hardMultiple ChoiceObjective-mapped
200-901 NetworkPolicy Practice Question
A Kubernetes cluster is configured with a NetworkPolicy that allows ingress traffic only from pods with label 'app: frontend'. A new backend service needs to communicate with the database pod. What must be done to allow this?
⚠ Common exam trap
Candidates may think that deleting the restrictive NetworkPolicy is the easiest solution, but the question asks what 'must be done' to allow the backend service while maintaining security. The correct approach is to add an ingress rule to the existing policy for the backend label, not to remove all restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Modify the NetworkPolicy to include an additional rule allowing from pods with label 'app: backend'
The existing NetworkPolicy only allows ingress from pods with label 'app: frontend'. To allow the backend service (which presumably has label 'app: backend') to communicate with the database pod, the best practice is to modify the existing NetworkPolicy to include an additional ingress rule that allows pods with label 'app: backend'. This preserves the existing security restrictions while permitting the new traffic. Deleting the policy (option A) would remove all ingress restrictions, which is less secure and not necessary unless explicitly required. Option B only adds a label to the database pod and does not affect the NetworkPolicy's source selection. Option D creates a new policy, but because NetworkPolicies are additive, the existing policy still denies traffic from the backend, so a new policy alone would not work unless it selects the same pod and explicitly allows the traffic; modifying the existing policy is simpler and more appropriate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Delete the existing NetworkPolicy
Why it's wrong here
Deleting the existing NetworkPolicy removes all ingress restrictions on the database pod. While this allows the backend service to communicate, it also allows all other traffic, which is less secure and not the best practice unless explicitly required. The question implies a need to maintain security, so this is not the correct answer.
- ✗
Add label 'app: backend' to the database pod
Why it's wrong here
Adding the label 'app: backend' to the database pod does not affect the NetworkPolicy, which selects sources based on source pod labels, not destination labels. The database pod's labels only affect which policies select it; the source labels are what matter for ingress rules.
- ✓
Modify the NetworkPolicy to include an additional rule allowing from pods with label 'app: backend'
Why this is correct
Modifying the existing NetworkPolicy to add an ingress rule that allows pods with label 'app: backend' is the correct approach. It permits the needed traffic while preserving the existing restriction that only 'app: frontend' pods are allowed by default. This is the most secure and appropriate solution.
- ✗
Create a new NetworkPolicy for the database
Why it's wrong here
Creating a new NetworkPolicy for the database pod does not remove or override the original policy's restriction on the same pod — NetworkPolicies are additive, so the existing rule limiting ingress to 'app: frontend' still applies unless it is also updated to allow the new source.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.