CKAD Services and Networking Practice Test 4 — 15 Questions

Question 1

A NetworkPolicy allows egress traffic to pods with label 'db: mysql' in the same namespace. Which egress rule is correct?

Accepted Answer

egress:
  - to:
    - podSelector:
        matchLabels:
          db: mysql. A NetworkPolicy egress rule uses the `to` field to specify destination pods, and a `podSelector` within the same namespace selects pods with the label `db: mysql`. This allows outbound traffic from any pod in the namespace to pods matching that label, which directly satisfies the requirement.

Answer

egress:
  - to:
    - namespaceSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - from:
    - podSelector:
        matchLabels:
          db: mysql

Answer

egress:
  - to:
    - ipBlock:
        cidr: 10.0.0.0/8

Question 2

Which TWO statements about Kubernetes Services are correct?

Accepted Answer

A Service provides a stable IP address and DNS name for a set of pods.. A Kubernetes Service provides a stable virtual IP address and a DNS name (via CoreDNS) that remains constant even as the underlying pods are created, destroyed, or scaled. This abstraction decouples clients from the ephemeral nature of pod IPs, ensuring reliable service discovery within the cluster.

Answer

A ClusterIP service is accessible from outside the cluster.

Answer

A Service can load balance traffic across multiple clusters.

Answer

A headless service assigns a ClusterIP to the service.

Question 3

Which THREE components are typically involved when using Ingress to expose a service?

Accepted Answer

Ingress resource. An Ingress resource defines the routing rules for external HTTP/HTTPS traffic to services within the cluster. It specifies hostnames, paths, and the backend service to forward requests to, but it is only a configuration object. The actual traffic handling requires an Ingress controller (e.g., NGINX, Traefik) to process the Ingress resource and implement the rules, and a Service of type ClusterIP or NodePort to expose the target pods internally.

Answer

External load balancer

Answer

NetworkPolicy

Question 4

Which TWO are valid ways to create a Service in Kubernetes?

Accepted Answer

Using kubectl apply -f service.yaml. `kubectl apply -f service.yaml` declaratively creates or updates a Service resource defined in a YAML manifest. This is the standard approach for managing Kubernetes resources in a GitOps or infrastructure-as-code workflow, ensuring the cluster state matches the file specification.

Answer

Using kubectl create service clusterip myservice --tcp=80:80

Answer

Using kubectl create deployment mydeploy --image=nginx --expose

Answer

Using kubectl run mypod --image=nginx --expose

Question 5

Which kubectl command creates a Service of type ClusterIP named 'my-service' that exposes port 80 on a set of pods selected by label 'app: web'?

Accepted Answer

kubectl expose deployment my-deployment --port=80 --target-port=80 --type=ClusterIP --name=my-service. `kubectl expose deployment my-deployment --port=80 --target-port=80 --type=ClusterIP --name=my-service` creates a ClusterIP Service that maps port 80 on the Service to port 80 on pods selected by the deployment's label selector. If the deployment has selector `app: web`, this satisfies the requirement. Option C is wrong because `kubectl create service clusterip` automatically generates a selector of `app=my-service` (based on the Service name), not `app=web`. Therefore, it would not select the desired pods.

Answer

kubectl run my-service --image=nginx --port=80 --expose

Answer

kubectl create service clusterip my-service --tcp=80:80

Answer

kubectl expose pod my-pod --port=80 --target-port=80 --type=NodePort --name=my-service

Question 6

You create a Service named 'backend' in namespace 'prod'. A pod in namespace 'dev' tries to reach the service using the DNS name 'backend.prod.svc.cluster.local'. The pod cannot resolve the name. What is the most likely cause?

Accepted Answer

The cluster DNS service is not running. The pod in the 'dev' namespace is correctly using the full DNS name 'backend.prod.svc.cluster.local' to reach the service in the 'prod' namespace. This is the proper way to resolve a service across namespaces. If the pod cannot resolve this name, the most likely cause is that the cluster DNS service (CoreDNS) is not running or is unhealthy, leading to DNS resolution failures.

Answer

CoreDNS is configured to reject cross-namespace queries

Answer

The 'prod' namespace does not exist

Answer

The pod is using the short name 'backend' without the namespace suffix

Question 7

You are tasked with creating a NetworkPolicy that denies all ingress traffic to pods in the 'db' namespace by default. Which YAML snippet correctly implements this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: db
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress: []. Options A and B are both correct because they define a NetworkPolicy that selects all pods in the namespace with `podSelector: {}`, specify `policyTypes: [Ingress]`, and have either an empty `ingress` array (A) or omit the `ingress` field entirely (B). In Kubernetes, both patterns result in a default-deny ingress policy, blocking all inbound traffic to the selected pods. Option C allows all ingress traffic with an empty rule `{}`, and option D only denies egress.

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: db
spec:
  podSelector: {}
  ingress:
  - {}

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-ingress
  namespace: db
spec:
  podSelector: {}
  policyTypes:
  - Egress

Question 8

You run 'kubectl port-forward pod/my-pod 8080:80' and try to access 'http://localhost:8080', but the connection is refused. The pod is running and port 80 is open. What is the most likely issue?

Accepted Answer

The pod is in a different namespace and the namespace flag is missing. kubectl port-forward creates a local listener on the specified local port. If the pod is in a different namespace and --namespace is not provided, kubectl fails to find the pod, prints an error, and does not create the local listener. As a result, connecting to localhost:8080 is refused. A local port conflict would instead cause kubectl to fail with 'address already in use', but another process would already be listening on that port, so connection refused would not occur.

Answer

The container is listening on port 8080 instead of 80

Answer

Local port 8080 is already in use by another process

Answer

The service must exist for port-forwarding to work

Question 9

A user runs 'kubectl get endpoints my-service' and sees no endpoints listed. The service has a selector 'app: my-app'. Pods with that label exist and are running. What is the most likely cause?

Accepted Answer

The pods are not ready (readiness probe failing). In Kubernetes, a Service creates Endpoints only for pods that match its selector and are ready. Because the pods are labeled app: my-app and match the selector, the missing endpoints indicate the pods are not passing their readiness probes.

Answer

The service selector does not match the pod labels

Answer

The pods are not assigned an IP address

Answer

The service name is incorrect

Question 10

Which command creates a Service named 'web' of type ClusterIP that selects pods with label 'tier: frontend' and exposes port 80?

Accepted Answer

kubectl expose deployment frontend --port=80 --target-port=80 --type=ClusterIP --name=web. kubectl expose deployment frontend --port=80 --target-port=80 --type=ClusterIP --name=web creates a ClusterIP Service named 'web' with port 80. The Service's selector is automatically set to match the deployment's pod selector. Therefore, to satisfy the requirement that the Service selects pods with label tier=frontend, the deployment 'frontend' must have a matching selector. Since the stem does not provide this context, the answer is conditionally correct. In a CKAD exam, this is often implied, but strictly speaking, the command does not guarantee the required selector.

Answer

kubectl create service clusterip web --tcp=80

Answer

kubectl expose deployment web --port=80 --type=NodePort

Answer

kubectl run web --image=nginx --port=80 --expose

Question 11

Which TWO of the following are valid ways to expose a service externally on a Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. A NodePort service exposes the service on a static port on each node's IP address, making it accessible from outside the cluster via `:`. This is a valid method for external exposure, as it opens a port in the node's firewall and routes traffic to the service.

Answer

kubectl port-forward

Answer

ExternalName

Answer

ClusterIP

Question 12

Which TWO of the following are valid rules for a NetworkPolicy that allows egress traffic from pods with label 'app: worker' to the external IP range '192.168.0.0/16' on port 53 UDP? (Select 2)

Accepted Answer

egress:
- ports:
  - port: 53
    protocol: UDP
  to:
  - ipBlock:
      cidr: 192.168.0.0/16. Option A and Option C are both valid egress rules that allow traffic to the specified IP block on port 53 with UDP protocol. Option D is identical to Option C and is considered a duplicate, so it is not counted as a separate correct answer. Options B and E are incorrect: B adds an unnecessary 'to' entry with 'podSelector: {}' that broadens the policy, and E uses the 'from' field (reserved for ingress) instead of 'to'.

Answer

egress:
- to:
  - ipBlock:
      cidr: 192.168.0.0/16
  ports:
  - port: 53
    protocol: UDP
- to:
  - podSelector: {}

Answer

egress:
- to:
  - ipBlock:
      cidr: 192.168.0.0/16
  ports:
  - port: 53
    protocol: UDP [wrong]

Answer

egress:
- from:
  - ipBlock:
      cidr: 192.168.0.0/16
  ports:
  - port: 53
    protocol: UDP

Question 13

Which TWO of the following are true about headless services? (Select 2)

Accepted Answer

DNS returns multiple A records, one for each pod's IP. Headless services (with clusterIP: None) cause DNS to return multiple A records, one for each pod's IP address, rather than a single virtual IP. This allows direct pod-to-pod DNS resolution, which is essential for stateful applications like databases that need to discover individual pod endpoints.

Answer

They provide a stable virtual IP for load balancing

Answer

They cannot have a selector

Answer

They are used exclusively with Deployments

Question 14

A developer runs `kubectl expose deployment web-deploy --port=80 --target-port=8080 --type=NodePort` and later wants to access the Service from outside the cluster. What is the correct way to find the external port?

Accepted Answer

Run `kubectl describe svc web-deploy` and look for the NodePort field.. `kubectl expose` with `--type=NodePort` creates a Service that maps a high-port (30000-32767) on each cluster node to the target container port. The `kubectl describe svc web-deploy` output includes the `NodePort` field, which shows this externally accessible port. To reach the Service from outside the cluster, you must use the node's external IP combined with this NodePort, not the Service's cluster-internal port (80).

Answer

Run `kubectl get nodes -o wide` and use the node's external IP and port 80.

Answer

Run `kubectl get pod -l app=web-deploy` and use the pod IP with port 8080.

Answer

Run `kubectl get svc web-deploy -o yaml` and look for `spec.ports[0].port`.

Question 15

An admin creates a Service without a selector. Which of the following is true about such a Service?

Accepted Answer

The admin must manually create an Endpoints object with the desired IPs.. When a Service is created without a selector, Kubernetes does not automatically manage its endpoints. The admin must manually create an Endpoints object (or use an EndpointSlice) that lists the IP addresses and ports to which the Service should route traffic. This allows the Service to direct traffic to external resources, such as databases running outside the cluster, or to specific pods not matching a label selector.

Answer

The Service will use the default ClusterIP and route to all pods in the cluster.

Answer

The Service will automatically route traffic to all pods in the namespace.

Answer

The Service will not have any endpoints until a selector is added.