CKAD Services and Networking Practice Test 8 — 15 Questions

Question 1

A developer runs 'kubectl run nginx --image=nginx --port=80' and then creates a Service with the following YAML:

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80

However, the Service has no endpoints. What is the most likely cause?

Accepted Answer

The Service selector 'app: nginx' does not match the pod's label 'run: nginx'. 'kubectl run nginx --image=nginx --port=80' creates a pod with label 'run: nginx', not 'app: nginx'. The Service selects pods with 'app: nginx', so there is no match. The fix is to correct the selector. Option A is correct. Option B is wrong because the pod is running and has ports. Option C is wrong because a Service does not need a selector to have endpoints if created manually. Option D is wrong because the namespace is consistent.

Answer

The Service and pod are in different namespaces

Answer

The Service must have a selector defined in order to have endpoints

Answer

The pod is not listening on port 80

Question 2

Given the following NetworkPolicy YAML:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What is the effect of this policy?

Accepted Answer

Denies all ingress and egress traffic to and from all pods in the namespace. The NetworkPolicy selects all pods in the namespace (empty podSelector). It specifies both Ingress and Egress policyTypes, but no rules under ingress or egress. This means all inbound and outbound traffic is denied for those pods. Option D is correct. Option A is wrong because it mentions 'allow all'. Option B is wrong because it allows traffic that is not explicitly denied (default deny). Option C is wrong because it suggests only ingress is affected.

Answer

Denies all ingress traffic but allows all egress traffic

Answer

Allows all traffic to and from pods in the namespace

Answer

Denies all traffic except traffic that is explicitly allowed by other policies

Question 3

What is the DNS name for a Service named 'backend' in the 'default' namespace?

Accepted Answer

backend.default.svc.cluster.local. The DNS name format for a Service is ..svc.cluster.local. Option A is correct. Option B is missing the namespace. Option C is incorrect because the suffix is .svc.cluster.local, not .svc.cluster. Option D is incorrect because the namespace comes before 'svc'.

Answer

backend.default.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.svc.cluster

Question 4

An Ingress resource is created with the following YAML:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80

Which of the following requests will be routed to the api-svc Service?

Accepted Answer

GET http://example.com/api/users. The Ingress routes requests with host 'example.com' and path prefix '/api' to api-svc. Option A matches both conditions. Option B has wrong host. Option C has wrong path (does not start with /api). Option D has wrong path type requirement (exact match would be needed for trailing slash behavior, but here it's Prefix).

Answer

GET http://example.com/other

Answer

GET http://example.com/api/

Answer

GET http://example.org/api

Answer

GET http://example.com/apix

Question 5

A StatefulSet named 'web' is created with 3 replicas. What is the DNS name for the second pod (index 1)?

Accepted Answer

web-1.web.default.svc.cluster.local. For StatefulSets, pod DNS names follow the format ...svc.cluster.local, where pod names are -. Here, the second pod is web-1. The headless service (assuming a service named 'web') provides DNS. Option C is correct. Option A is incorrect because the pod name is missing. Option B has wrong ordinal. Option D has wrong format (no pod name prefix).

Answer

web-2.web.default.svc.cluster.local

Answer

web.default.svc.cluster.local

Answer

web-1.default.svc.cluster.local

Question 6

You have a Deployment with multiple replicas. You want to expose it via a Service that has a stable IP address and is accessible from outside the cluster on a static port on each node. Which Service type should you use?

Accepted Answer

NodePort. NodePort exposes the Service on a static port on each node's IP, allowing external access. ClusterIP is only internal. LoadBalancer builds on NodePort but requires cloud provider support. ExternalName maps to an external DNS name. Option B is correct.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 7

Which of the following is true about headless services?

Accepted Answer

It has no cluster IP; DNS returns the IPs of the pods. A headless service is created by setting clusterIP: None. It does not have a cluster IP; instead, DNS returns the IP addresses of the pods matching the selector. This is useful for StatefulSets. Option C is correct. Option A is false because it does have a DNS record. Option B is false because it does not perform load balancing. Option D is false because it can have a selector.

Answer

It performs round-robin load balancing across pods

Answer

It provides a single DNS record for the service

Answer

It must not have a selector

Question 8

An administrator wants to allow ingress traffic to pods with label 'app: database' only from pods with label 'app: api' in the same namespace. Which NetworkPolicy rule is correct?

Accepted Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - podSelector: { matchLabels: { app: api } }. The ingress rule should select pods with label 'app: database' as the podSelector, and allow from pods with label 'app: api' via a podSelector in the from block. Option A is correct. Option B selects the wrong pods. Option C uses namespaceSelector, which is not needed. Option D uses ipBlock, which is not appropriate.

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - ipBlock: { cidr: 10.0.0.0/8 }

Answer

podSelector: { matchLabels: { app: api } }
ingress:
- from:
  - podSelector: { matchLabels: { app: database } }

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - namespaceSelector: { matchLabels: { name: default } }

Question 9

You run 'kubectl port-forward pod/my-pod 8080:80'. What does this command do?

Accepted Answer

Forwards local port 8080 to port 80 on the pod. kubectl port-forward forwards local port 8080 to port 80 on the pod. Option A is correct. Option B is wrong because it forwards to a service. Option C is wrong because it does not create a service. Option D is wrong because it does not expose on a node port.

Answer

Exposes the pod on port 8080 on each node's IP

Answer

Forwards local port 8080 to port 80 on the Service

Answer

Creates a Service that maps port 8080 to port 80 on the pod

Question 10

An Ingress resource has the following annotation: 'kubernetes.io/ingress.class: nginx'. What is the purpose of this annotation?

Accepted Answer

It specifies the Ingress controller to use (e.g., nginx). The annotation 'kubernetes.io/ingress.class' specifies which Ingress controller should process this Ingress resource. In Kubernetes 1.18+, this is replaced by the 'ingressClassName' field, but the annotation is still supported. Option B is correct. Option A is wrong because it does not set the type of TLS. Option C is wrong because it does not create a default backend. Option D is wrong because it does not enable sticky sessions.

Answer

It sets a default backend for the Ingress

Answer

It enables session affinity (sticky sessions)

Answer

It enables TLS for the Ingress

Question 11

What is the default Service type when creating a Service via 'kubectl create service' or YAML without specifying type?

Accepted Answer

ClusterIP. The default Service type is ClusterIP. Option A is correct. NodePort, LoadBalancer, and ExternalName require explicit specification.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 12

Which TWO of the following are valid ways to expose a Deployment named 'web' as a Service?

Accepted Answer

kubectl expose deployment web --port=80. Option A is valid: 'kubectl expose deployment web --port=80' creates a ClusterIP Service. Option D is valid: apply a Service YAML that selects the pods. Option B is invalid because 'kubectl run' creates a pod, not a service. Option C is invalid because 'kubectl create service' requires --tcp flag for port, but the command is incomplete. Option E is invalid because 'kubectl port-forward' does not create a Service.

Answer

kubectl port-forward deployment/web 8080:80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80

Question 13

Which THREE of the following are true regarding NetworkPolicy in Kubernetes?

Accepted Answer

By default, all traffic is allowed unless a NetworkPolicy selects the pod. Option A is true: NetworkPolicy is an additive rule; if no policy selects a pod, traffic is allowed by default. Option C is true: you can allow traffic from specific pods in other namespaces using namespaceSelector combined with podSelector. Option D is true: egress rules can restrict outbound traffic. Option B is false: NetworkPolicy cannot block traffic to a specific port on the node; it works at the pod level. Option E is false: NetworkPolicy cannot enforce rules for the kube-system namespace unless explicitly created there.

Answer

NetworkPolicy can block traffic to a specific port on the node's IP

Answer

NetworkPolicy resources can be applied to the kube-system namespace to restrict system pods

Question 14

Which TWO of the following are correct about the ExternalName Service type?

Accepted Answer

It maps a Service to a DNS name, not to pods. Option A is true: ExternalName maps to an external DNS name. Option D is true: It returns a CNAME record. Option B is false: It does not have selectors or pod endpoints. Option C is false: It does not provide load balancing. Option E is false: It does not require a cloud provider.

Answer

It provides load balancing across pods

Answer

It selects pods using a label selector

Answer

It requires a cloud provider load balancer

Question 15

You create a Service with `kubectl expose deployment web --port=80 --target-port=8080`. What type of Service is created by default?

Accepted Answer

ClusterIP. By default, `kubectl expose` creates a ClusterIP Service if no type is specified.

Answer

LoadBalancer

Answer

NodePort

Answer

ExternalName