CKAD Services and Networking Practice Test 5 — 15 Questions

Question 1

What is the primary purpose of a headless Service (clusterIP: None) in Kubernetes?

Accepted Answer

To allow DNS resolution to return all pod IPs for a StatefulSet.. Headless Services are used with StatefulSets to provide stable network identities for pods, allowing direct pod-to-pod communication without a load-balanced IP.

Answer

To prevent external access to the Service.

Answer

To provide a stable IP address for the Service.

Answer

To enable load balancing across pods.

Question 2

Which of the following Ingress controllers is commonly used in Kubernetes?

Accepted Answer

NGINX. NGINX is the most widely adopted Ingress controller in Kubernetes, providing a reverse proxy that routes external HTTP/HTTPS traffic to services based on Ingress resource rules. It is officially maintained by the Kubernetes community and supports advanced features like SSL termination, load balancing, and path-based routing, making it the default choice for many production clusters.

Answer

IIS

Answer

Apache

Answer

Tomcat

Question 3

An admin applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What effect does this policy have?

Accepted Answer

Denies all ingress and egress traffic to all pods in the namespace.. The NetworkPolicy with an empty `podSelector: {}` selects all pods in the namespace, and specifying `policyTypes: [Ingress, Egress]` with no rules under `ingress` or `egress` means no traffic is explicitly allowed. By default, Kubernetes NetworkPolicies are whitelist-based: if a policy selects a pod, any traffic not explicitly permitted is denied. Thus, this policy denies all ingress and egress traffic to all pods in the namespace.

Answer

Allows all traffic because no rules are specified.

Answer

Only denies egress traffic; ingress is allowed.

Answer

Only denies ingress traffic; egress is allowed.

Question 4

A pod in namespace 'app' needs to resolve the DNS name 'db-service.data.svc.cluster.local'. What is the likely namespace of the 'db-service' Service?

Accepted Answer

data. The DNS name 'db-service.data.svc.cluster.local' follows the Kubernetes DNS specification for Services, which has the format ..svc.cluster.local. The second component (after the first dot) is the namespace. Here, 'data' is the namespace of the Service, so the correct answer is B.

Answer

app

Answer

svc

Answer

default

Question 5

An admin wants to expose a Service only for internal cluster communication, without external access. Which Service type should they use?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type and exposes the Service on a cluster-internal IP address, making it reachable only from within the cluster. This is the correct choice for internal cluster communication because no external endpoints are created, and traffic is routed via kube-proxy using iptables or IPVS rules.

Answer

ExternalName

Answer

NodePort

Answer

LoadBalancer

Question 6

What is the correct command to forward a local port to a pod for debugging?

Accepted Answer

kubectl port-forward pod/my-pod 8080:80. `kubectl port-forward` creates a tunnel from a local port (8080) to a target port (80) on a pod, enabling direct network access for debugging without exposing the pod externally. This command is specifically designed for forwarding traffic to pods, services, or deployments in Kubernetes.

Answer

kubectl expose pod my-pod --port=8080

Answer

kubectl attach pod/my-pod

Answer

kubectl proxy pod/my-pod 8080:80

Question 7

An Ingress resource has the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

What will the Ingress controller do for a request to http://example.com/api/v1/users?

Accepted Answer

Route the request to api-service on port 80.. The Ingress rule uses `pathType: Prefix` and a path of `/api`, which matches any request whose URL path begins with `/api`. The request to `http://example.com/api/v1/users` starts with `/api`, so the Ingress controller routes it to `api-service` on port 80. This is the standard behavior defined by the Kubernetes Ingress specification for prefix-based path matching.

Answer

Route the request to the default backend.

Answer

Return a 502 Bad Gateway error.

Answer

Return 404 Not Found because the path does not match exactly.

Question 8

Which of the following is a valid NetworkPolicy that allows ingress traffic only from pods with label 'role: frontend' in any namespace?

Accepted Answer

ingress:
- from:
  - namespaceSelector: {}
    podSelector:
      matchLabels:
        role: frontend. It uses a `namespaceSelector: {}` (which matches all namespaces) combined with a `podSelector` that selects pods with label `role: frontend`. This combination allows ingress traffic from pods with that label in any namespace, which is exactly what the question requires. In Kubernetes NetworkPolicy, when you want to select pods across all namespaces, you must include an empty `namespaceSelector` alongside the `podSelector`.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 9

What is the purpose of the `IngressClass` resource in Kubernetes?

Accepted Answer

To specify which Ingress controller should implement the Ingress.. The `IngressClass` resource decouples the Ingress definition from the specific Ingress controller implementation. It allows you to specify which controller (e.g., NGINX, HAProxy, Traefik) should process the Ingress by referencing the `spec.controller` field, enabling multi-controller clusters and dynamic routing decisions.

Answer

To enable path-based routing.

Answer

To define the TLS certificate for an Ingress.

Answer

To set the default backend for an Ingress.

Question 10

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.

Question 11

Which TWO of the following are valid Ingress path types? (Select 2)

Accepted Answer

Exact. In Kubernetes Ingress, the `spec.rules.http.paths[].pathType` field supports two valid types: `Exact` and `Prefix`. `Exact` matches the URL path exactly, case-sensitive, and is used when you need a precise match without any wildcard or prefix behavior.

Answer

Glob

Answer

Wildcard

Answer

Regex

Question 12

A developer wants to expose a Deployment named 'web-app' (with label 'app: web') as a ClusterIP service on port 80. Which command achieves this?

Accepted Answer

kubectl expose deployment web-app --port=80. `kubectl expose deployment web-app --port=80` creates a ClusterIP Service that selects Pods based on the labels of the specified Deployment (in this case, `app: web`). The `expose` command automatically reads the Pod template labels from the Deployment and applies them as the Service's selector, then maps the Service's port 80 to the target port of the containers in the selected Pods.

Answer

kubectl expose service web-app --port=80

Answer

kubectl create service clusterip web-app --tcp=80

Answer

kubectl expose pod web-app --port=80

Question 13

You have a headless service 'db' in namespace 'data'. Pods in that namespace can resolve 'db.data.svc.cluster.local'. What is the effect of a headless service on DNS resolution?

Accepted Answer

It returns a round-robin list of pod IPs. A headless service (with `clusterIP: None`) does not have a ClusterIP, so DNS queries for the service name return the IP addresses of all ready pods backing the service, rather than a single virtual IP. This enables client-side load balancing via DNS round-robin, as the DNS resolver returns multiple A records that the client can cycle through. Option C correctly describes this behavior.

Answer

It does not create any DNS record

Answer

It returns the IP of the first pod

Answer

It returns the ClusterIP of the service

Question 14

A NetworkPolicy with the following spec is applied:
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
What does this policy do?

Accepted Answer

Allows incoming traffic from pods labeled 'role: frontend' to all pods. This NetworkPolicy selects all pods (empty podSelector `{}`) and defines an ingress rule that only allows incoming traffic from pods with the label `role: frontend`. By default, Kubernetes NetworkPolicies are additive and deny all traffic that is not explicitly allowed, so this policy permits ingress from frontend pods to all pods while blocking all other inbound traffic.

Answer

Allows all outgoing traffic from pods labeled 'role: frontend'

Answer

Blocks all incoming traffic to pods labeled 'role: frontend'

Answer

Has no effect because policyTypes is missing Egress

Question 15

You need to access a database pod 'db-pod' on port 5432 from your local machine. Which command forwards local port 15432 to the pod's port 5432?

Accepted Answer

kubectl port-forward pod/db-pod 15432:5432. `kubectl port-forward` creates a direct tunnel from a local port to a port on a specific pod. The syntax `kubectl port-forward pod/db-pod 15432:5432` forwards local port 15432 to the pod's port 5432, allowing you to access the database as if it were running locally.

Answer

kubectl proxy --port=15432 db-pod:5432

Answer

kubectl expose pod db-pod --port=15432 --target-port=5432

Answer

kubectl port-forward db-pod 5432:15432