CKA Services and Networking Practice Question
A NetworkPolicy named 'deny-all' has only a podSelector matching all pods and no rules. What is the effect?
⚠ Common exam trap
A common mix-up: candidates assume an empty policy has no effect, but in Kubernetes, a NetworkPolicy with no rules creates a default-deny for the selected direction (ingress or egress), which is a common point of confusion in the CKA exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Denies all ingress traffic to all pods in the namespace
A NetworkPolicy with a podSelector matching all pods and no rules defaults to denying all ingress traffic because the policy's empty `ingress` rules array means no traffic is allowed. This implements a default-deny ingress behavior for the selected pods, as Kubernetes NetworkPolicy rules are whitelist-based: any traffic not explicitly allowed is denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Has no effect because NetworkPolicy requires at least one rule
Why it's wrong here
A NetworkPolicy is always effective once applied, even without explicit `ingress` or `egress` rules defined within its specification. Its presence with a `podSelector` immediately changes the default network behavior for selected pods from 'allow all' to 'deny all' for the traffic types specified in `policyTypes`. Therefore, stating it has no effect is incorrect, as it actively enforces a denial policy based on its default interpretations.
- ✗
Allows all traffic because there are no explicit deny rules
Why it's wrong here
NetworkPolicies operate on a whitelist model, meaning that if a policy selects a pod, only traffic explicitly allowed by its rules will pass. The absence of explicit `deny` rules does not imply allowing traffic; instead, it means no traffic is explicitly permitted, leading to a default denial for the governed traffic type. This behavior is fundamental to Kubernetes NetworkPolicy design, contrasting with traditional firewall rules that often have an implicit 'allow all' followed by explicit 'deny' rules.
- ✓
Denies all ingress traffic to all pods in the namespace
Why this is correct
A NetworkPolicy with an empty `podSelector: {}` targets all pods within its namespace. When no `ingress` rules are explicitly defined, or an empty `ingress: []` array is present, and `policyTypes` implicitly defaults to `["Ingress"]`, the policy effectively denies all incoming network connections to these selected pods. This creates a secure-by-default posture for ingress traffic across the entire namespace, preventing any external or internal pod-to-pod communication unless explicitly allowed by another policy.
- ✗
Denies all egress traffic from all pods in the namespace
Why it's wrong here
By default, if the `policyTypes` field is omitted from a NetworkPolicy, it implicitly defaults to `["Ingress"]`, meaning the policy only governs incoming traffic. For a NetworkPolicy to affect egress traffic, the `policyTypes` field must explicitly include `Egress`, or an `egress` rule section must be present. Therefore, without explicit configuration for egress, this policy will not deny outgoing connections from the pods, as egress traffic remains unaffected by its rules.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.