CKAD Services and Networking Practice Test 9 — 15 Questions

Question 1

Which of the following is true about Istio as a service mesh?

Accepted Answer

It injects a sidecar proxy into each pod. Istio is a service mesh that deploys an Envoy sidecar proxy alongside each application pod. This sidecar intercepts all inbound and outbound traffic, enabling advanced traffic management, observability, and security features without modifying application code. The sidecar injection is typically done automatically via a mutating webhook admission controller.

Answer

It replaces kube-proxy for service routing

Answer

It only works with HTTP traffic

Answer

It requires all services to be of type LoadBalancer

Question 2

Which THREE statements about NetworkPolicy are correct?

Accepted Answer

A single NetworkPolicy can contain both ingress and egress rules. A single NetworkPolicy resource can define both ingress and egress rules within its spec. The `spec.policyTypes` field explicitly lists which rule types are applied; if both `Ingress` and `Egress` are specified, the policy governs both directions. This allows administrators to enforce bidirectional traffic controls with a single policy object.

Answer

NetworkPolicy is a cluster-scoped resource

Answer

NetworkPolicy can only be applied to pods with a specific annotation

Question 3

Which TWO of the following are valid service types in Kubernetes?

Accepted Answer

NodePort. NodePort is a valid Kubernetes service type that exposes a service on a static port on each node's IP address, allowing external traffic to reach the service. It builds on top of ClusterIP by creating a cluster-wide port mapping that forwards traffic from the node's port to the service's ClusterIP and target port.

Answer

Headless

Answer

Ingress

Answer

Gateway

Question 4

A developer runs 'kubectl run nginx --image=nginx --port=80' and then creates a Service with the following YAML:

apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80

However, the Service has no endpoints. What is the most likely cause?

Accepted Answer

The Service selector 'app: nginx' does not match the pod's label 'run: nginx'. The `kubectl run nginx --image=nginx --port=80` command creates a pod with a default label `run: nginx`, not `app: nginx`. The Service's selector `app: nginx` therefore does not match any pod's labels, so the Service's endpoint controller finds no pods to add to the endpoints list. Without matching labels, the Service cannot route traffic to any pod, resulting in zero endpoints.

Answer

The Service and pod are in different namespaces

Answer

The Service must have a selector defined in order to have endpoints

Answer

The pod is not listening on port 80

Question 5

Given the following NetworkPolicy YAML:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

What is the effect of this policy?

Accepted Answer

Denies all ingress and egress traffic to and from all pods in the namespace. This NetworkPolicy uses an empty `podSelector: {}` which selects all pods in the namespace. By specifying both `Ingress` and `Egress` in `policyTypes` without any `ingress` or `egress` rules, the policy defaults to denying all ingress and egress traffic. In Kubernetes, NetworkPolicy rules are additive (allow-listed), so an empty rules list means no traffic is permitted, effectively creating a default-deny for both directions.

Answer

Denies all ingress traffic but allows all egress traffic

Answer

Allows all traffic to and from pods in the namespace

Answer

Denies all traffic except traffic that is explicitly allowed by other policies

Question 6

What is the DNS name for a Service named 'backend' in the 'default' namespace?

Accepted Answer

backend.default.svc.cluster.local. In Kubernetes, a Service named 'backend' in the 'default' namespace is assigned a DNS name following the pattern `..svc.cluster.local`. This is the standard internal DNS resolution format used by CoreDNS (or kube-dns) for cluster-local services. Option B correctly follows this pattern: `backend.default.svc.cluster.local`.

Answer

backend.default.cluster.local

Answer

backend.svc.cluster.local

Answer

backend.default.svc.cluster

Question 7

An Ingress resource is created with the following YAML:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
spec:
  rules:
  - host: example.com
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: api-svc
            port:
              number: 80

Which of the following requests will be routed to the api-svc Service? (Select all that apply.)

Accepted Answer

GET http://example.com/api/. Based on the Ingress YAML, the host must be 'example.com' and the path must match the prefix '/api' according to pathType: Prefix, which matches based on URL path elements split by '/'. /api/ and /api/users are valid matches because the first path element 'api' matches and then the prefix ends. /apix does not match because 'apix' is not an element-wise prefix of 'api'. Option A fails due to path '/other'. Option C fails due to host 'example.org'. Therefore, only options B and E are correct.

Answer

GET http://example.com/other

Answer

GET http://example.org/api

Answer

GET http://example.com/apix

Question 8

A StatefulSet named 'web' is created with 3 replicas. What is the DNS name for the second pod (index 1)?

Accepted Answer

web-1.web.default.svc.cluster.local. In Kubernetes, a StatefulSet creates pods with a stable, ordinal hostname based on the pattern `-`. The second pod (index 1) is named `web-1`. When a headless Service (named `web`) is associated with the StatefulSet, each pod gets a DNS A record in the form `...svc.cluster.local`. Therefore, the correct DNS name is `web-1.web.default.svc.cluster.local`.

Answer

web-2.web.default.svc.cluster.local

Answer

web.default.svc.cluster.local

Answer

web-1.default.svc.cluster.local

Question 9

You have a Deployment with multiple replicas. You want to expose it via a Service that has a stable IP address and is accessible from outside the cluster on a static port on each node. Which Service type should you use?

Accepted Answer

NodePort. A NodePort Service type exposes the application on a static port (in the range 30000-32767) on every node's IP address, making it accessible from outside the cluster. This satisfies the requirement for a stable IP (the node's IP) and a static port on each node, while also providing a stable ClusterIP for internal use.

Answer

LoadBalancer

Answer

ClusterIP

Answer

ExternalName

Question 10

Which of the following is true about headless services?

Accepted Answer

It has no cluster IP; DNS returns the IPs of the pods. A headless service is created by setting `clusterIP: None` in the Service spec. Because it has no Cluster IP, kube-proxy does not create any load-balancing rules for it. Instead, the DNS lookup for the service name returns the IP addresses of all ready pods backing the service, allowing direct pod-to-pod communication without a proxy.

Answer

It performs round-robin load balancing across pods

Answer

It provides a single DNS record for the service

Answer

It must not have a selector

Question 11

An administrator wants to allow ingress traffic to pods with label 'app: database' only from pods with label 'app: api' in the same namespace. Which NetworkPolicy rule is correct?

Accepted Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - podSelector: { matchLabels: { app: api } }. It defines a NetworkPolicy that selects pods with label 'app: database' as the target (podSelector) and allows ingress traffic only from pods with label 'app: api' (ingress.from.podSelector). This matches the requirement exactly: only pods with 'app: api' can send traffic to pods with 'app: database' within the same namespace, as NetworkPolicy podSelector rules are namespace-scoped by default.

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - ipBlock: { cidr: 10.0.0.0/8 }

Answer

podSelector: { matchLabels: { app: api } }
ingress:
- from:
  - podSelector: { matchLabels: { app: database } }

Answer

podSelector: { matchLabels: { app: database } }
ingress:
- from:
  - namespaceSelector: { matchLabels: { name: default } }

Question 12

You run 'kubectl port-forward pod/my-pod 8080:80'. What does this command do?

Accepted Answer

Forwards local port 8080 to port 80 on the pod. `kubectl port-forward pod/my-pod 8080:80` creates a tunnel from localhost:8080 on your client machine to port 80 on the specified pod. This command does not expose the pod to the network; it only provides a direct, temporary connection for debugging or accessing a specific pod without a Service.

Answer

Exposes the pod on port 8080 on each node's IP

Answer

Forwards local port 8080 to port 80 on the Service

Answer

Creates a Service that maps port 8080 to port 80 on the pod

Question 13

An Ingress resource has the following annotation: 'kubernetes.io/ingress.class: nginx'. What is the purpose of this annotation?

Accepted Answer

It specifies the Ingress controller to use (e.g., nginx). The annotation `kubernetes.io/ingress.class: nginx` explicitly tells Kubernetes which Ingress controller should process this Ingress resource. In Kubernetes, multiple Ingress controllers (e.g., nginx, haproxy, traefik) can run in the same cluster; this annotation selects the `nginx` controller, ensuring that only that controller reads and implements the routing rules defined in the Ingress.

Answer

It sets a default backend for the Ingress

Answer

It enables session affinity (sticky sessions)

Answer

It enables TLS for the Ingress

Question 14

What is the default Service type when creating a Service via 'kubectl create service' or YAML without specifying type?

Accepted Answer

ClusterIP. When creating a Service via `kubectl create service` or defining it in YAML without specifying the `type` field, Kubernetes defaults to `ClusterIP`. This is because `ClusterIP` is the implicit default type defined in the Service spec, providing internal cluster-wide virtual IP-based load balancing without external exposure.

Answer

NodePort

Answer

ExternalName

Answer

LoadBalancer

Question 15

Which TWO of the following are valid ways to expose a Deployment named 'web' as a Service?

Accepted Answer

kubectl expose deployment web --port=80. `kubectl expose deployment web --port=80` creates a Service that automatically selects Pods based on the labels defined in the Deployment's pod template. This command generates a ClusterIP Service that maps port 80 on the Service to the target port (defaulting to the same port) on the selected Pods, providing a stable network endpoint for the Deployment's replicas.

Answer

kubectl port-forward deployment/web 8080:80

Answer

kubectl run web --image=nginx --port=80

Answer

kubectl create service clusterip web --tcp=80:80