CKAD Services and Networking Practice Test 4 — 15 Questions

Question 1

A developer creates a Service named 'backend' in namespace 'default'. The service targets pods with label 'app: backend'. From within a pod in the same namespace, which DNS name resolves to the service's ClusterIP?

Accepted Answer

backend. The short form 'backend' works for services in the same namespace. The full DNS name is 'backend.default.svc.cluster.local', but within same namespace, just 'backend' is sufficient.

Answer

backend.default.svc.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.cluster.local

Question 2

An ingress resource is created with the following spec. Which request will be routed to the 'green' service?

```yaml
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: blue
            port:
              number: 80
      - path: /api/v1
        pathType: Exact
        backend:
          service:
            name: green
            port:
              number: 80
```

Accepted Answer

http://example.com/api/v1. The path /api/v1 matches exactly, so requests to http://example.com/api/v1 go to green. The Prefix path /api would also match /api/v1, but Exact paths take precedence over Prefix paths when they match exactly.

Answer

http://example.com/api/v1/

Answer

http://example.com/api

Answer

http://example.com/

Question 3

A NetworkPolicy named 'default-deny-ingress' is applied to a namespace but contains no rules. What is the effect on pods in that namespace?

Accepted Answer

All ingress traffic is denied.. An empty ingress rules array in a NetworkPolicy denies all ingress traffic by default. This is a common pattern to isolate pods.

Answer

Only traffic from pods with label 'allow: true' is allowed.

Answer

All ingress traffic is allowed.

Answer

Only traffic from pods in the same namespace is allowed.

Question 4

To create a service that will be accessible from outside the cluster using a cloud provider's load balancer, what type should be used?

Accepted Answer

LoadBalancer. LoadBalancer provisions an external load balancer in cloud environments. NodePort also exposes externally but on a static port on each node, not via a cloud LB.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 5

A pod in namespace 'default' cannot resolve the service name 'db' in namespace 'data'. Which DNS name should the pod use to reach the service?

Accepted Answer

db.data.svc.cluster.local. Cross-namespace DNS requires the full service name: 'service.namespace.svc.cluster.local'.

Answer

db.default.svc.cluster.local

Answer

data.db.svc.cluster.local

Answer

db.svc.data.cluster.local

Question 6

A NetworkPolicy allows ingress traffic from pods with label 'role: frontend' in the same namespace. Which podSelector is correct?

Accepted Answer

ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend. The ingress 'from' rule uses podSelector to select source pods within the namespace. Option D uses namespaceSelector, which selects namespaces, not pods.

Answer

ingress:
  - from:
    - podSelector:
        matchExpressions:
          - key: role
            operator: In
            values:
            - frontend

Answer

ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          role: frontend

Answer

ingress:
  - from:
    - ipBlock:
        cidr: 0.0.0.0/0

Question 7

A developer wants to test a service locally using kubectl. Which command forwards local port 8080 to the service's port 80?

Accepted Answer

kubectl port-forward service/myservice 8080:80. The correct syntax is 'kubectl port-forward service/<service-name> 8080:80'. Option B uses 'svc' abbreviation, which is correct, but the order is local:remote. Option A is missing service/ prefix. Option C is reversed ports. Option D uses pod instead of service.

Answer

kubectl port-forward pod/myservice 8080:80

Answer

kubectl port-forward myservice 8080:80

Answer

kubectl port-forward service/myservice 80:8080

Question 8

Which service type is used to expose a service using an external DNS name, such as a database hosted outside Kubernetes?

Accepted Answer

ExternalName. ExternalName service maps to an external DNS name. It returns a CNAME record.

Answer

ClusterIP

Answer

NodePort

Answer

LoadBalancer

Question 9

A headless service is created with 'clusterIP: None'. What is the primary use case for such a service?

Accepted Answer

To allow direct pod-to-pod DNS resolution for StatefulSets.. Headless services are used for StatefulSets to allow pod-to-pod DNS resolution. They also enable custom load balancing or when you don't need a single IP.

Answer

To provide a stable IP address for the service.

Answer

To expose the service externally without a load balancer.

Answer

To enable DNS round-robin across all pods.

Question 10

An Ingress resource uses the annotation 'kubernetes.io/ingress.class: nginx'. However, traffic is not being routed. The cluster has multiple ingress controllers. What is the most likely cause?

Accepted Answer

The annotation is deprecated; use spec.ingressClassName instead.. The annotation is deprecated in v1.18+; the new method is to use 'spec.ingressClassName' field. Also, if multiple controllers exist, the ingress class must match one of them.

Answer

The ingress controller is not installed.

Answer

The service backend doesn't exist.

Answer

TLS certificate is invalid.

Question 11

A NetworkPolicy allows egress traffic to pods with label 'db: mysql' in the same namespace. Which egress rule is correct?

Accepted Answer

egress:
  - to:
    - podSelector:
        matchLabels:
          db: mysql. Egress rules use 'to' with podSelector. Option A uses 'from' which is for ingress. Option D uses namespaceSelector incorrectly.

Answer

egress:
  - to:
    - namespaceSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - from:
    - podSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8

Question 12

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

A Service provides a stable IP address and DNS name for a set of pods.. A is correct: Services provide stable endpoints. C is correct: NodePort exposes on a static port on each node. B is false: ClusterIP is internal. D is false: Services do not provide load balancing across clusters. E is false: Headless services do not have ClusterIP.

Answer

A ClusterIP service is accessible from outside the cluster.

Answer

A Service can load balance traffic across multiple clusters.

Answer

A headless service assigns a ClusterIP to the service.

Question 13

Which THREE components are typically involved when using Ingress to expose a service?

Accepted Answer

Ingress resource. A, B, D are correct. Ingress resource defines rules, Ingress controller implements them, and Service routes to pods. C is not required; E is optional but not typically involved.

Answer

External load balancer

Answer

NetworkPolicy

Question 14

Which TWO are valid ways to create a Service in Kubernetes?

Accepted Answer

Using kubectl apply -f service.yaml. A and B are correct. kubectl expose creates a service from a resource. YAML manifest can be applied. C is incorrect because 'create service' doesn't automatically select pods. D creates a pod, not a service. E is not a command.

Answer

Using kubectl create service clusterip myservice --tcp=80:80

Answer

Using kubectl create deployment mydeploy --image=nginx --expose

Answer

Using kubectl run mypod --image=nginx --expose

Question 15

Which kubectl command creates a Service of type ClusterIP named 'my-service' that exposes port 80 on a set of pods selected by label 'app: web'?

Accepted Answer

kubectl expose deployment my-deployment --port=80 --target-port=80 --type=ClusterIP --name=my-service. The correct command uses 'kubectl expose' with the '--type' flag to specify ClusterIP and '--target-port' for the container port. Option B is correct. Option A uses '--type=NodePort', which is incorrect. Option C uses 'kubectl run' which is not the proper way to create a service. Option D uses 'kubectl create service clusterip' but without specifying the selector explicitly, it will not correctly select pods.

Answer

kubectl run my-service --image=nginx --port=80 --expose

Answer

kubectl create service clusterip my-service --tcp=80:80

Answer

kubectl expose pod my-pod --port=80 --target-port=80 --type=NodePort --name=my-service