CKAD Services and Networking Practice Test 6 — 15 Questions

Question 1

What is the default service type in Kubernetes?

Accepted Answer

ClusterIP. The default service type in Kubernetes is ClusterIP, which exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, enabling pod-to-pod communication without external access. If no `type` field is specified in the Service manifest, Kubernetes automatically sets `type: ClusterIP`.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 2

A ClusterIP service named 'svc' has no endpoints. Which command can you use to debug why the service is not routing traffic?

Accepted Answer

kubectl get endpoints svc. `kubectl get endpoints svc` directly shows the list of pod IPs and ports that the ClusterIP service is routing traffic to. If the service has no endpoints, this command will return an empty list, confirming that no pods match the service's selector, which is the most common reason for traffic not being routed.

Answer

kubectl describe service svc

Answer

kubectl logs svc

Answer

kubectl exec -it svc -- /bin/sh

Question 3

What annotation is required on an Ingress resource to use a specific IngressClass (e.g., 'nginx')?

Accepted Answer

kubernetes.io/ingress.class: nginx. The `kubernetes.io/ingress.class` annotation is the legacy method to specify the IngressClass for an Ingress resource. This annotation tells the Ingress controller (e.g., nginx) which controller should process the Ingress rules. In Kubernetes 1.18+, the preferred method is the `spec.ingressClassName` field, but the annotation is still widely supported for backward compatibility.

Answer

kubernetes.io/ingress-type: nginx

Answer

ingress.kubernetes.io/class: nginx

Answer

kubernetes.io/class: nginx

Question 4

A NetworkPolicy denies all ingress traffic to a namespace. Which rule would allow traffic only from pods in the same namespace?

Accepted Answer

from:
  - podSelector: {}. A `podSelector: {}` in a NetworkPolicy ingress rule selects all pods in the same namespace as the policy, effectively allowing traffic only from pods within that namespace. This works because the empty podSelector matches all pods in the namespace where the NetworkPolicy is applied, and no namespaceSelector is specified, so the rule is scoped to the local namespace only.

Answer

from:
  - namespaceSelector: {}
    podSelector: {}

Answer

from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

from:
  - namespaceSelector:
      matchLabels:
        name: mynamespace

Question 5

A pod 'app' has an init container that fails. The pod status is Init:Error. What is the first step to diagnose?

Accepted Answer

kubectl logs app -c . When a pod has an init container that fails, the pod status is 'Init:Error'. The first diagnostic step is to check the logs of the specific init container that failed, because the main container has not started yet. Option B is correct because `kubectl logs app -c ` retrieves the logs from the failing init container, which contains the error details. The `-c` flag is essential to target the init container rather than the main container, which has no logs at this point.

Answer

kubectl describe pod app

Answer

kubectl exec -it app -- /bin/sh

Answer

kubectl logs app

Question 6

Which of the following is true about Istio as a service mesh?

Accepted Answer

It injects a sidecar proxy into each pod. Istio is a service mesh that deploys an Envoy sidecar proxy alongside each application pod. This sidecar intercepts all inbound and outbound traffic, enabling advanced traffic management, observability, and security features without modifying application code. The sidecar injection is typically done automatically via a mutating webhook admission controller.

Answer

It replaces kube-proxy for service routing

Answer

It only works with HTTP traffic

Answer

It requires all services to be of type LoadBalancer

Question 7

Which TWO of the following are valid ways to create a Service named 'web' that targets pods with label 'app: web' on port 80?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a Service named 'web' that selects pods from the Deployment named 'web' (which by default uses the label `app: web` from the Deployment's pod template) and exposes port 80. This command automatically sets the Service's selector to match the Deployment's pod labels and configures the target port to 80.

Answer

kubectl apply -f service.yaml where service.yaml contains a Service with spec.clusterIP: None

Answer

kubectl run web --image=nginx --port=80 --expose

Answer

kubectl create service clusterip web --tcp=80 --selector=app=web

Question 8

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

A single NetworkPolicy can contain both ingress and egress rules. A single NetworkPolicy resource can define both ingress and egress rules within its spec. The `spec.policyTypes` field explicitly lists which rule types are applied; if both `Ingress` and `Egress` are specified, the policy governs both directions. This allows administrators to enforce bidirectional traffic controls with a single policy object.

Answer

NetworkPolicy is a cluster-scoped resource

Answer

NetworkPolicy can only be applied to pods with a specific annotation

Question 9

Which TWO of the following are valid service types in Kubernetes?

Accepted Answer

NodePort. NodePort is a valid Kubernetes service type that exposes a service on a static port on each node's IP address, allowing external traffic to reach the service. It builds on top of ClusterIP by creating a cluster-wide port mapping that forwards traffic from the node's port to the service's ClusterIP and target port.

Answer

Headless

Answer

Ingress

Answer

Gateway

Question 10

Which of the following commands creates a Service named 'my-svc' of type ClusterIP that exposes TCP port 80 on a set of pods selected by the label 'app: web'?

Accepted Answer

kubectl expose pod my-pod --port=80 --target-port=80 --type=ClusterIP --name=my-svc --selector=app=web. It uses `kubectl expose pod` with `--type=ClusterIP` to create a Service named 'my-svc' that exposes TCP port 80. The `--selector=app=web` flag sets the label selector, ensuring the Service routes traffic to pods with that label, which matches the requirement. Note that `kubectl expose` supports the `--selector` flag for all resource types, including pods.

Answer

kubectl port-forward my-pod 8080:80

Answer

kubectl expose deployment my-deploy --port=80 --type=LoadBalancer --name=my-svc

Answer

kubectl expose pod my-pod --port=80 --target-port=80 --type=NodePort --name=my-svc

Question 11

A developer runs 'kubectl run nginx --image=nginx --port=80' and then creates a Service with the following YAML:

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80

However, the Service has no endpoints. What is the most likely cause?

Accepted Answer

The Service selector 'app: nginx' does not match the pod's label 'run: nginx'. The `kubectl run nginx --image=nginx --port=80` command creates a pod with a default label `run: nginx`, not `app: nginx`. The Service's selector `app: nginx` therefore does not match any pod's labels, so the Service's endpoint controller finds no pods to add to the endpoints list. Without matching labels, the Service cannot route traffic to any pod, resulting in zero endpoints.

Answer

The Service and pod are in different namespaces

Answer

The Service must have a selector defined in order to have endpoints

Answer

The pod is not listening on port 80

Question 12

Given the following NetworkPolicy YAML:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What is the effect of this policy?

Accepted Answer

Denies all ingress and egress traffic to and from all pods in the namespace. This NetworkPolicy uses an empty `podSelector: {}` which selects all pods in the namespace. By specifying both `Ingress` and `Egress` in `policyTypes` without any `ingress` or `egress` rules, the policy defaults to denying all ingress and egress traffic. In Kubernetes, NetworkPolicy rules are additive (allow-listed), so an empty rules list means no traffic is permitted, effectively creating a default-deny for both directions.

Answer

Denies all ingress traffic but allows all egress traffic

Answer

Allows all traffic to and from pods in the namespace

Answer

Denies all traffic except traffic that is explicitly allowed by other policies

Question 13

What is the DNS name for a Service named 'backend' in the 'default' namespace?

Accepted Answer

backend.default.svc.cluster.local. In Kubernetes, a Service named 'backend' in the 'default' namespace is assigned a DNS name following the pattern `..svc.cluster.local`. This is the standard internal DNS resolution format used by CoreDNS (or kube-dns) for cluster-local services. Option B correctly follows this pattern: `backend.default.svc.cluster.local`.

Answer

backend.default.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.svc.cluster

Question 14

A StatefulSet named 'web' is created with 3 replicas. What is the DNS name for the second pod (index 1)?

Accepted Answer

web-1.web.default.svc.cluster.local. In Kubernetes, a StatefulSet creates pods with a stable, ordinal hostname based on the pattern `-`. The second pod (index 1) is named `web-1`. When a headless Service (named `web`) is associated with the StatefulSet, each pod gets a DNS A record in the form `...svc.cluster.local`. Therefore, the correct DNS name is `web-1.web.default.svc.cluster.local`.

Answer

web-2.web.default.svc.cluster.local

Answer

web.default.svc.cluster.local

Answer

web-1.default.svc.cluster.local

Question 15

Which of the following is true about headless services?

Accepted Answer

It has no cluster IP; DNS returns the IPs of the pods. A headless service is created by setting `clusterIP: None` in the Service spec. Because it has no Cluster IP, kube-proxy does not create any load-balancing rules for it. Instead, the DNS lookup for the service name returns the IP addresses of all ready pods backing the service, allowing direct pod-to-pod communication without a proxy.

Answer

It performs round-robin load balancing across pods

Answer

It provides a single DNS record for the service

Answer

It must not have a selector