CKAD Services and Networking Practice Test 8 — 15 Questions

Question 1

Which Service type is used to expose a Service on a static port on each node in the cluster?

Accepted Answer

NodePort. NodePort is the correct Service type because it exposes the Service on a static port (in the range 30000-32767) on every node's IP address in the cluster. Traffic sent to any node's IP on that port is forwarded to the Service's ClusterIP and then to the selected Pods, enabling external access without a cloud load balancer.

Answer

ClusterIP

Answer

ExternalName

Answer

LoadBalancer

Question 2

You create a Service with the following YAML:
```
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - name: http
    port: 80
    targetPort: 8080
  selector:
    app: my-app
```
What is the default Service type?

Accepted Answer

ClusterIP. When no `type` field is specified in a Service YAML, Kubernetes defaults to `ClusterIP`. This assigns a stable internal IP address reachable only within the cluster, enabling pod-to-pod communication without external exposure. The `spec.type` field is optional, and `ClusterIP` is the implicit default.

Answer

NodePort

Answer

LoadBalancer

Answer

ExternalName

Question 3

An Ingress has two rules:
- host: app.example.com, path: /api -> service-a:80
- host: api.example.com, path: / -> service-b:80
A request to `app.example.com/api/v1` reaches which service?

Accepted Answer

service-a. Ingress rules match the longest prefix of the request path for the given host. For `app.example.com/api/v1`, the path `/api` is a prefix match (since `/api/v1` starts with `/api`), so it routes to service-a:80. The second rule requires host `api.example.com`, which does not match, so service-b is not considered.

Answer

Both services

Answer

Neither service

Answer

service-b

Question 4

What is the DNS name for a Service named `svc` in namespace `ns`?

Accepted Answer

svc.ns.svc.cluster.local. B is correct because Kubernetes constructs the DNS name for a Service using the format `..svc.cluster.local`. For a Service named `svc` in namespace `ns`, this becomes `svc.ns.svc.cluster.local`. This allows Pods to resolve the Service by its fully qualified domain name (FQDN) within the cluster, leveraging CoreDNS or kube-dns.

Answer

svc.cluster.local

Answer

svc.svc.cluster.local

Answer

ns.svc.cluster.local

Question 5

Which TWO statements about NetworkPolicy are correct? (Choose two.)

Accepted Answer

NetworkPolicy uses labels to select pods within a namespace. NetworkPolicy uses label selectors in its `spec.podSelector` field to identify which pods within a namespace the policy applies to. This allows fine-grained control over traffic to and from specific sets of pods based on their labels, without needing to reference pod names or IPs.

Answer

If no NetworkPolicy selects a pod, then that pod is isolated and traffic is denied

Answer

NetworkPolicy is only applicable to Services

Answer

NetworkPolicy is a cluster-scoped resource

Question 6

Which THREE are valid fields in a NetworkPolicy spec? (Choose three.)

Accepted Answer

podSelector. `podSelector` is a required field in a NetworkPolicy spec that defines which pods the policy applies to, using standard Kubernetes label selectors. It must be present to target specific pods within a namespace, and an empty `podSelector` selects all pods in the namespace.

Answer

ports

Answer

ipBlock

Question 7

You have a Deployment named 'web' with label 'app: web'. You want to create a Service that exposes the Deployment on port 80 internally within the cluster. Which kubectl command achieves this?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a ClusterIP Service that selects Pods based on the Deployment's label selector (app: web) and exposes port 80 internally within the cluster. This command directly maps the Deployment's Pods to a Service without requiring manual specification of the target port or protocol, defaulting to TCP.

Answer

kubectl create service clusterip web --tcp=80

Answer

kubectl create deployment web --image=nginx --expose --port=80

Answer

kubectl expose pod web --port=80

Question 8

A Service of type NodePort is created with 'spec.ports[0].nodePort: 30080'. The cluster nodes have IPs 10.0.0.1, 10.0.0.2. Which command can be used to test connectivity to the Service from outside the cluster?

Accepted Answer

curl 10.0.0.1:30080. A NodePort service exposes the same port (nodePort: 30080) on every cluster node's IP address. From outside the cluster, you can reach the service by targeting any node's IP and the nodePort, so `curl 10.0.0.1:30080` will connect to the service via node 10.0.0.1.

Answer

curl 10.0.0.1:80 --header 'Host: service.namespace.svc.cluster.local'

Answer

curl 10.0.0.1:80

Answer

curl 10.96.0.1:30080

Question 9

You have a Service named 'app-service' in namespace 'default'. You want a pod in namespace 'monitoring' to resolve the service DNS name. What is the correct fully qualified domain name (FQDN)?

Accepted Answer

app-service.default.svc.cluster.local. The standard FQDN for a Kubernetes Service follows the pattern `..svc.cluster.local`. This allows a pod in any namespace (including 'monitoring') to resolve the service by appending the cluster's DNS suffix. The DNS query for `app-service.default.svc.cluster.local` will be handled by CoreDNS (or kube-dns) and return the cluster IP of the service.

Answer

app-service.default.cluster.local

Answer

app-service.svc.default.cluster.local

Answer

app-service.cluster.local.default.svc

Question 10

You have a headless Service for a StatefulSet. What is the DNS resolution behavior for the StatefulSet pods?

Accepted Answer

Each pod gets a DNS A record pointing to its individual IP.. For a headless Service (clusterIP: None) associated with a StatefulSet, DNS resolution returns individual A records for each pod, mapping the pod's hostname (e.g., pod-name.service-name.namespace.svc.cluster.local) to its unique pod IP. This is because headless Services disable load-balanced cluster IPs and instead rely on DNS to provide direct pod-to-pod connectivity, which is essential for StatefulSet workloads like databases that require stable network identities.

Answer

DNS is disabled for headless Services.

Answer

The Service name resolves to the IP of the first pod only.

Answer

All pods share a single cluster IP via the Service.

Question 11

Which Service type is used to expose a Service externally using a cloud provider's load balancer?

Accepted Answer

LoadBalancer. The LoadBalancer service type provisions an external load balancer from the underlying cloud provider (e.g., AWS ELB, GCP TCP/UDP Load Balancer) and assigns a public IP or DNS name to route external traffic to the Service's ClusterIP and NodePort. This is the correct choice because it directly exposes the Service externally via the cloud provider's infrastructure, unlike other types that either expose internally or require manual configuration.

Answer

NodePort

Answer

ExternalName

Answer

ClusterIP

Question 12

An Ingress resource is configured with TLS. Which field in the Ingress YAML specifies the secret containing the TLS certificate and key?

Accepted Answer

spec.tls[].secretName. In Kubernetes, TLS configuration for an Ingress is defined under the `spec.tls` array. Each entry in this array must include a `secretName` field that references a Kubernetes Secret of type `kubernetes.io/tls` containing the TLS certificate and private key. This is the only field that correctly specifies the secret name, as per the Kubernetes API specification.

Answer

metadata.annotations['tls-secret']

Answer

spec.tls[].secret

Answer

spec.secretName

Question 13

Which kubectl command forwards local port 8080 to port 80 of a pod named 'web-pod'?

Accepted Answer

kubectl port-forward pod/web-pod 8080:80. `kubectl port-forward` is the command used to forward a local port to a port on a specific pod. The syntax is `kubectl port-forward pod/

:`, so `kubectl port-forward pod/web-pod 8080:80` forwards local port 8080 to port 80 on the pod named 'web-pod'.

Answer

kubectl port-forward pod/web-pod 80:8080

Answer

kubectl expose pod web-pod --port=8080 --target-port=80

Answer

kubectl proxy pod/web-pod 8080:80

Question 14

You have a Service named 'api' with selectors that match pods. However, curl to the Service cluster IP times out. 'kubectl get endpoints api' shows no endpoints. What is the most likely cause?

Accepted Answer

The Service's selector does not match any pod labels.. When a Service has no endpoints, it means the Service's selector query returned zero matching pods. Since `kubectl get endpoints api` shows no endpoints, the most likely cause is that the selector labels defined in the Service do not match the labels on any running pods. This is the first thing to check when a Service is unreachable.

Answer

The Service is of type ExternalName.

Answer

The pods are not listening on the target port.

Answer

The Service is in a different namespace than the pods.

Question 15

An Ingress resource uses host-based routing. Which field in the Ingress YAML specifies the host header to match?

Accepted Answer

spec.rules[].host. In Kubernetes, host-based routing in an Ingress resource is configured using the `spec.rules[].host` field. This field specifies the fully qualified domain name (FQDN) that the Ingress controller should match against the `Host` header of incoming HTTP requests. When a request arrives with a matching `Host` header, the Ingress controller routes it to the backend service defined under that rule.

Answer

metadata.annotations['nginx.ingress.kubernetes.io/rewrite-target']

Answer

spec.tls[].hosts

Answer

spec.rules[].http.paths[].host