Question 30 of 302
CKA Services and Networking Practice Question
A NetworkPolicy named 'default-deny-ingress' is applied to all pods in a namespace. The policy has no rules. An administrator then creates a new NetworkPolicy that allows ingress traffic to pods with label 'app: web' from any source using a podSelector with '{}'. Will traffic be allowed to pods labeled 'app: web'?
⚠ Common exam trap
Many exam-takers think a default-deny policy is absolute and cannot be overridden, or they misunderstand that an empty podSelector in the 'from' field means 'from all sources', leading them to incorrectly assume the new policy is incomplete.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Yes, because the new policy allows traffic to pods with label 'app: web'
A NetworkPolicy with a podSelector of '{}' selects all pods in the namespace, and the 'from' section with an empty podSelector (or no 'from' selector at all) allows traffic from any source. When multiple NetworkPolicies are applied, they are additive: if any policy allows the traffic, it is allowed, overriding a default-deny policy that has no rules. Thus, the new policy explicitly permits ingress to pods with label 'app: web', so traffic to those pods is allowed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
No, because the new policy's empty podSelector selects all pods but does not specify a source
Why it's wrong here
An empty `podSelector: {}` within an `ingress.from` rule in a Kubernetes NetworkPolicy explicitly selects *all pods within the NetworkPolicy's namespace* as valid sources for ingress traffic. Therefore, it absolutely specifies a source, and that source is very broad. The statement incorrectly implies a lack of source specification, misinterpreting the behavior of an empty `podSelector` in this context.
- ✗
Yes, because the default-deny policy is ignored when a new policy exists
Why it's wrong here
This is incorrect because Kubernetes NetworkPolicies are additive, not mutually exclusive. A default-deny policy is never "ignored"; it establishes a baseline rule that denies all traffic not explicitly allowed. Any subsequent NetworkPolicy with specific `allow` rules will create exceptions to this baseline for the traffic and pods it matches, without invalidating the default-deny for other traffic.
- ✗
No, because the default-deny policy takes precedence
Why it's wrong here
This statement is incorrect because NetworkPolicies operate on an additive "allow-list" model. While a default-deny policy sets a baseline of denying all traffic, any specific `allow` rule defined in *any* NetworkPolicy (including new ones) will take precedence for the traffic it explicitly permits. If a connection matches an allow rule, it is permitted, regardless of a general deny.
- ✓
Yes, because the new policy allows traffic to pods with label 'app: web'
Why this is correct
Kubernetes NetworkPolicies are additive, meaning that if any policy explicitly allows a connection, that connection is permitted. Even with a default-deny ingress policy in place, a new NetworkPolicy that specifically targets pods with the label `app: web` and defines an `ingress` rule will create an exception. This new policy's allow rule will override the general deny for traffic destined for those specific pods.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jul 4, 2026
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.