CKAD Services and Networking Practice Test 7 — 15 Questions

Question 1

An administrator wants to allow ingress traffic to pods with label 'app: database' only from pods with label 'app: api' in the same namespace. Which NetworkPolicy rule is correct?

Accepted Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - podSelector: { matchLabels: { app: api } }. It defines a NetworkPolicy that selects pods with label 'app: database' as the target (podSelector) and allows ingress traffic only from pods with label 'app: api' (ingress.from.podSelector). This matches the requirement exactly: only pods with 'app: api' can send traffic to pods with 'app: database' within the same namespace, as NetworkPolicy podSelector rules are namespace-scoped by default.

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - ipBlock: { cidr: 10.0.0.0/8 }

Answer

podSelector: { matchLabels: { app: api } }
ingress:
- from:
  - podSelector: { matchLabels: { app: database } }

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - namespaceSelector: { matchLabels: { name: default } }

Question 2

You run 'kubectl port-forward pod/my-pod 8080:80'. What does this command do?

Accepted Answer

Forwards local port 8080 to port 80 on the pod. `kubectl port-forward pod/my-pod 8080:80` creates a tunnel from localhost:8080 on your client machine to port 80 on the specified pod. This command does not expose the pod to the network; it only provides a direct, temporary connection for debugging or accessing a specific pod without a Service.

Answer

Exposes the pod on port 8080 on each node's IP

Answer

Forwards local port 8080 to port 80 on the Service

Answer

Creates a Service that maps port 8080 to port 80 on the pod

Question 3

An Ingress resource has the following annotation: 'kubernetes.io/ingress.class: nginx'. What is the purpose of this annotation?

Accepted Answer

It specifies the Ingress controller to use (e.g., nginx). The annotation `kubernetes.io/ingress.class: nginx` explicitly tells Kubernetes which Ingress controller should process this Ingress resource. In Kubernetes, multiple Ingress controllers (e.g., nginx, haproxy, traefik) can run in the same cluster; this annotation selects the `nginx` controller, ensuring that only that controller reads and implements the routing rules defined in the Ingress.

Answer

It sets a default backend for the Ingress

Answer

It enables session affinity (sticky sessions)

Answer

It enables TLS for the Ingress

Question 4

What is the default Service type when creating a Service via 'kubectl create service' or YAML without specifying type?

Accepted Answer

ClusterIP. When creating a Service via `kubectl create service` or defining it in YAML without specifying the `type` field, Kubernetes defaults to `ClusterIP`. This is because `ClusterIP` is the implicit default type defined in the Service spec, providing internal cluster-wide virtual IP-based load balancing without external exposure.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 5

Which TWO of the following are valid ways to expose a Deployment named 'web' as a Service?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a Service that automatically selects Pods based on the labels defined in the Deployment's pod template. This command generates a ClusterIP Service that maps port 80 on the Service to the target port (defaulting to the same port) on the selected Pods, providing a stable network endpoint for the Deployment's replicas.

Answer

kubectl port-forward deployment/web 8080:80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80

Question 6

Which THREE of the following are true regarding NetworkPolicy in Kubernetes?

Accepted Answer

By default, all traffic is allowed unless a NetworkPolicy selects the pod. Kubernetes NetworkPolicy defaults to an allow-all behavior. If no NetworkPolicy selects a pod, all ingress and egress traffic to that pod is permitted. Only when a NetworkPolicy selects a pod does it enforce the rules defined in that policy, with an implicit deny for any traffic not explicitly allowed.

Answer

NetworkPolicy can block traffic to a specific port on the node's IP

Answer

NetworkPolicy resources can be applied to the kube-system namespace to restrict system pods

Question 7

Which TWO of the following are correct about the ExternalName Service type?

Accepted Answer

It maps a Service to a DNS name, not to pods. An ExternalName Service maps a Service to an external DNS name (e.g., `my-service.default.svc.cluster.local` resolves to `api.example.com`) rather than to a set of pods. It does not use selectors or endpoints; instead, it returns a CNAME record pointing to the external name, enabling in-cluster clients to access external services via a stable Kubernetes Service DNS name.

Answer

It provides load balancing across pods

Answer

It selects pods using a label selector

Answer

It requires a cloud provider load balancer

Question 8

You create a Service with `kubectl expose deployment web --port=80 --target-port=8080`. What type of Service is created by default?

Accepted Answer

ClusterIP. When you run `kubectl expose deployment web --port=80 --target-port=8080` without specifying the `--type` flag, Kubernetes defaults to creating a Service of type ClusterIP. This is because ClusterIP is the default Service type in Kubernetes, providing internal cluster-only access to the pods via a stable virtual IP address.

Answer

LoadBalancer

Answer

NodePort

Answer

ExternalName

Question 9

A developer creates a Deployment with 3 replicas and a Service with `clusterIP: None`. What is the primary use case for this headless Service?

Accepted Answer

To enable direct pod-to-pod communication without load balancing. A headless Service (clusterIP: None) disables the kube-proxy load balancer and DNS round-robin, returning A/AAAA records for all ready pod IPs. This allows client applications to perform direct pod-to-pod communication for stateful workloads like databases or messaging systems that require custom load balancing or leader election.

Answer

To assign a static IP address to the Service

Answer

To automatically create an Ingress resource

Answer

To expose the Service externally via a load balancer

Question 10

A Pod named `my-pod` in namespace `ns1` tries to resolve `svc-a.ns2.svc.cluster.local`. The DNS query fails. The Service `svc-a` exists in namespace `ns2`. What is the most likely cause?

Accepted Answer

The DNS add-on (e.g., CoreDNS) is not deployed or is misconfigured. The DNS query for `svc-a.ns2.svc.cluster.local` fails despite the Service existing, which points to a cluster-wide DNS resolution issue. CoreDNS is the default DNS add-on in Kubernetes that translates service names to IP addresses; if it is not deployed or misconfigured, all DNS queries (including cross-namespace ones) will fail. The fact that the Service exists and the Pod is in a different namespace does not inherently prevent resolution—CoreDNS handles cross-namespace lookups by default.

Answer

The Service `svc-a` does not have any endpoints

Answer

The Pod cannot resolve names from other namespaces

Answer

The Service type is NodePort

Question 11

You apply the following Ingress manifest:
```
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  ingressClassName: nginx
  rules:
  - host: app.example.com
    http:
      paths:
      - pathType: Prefix
        path: /
        backend:
          service:
            name: app-svc
            port:
              number: 80
```
What is missing to enable TLS termination for this Ingress?

Accepted Answer

Add `tls` section under spec with hosts and secretName. D is correct because TLS termination in Kubernetes Ingress requires a `tls` section under `spec` that specifies the `hosts` and a `secretName` referencing a Kubernetes Secret containing the TLS certificate and private key. Without this section, the Ingress will only serve HTTP traffic, even if an ingress controller like nginx is used.

Answer

Create a ConfigMap with the TLS certificate

Answer

Set `service.beta.kubernetes.io/load-balancer-source-ranges` annotation on the Service

Answer

Change the Ingress API version to extensions/v1beta1

Question 12

Which of the following commands creates a LoadBalancer Service named `web-svc` for a Deployment named `web` on port 80?

Accepted Answer

kubectl expose deployment web --name=web-svc --port=80 --type=LoadBalancer. `kubectl expose deployment` creates a Service from an existing Deployment, and the `--name` flag sets the Service name to `web-svc`. The `--port=80` and `--type=LoadBalancer` flags configure the Service to listen on port 80 and expose it externally via a cloud load balancer, which is the standard way to create a LoadBalancer Service for a Deployment.

Answer

kubectl create service web-svc --port=80 --type=LoadBalancer

Answer

kubectl create deployment web --expose --port=80 --type=LoadBalancer

Answer

kubectl expose pod web --port=80 --type=LoadBalancer

Question 13

A NetworkPolicy is applied to a namespace with the following rules:
```
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
```
What is the effect on pods in that namespace?

Accepted Answer

All inbound traffic is denied, outbound traffic is allowed. This NetworkPolicy selects all pods in the namespace (podSelector: {}) and specifies only Ingress in policyTypes. By default, if any NetworkPolicy selects a pod, all traffic not explicitly allowed by a rule is denied. Since no ingress rules are defined, all inbound traffic is denied. Outbound traffic is not restricted because Egress is not listed in policyTypes and no egress rules are defined, so it remains allowed by default.

Answer

All traffic is allowed

Answer

Only traffic from specific namespaces is allowed

Answer

All inbound and outbound traffic is denied

Question 14

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine. Which command should you use?

Accepted Answer

kubectl port-forward pod/my-pod 8080:8080. `kubectl port-forward` creates a direct tunnel from a local port to a pod's port, allowing you to access the pod's HTTP endpoint at `localhost:8080` from your local machine. This is the standard method for temporarily exposing a pod's network endpoint without creating a Service or modifying cluster networking.

Answer

kubectl exec -it pod/my-pod -- curl http://localhost:8080

Answer

kubectl proxy --port=8080

Answer

kubectl attach pod/my-pod

Question 15

A Service named `api` in namespace `default` has multiple endpoints. You run `kubectl get endpoints api` and see no IPs. What is the most likely cause?

Accepted Answer

The Service selector does not match any pods. The most likely cause is that the Service's selector does not match any pods. A Service uses its label selector to identify pods and automatically populate its endpoints. If no pods match the selector, the endpoints list will be empty, resulting in no IPs shown by `kubectl get endpoints api`.

Answer

The Service type is ExternalName

Answer

The namespace has a NetworkPolicy blocking traffic

Answer

The Service has a clusterIP of None