CKA Services and Networking Practice Question
A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?
⚠ Common exam trap
Many candidates confuse `spec.podSelector` (which selects the target pods) with `from.podSelector` (which selects the source pods), leading them to pick option B instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
from.podSelector
In a Kubernetes NetworkPolicy, the `from.podSelector` field under `ingress` specifies the source pods from which traffic is allowed. When you set `from.podSelector.matchLabels` with `role: frontend`, only pods with that label can send ingress traffic to the pods selected by `spec.podSelector`. This is defined in the Kubernetes networking API under `networking.k8s.io/v1`.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
from.podSelector
Why this is correct
For an ingress rule inside a NetworkPolicy, the `from` array identifies the allowed sources of inbound traffic. `from.podSelector` selects source pods by their labels within the same namespace as the policy, and it is the correct field to express 'allow ingress from pods with role f'.
- ✗
spec.podSelector
Why it's wrong here
The top-level `spec.podSelector` chooses the pods to which the NetworkPolicy applies, not the source of traffic. It scopes the policy's allow/deny rules to a specific set of workload pods. Confusing it with `from.podSelector` would leave the rule selecting targets rather than sources, so it cannot satisfy an ingress condition.
- ✗
ingress.podSelector
Why it's wrong here
There is no `ingress.podSelector` field in the NetworkPolicy API. `ingress` is an array of rule objects, and each rule contains a `from` field which holds the `podSelector`. Placing the selector under `ingress` directly would be invalid syntax; the correct path is `ingress[].from.podSelector`.
- ✗
to.podSelector
Why it's wrong here
The `to` field belongs exclusively to egress rules, where it selects destination pods for outbound traffic. Ingress rules use `from` to specify sources; using `to.podSelector` in an ingress context mixes egress syntax into an ingress rule and would not be evaluated as a source selector.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.