CKAD Services and Networking Practice Test 3 — 15 Questions

Question 1

Which TWO statements about Services are true? (Choose two.)

Accepted Answer

A Service of type LoadBalancer automatically creates a NodePort Service.. When a Service of type LoadBalancer is created, Kubernetes automatically creates a corresponding NodePort Service (and a ClusterIP Service) as part of its implementation. The cloud load balancer routes external traffic to the NodePort on each node, which then forwards to the ClusterIP. This is defined in the Kubernetes Service specification and is a core behavior of the LoadBalancer type.

Answer

A Service of type ClusterIP is accessible from outside the cluster.

Answer

A Service of type ExternalName requires a selector to route traffic.

Answer

A headless Service has clusterIP set to "0.0.0.0".

Question 2

You need to debug a Service that is not routing traffic to its endpoints. Which command shows the current endpoints of a Service?

Accepted Answer

kubectl get endpoints my-service. `kubectl get endpoints my-service` directly retrieves the Endpoints object associated with the Service, which lists the IP addresses and ports of the Pods that are currently receiving traffic. This is the most precise way to verify whether the Service has any active endpoints, as the Endpoints object is updated by the kube-controller-manager based on Pod readiness and label selectors.

Answer

kubectl describe service my-service

Answer

kubectl get svc my-service -o wide

Answer

kubectl get pods -l app=my-app

Question 3

An Ingress resource has the following spec. What is the effect?

spec:
  tls:
  - hosts:
    - myapp.example.com
    secretName: myapp-tls
  rules:
  - host: myapp.example.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: myapp
            port:
              number: 80

Accepted Answer

Ingress terminates TLS using the secret and routes to the service.. The Ingress spec defines TLS termination at the ingress controller using the secret `myapp-tls` for the host `myapp.example.com`. The `tls` block configures the ingress to decrypt HTTPS traffic using the certificate and key stored in that secret, and then forward the decrypted HTTP traffic to the backend service `myapp` on port 80. This is the standard behavior for securing traffic with TLS in Kubernetes Ingress.

Answer

Ingress uses the secret for client authentication.

Answer

Ingress redirects HTTP to HTTPS automatically.

Answer

Ingress passes the TLS connection through to the service.

Question 4

Which THREE statements about Ingress are correct? (Choose three.)

Accepted Answer

Ingress can terminate TLS connections.. Ingress can terminate TLS connections by referencing a Secret that contains the TLS certificate and private key. When a TLS section is defined in the Ingress spec, the Ingress controller terminates the HTTPS connection at the edge and forwards plain HTTP traffic to the backend services. This is a core feature for securing ingress traffic in Kubernetes.

Answer

Ingress can route traffic based on source IP.

Answer

Ingress can route traffic based on destination port.

Question 5

Which TWO are valid ways to create a Service from a deployment named 'frontend'? (Choose two.)

Accepted Answer

Write a YAML manifest with apiVersion: v1, kind: Service, metadata.name, spec.selector matching deployment labels, and run kubectl apply -f manifest.yaml. It describes the standard method of creating a Kubernetes Service by writing a YAML manifest with the correct apiVersion (v1), kind (Service), metadata.name, and spec.selector that matches the labels of the target Pods (e.g., from the 'frontend' deployment). Running 'kubectl apply -f manifest.yaml' then creates the Service, which routes traffic to Pods with matching labels.

Answer

kubectl create service clusterip frontend --tcp=80:80

Answer

kubectl autoscale deployment frontend --min=1 --max=5

Answer

kubectl run frontend --image=nginx --port=80 --expose

Question 6

Which command exposes a deployment named 'web' as a ClusterIP service on port 80?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a ClusterIP service by default, which exposes the deployment on port 80 within the cluster. The `expose` command automatically selects the deployment's pod labels and creates a service that maps port 80 to the target port (defaulting to the same port).

Answer

kubectl create service clusterip web --port=80

Answer

kubectl run web --expose --port=80

Answer

kubectl expose deployment web --port=80 --type=NodePort

Question 7

A developer creates a Service named 'backend' in namespace 'default'. The service targets pods with label 'app: backend'. From within a pod in the same namespace, which DNS name resolves to the service's ClusterIP?

Accepted Answer

backend. Kubernetes DNS resolves a Service name to its ClusterIP when queried from within the same namespace. The DNS record for a Service is simply `<service-name>` in the same namespace, so 'backend' resolves directly to the ClusterIP of the backend Service.

Answer

backend.default.svc.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.cluster.local

Question 8

An ingress resource is created with the following spec. Which request will be routed to the 'green' service?

```yaml
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: blue
            port:
              number: 80
      - path: /api/v1
        pathType: Exact
        backend:
          service:
            name: green
            port:
              number: 80
```

Accepted Answer

http://example.com/api/v1. The request to http://example.com/api/v1 matches the Exact path /api/v1, which routes to the green service. In Kubernetes ingress, Exact pathType requires the request path to be identical to the specified path, and /api/v1 matches exactly.

Answer

http://example.com/api/v1/

Answer

http://example.com/api

Answer

http://example.com/

Question 9

A NetworkPolicy named 'default-deny-ingress' is applied to a namespace but contains no rules. What is the effect on pods in that namespace?

Accepted Answer

All ingress traffic is denied.. A NetworkPolicy with no rules defaults to denying all ingress traffic because Kubernetes NetworkPolicies are additive: any pod selected by a NetworkPolicy is isolated, and only traffic explicitly allowed by rules is permitted. Since this policy has no rules, no ingress traffic is allowed, effectively creating a deny-all ingress policy for pods in the namespace.

Answer

Only traffic from pods with label 'allow: true' is allowed.

Answer

All ingress traffic is allowed.

Answer

Only traffic from pods in the same namespace is allowed.

Question 10

A pod in namespace 'default' cannot resolve the service name 'db' in namespace 'data'. Which DNS name should the pod use to reach the service?

Accepted Answer

db.data.svc.cluster.local. Kubernetes DNS resolves a service in another namespace using the format ..svc.cluster.local. Since the service is named 'db' in namespace 'data', the fully qualified domain name (FQDN) is db.data.svc.cluster.local. This allows cross-namespace service discovery without needing to modify the pod's DNS configuration.

Answer

db.default.svc.cluster.local

Answer

data.db.svc.cluster.local

Answer

db.svc.data.cluster.local

Question 11

A NetworkPolicy allows ingress traffic from pods with label 'role: frontend' in the same namespace. Which podSelector is correct?

Accepted Answer

ingress:
  - from:
    - podSelector:
        matchExpressions:
          - key: role
            operator: In
            values:
            - frontend. In Kubernetes NetworkPolicy, podSelector is a LabelSelector which supports both matchLabels and matchExpressions. Option A uses matchExpressions with operator In and values [frontend], which is equivalent to matchLabels role=frontend. Therefore A is also correct. The question must be revised to only accept matchLabels or to allow multiple correct options.

Answer

ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          role: frontend

Answer

ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

Question 12

A developer wants to test a service locally using kubectl. Which command forwards local port 8080 to the service's port 80?

Accepted Answer

kubectl port-forward service/myservice 8080:80. `kubectl port-forward` requires the resource type (e.g., `service/`) to be specified when targeting a Service. The syntax `kubectl port-forward service/myservice 8080:80` forwards local port 8080 to the Service's port 80, allowing local traffic to reach the Service's cluster IP.

Answer

kubectl port-forward pod/myservice 8080:80

Answer

kubectl port-forward myservice 8080:80

Answer

kubectl port-forward service/myservice 80:8080

Question 13

Which service type is used to expose a service using an external DNS name, such as a database hosted outside Kubernetes?

Accepted Answer

ExternalName. ExternalName is the correct service type because it maps a Kubernetes service to an external DNS name (e.g., a database hosted outside the cluster) by returning a CNAME record with that external name. This allows pods to access the external resource using the service's DNS name without needing to know the external endpoint's IP address.

Answer

ClusterIP

Answer

NodePort

Answer

LoadBalancer

Question 14

A headless service is created with 'clusterIP: None'. What is the primary use case for such a service?

Accepted Answer

To allow direct pod-to-pod DNS resolution for StatefulSets.. A headless service (clusterIP: None) is primarily used with StatefulSets to enable direct pod-to-pod DNS resolution. Instead of a single virtual IP, the DNS returns the individual pod IPs (A/AAAA records) or SRV records, allowing each pod to be addressed by its stable network identity (e.g., pod-name.service-name.namespace.svc.cluster.local). This is essential for stateful applications like databases that require stable peer discovery.

Answer

To provide a stable IP address for the service.

Answer

To expose the service externally without a load balancer.

Answer

To enable DNS round-robin across all pods.

Question 15

An Ingress resource uses the annotation 'kubernetes.io/ingress.class: nginx'. However, traffic is not being routed. The cluster has multiple ingress controllers. What is the most likely cause?

Accepted Answer

The annotation is deprecated; use spec.ingressClassName instead.. The annotation `kubernetes.io/ingress.class` is deprecated in Kubernetes 1.18+ and removed in 1.25+. The correct approach is to use `spec.ingressClassName` in the Ingress spec, which references an `IngressClass` resource. Since the cluster has multiple ingress controllers, the deprecated annotation may be ignored or not processed by the intended controller, causing traffic not to be routed.

Answer

The ingress controller is not installed.

Answer

The service backend doesn't exist.

Answer

TLS certificate is invalid.