CKAD Services and Networking Practice Test 6 — 15 Questions

Question 1

A developer runs `kubectl expose deployment web-deploy --port=80 --target-port=8080 --type=NodePort` and later wants to access the Service from outside the cluster. What is the correct way to find the external port?

Accepted Answer

Run `kubectl describe svc web-deploy` and look for the NodePort field.. The `kubectl get svc web-deploy` command shows the NodePort assigned in the PORT(S) column, e.g., 80:31234/TCP.

Answer

Run `kubectl get nodes -o wide` and use the node's external IP and port 80.

Answer

Run `kubectl get pod -l app=web-deploy` and use the pod IP with port 8080.

Answer

Run `kubectl get svc web-deploy -o yaml` and look for `spec.ports[0].port`.

Question 2

An admin creates a Service without a selector. Which of the following is true about such a Service?

Accepted Answer

The admin must manually create an Endpoints object with the desired IPs.. A selectorless Service does not automatically create endpoints; the admin must manually create an Endpoints resource to route traffic.

Answer

The Service will use the default ClusterIP and route to all pods in the cluster.

Answer

The Service will automatically route traffic to all pods in the namespace.

Answer

The Service will not have any endpoints until a selector is added.

Question 3

What is the primary purpose of a headless Service (clusterIP: None) in Kubernetes?

Accepted Answer

To allow DNS resolution to return all pod IPs for a StatefulSet.. Headless Services are used with StatefulSets to provide stable network identities for pods, allowing direct pod-to-pod communication without a load-balanced IP.

Answer

To prevent external access to the Service.

Answer

To provide a stable IP address for the Service.

Answer

To enable load balancing across pods.

Question 4

Which of the following Ingress controllers is commonly used in Kubernetes?

Accepted Answer

NGINX. NGINX is one of the most common Ingress controllers, along with others like Traefik, HAProxy, and Contour.

Answer

IIS

Answer

Apache

Answer

Tomcat

Question 5

An admin applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What effect does this policy have?

Accepted Answer

Denies all ingress and egress traffic to all pods in the namespace.. An empty podSelector selects all pods. With no rules, both ingress and egress traffic are denied by default.

Answer

Allows all traffic because no rules are specified.

Answer

Only denies egress traffic; ingress is allowed.

Answer

Only denies ingress traffic; egress is allowed.

Question 6

A pod in namespace 'app' needs to resolve the DNS name 'db-service.data.svc.cluster.local'. What is the likely namespace of the 'db-service' Service?

Accepted Answer

data. The DNS format is service.namespace.svc.cluster.local. Here, 'data' is the namespace.

Answer

app

Answer

svc

Answer

default

Question 7

An admin wants to expose a Service only for internal cluster communication, without external access. Which Service type should they use?

Accepted Answer

ClusterIP. ClusterIP is the default Service type, accessible only within the cluster.

Answer

ExternalName

Answer

NodePort

Answer

LoadBalancer

Question 8

What is the correct command to forward a local port to a pod for debugging?

Accepted Answer

kubectl port-forward pod/my-pod 8080:80. `kubectl port-forward pod/my-pod 8080:80` forwards local port 8080 to pod port 80.

Answer

kubectl expose pod my-pod --port=8080

Answer

kubectl attach pod/my-pod

Answer

kubectl proxy pod/my-pod 8080:80

Question 9

An Ingress resource has the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

What will the Ingress controller do for a request to http://example.com/api/v1/users?

Accepted Answer

Route the request to api-service on port 80.. Prefix matching matches any path starting with /api, so /api/v1/users matches.

Answer

Route the request to the default backend.

Answer

Return a 502 Bad Gateway error.

Answer

Return 404 Not Found because the path does not match exactly.

Question 10

Which of the following is a valid NetworkPolicy that allows ingress traffic only from pods with label 'role: frontend' in any namespace?

Accepted Answer

ingress:
- from:
  - namespaceSelector: {}
    podSelector:
      matchLabels:
        role: frontend. NamespaceSelector selects namespaces, and podSelector selects pods within those namespaces.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 11

What is the purpose of the `IngressClass` resource in Kubernetes?

Accepted Answer

To specify which Ingress controller should implement the Ingress.. IngressClass allows selecting a specific Ingress controller implementation to handle the Ingress resource.

Answer

To enable path-based routing.

Answer

To define the TLS certificate for an Ingress.

Answer

To set the default backend for an Ingress.

Question 12

Which TWO of the following are valid methods to create a Service in Kubernetes? (Select 2)

Accepted Answer

kubectl apply -f service.yaml. Both `kubectl expose` and creating a YAML manifest are valid methods.

Answer

kubectl port-forward svc/my-svc 8080:80

Answer

kubectl run my-svc --image=nginx --port=80

Question 13

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. ClusterIP is default, Services can have multiple ports, and NodePorts are allocated from a range (default 30000-32767).

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.

Question 14

Which TWO of the following are valid Ingress path types? (Select 2)

Accepted Answer

Exact. Exact and Prefix are the valid path types in networking.k8s.io/v1.

Answer

Glob

Answer

Wildcard

Answer

Regex

Question 15

A developer wants to expose a Deployment named 'web-app' (with label 'app: web') as a ClusterIP service on port 80. Which command achieves this?

Accepted Answer

kubectl expose deployment web-app --port=80. The correct command is 'kubectl expose deployment web-app --port=80'. This creates a ClusterIP service named 'web-app' that selects pods with label 'app: web' and exposes port 80.

Answer

kubectl expose service web-app --port=80

Answer

kubectl create service clusterip web-app --tcp=80

Answer

kubectl expose pod web-app --port=80