EX280 Networking And Network Policies Practice Test 4 — 15 Questions

Question 1

Which TWO statements are true regarding OpenShift Services of type LoadBalancer? (Choose TWO)

Accepted Answer

They interact with cloud provider APIs or MetalLB to provision an external IP address.. LoadBalancer services provision external load balancers via cloud provider integrations and automatically program NodePort mappings underneath.

Answer

They are restricted to internal cluster communication only.

Answer

They replace the need for Ingress controllers completely.

Answer

They can only be created when running on bare-metal hardware without external integrations.

Question 2

Which TWO methods can an administrator use to troubleshoot why a pod cannot connect to a remote Service? (Choose TWO)

Accepted Answer

Verifying that the target service has valid endpoints pointing to running pods.. Checking service endpoints and testing connectivity with nc/telnet/curl are standard troubleshooting steps.

Answer

Restarting the cluster storage provider pods.

Answer

Deleting all persistent volume claims.

Answer

Modifying the global MachineConfig pool.

Question 3

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

Accepted Answer

If an ingress policy is present, the connection must be explicitly permitted by at least one rule.. Traffic must not be blocked by default namespace isolation, the source must match the ingress rule selector, and the port/protocol must match.

Answer

The cluster must have exactly three worker nodes.

Answer

The physical switch port on the top-of-rack switch must be configured in trunk mode.

Question 4

An administrator needs to expose an internal application running on port 8080 via an OpenShift Route using edge termination. Which object configuration correctly defines this Route?

Accepted Answer

kind: Route
metadata:
  name: my-app
spec:
  to:
    kind: Service
    name: my-service
  port:
    targetPort: 8080
  tls:
    termination: edge. An edge terminated route requires the TLS configuration block with termination set to edge, while the target port references the container port 8080.

Answer

kind: Route
metadata:
  name: my-app
spec:
  to:
    kind: Service
    name: my-service
  port:
    targetPort: 8080
  tls:
    termination: passthrough

Answer

kind: Route
metadata:
  name: my-app
spec:
  to:
    kind: Service
    name: my-service
  port:
    targetPort: 8080

Answer

kind: Route
metadata:
  name: my-app
spec:
  to:
    kind: Service
    name: my-service
  port:
    targetPort: 8080
  tls:
    termination: reencrypt

Question 5

A developer reports that pods in the namespace 'project-a' cannot resolve services located in the namespace 'project-b' using standard internal DNS names. What is the correct way to query 'project-b' service 'backend' from 'project-a'?

Accepted Answer

backend.project-b.svc.cluster.local. Kubernetes cluster DNS allows cross-namespace resolution using the FQDN format ..svc.cluster.local.

Answer

backend.project-b.pod.cluster.local

Answer

backend.project-b.svc

Answer

backend.project-b.internal

Question 6

An administrator must configure a NetworkPolicy in the 'secure-zone' namespace to explicitly deny all ingress traffic except for TCP traffic coming from pods labeled 'tier=frontend' in the 'frontend-zone' namespace. Which NetworkPolicy specification achieves this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: frontend-zone
      podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP. To allow traffic from another namespace, the policyPeer must use namespaceSelector combined with podSelector. Denying all other ingress requires an empty ingress rule list alongside policyTypes: [Ingress].

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.128.0.0/14
    ports:
    - protocol: TCP

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: frontend-zone
    ports:
    - protocol: TCP

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: frontend
        matchExpressions:
          - key: namespace
            operator: In
            values: [frontend-zone]
    ports:
    - protocol: TCP

Question 7

An administrator needs to create a service that exposes an application externally via an IP address allocated from an external cloud provider load balancer. Which service type must be used?

Accepted Answer

LoadBalancer. A LoadBalancer service type provisions an external load balancer specific to the underlying cloud infrastructure platform.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 8

An administrator configures an Ingress resource in the 'web-apps' namespace to route traffic using the default OpenShift Ingress controller. The Ingress creation succeeds, but traffic to the hostname returns a 404 error. What is a common reason for this behavior in OpenShift?

Accepted Answer

The Ingress resource is missing the spec.ingressClassName set to the default OpenShift ingress class name.. OpenShift natively uses Route objects. While Ingress is supported, the Ingress controller watches Ingress objects, but custom annotations or missing paths/backend configurations or default controller sharding often require ensuring the Ingress class or annotations match the default router configuration. Alternatively, Ingress controllers in OpenShift require the ingress class name to be specified correctly (e.g., 'openshift-default').

Answer

Ingress hostnames must end with the exact string '.internal.cloudapp.net'.

Answer

Ingress objects require a ServiceMeshControlPlane to function properly in OpenShift.

Answer

OpenShift completely ignores Ingress resources and only processes Route objects.

Question 9

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

Accepted Answer

oc get networks.config/cluster -o jsonpath='{.spec.networkType}'. The cluster network operator configuration stores the active cluster network plugin type under spec.defaultNetwork.type.

Answer

oc get dns cluster -o jsonpath='{.spec.baseDomain}'

Answer

oc get proxy cluster -o jsonpath='{.spec.httpProxy}'

Answer

oc get clusterversion version -o jsonpath='{.status.capabilities}'

Question 10

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

Accepted Answer

It has spec.clusterIP set to None.. A headless service is created by setting clusterIP: None, which disables load balancing and returns the IP addresses of the individual pods via DNS.

Answer

It automatically creates an external Route resource.

Answer

It does not have any selector defined in its specification.

Answer

It disables internal container DNS resolution entirely.

Question 11

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

Accepted Answer

Edit the ingresscontroller instance named 'default' in the 'openshift-ingress-operator' namespace.. Ingress controller parameters such as timeouts are configured by editing the IngressController custom resource in the 'openshift-ingress-controller' namespace.

Answer

Edit the proxy resource named 'cluster'.

Answer

Edit the endpoints resource in the 'openshift-ingress' namespace.

Answer

Modify the kube-apiserver configmap.

Question 12

An OVN-Kubernetes clustered OpenShift environment requires troubleshooting packet flows between namespaces. Which tool is installed on the cluster nodes that allows administrators to inspect OVN database contents and flow tables?

Accepted Answer

ovn-sbctl. OVN-Kubernetes utilizes OVN northbound and southbound databases, which can be queried using the ovn-sbctl and ovn-nbctl utilities from within the ovn-controlplane or node pods.

Answer

iptables-save

Answer

nft

Answer

firewall-cmd

Question 13

A developer wants to expose an application using a secure Route that terminates TLS on the pod itself, avoiding decryption at the router layer. Which TLS termination type should be selected?

Accepted Answer

passthrough. Passthrough termination forwards encrypted traffic directly to the backend pod without terminating TLS at the router.

Answer

reencrypt

Answer

edge

Answer

none

Question 14

An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?

Accepted Answer

Add the annotation 'haproxy.router.openshift.io/ip_whitelist' to the Route object.. Routes support spec.securityContext or annotations/fields for IP filtering. Specifically, the 'haproxy.router.openshift.io/ip_whitelist' annotation restricts access based on client source IP.

Answer

Configure spec.clientIP in the Service object definition.

Answer

Create a NetworkPolicy with spec.ingress.ipBlock restricting the router pod.

Answer

Update the IngressController CR with a global clientIP blacklist.

Question 15

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

Accepted Answer

oc get clusteroperator network. The ClusterNetworkOperator status can be verified by inspecting the operator resource cluster/network.

Answer

oc get cni cluster

Answer

oc describe networkconfig

Answer

oc get nodes --show-mtu