CKAD Services and Networking Practice Test 12 — 15 Questions

Question 1

A ClusterIP service named 'db-service' in namespace 'data' is not reachable from a pod in the same namespace. The pod's /etc/resolv.conf shows 'search data.svc.cluster.local svc.cluster.local cluster.local'. Using the pod, which command tests DNS resolution for the service?

Accepted Answer

nslookup db-service.data.svc.cluster.local. Option C is correct. The full DNS name for a service is 'service.namespace.svc.cluster.local'. Using 'nslookup db-service.data.svc.cluster.local' will test resolution. In-cluster DNS resolves short names within the same namespace, so 'db-service' should work, but the question asks for a command that tests DNS resolution. Option C explicitly uses the full name.

Answer

dig db-service.data.svc.cluster.local

Answer

ping db-service

Answer

curl http://db-service:3306

Question 2

You create a headless service with 'clusterIP: None' for a StatefulSet. How does a client discover the individual pod IPs?

Accepted Answer

DNS returns multiple A records for the service name, each pointing to a pod IP. Option A is correct. For a headless service, DNS returns A/AAAA records for all pods that match the selector. Clients can then connect directly to any pod IP. Option B describes a regular ClusterIP service. Option C is about Ingress. Option D is about ExternalName.

Answer

The service returns the pod's hostname from the StatefulSet

Answer

An Ingress controller must be configured to expose each pod

Answer

The service provides a virtual IP that load balances among pods

Question 3

Which annotation is used to specify the IngressClass for an Ingress resource in Kubernetes v1.18+?

Accepted Answer

kubernetes.io/ingress.class. Option B is correct. The 'kubernetes.io/ingress.class' annotation was deprecated in v1.18 in favor of the 'spec.ingressClassName' field, but the annotation still works. Option A is for a different annotation. Option C is for ingress controller. Option D is for custom annotation.

Answer

nginx.ingress.kubernetes.io/rewrite-target

Answer

ingress.kubernetes.io/class

Answer

kubernetes.io/ingress-controller

Question 4

What is the default type of a Kubernetes Service when no type is specified in the YAML manifest?

Accepted Answer

ClusterIP. Option B is correct. The default service type is ClusterIP. If you omit 'spec.type', Kubernetes assumes ClusterIP.

Answer

NodePort

Answer

LoadBalancer

Answer

ExternalName

Question 5

You have an Ingress with the following spec:

spec:
  rules:
  - host: app.example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

How does the Ingress controller route a request to http://app.example.com/api/v1/users?

Accepted Answer

It matches because /api/v1/users begins with /api. Option B is correct. With pathType: Prefix, the path /api matches any path that starts with /api. So /api/v1/users matches. Option A would be for Exact pathType. Option C is incorrect because the host matches. Option D is irrelevant.

Answer

The request is rejected because pathType Prefix requires trailing /

Answer

It matches but the host is app.example.com, so it goes to api-service

Answer

It does not match because the path is exactly /api

Question 6

A NetworkPolicy named 'default-deny-all' is applied to a namespace. It has no rules. Which statement is true?

Accepted Answer

All ingress and egress traffic is denied for pods matching the selector. Option D is correct. A NetworkPolicy with no rules (empty spec) effectively denies all ingress and egress traffic to pods selected by the policy (if podSelector is empty, it applies to all pods in the namespace). Option A is wrong because egress is also denied. Option B is wrong because empty rules deny all. Option C is wrong because no traffic is allowed.

Answer

Only ingress traffic is denied; egress is allowed by default

Answer

Only traffic from pods in the same namespace is allowed

Answer

Traffic is allowed because no rules are defined

Question 7

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. Option C is correct. 'kubectl port-forward pod/web-pod 8080:80' forwards local port 8080 to pod port 80. Option A incorrectly places local port after colon. Option B uses deployment. Option D uses service, not pod.

Answer

kubectl port-forward service/web-service 8080:80

Answer

kubectl port-forward deployment/web-deployment 8080:80

Answer

kubectl port-forward pod/web-pod 80:8080

Question 8

What is the purpose of the 'spec.externalName' field in a Service of type ExternalName?

Accepted Answer

To return a CNAME record pointing to an external domain. Option A is correct. ExternalName service maps a service name to an external DNS name, returning a CNAME record. Option B is for LoadBalancer. Option C for ClusterIP. Option D for NodePort.

Answer

To expose the service on a static port on each node

Answer

To expose the service using an external load balancer

Answer

To assign a static cluster IP

Question 9

You have a Deployment with pods labeled 'tier: frontend'. You create a Service with selector 'tier: frontend'. However, the Service has no endpoints. What is the MOST likely cause?

Accepted Answer

The pod labels do not match the service selector. Option C is correct. If a service selector does not match any pod labels, the service will have no endpoints. Option A (wrong port) would still show endpoints if pods match. Option B (multiple ports) is not a problem. Option D (namespace) would be an issue if different, but the question implies same namespace.

Answer

The service has multiple ports defined

Answer

The service port does not match the container port

Answer

The service and pods are in different namespaces

Question 10

An Ingress resource specifies TLS termination using a secret. The secret must contain which keys?

Accepted Answer

tls.crt and tls.key. Option C is correct. TLS secrets in Kubernetes must contain 'tls.crt' and 'tls.key' data keys. Option A is for a different purpose. Option B is for authentication. Option D is for custom.

Answer

username and password

Answer

cert.pem and key.pem

Answer

ca.crt and tls.crt

Question 11

When using 'kubectl expose', which flag creates a NodePort service?

Accepted Answer

--type=NodePort. Option B is correct. '--type=NodePort' creates a NodePort service. Option A is default. Option C is not a valid flag. Option D is not a flag.

Answer

--node-port

Answer

--type=ClusterIP

Answer

--port

Question 12

Which TWO of the following are valid Ingress pathTypes in Kubernetes networking.k8s.io/v1?

Accepted Answer

Prefix. Options B and C are correct. The valid pathTypes are 'Prefix' (matches based on URL path prefix) and 'Exact' (matches exact URL path). Option A is misspelled. Option D is not valid. Option E is not valid.

Answer

Wildcard

Answer

Suffix

Answer

ImplementationSpecific

Question 13

Which THREE of the following are valid fields in a NetworkPolicy spec?

Accepted Answer

podSelector. Options B, C, and E are correct. A NetworkPolicy spec includes 'podSelector', 'policyTypes', 'ingress', and 'egress'. Option A 'namespaceSelector' is a field within ingress/egress rules, not directly in spec. Option D 'ipBlock' is within ingress/egress rules. So B, C, E are top-level fields.

Answer

namespaceSelector

Answer

ipBlock

Question 14

Which TWO of the following are correct statements about DNS in Kubernetes?

Accepted Answer

Pod DNS records are created by default with format pod-ip.namespace.pod.cluster.local. Options B and D are correct. Service DNS format is 'service.namespace.svc.cluster.local' (B). Pod DNS by default is 'pod-ip-address.namespace.pod.cluster.local' (D). Option A is missing 'svc'. Option C is wrong because headless services return multiple A records. Option E is wrong because service DNS is not limited to ClusterIP type.

Answer

DNS resolution works only for ClusterIP services

Answer

Headless services return a single A record for the service IP

Answer

A service's fully qualified domain name is service.namespace.cluster.local

Question 15

You have a Deployment running three replicas of a web application. You need to expose the application on port 80 of all cluster nodes. Which Service type should you use?

Accepted Answer

NodePort. NodePort exposes a service on a static port on each node's IP address, making the service accessible from outside the cluster via nodeIP:nodePort.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP