CKAD Services and Networking Practice Test 3 — 15 Questions

Question 1

You have a Deployment with pods labeled 'tier: frontend'. You create a Service with selector 'tier: frontend'. However, the Service has no endpoints. What is the MOST likely cause?

Accepted Answer

The pod labels do not match the service selector. The most likely cause is that the pod labels do not match the service selector. A Service uses its `selector` field to identify which Pods to target based on label key-value pairs. If the Pods have labels like `tier: frontend` but the Service's selector is misspelled or uses a different key (e.g., `tier: front-end`), the Service will not discover any Pods, resulting in zero endpoints. This is a common misconfiguration where label matching is case-sensitive and must be exact.

Answer

The service has multiple ports defined

Answer

The service port does not match the container port

Answer

The service and pods are in different namespaces

Question 2

Which TWO of the following are correct statements about DNS in Kubernetes?

Accepted Answer

Pod DNS records are created by default with format pod-ip.namespace.pod.cluster.local. Option A is correct because Kubernetes DNS (CoreDNS) creates a default A record for each Pod in the form pod-ip.namespace.pod.cluster.local, where the pod IP is dash-encoded (e.g., 10-244-1-5.default.pod.cluster.local). Option C is correct because a normal Service gets an FQDN of the form service.namespace.svc.cluster.local, where svc is the subdomain identifying the Service record within the cluster domain. Option B is wrong because DNS resolution also works for headless services, NodePort, LoadBalancer, and ExternalName services, not only ClusterIP. Option D is wrong because a headless service (clusterIP: None) returns multiple A records pointing directly to the backing Pod IPs, not a single A record for a service IP. Option E is wrong because it omits the svc segment; the correct FQDN is service.namespace.svc.cluster.local.

Answer

DNS resolution works only for ClusterIP services

Answer

Headless services return a single A record for the service IP

Answer

A service's fully qualified domain name is service.namespace.cluster.local

Question 3

You have a Deployment running three replicas of a web application. You need to expose the application on port 80 of all cluster nodes. Which Service type should you use?

Accepted Answer

NodePort. The explanation correctly describes NodePort as using a static port in the 30000-32767 range, but the stem specifically requires port 80. There is no Service type among the options that exposes on port 80 of all cluster nodes. LoadBalancer exposes on port 80 but only on a cloud load balancer, not on each node. The question needs rewording.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP

Question 4

A Service of type LoadBalancer is created but the external IP remains pending. What is the most likely reason?

Accepted Answer

The cluster does not have a load balancer controller. A Service of type LoadBalancer in Kubernetes requires an external load balancer controller (e.g., cloud-controller-manager for AWS, Azure, GCP, or MetalLB for on-premises) to provision and assign the external IP. If no such controller is running in the cluster, the external IP remains in 'pending' state indefinitely because Kubernetes itself does not implement load balancer logic. This is the most common reason for a stuck pending external IP.

Answer

The service selector does not match any pods

Answer

The service port is already in use

Answer

The namespace has a NetworkPolicy blocking traffic

Question 5

Which THREE conditions must be met for a NetworkPolicy to effectively isolate a set of pods?

Accepted Answer

The NetworkPolicy must have a non-empty podSelector that matches the target pods. Option A is correct because a NetworkPolicy only applies to pods that its podSelector matches, so a non-empty podSelector is required to target the specific set of pods being isolated. Option D is correct because including 'policyTypes: - Ingress' makes the policy govern ingress traffic, and with no matching ingress rules the selected pods become isolated for inbound traffic (deny by default). Option E is correct because NetworkPolicy is a namespaced resource, so it must reside in the same namespace as the pods it selects to affect them. Option B is not required, since a single policy with the right podSelector and policyTypes can isolate pods without a separate namespace-wide default deny-all policy. Option C is not required, as 'networking/allow-external' is not a standard or mandatory label for NetworkPolicy isolation.

Answer

The namespace must have a default deny-all NetworkPolicy

Answer

The pods must have the label 'networking/allow-external'

Question 6

Which TWO are valid port names in a Service definition?

Accepted Answer

grpc. Options D and E are correct because Kubernetes Service port names must be valid IANA_SVC_NAME values: lowercase alphanumeric characters or hyphens, must start and end with an alphanumeric character, and be at most 15 characters. 'grpc' (D) and 'http' (E) both satisfy these rules and are commonly used to name Service ports, such as when specifying targetPort by name or using protocol-aware features. Option A 'my_port' is invalid because underscores are not permitted in IANA_SVC_NAME. Option B 'Port-1' is invalid because uppercase letters are not allowed. Option C '123' is invalid as a port name because a name must contain at least one letter; purely numeric values are reserved for port numbers, not names.

Answer

my_port

Answer

Port-1

Answer

123

Question 7

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

NodePort services expose the service on a static port on each node's IP. A NodePort service exposes the application on a static port (in the range 30000-32767) on every node's IP address. This allows external traffic to reach the service by targeting any cluster node's IP on that specific port, making it accessible from outside the cluster without requiring a cloud provider.

Answer

Headless services (clusterIP: None) are used for load balancing

Answer

LoadBalancer services always create an external load balancer even without a cloud provider

Answer

ExternalName services can be used to expose a service without selectors

Question 8

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

NetworkPolicy uses labels to select pods and namespaces. NetworkPolicy uses label selectors (podSelector and namespaceSelector) to determine which pods and namespaces the policy applies to. This allows fine-grained control over traffic flow based on Kubernetes labels, which is the standard mechanism for selecting resources in Kubernetes.

Answer

NetworkPolicy resources are cluster-scoped

Answer

ipBlock can only be used in ingress rules

Question 9

A pod named 'debug' is running. Which command forwards local port 4000 to port 80 on the pod?

Accepted Answer

kubectl port-forward pod/debug 4000:80. `kubectl port-forward pod/debug 4000:80` forwards traffic from localhost port 4000 to port 80 on the specified pod. The syntax `pod/debug` explicitly identifies the resource type and name, which is the standard and unambiguous way to reference a pod in kubectl commands.

Answer

kubectl exec debug -- socat TCP-LISTEN:4000 TCP:localhost:80

Answer

kubectl port-forward pod debug 4000:80

Answer

kubectl proxy --port=4000 --target=80

Question 10

You are deploying a web application as a Deployment named 'web' with 3 replicas in namespace 'prod'. The application listens on port 8080. You need to expose this application to other pods within the cluster, and also make it accessible from outside the cluster via a stable IP address that does not change. Which of the following should you create?

Accepted Answer

A Service of type LoadBalancer with port 8080.. The requirement is for internal access and a stable external IP. A LoadBalancer Service provides both: it allocates an external load balancer with a persistent IP (in cloud environments) and also creates a ClusterIP for internal communication. NodePort uses node IPs that can change, ClusterIP is internal-only, and Ingress lacks a guaranteed stable IP and may not support the protocol.

Answer

A Service of type ClusterIP with port 8080.

Answer

An Ingress resource with a rule routing to the 'web' Service.

Answer

A Service of type NodePort with port 8080 and nodePort 30080.

Question 11

You have a Pod named 'client' in namespace 'frontend' that needs to connect to a Service named 'backend' in namespace 'backend-ns'. The Service 'backend' has clusterIP 10.96.100.50 and port 8080. Which of the following DNS names can the 'client' Pod use to resolve the Service?

Accepted Answer

backend.backend-ns. For cross-namespace Service access, the DNS name must include the namespace. The format is ..svc.cluster.local. The short form . also works due to DNS search domains. Using only the Service name or omitting the namespace defaults to the client's namespace, which is incorrect here. The reversed order is invalid.

Answer

backend-ns.backend.svc.cluster.local

Answer

backend.svc.cluster.local

Answer

backend

Question 12

You are configuring an Ingress resource to route traffic to two Services: 'frontend-svc' on port 80 and 'api-svc' on port 8080. The Ingress controller is NGINX. Which two fields are required in the Ingress spec to correctly route HTTP traffic based on the path? (Choose two.)

Accepted Answer

spec.rules[].http.paths[].backend.service.name. To route HTTP traffic based on path, the Ingress must define the path to match and the backend Service to forward to. The 'path' field specifies the URL path, and 'backend.service.name' identifies the target Service. Other fields like host, port number, and pathType are either optional or serve different purposes, such as specifying matching behavior or host-based routing.

Answer

spec.rules[].http.paths[].pathType

Answer

spec.rules[].http.paths[].backend.service.port.number

Answer

spec.rules[].host

Question 13

A developer deploys a set of Pods labeled app=frontend and wants to expose them internally within the cluster on a stable IP. Which resource should be used?

Accepted Answer

Service of type ClusterIP. A Service of type ClusterIP exposes the Pods on a stable internal IP address that is only reachable within the cluster. This is the default Service type and is ideal for internal communication between components, such as a frontend being accessed by a backend, without exposing the service outside the cluster.

Answer

Service of type NodePort

Answer

Service of type LoadBalancer

Answer

Ingress resource

Question 14

A team uses a Service named 'backend' in namespace 'prod' to reach Pods in namespace 'staging'. The Service in 'prod' has no endpoints. What is the most likely cause?

Accepted Answer

The Service selector does not match any Pods in the same namespace. The Service in the 'prod' namespace has no endpoints because its selector does not match any Pods in the same namespace. Kubernetes Services only discover Pods within the same namespace via label selectors; cross-namespace access requires a different approach (e.g., ExternalName Service or manual endpoint configuration). Since the Pods are in 'staging', the selector in 'prod' finds no matching Pods, resulting in zero endpoints.

Answer

The Service port name does not match the container port

Answer

The Service type is ClusterIP but should be NodePort

Answer

DNS resolution is broken in the staging namespace

Question 15

A Pod needs to access an external database at db.example.com:3306. Which Service type allows Pods to resolve a cluster-local name to this external address?

Accepted Answer

ExternalName. The ExternalName Service type maps a cluster-local DNS name (e.g., `my-db.default.svc.cluster.local`) to an external DNS name (`db.example.com`) using a CNAME record. This allows Pods to resolve the service name to the external database address without needing to modify application code or use an external endpoint.

Answer

LoadBalancer

Answer

NodePort

Answer

ClusterIP