CKA Services and Networking Practice Question
Which THREE statements about NetworkPolicy are correct?
⚠ Common exam trap
A common misconception is that NetworkPolicy defaults to deny-all when no policy exists, but the actual default is allow-all; the trap is that candidates confuse the 'default deny' behavior that occurs once a policy selects a pod (if no rule allows traffic) with the cluster-wide default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To allow traffic from a specific namespace, you can use a namespaceSelector in the ingress rule.
A NetworkPolicy ingress rule can use a `namespaceSelector` to allow traffic from pods in a specific namespace. Option C is correct because an empty `podSelector: {}` selects all pods in the namespace. Option D is correct because `podSelector.matchLabels` is used to select pods based on specific labels. Options B and E are incorrect: B is false because without any NetworkPolicy, all traffic is allowed; E is false because NetworkPolicy is namespaced, not cluster-scoped.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
To allow traffic from a specific namespace, you can use a namespaceSelector in the ingress rule.
Why this is correct
Correct. The namespaceSelector in the ingress rule allows traffic from pods in namespaces matching the selector, enabling cross-namespace traffic control.
- ✗
If no NetworkPolicy exists, all traffic is denied by default.
Why it's wrong here
Incorrect. If no NetworkPolicy exists, all traffic is allowed by default. The 'default deny' behavior only applies when a NetworkPolicy selects a pod and no rules allow traffic.
- ✓
A NetworkPolicy with podSelector: {} selects all pods in the namespace.
Why this is correct
Correct. An empty podSelector (`podSelector: {}`) matches all pods in the namespace, applying the policy to the entire namespace.
- ✓
The field 'podSelector.matchLabels' is used to select pods based on labels.
Why this is correct
Correct. The `podSelector.matchLabels` field (or `matchExpressions`) specifies the label-based selection of pods for the policy.
- ✗
NetworkPolicy is a cluster-scoped resource.
Why it's wrong here
NetworkPolicy is namespaced.
Go deeper
Related to this question
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.