CKAD Services and Networking Practice Test 7 — 15 Questions

Question 1

Which Service type is used to expose a service externally on a static port on each worker node?

Accepted Answer

NodePort. A NodePort service exposes the application on a static port (in the range 30000-32767) on every worker node's IP address. This allows external traffic to reach the service by targeting any node's IP and the assigned NodePort, making it the correct choice for exposing a service externally on a static port per node.

Answer

ExternalName

Answer

ClusterIP

Answer

LoadBalancer

Question 2

A user runs 'kubectl get endpoints my-service' and sees no endpoints listed. The service has a selector 'app: my-app'. Pods with that label exist and are running. What is the most likely cause?

Accepted Answer

The pods are not ready (readiness probe failing). In Kubernetes, a Service creates Endpoints only for pods that match its selector and are ready. Because the pods are labeled app: my-app and match the selector, the missing endpoints indicate the pods are not passing their readiness probes.

Answer

The service selector does not match the pod labels

Answer

The pods are not assigned an IP address

Answer

The service name is incorrect

Question 3

You have an Ingress with TLS configured. The Ingress controller returns a certificate error when accessing via HTTPS. The secret 'my-tls' exists in the same namespace. Which of the following is the most likely cause?

Accepted Answer

The secret name in the TLS section of the Ingress does not match the actual secret name. The most likely cause is that the secret name specified in the TLS section of the Ingress resource does not match the actual name of the Secret object. When TLS is configured, the Ingress controller reads the `secretName` field to fetch the certificate and key; a mismatch causes the controller to fail to load the TLS material, resulting in a certificate error. Since the secret exists in the same namespace, the only plausible issue is a naming mismatch.

Answer

The Ingress controller does not support TLS

Answer

The secret is in a different namespace than the Ingress

Answer

The certificate is not signed by a trusted CA

Question 4

You need to allow ingress traffic to pods in namespace 'api' only from pods in namespace 'frontend' that have label 'role: proxy'. Which NetworkPolicy ingress rule correctly implements this?

Accepted Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        name: frontend
    podSelector:
      matchLabels:
        role: proxy. It combines a namespaceSelector (to match the 'frontend' namespace) with a podSelector (to match pods with label 'role: proxy') in the same ingress rule. This ensures that only traffic from pods in the 'frontend' namespace that also have the label 'role: proxy' is allowed, fulfilling the requirement precisely.

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        name: frontend

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0
  - podSelector:
      matchLabels:
        role: proxy

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: proxy

Question 5

Which TWO of the following are valid ways to expose a service externally on a Kubernetes cluster? (Select 2)

Accepted Answer

NodePort. A NodePort service exposes the service on a static port on each node's IP address, making it accessible from outside the cluster via `:`. This is a valid method for external exposure, as it opens a port in the node's firewall and routes traffic to the service.

Answer

kubectl port-forward

Answer

ExternalName

Answer

ClusterIP

Question 6

Which TWO of the following are true about headless services? (Select 2)

Accepted Answer

DNS returns multiple A records, one for each pod's IP. Headless services (with clusterIP: None) cause DNS to return multiple A records, one for each pod's IP address, rather than a single virtual IP. This allows direct pod-to-pod DNS resolution, which is essential for stateful applications like databases that need to discover individual pod endpoints.

Answer

They provide a stable virtual IP for load balancing

Answer

They cannot have a selector

Answer

They are used exclusively with Deployments

Question 7

Which Service type is used to expose a Service on a static port on each node's IP address, allowing external traffic to reach the Service?

Accepted Answer

NodePort. NodePort is the correct Service type because it exposes the Service on a static port (in the range 30000-32767) on each node's IP address. This allows external traffic to reach the Service by sending requests to any node's IP at that port, which then forwards traffic to the appropriate Pods via the ClusterIP and kube-proxy rules.

Answer

ClusterIP

Answer

ExternalName

Answer

LoadBalancer

Question 8

A developer runs `kubectl expose deployment web-deploy --port=80 --target-port=8080 --type=NodePort` and later wants to access the Service from outside the cluster. What is the correct way to find the external port?

Accepted Answer

Run `kubectl describe svc web-deploy` and look for the NodePort field.. `kubectl expose` with `--type=NodePort` creates a Service that maps a high-port (30000-32767) on each cluster node to the target container port. The `kubectl describe svc web-deploy` output includes the `NodePort` field, which shows this externally accessible port. To reach the Service from outside the cluster, you must use the node's external IP combined with this NodePort, not the Service's cluster-internal port (80).

Answer

Run `kubectl get nodes -o wide` and use the node's external IP and port 80.

Answer

Run `kubectl get pod -l app=web-deploy` and use the pod IP with port 8080.

Answer

Run `kubectl get svc web-deploy -o yaml` and look for `spec.ports[0].port`.

Question 9

An admin creates a Service without a selector. Which of the following is true about such a Service?

Accepted Answer

The admin must manually create an Endpoints object with the desired IPs.. When a Service is created without a selector, Kubernetes does not automatically manage its endpoints. The admin must manually create an Endpoints object (or use an EndpointSlice) that lists the IP addresses and ports to which the Service should route traffic. This allows the Service to direct traffic to external resources, such as databases running outside the cluster, or to specific pods not matching a label selector.

Answer

The Service will use the default ClusterIP and route to all pods in the cluster.

Answer

The Service will automatically route traffic to all pods in the namespace.

Answer

The Service will not have any endpoints until a selector is added.

Question 10

What is the primary purpose of a headless Service (clusterIP: None) in Kubernetes?

Accepted Answer

To allow DNS resolution to return all pod IPs for a StatefulSet.. Headless Services are used with StatefulSets to provide stable network identities for pods, allowing direct pod-to-pod communication without a load-balanced IP.

Answer

To prevent external access to the Service.

Answer

To provide a stable IP address for the Service.

Answer

To enable load balancing across pods.

Question 11

Which of the following Ingress controllers is commonly used in Kubernetes?

Accepted Answer

NGINX. NGINX is the most widely adopted Ingress controller in Kubernetes, providing a reverse proxy that routes external HTTP/HTTPS traffic to services based on Ingress resource rules. It is officially maintained by the Kubernetes community and supports advanced features like SSL termination, load balancing, and path-based routing, making it the default choice for many production clusters.

Answer

IIS

Answer

Apache

Answer

Tomcat

Question 12

An admin applies the following NetworkPolicy:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What effect does this policy have?

Accepted Answer

Denies all ingress and egress traffic to all pods in the namespace.. The NetworkPolicy with an empty `podSelector: {}` selects all pods in the namespace, and specifying `policyTypes: [Ingress, Egress]` with no rules under `ingress` or `egress` means no traffic is explicitly allowed. By default, Kubernetes NetworkPolicies are whitelist-based: if a policy selects a pod, any traffic not explicitly permitted is denied. Thus, this policy denies all ingress and egress traffic to all pods in the namespace.

Answer

Allows all traffic because no rules are specified.

Answer

Only denies egress traffic; ingress is allowed.

Answer

Only denies ingress traffic; egress is allowed.

Question 13

A pod in namespace 'app' needs to resolve the DNS name 'db-service.data.svc.cluster.local'. What is the likely namespace of the 'db-service' Service?

Accepted Answer

data. The DNS name 'db-service.data.svc.cluster.local' follows the Kubernetes DNS specification for Services, which has the format ..svc.cluster.local. The second component (after the first dot) is the namespace. Here, 'data' is the namespace of the Service, so the correct answer is B.

Answer

app

Answer

svc

Answer

default

Question 14

An admin wants to expose a Service only for internal cluster communication, without external access. Which Service type should they use?

Accepted Answer

ClusterIP. ClusterIP is the default Kubernetes Service type and exposes the Service on a cluster-internal IP address, making it reachable only from within the cluster. This is the correct choice for internal cluster communication because no external endpoints are created, and traffic is routed via kube-proxy using iptables or IPVS rules.

Answer

ExternalName

Answer

NodePort

Answer

LoadBalancer

Question 15

What is the correct command to forward a local port to a pod for debugging?

Accepted Answer

kubectl port-forward pod/my-pod 8080:80. `kubectl port-forward` creates a tunnel from a local port (8080) to a target port (80) on a pod, enabling direct network access for debugging without exposing the pod externally. This command is specifically designed for forwarding traffic to pods, services, or deployments in Kubernetes.

Answer

kubectl expose pod my-pod --port=8080

Answer

kubectl attach pod/my-pod

Answer

kubectl proxy pod/my-pod 8080:80