CKAD Services and Networking Practice Test 12 — 15 Questions

Question 1

Which TWO Service types allow external access to pods from outside the Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. NodePort is correct because it exposes a service on a static port on each node's IP address, allowing external traffic to reach the service by targeting any node's IP and that port. This works by opening a high-range port (30000-32767) on all nodes, which forwards traffic to the ClusterIP service and then to the pods.

Answer

Headless

Answer

ClusterIP

Answer

ExternalName

Question 2

You have a Deployment named 'web-app' with 3 replicas. You want to expose the pods on port 80 internally within the cluster using a ClusterIP service. Which kubectl command should you use?

Accepted Answer

kubectl expose deployment web-app --port=80 --target-port=8080. `kubectl expose deployment web-app --port=80 --target-port=8080` creates a ClusterIP Service that maps port 80 on the Service to port 8080 on the Pods, allowing internal cluster traffic to reach the application. The `--port` flag defines the Service's listening port, while `--target-port` specifies the container port the traffic is forwarded to, which is essential when the container listens on a different port than the Service exposes.

Answer

kubectl create service clusterip web-app --tcp=80:8080

Answer

kubectl create service nodeport web-app --tcp=80:8080

Answer

kubectl expose pod web-app --port=80 --target-port=8080

Question 3

You have a headless Service for a StatefulSet. The DNS query for the service returns no A records. What is the most likely cause?

Accepted Answer

The Service selector does not match any pod labels. A headless Service (clusterIP: None) relies on DNS A records to return the IP addresses of the Pods selected by its selector. If the selector does not match any Pod labels, the Service has no endpoints, and the DNS lookup returns no A records. This is the most common cause for a headless Service returning empty DNS results.

Answer

The Service has clusterIP set to an IP address

Answer

The Service is of type ExternalName

Answer

The StatefulSet is using a volumeClaimTemplate

Question 4

You apply the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

After applying, pods in the namespace cannot reach the kube-dns service. What is the most likely reason?

Accepted Answer

The policy blocks all egress traffic, including DNS. The NetworkPolicy explicitly includes `Egress` in `policyTypes` and uses an empty `podSelector: {}`, which selects all pods in the namespace. With no `egress` rules defined, the default behavior is to deny all egress traffic. DNS resolution for kube-dns typically uses UDP/TCP on port 53, and since all egress traffic is blocked, pods cannot reach the kube-dns service, causing DNS failures.

Answer

The policy does not have a namespaceSelector

Answer

The policy blocks all ingress traffic only

Answer

The kube-dns service is not running

Question 5

You have an Ingress resource with TLS configured. The certificate is stored in a Secret named 'my-tls'. Which field in the Ingress YAML specifies the Secret name?

Accepted Answer

.spec.tls[0].secretName. In Kubernetes Ingress resources, the TLS configuration is defined under `.spec.tls`, which is an array of TLS objects. Each object contains a `hosts` field and a `secretName` field that references the Kubernetes Secret holding the TLS certificate and private key. Option A correctly identifies `.spec.tls[0].secretName` as the field that specifies the Secret name.

Answer

.spec.tls[0].secret

Answer

.metadata.annotations['cert-manager.io/cluster-issuer']

Answer

.spec.tlsSecretName

Question 6

You need to forward a local port to port 8080 on a pod named 'my-pod' in the 'default' namespace. Which kubectl command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. The `kubectl port-forward` command requires the resource type (pod/) and the correct port mapping syntax. The question specifies forwarding a local port to port 8080 on the pod, so the local port is 8080 and the pod port is 8080, making `8080:8080` the correct mapping. The full command `kubectl port-forward pod/my-pod 8080:8080` establishes a tunnel from localhost:8080 to the pod's port 8080.

Answer

kubectl port-forward pod/my-pod 8080:80

Answer

kubectl forward pod/my-pod 8080:8080

Answer

kubectl port-forward my-pod 8080

Question 7

You have a Service named 'my-svc' in the 'prod' namespace. What is the fully qualified DNS name for this Service?

Accepted Answer

my-svc.prod.svc.cluster.local. The fully qualified DNS name for a Service in Kubernetes follows the pattern `..svc.cluster.local`. For 'my-svc' in the 'prod' namespace, this resolves to 'my-svc.prod.svc.cluster.local'. This is the standard DNS naming convention used by CoreDNS (or kube-dns) for Service discovery within a cluster.

Answer

my-svc.svc.cluster.local

Answer

prod.my-svc.svc.cluster.local

Answer

my-svc.prod.cluster.local

Question 8

You want to block all ingress traffic to pods labeled 'app=api' except from pods labeled 'app=frontend'. Which NetworkPolicy rule is correct?

Accepted Answer

ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend. A NetworkPolicy with an ingress rule using a podSelector with matchLabels: app: frontend allows traffic only from pods that have that label. By default, when no NetworkPolicy selects the pods, all ingress traffic is allowed; once a policy selects them, only explicitly allowed traffic is permitted. This rule therefore blocks all ingress except from pods labeled app=frontend.

Answer

ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          app: frontend

Answer

ingress:
  - ports:
    - port: 80

Answer

ingress:
  - from:
    - ipBlock:
        cidr: 10.0.0.0/8

Question 9

Which Service type exposes a Service externally via each Node's IP on a static port?

Accepted Answer

NodePort. A NodePort Service exposes the Service on each Node's IP address at a static port (in the range 30000-32767 by default). This allows external traffic to reach the Service by sending requests to any Node's IP and the specified NodePort, which then forwards traffic to the corresponding ClusterIP Service and ultimately to the Pods.

Answer

ClusterIP

Answer

LoadBalancer

Answer

ExternalName

Question 10

You have a Service that exposes a Deployment. Some pods are not receiving traffic. 'kubectl get endpoints my-service' shows only 2 out of 3 pod IPs. What is the most likely cause?

Accepted Answer

One pod is not ready (readiness probe failing). The most likely cause is that one pod is not ready because its readiness probe is failing. Services only forward traffic to pods that are in the Ready state, as reflected in the Endpoints object. If a pod fails its readiness probe, it is removed from the list of endpoints, even if it is running and has the correct labels.

Answer

The Deployment has a wrong targetPort

Answer

The Service type is NodePort

Answer

One pod has a different label than the Service selector

Question 11

You want to expose a Deployment named 'nginx' on port 80 using a LoadBalancer service. Which YAML snippet is correct?

Accepted Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: nginx. It defines a Service of type LoadBalancer, exposing the 'nginx' Deployment on port 80. The apiVersion v1 is appropriate for a Service, and the selector matches the Deployment's labels. Option B includes an unnecessary explicit targetPort: 80, making it less preferred for the CKAD exam, which expects the most concise correct YAML. Option A uses NodePort instead of LoadBalancer, and Option D uses an incorrect apiVersion.

Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: NodePort
  ports:
  - port: 80
  selector:
    app: nginx

Answer

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  targetPort: 80
  selector:
    app: nginx

Answer

apiVersion: apps/v1
kind: Service
metadata:
  name: nginx-svc
spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: nginx

Question 12

You have an Ingress that should route requests to 'api.example.com' to a service named 'api-svc' on port 80, and requests to 'www.example.com' to 'web-svc' on port 80. Which host-based routing rule is correct?

Accepted Answer

spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - backend:
          service:
            name: api-svc
            port:
              number: 80
  - host: www.example.com
    http:
      paths:
      - backend:
          service:
            name: web-svc
            port:
              number: 80. It follows the Kubernetes Ingress v1 API specification: each rule in `spec.rules` is an object with a `host` field and an `http` field, and within `http`, a `paths` array containing backend references. This structure correctly routes requests for `api.example.com` to `api-svc:80` and `www.example.com` to `web-svc:80`.

Answer

spec:
  rules:
  - http:
      paths:
      - host: api.example.com
        backend:
          service:
            name: api-svc
            port:
              number: 80
      - host: www.example.com
        backend:
          service:
            name: web-svc
            port:
              number: 80

Answer

spec:
  rules:
  - host: api.example.com
    - backend:
        service:
          name: api-svc
          port:
            number: 80
  - host: www.example.com
    - backend:
        service:
          name: web-svc
          port:
            number: 80

Answer

spec:
  rules:
  - host: api.example.com
    http:
      paths:
      - backend:
          serviceName: api-svc
          servicePort: 80
  - host: www.example.com
    http:
      paths:
      - backend:
          serviceName: web-svc
          servicePort: 80

Question 13

You have a Service named 'myservice' in namespace 'default'. A pod in the same cluster but different namespace 'other' wants to resolve the service's IP. What DNS name should it use?

Accepted Answer

myservice.default.svc.cluster.local. Kubernetes DNS resolves services using the format `..svc.cluster.local`. Since the service 'myservice' is in the 'default' namespace, a pod in the 'other' namespace must include the namespace in the DNS name to reach it. This fully qualified domain name (FQDN) ensures the DNS query resolves to the service's cluster IP, regardless of the pod's namespace.

Answer

default.myservice.svc.cluster.local

Answer

myservice.svc.cluster.local

Answer

myservice.other.svc.cluster.local

Question 14

Which THREE of the following are true about NetworkPolicy? (Select 3)

Accepted Answer

Multiple NetworkPolicies are additive. Kubernetes NetworkPolicy rules are additive: if multiple policies select the same pod, the effective network rules are the union of all rules from all policies. This means that if any policy allows ingress or egress traffic on a given port/protocol, that traffic is permitted, even if another policy does not explicitly allow it. This additive behavior is defined in the Kubernetes networking specification and is critical for correctly combining policies from different teams or layers.

Answer

NetworkPolicy can control traffic to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 15

Which of the following commands creates a ClusterIP service named 'my-service' that exposes port 80 on the pod with label 'app=web'?

Accepted Answer

kubectl expose deployment my-deployment --port=80 --name=my-service. `kubectl expose deployment my-deployment --port=80 --name=my-service` creates a ClusterIP service by default, which selects pods based on the labels of the deployment (e.g., `app=web` if the deployment has that label). The `--port=80` flag sets the service port, and the service automatically maps to the container port (defaults to the same port if `--target-port` is omitted). This command satisfies the requirement of exposing port 80 on pods with label `app=web`.

Answer

kubectl expose pod my-pod --port=80 --target-port=8080 --name=my-service

Answer

kubectl create service clusterip my-service --tcp=80:8080 --cluster-ip=10.0.0.1

Answer

kubectl expose deployment my-deployment --type=NodePort --port=80 --name=my-service