Services and Networking

You need to create a Service that exposes port 80 on each node's IP at a static port (30080). Which Service type should you use?

You create a ClusterIP service named 'my-svc' in the 'default' namespace. A pod in the same namespace tries to reach the service using the DNS name 'my-svc'. Which fully qualified domain name (FQDN) should the pod use to resolve the service?

Which two of the following are valid methods for service discovery in Kubernetes?

A NetworkPolicy named 'default-deny-ingress' is applied to all pods in a namespace. The policy has no rules. An administrator then creates a new NetworkPolicy that allows ingress traffic to pods with label 'app: web' from any source using a podSelector with '{}'. Will traffic be allowed to pods labeled 'app: web'?

Which TWO of the following are valid kube-proxy modes?

Which THREE of the following are valid methods for service discovery in Kubernetes?

A pod 'my-pod' in the 'default' namespace cannot resolve the service 'db-service' in the 'production' namespace. Which DNS name should be used to reach the service from 'my-pod'?

You create a Deployment with 3 replicas and a ClusterIP Service. You notice that some pods are not receiving traffic. What is the most likely cause?

Which Service type exposes a Service on each Node's IP at a static port in the range 30000-32767?

Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)

Which THREE of the following are CNI plugins?

Which of the following is NOT a valid Service type in Kubernetes?

Which kube-proxy mode supports connection-based load balancing using Linux IPVS?

Which resource is used to configure TLS termination and path-based routing for HTTP(S) traffic into a cluster?

A NetworkPolicy allows ingress from pods with label 'role: frontend'. Which field is used to select those pods?

You apply the following NetworkPolicy: ```yaml apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress - Egress ``` What is the result?

What is the default DNS name for a service named 'my-svc' in namespace 'default'?

What is the default kube-proxy mode in modern Kubernetes clusters?

You apply the following NetworkPolicy to namespace 'ns1': apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-ingress spec: podSelector: {} policyTypes: - Ingress ingress: [] What effect does this policy have?

Which of the following commands can be used to check the endpoints of a service named 'my-service'?

Which Service type is used to expose a service externally with a cloud provider's load balancer?

You need to expose a Service externally using an Ingress. The Ingress controller requires a specific IngressClass. How do you specify the IngressClass in the Ingress resource?

A cluster administrator needs to allow pods labeled 'app=web' in namespace 'frontend' to receive TCP traffic on port 443 only from pods labeled 'app=proxy' in namespace 'backend'. The cluster uses the default CNI plugin that enforces NetworkPolicy. The administrator creates a NetworkPolicy in the 'frontend' namespace with podSelector matching 'app=web', policyTypes: ['Ingress'], and an ingress rule with from: [{namespaceSelector: {matchLabels: {name: 'backend'}}, podSelector: {matchLabels: {app: 'proxy'}}}], ports: [{protocol: 'TCP', port: 443}]. However, the namespace 'backend' is not labeled with 'name=backend'. What is the effect of this policy?

A developer runs `kubectl run nginx --image=nginx --port=80` and then `kubectl expose pod nginx --port=80 --target-port=80 --type=NodePort`. What is the name of the created Service?

What is the default DNS name for a Service named 'my-service' in namespace 'my-ns'?

Which TWO commands can be used to test DNS resolution for a Service named 'my-svc' in namespace 'default' from within a temporary pod? (Choose 2)

Which two of the following are valid methods for exposing a Service externally in Kubernetes? (Select TWO.)

Which of the following Service types exposes a Service on a static port on each node's IP?

You want to expose a Deployment named 'web' on port 80 internally within the cluster. Which command creates a ClusterIP Service?

A NetworkPolicy named 'deny-all' is applied to a namespace with podSelector: {}. The policy has no ingress rules. What is the effect?

Which of the following service types exposes a service on a static port on each node's IP address?

You want to configure NetworkPolicy to allow ingress traffic only from pods with label 'role: frontend' in the same namespace. Which podSelector should be in the ingress rule?

What is the default kube-proxy mode in Kubernetes v1.29?

Which Service type exposes a Service externally via a cloud provider's load balancer?

You need to expose multiple HTTP services on a single IP address with path-based routing. Which resource should you use?

You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?

A NetworkPolicy named 'deny-all' is created with an empty podSelector and no rules. What does this policy accomplish?

A pod cannot resolve a service DNS name. The cluster uses CoreDNS. Which of the following is the most likely cause if the pod's /etc/resolv.conf contains 'nameserver 10.96.0.10' and the CoreDNS pod is running?

You have a NodePort service. Which kube-proxy mode allows for better performance and more sophisticated load balancing algorithms like 'least connection'?

Which of the following Service types does NOT assign a ClusterIP to the Service?

Which of the following is a valid CNI plugin for Kubernetes networking?

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Which kube-proxy mode uses iptables rules to handle service traffic?

You need to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 8080. Which kubectl command should you use?

You run `kubectl port-forward service/my-svc 8080:80`. What does this command do?

Which command forwards local port 8080 to port 80 of a pod named 'web-pod'?

A developer runs 'kubectl port-forward service/my-svc 8080:80' and reports that connections to localhost:8080 fail. The service is a ClusterIP service that selects pods with label 'app: my-app'. What is the most likely cause?

Which of the following is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

You have a headless service named 'my-headless' with clusterIP: None. A pod in the same namespace queries the DNS name 'my-headless'. What will the DNS response contain?

You have a NetworkPolicy that selects pods with label 'app: db'. The policy has an ingress rule allowing traffic from pods with label 'app: frontend'. A pod with label 'app: frontend' is in a different namespace. No namespaceSelector is specified in the ingress rule. Will traffic from that pod be allowed?

You run 'kubectl get svc my-service -o yaml' and see 'type: ClusterIP'. The service has no endpoints. What is the most likely cause?

What is the DNS name for a Service named 'api' in the 'default' namespace?

You create a Service of type LoadBalancer in a Kubernetes cluster that does not have an external load balancer provider (e.g., bare-metal). What will be the state of the EXTERNAL-IP field when you run 'kubectl get svc'?

You apply the following NetworkPolicy: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress What effect does this policy have?

You have an Ingress resource with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 A client sends a request to http://example.com/api/v1/users. Which path is matched?

Which three components are part of the Gateway API? (Choose three.)

An Ingress resource is created with the following spec: spec: rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80 The backend service 'api-service' is in the same namespace as the Ingress. What must be true for the Ingress to route traffic to the service?

You want to forward local port 8080 to port 80 of a pod named 'nginx-pod'. Which command should you use?

Which TWO statements about Headless services are correct? (Select TWO)

You have a NetworkPolicy that selects pods with label 'role: db' in the 'default' namespace. The policy has no ingress rules defined. What is the effect on traffic to the selected pods?

Which of the following is a correct Ingress resource snippet that routes traffic to service 'web-svc' on port 80 for the host 'example.com'?

You have a Service with endpoints for pods in different zones. You want kube-proxy to use a mode that provides better performance for large clusters and supports scheduling algorithms like least-connection. Which mode should you use?

Which THREE components are required for a pod to resolve a Service DNS name?

Which resource type is used to configure HTTP/HTTPS routing to Services?

A developer runs 'kubectl port-forward service/my-service 8080:80'. What does this command do?

Which TWO statements about EndpointSlices are correct?

You have a kube-proxy running in ipvs mode. Which of the following is true about IPVS?

You run `kubectl expose deployment web --port=80 --target-port=8080 --type=NodePort` and the Service is created. What is the effect of this command?

An ingress resource is defined with the following snippet: ```yaml spec: tls: - hosts: - app.example.com secretName: app-tls rules: - host: app.example.com http: paths: - path: / pathType: Prefix backend: service: name: app-service port: number: 80 ``` The secret 'app-tls' exists and contains a valid certificate. However, accessing https://app.example.com returns a certificate warning in the browser. What is the most likely cause?

You need to expose a service named 'my-svc' on a static port 30080 on every node. Which service type should you use?

You have a service 'my-svc' of type ClusterIP with no selector defined. You manually create an Endpoints object with the same name. Which statement is true?

A pod in namespace 'ns1' cannot resolve the DNS name 'svc.ns2.svc.cluster.local'. What is the most likely cause?

Which TWO of the following are valid ways to expose a Service externally in a Kubernetes cluster running on-premises (no cloud provider)?

Which two of the following are correct statements about EndpointSlices?

You have an Ingress resource with a TLS section specifying a secret named 'tls-secret'. The certificate in 'tls-secret' is expired. What happens when a client connects via HTTPS to the Ingress host?

A Kubernetes cluster uses kube-proxy in iptables mode. A Service named 'web-svc' of type ClusterIP has three endpoints: pod A (10.244.1.5:8080), pod B (10.244.2.6:8080), and pod C (10.244.3.7:8080). A client pod repeatedly sends requests to the Service's ClusterIP. The administrator observes that all requests from a single client pod are being routed to pod A, even though pod B and pod C are healthy. Which of the following is the most likely explanation?

You have a Service named 'my-service' in namespace 'ns1'. Another pod in namespace 'ns2' needs to resolve 'my-service' using DNS. What FQDN should the pod use?

A NetworkPolicy named 'deny-all' has only a podSelector matching all pods and no rules. What is the effect?

Which component is responsible for implementing the NetworkPolicy rules?

You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?

Which annotation is commonly used with ExternalDNS to specify the DNS hostname for a Service?

Which Kubernetes Service type exposes the Service on a static port on each Node's IP address, allowing external access without a LoadBalancer?

Which kube-proxy mode uses iptables rules to handle service traffic and is the default in many distributions?

You create a Service with clusterIP: None. What is this called and what is its purpose?

A developer asks you to create a Service that resolves to an external database at 'db.example.com'. Which Service type should you use?

Which annotation is commonly used with the ExternalDNS project to manage DNS records for a Kubernetes service?

Which kube-proxy mode uses IP Virtual Server (IPVS) for load balancing and supports more algorithms than the default mode?

A pod is unable to resolve DNS names of services in other namespaces. Which DNS configuration is most likely missing?

After creating a NetworkPolicy that selects pods with label 'role: db' and allows ingress on TCP port 3306 from pods with label 'role: api', you notice that pods with label 'role: db' are still reachable on port 3306 from pods without 'role: api' label. What is the most likely cause?

Which THREE components are part of the Gateway API?

You have a Service 'my-svc' with ClusterIP None (headless). You create a StatefulSet with 3 replicas and a headless Service. How do you reach individual pods?

Which NetworkPolicy rule will allow ingress traffic from pods with label 'role: frontend' in the same namespace?

Which DNS record does CoreDNS create for a headless Service named 'headless-svc' in the namespace 'default'?

Which of the following is the default DNS name for a Service named 'api' in namespace 'production'?

You want to expose an application running in the cluster on a public IP address. Which Service type should you use?

You have a NetworkPolicy that denies all ingress traffic by default, and you want to allow traffic only from pods with label 'app: monitoring' in the same namespace. What should the policy spec look like?

Which THREE components are part of the Gateway API resource model? (Select THREE)

A pod cannot resolve a Service name 'my-svc' in the same namespace. The DNS pod is running. What is a likely cause?

An administrator creates a NetworkPolicy in namespace 'app' with the following YAML. Which statement is true about the policy? apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: deny-all spec: podSelector: {} policyTypes: - Ingress

You have three pods selected by a service. One pod is in 'CrashLoopBackOff' state. How does the service's endpoints behave?

Which of the following is a core component of the Gateway API?

Which FOUR are correct ways to configure a default deny all ingress traffic NetworkPolicy? (Choose 4)

A cluster uses Flannel as the CNI plugin. Which of the following best describes Flannel's networking model?

Which TWO of the following are components of the Ingress API? (Select TWO.)

A Kubernetes cluster has a Service of type ClusterIP named 'my-svc' in the 'default' namespace. You deploy a pod and want it to resolve the service's cluster IP using DNS. What FQDN should the pod use?

Which of the following CNI plugins typically uses BGP to distribute routing information across nodes?

Which of the following is a valid use case for a Headless Service?

In a Kubernetes cluster using CoreDNS, what is the DNS name for a Service named 'api' in namespace 'backend'?

You want to temporarily access a pod's HTTP endpoint on port 8080 from your local machine on port 9090. Which command should you use?

Which kubectl command correctly retrieves the list of EndpointSlices for a Service named 'my-svc' in the 'default' namespace?

What is the default DNS name for a Service named 'my-svc' in namespace 'my-ns'?

An Ingress resource uses 'networking.k8s.io/v1' API. Which field specifies the hostname and path rules for routing traffic?

Which TWO network plugins (CNI) are commonly used in Kubernetes clusters? (Select TWO)

A NetworkPolicy allows ingress traffic from pods with label 'app: frontend' in any namespace. Which selector is used?

You run: kubectl expose deployment web --port=80 --target-port=8080 --type=LoadBalancer --name=web-svc. What is the effect of this command?

Which TWO statements about EndpointSlices are true? (Choose 2)

Which of the following can be used to expose a set of pods externally to the internet in a Kubernetes cluster? (Select THREE.)

What is the purpose of a headless Service (clusterIP: None)?

Which Ingress resource field is used to specify the hostname for which traffic should be routed?

Which TWO statements about Ingress in Kubernetes are correct?

You need to expose a Deployment named 'web' on port 80 inside the cluster. Which kubectl command creates a ClusterIP service?

Which two of the following are valid service discovery methods in Kubernetes? (Choose two.)

A cluster has kube-proxy running in ipvs mode. An administrator creates a Service of type ClusterIP. Which of the following is true about how traffic is forwarded to the pods?

Which THREE of the following are true about NetworkPolicy in Kubernetes? (Select 3)

You have a Deployment with 3 replicas. You create a headless service (clusterIP: None) with a label selector. Which of the following is true about DNS resolution for this service?

Which TWO statements are true about Ingress in Kubernetes?

A developer runs 'kubectl run nginx --image=nginx --expose --port=80'. What Kubernetes resources are created?

Which DNS record type does Kubernetes use to resolve a Service's ClusterIP?

A NetworkPolicy with podSelector: {} and policyTypes: [Ingress] is applied to a namespace. What is the effect on pods in that namespace?

Which kubectl command will expose a deployment named 'web-app' as a NodePort service on port 80?

Which THREE statements about NetworkPolicy are correct?