CKAD Services and Networking Practice Test 8 — 15 Questions

Question 1

An Ingress resource has the following spec:

spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80

What will the Ingress controller do for a request to http://example.com/api/v1/users?

Accepted Answer

Route the request to api-service on port 80.. The Ingress rule uses `pathType: Prefix` and a path of `/api`, which matches any request whose URL path begins with `/api`. The request to `http://example.com/api/v1/users` starts with `/api`, so the Ingress controller routes it to `api-service` on port 80. This is the standard behavior defined by the Kubernetes Ingress specification for prefix-based path matching.

Answer

Route the request to the default backend.

Answer

Return a 502 Bad Gateway error.

Answer

Return 404 Not Found because the path does not match exactly.

Question 2

Which of the following is a valid NetworkPolicy that allows ingress traffic only from pods with label 'role: frontend' in any namespace?

Accepted Answer

ingress:
- from:
  - namespaceSelector: {}
    podSelector:
      matchLabels:
        role: frontend. It uses a `namespaceSelector: {}` (which matches all namespaces) combined with a `podSelector` that selects pods with label `role: frontend`. This combination allows ingress traffic from pods with that label in any namespace, which is exactly what the question requires. In Kubernetes NetworkPolicy, when you want to select pods across all namespaces, you must include an empty `namespaceSelector` alongside the `podSelector`.

Answer

ingress:
- from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

ingress:
- from:
  - podSelector:
      matchLabels:
        role: frontend

Answer

ingress:
- from:
  - namespaceSelector:
      matchLabels:
        role: frontend

Question 3

What is the purpose of the `IngressClass` resource in Kubernetes?

Accepted Answer

To specify which Ingress controller should implement the Ingress.. The `IngressClass` resource decouples the Ingress definition from the specific Ingress controller implementation. It allows you to specify which controller (e.g., NGINX, HAProxy, Traefik) should process the Ingress by referencing the `spec.controller` field, enabling multi-controller clusters and dynamic routing decisions.

Answer

To enable path-based routing.

Answer

To define the TLS certificate for an Ingress.

Answer

To set the default backend for an Ingress.

Question 4

Which THREE of the following are true about Kubernetes Services? (Select 3)

Accepted Answer

The NodePort range is 30000-32767 by default.. The default NodePort range in Kubernetes is 30000-32767, as defined by the kube-apiserver's --service-node-port-range flag. This range ensures that NodePorts do not conflict with well-known or ephemeral ports used by system services.

Answer

Headless Services have a ClusterIP assigned.

Answer

Services can only expose one port.

Question 5

Which TWO of the following are valid Ingress path types? (Select 2)

Accepted Answer

Exact. In Kubernetes Ingress, the `spec.rules.http.paths[].pathType` field supports two valid types: `Exact` and `Prefix`. `Exact` matches the URL path exactly, case-sensitive, and is used when you need a precise match without any wildcard or prefix behavior.

Answer

Glob

Answer

Wildcard

Answer

Regex

Question 6

A developer wants to expose a Deployment named 'web-app' (with label 'app: web') as a ClusterIP service on port 80. Which command achieves this?

Accepted Answer

kubectl expose deployment web-app --port=80. `kubectl expose deployment web-app --port=80` creates a ClusterIP Service that selects Pods based on the labels of the specified Deployment (in this case, `app: web`). The `expose` command automatically reads the Pod template labels from the Deployment and applies them as the Service's selector, then maps the Service's port 80 to the target port of the containers in the selected Pods.

Answer

kubectl expose service web-app --port=80

Answer

kubectl create service clusterip web-app --tcp=80

Answer

kubectl expose pod web-app --port=80

Question 7

You have a headless service 'db' in namespace 'data'. Pods in that namespace can resolve 'db.data.svc.cluster.local'. What is the effect of a headless service on DNS resolution?

Accepted Answer

It returns a round-robin list of pod IPs. A headless service (with `clusterIP: None`) does not have a ClusterIP, so DNS queries for the service name return the IP addresses of all ready pods backing the service, rather than a single virtual IP. This enables client-side load balancing via DNS round-robin, as the DNS resolver returns multiple A records that the client can cycle through. Option C correctly describes this behavior.

Answer

It does not create any DNS record

Answer

It returns the IP of the first pod

Answer

It returns the ClusterIP of the service

Question 8

An Ingress resource is defined as:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: test-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-service
            port:
              number: 80
  tls:
  - hosts:
    - example.com
    secretName: tls-secret
What must exist in the cluster for TLS termination to work?

Accepted Answer

A Secret named tls-secret of type kubernetes.io/tls in the same namespace. C is correct because TLS termination requires the actual TLS certificate and key to be stored in a Kubernetes Secret of type `kubernetes.io/tls`. The Ingress controller reads this Secret to terminate HTTPS connections, decrypting traffic before forwarding it to the backend service. Without this Secret, the Ingress controller cannot present a valid certificate to clients.

Answer

An IngressClass annotation specifying the ingress controller

Answer

A ServiceAccount named tls-secret

Answer

A ConfigMap named tls-secret with certificate data

Question 9

A NetworkPolicy with the following spec is applied:
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          role: frontend
What does this policy do?

Accepted Answer

Allows incoming traffic from pods labeled 'role: frontend' to all pods. This NetworkPolicy selects all pods (empty podSelector `{}`) and defines an ingress rule that only allows incoming traffic from pods with the label `role: frontend`. By default, Kubernetes NetworkPolicies are additive and deny all traffic that is not explicitly allowed, so this policy permits ingress from frontend pods to all pods while blocking all other inbound traffic.

Answer

Allows all outgoing traffic from pods labeled 'role: frontend'

Answer

Blocks all incoming traffic to pods labeled 'role: frontend'

Answer

Has no effect because policyTypes is missing Egress

Question 10

You need to access a database pod 'db-pod' on port 5432 from your local machine. Which command forwards local port 15432 to the pod's port 5432?

Accepted Answer

kubectl port-forward pod/db-pod 15432:5432. `kubectl port-forward` creates a direct tunnel from a local port to a port on a specific pod. The syntax `kubectl port-forward pod/db-pod 15432:5432` forwards local port 15432 to the pod's port 5432, allowing you to access the database as if it were running locally.

Answer

kubectl proxy --port=15432 db-pod:5432

Answer

kubectl expose pod db-pod --port=15432 --target-port=5432

Answer

kubectl port-forward db-pod 5432:15432

Question 11

What is the default service type in Kubernetes?

Accepted Answer

ClusterIP. The default service type in Kubernetes is ClusterIP, which exposes the service on a cluster-internal IP address. This makes the service reachable only from within the cluster, enabling pod-to-pod communication without external access. If no `type` field is specified in the Service manifest, Kubernetes automatically sets `type: ClusterIP`.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 12

A ClusterIP service named 'svc' has no endpoints. Which command can you use to debug why the service is not routing traffic?

Accepted Answer

kubectl get endpoints svc. `kubectl get endpoints svc` directly shows the list of pod IPs and ports that the ClusterIP service is routing traffic to. If the service has no endpoints, this command will return an empty list, confirming that no pods match the service's selector, which is the most common reason for traffic not being routed.

Answer

kubectl describe service svc

Answer

kubectl logs svc

Answer

kubectl exec -it svc -- /bin/sh

Question 13

What annotation is required on an Ingress resource to use a specific IngressClass (e.g., 'nginx')?

Accepted Answer

kubernetes.io/ingress.class: nginx. The `kubernetes.io/ingress.class` annotation is the legacy method to specify the IngressClass for an Ingress resource. This annotation tells the Ingress controller (e.g., nginx) which controller should process the Ingress rules. In Kubernetes 1.18+, the preferred method is the `spec.ingressClassName` field, but the annotation is still widely supported for backward compatibility.

Answer

kubernetes.io/ingress-type: nginx

Answer

ingress.kubernetes.io/class: nginx

Answer

kubernetes.io/class: nginx

Question 14

A NetworkPolicy denies all ingress traffic to a namespace. Which rule would allow traffic only from pods in the same namespace?

Accepted Answer

from:
  - podSelector: {}. A `podSelector: {}` in a NetworkPolicy ingress rule selects all pods in the same namespace as the policy, effectively allowing traffic only from pods within that namespace. This works because the empty podSelector matches all pods in the namespace where the NetworkPolicy is applied, and no namespaceSelector is specified, so the rule is scoped to the local namespace only.

Answer

from:
  - namespaceSelector: {}
    podSelector: {}

Answer

from:
  - ipBlock:
      cidr: 0.0.0.0/0

Answer

from:
  - namespaceSelector:
      matchLabels:
        name: mynamespace

Question 15

You want to expose a Deployment 'app' externally on port 30080 on each node. What service type should you use?

Accepted Answer

NodePort. A NodePort service exposes the Deployment on a static port (30080) on each node's IP address, making it accessible externally via <NodeIP>:30080. This is the correct choice because the requirement explicitly asks to expose the app on port 30080 on each node, which matches the NodePort service type's behavior of opening a specific port on every node in the cluster.

Answer

LoadBalancer

Answer

ExternalName

Answer

ClusterIP