CKA Services and Networking Practice Question
You update a NetworkPolicy to add an egress rule. After applying, pods affected by the policy can no longer reach external IPs. What is the most likely reason?
⚠ Common exam trap
It's easy for candidates to assume egress rules are additive (i.e., they only allow traffic without affecting existing connectivity), but Kubernetes NetworkPolicy egress rules are whitelist-only, meaning any egress rule implicitly denies all other egress traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetworkPolicy egress rules deny all traffic by default unless explicitly allowed
NetworkPolicy in Kubernetes follows a default-deny model for traffic. When any egress rule is added to a NetworkPolicy, it implicitly denies all egress traffic that is not explicitly allowed by that rule. Therefore, if the egress rule does not include a rule allowing traffic to external IPs (e.g., via an IPBlock or a namespace selector), those destinations become unreachable. This is by design, as NetworkPolicies are additive whitelists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The egress rule has a typo in the IP block
Why it's wrong here
A typo in an `ipBlock` within an egress rule would only affect the specific IP range intended or unintended by that particular rule. It would not cause *all* external traffic to be universally blocked. NetworkPolicies introduce a "default deny" for a specific direction (ingress or egress) only once that direction's rules are defined; a single malformed `ipBlock` entry would not trigger a complete external egress block for all traffic.
- ✗
The pods are not running
Why it's wrong here
Whether the targeted pods are running or not does not explain why *all* external egress traffic is blocked. NetworkPolicies define the communication rules for pods, and these rules are enforced by the CNI plugin regardless of the pods' current lifecycle state. If the pods were to start, they would immediately be subject to the updated NetworkPolicy, including any new egress rules, but their running state isn't the cause of the blocking.
- ✓
NetworkPolicy egress rules deny all traffic by default unless explicitly allowed
Why this is correct
When a `NetworkPolicy` is applied to pods and includes an `egress` section, the default behavior for those pods' outbound traffic immediately switches from "allow all" to "deny all." Any egress traffic not explicitly matched by one of the `egress` rules within that policy will be dropped. Therefore, if the newly added egress rule does not explicitly permit the necessary external IPs, all external traffic will be blocked by default.
- ✗
The CNI plugin does not support egress rules
Why it's wrong here
Most modern, production-ready CNI plugins fully implement the Kubernetes NetworkPolicy API, including comprehensive support for both ingress and egress rules. If the CNI plugin truly did not support egress rules, the policy would likely have no effect on egress traffic at all, rather than causing a complete block of all external egress. This scenario is highly improbable in a functional Kubernetes cluster configured for NetworkPolicy enforcement.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.