hosts

Question 8

Which TWO statements about headless services are correct?

Accepted Answer

DNS returns the pod IPs directly. Headless services are created by setting `clusterIP: None` in the service spec. When a DNS lookup is performed for a headless service, the DNS server returns the IP addresses of the matching pods directly, rather than a single virtual ClusterIP. This is because there is no ClusterIP to load-balance traffic, so DNS returns all pod IPs (A/AAAA records) for the service name, enabling direct pod-to-pod communication.

Answer

They require a selector to match pods

Answer

They provide load balancing across pods

Answer

They have a ClusterIP assigned

Question 9

Which THREE conditions must be met for a NetworkPolicy to effectively isolate a set of pods?

Accepted Answer

The NetworkPolicy must have a non-empty podSelector that matches the target pods. A NetworkPolicy uses a podSelector field to identify which pods the policy applies to. If the podSelector is empty, the policy applies to all pods in the namespace, but to isolate a specific set of pods, you must provide a non-empty selector that matches their labels. This ensures that only those pods are subject to the policy's rules.

Answer

The namespace must have a default deny-all NetworkPolicy

Answer

The pods must have the label 'networking/allow-external'

Question 10

Which THREE commands can be used to list the endpoints of a Service named 'my-svc'?

Accepted Answer

kubectl describe svc my-svc. `kubectl describe svc my-svc` displays detailed information about the service, including the list of endpoints (IP:Port pairs) that the service routes traffic to. Options D and E are also correct because `kubectl get ep my-svc` and `kubectl get endpoints my-svc` are equivalent commands that directly list the Endpoints resource associated with the service. All three commands provide the endpoint information.

Answer

kubectl get networkpolicy

Answer

kubectl get pods -l app=my-svc

Question 11

Which TWO are valid port names in a Service definition?

Accepted Answer

grpc. In Kubernetes Service definitions, port names must follow RFC 1035 label syntax: they must consist of lowercase alphanumeric characters or hyphens, start with an alphabetic character, and end with an alphanumeric character. 'grpc' and 'http' are valid because they are lowercase alphabetic strings, commonly used for protocol identification and required for named ports in Istio or other service mesh configurations.

Answer

my_port

Answer

Port-1

Answer

123

Question 12

A developer needs to expose a deployment named 'web-app' running in the 'default' namespace on port 8080 internally within the cluster. Which kubectl command creates a ClusterIP service that selects pods with label 'app: web'?

Accepted Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --selector=app=web. `kubectl expose deployment web-app --port=8080 --target-port=8080 --selector=app=web` creates a ClusterIP service by default (no `--type` flag defaults to ClusterIP), and the `--selector` flag explicitly sets the label selector to `app=web`, ensuring the service routes traffic to pods with that label. The `--port` flag defines the service port, and `--target-port` defines the container port (8080), matching the requirement for internal cluster exposure.

Answer

kubectl expose deployment web-app --port=8080 --target-port=8080 --type=ClusterIP

Answer

kubectl run web-app --image=nginx --port=8080 --expose

Answer

kubectl create service clusterip web-app --tcp=8080:8080 --selector=app=web

Question 13

An administrator applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

After applying this policy, which traffic flows are affected?

Accepted Answer

Both inbound and outbound traffic for all pods in the namespace is denied. The NetworkPolicy has an empty `podSelector: {}` which selects all pods in the namespace, and it specifies both `Ingress` and `Egress` in `policyTypes`. By default, if no rules are defined under `ingress` or `egress` (as in this case), Kubernetes denies all traffic of that type. Thus, both inbound and outbound traffic for all pods in the namespace is denied.

Answer

Only inbound traffic to pods is denied

Answer

Only outbound traffic from pods is denied

Answer

Traffic to and from the kube-system namespace is also denied

Question 14

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

NodePort services expose the service on a static port on each node's IP. A NodePort service exposes the application on a static port (in the range 30000-32767) on every node's IP address. This allows external traffic to reach the service by targeting any cluster node's IP on that specific port, making it accessible from outside the cluster without requiring a cloud provider.

Answer

Headless services (clusterIP: None) are used for load balancing

Answer

LoadBalancer services always create an external load balancer even without a cloud provider

Answer

ExternalName services can be used to expose a service without selectors

Question 15

Which TWO items are required for Ingress to work correctly in a Kubernetes cluster?

Accepted Answer

At least one rule specifying either host or path. For Ingress to work correctly, the cluster must have a running Ingress controller to process Ingress resources. At least one rule specifying a host or path is required to define routing logic. A TLS secret is optional for HTTPS termination, not mandatory. Without these two components, the Ingress will not route traffic.

Answer

A TLS secret for HTTPS termination

Answer

A LoadBalancer service for the backend

Answer

A default backend service