CKAD Services and Networking Practice Question
You have a NetworkPolicy that allows ingress from pods with label 'app: frontend' in any namespace, and also allows ingress from the IP range '10.0.0.0/8'. The policy is not working as expected. Which YAML snippet correctly implements both requirements?
⚠ Common exam trap
The trap here is that candidates often try to combine `ipBlock` with `podSelector` or `namespaceSelector` in the same `from` entry, not realizing that `ipBlock` must be in its own `from` entry to be ORed with other rules, and that omitting `namespaceSelector: {}` restricts the pod selector to the current namespace only.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ingress: - from: - namespaceSelector: {} podSelector: matchLabels: app: frontend - from: - ipBlock: cidr: 10.0.0.0/8
It uses two separate `from` entries in the ingress rule. The first `from` combines a `namespaceSelector: {}` (selects all namespaces) with a `podSelector` for `app: frontend`, meaning pods with that label in any namespace are allowed. The second `from` uses an `ipBlock` to allow traffic from the 10.0.0.0/8 CIDR range. In Kubernetes NetworkPolicy, multiple `from` entries are ORed together, so traffic matching either rule is permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
ingress: - from: - namespaceSelector: {} podSelector: matchLabels: app: frontend - from: - ipBlock: cidr: 10.0.0.0/8
Why this is correct
Correct. Two separate `from` entries OR the two rules, allowing pods with label `app: frontend` in any namespace and the IP range 10.0.0.0/8.
- ✗
ingress: - from: - namespaceSelector: {} - podSelector: matchLabels: app: frontend - ipBlock: cidr: 10.0.0.0/8
Why it's wrong here
Incorrect. All three selectors are in the same `from` entry, resulting in AND logic, which is not the intended behavior. Also, the `namespaceSelector` and `podSelector` are separate list items, not combined.
- ✗
ingress: - from: - podSelector: matchLabels: app: frontend - ipBlock: cidr: 10.0.0.0/8
Why it's wrong here
Incorrect. Missing `namespaceSelector: {}` means the `podSelector` only applies to current namespace, not all namespaces. Also, `ipBlock` is combined in the same `from` entry.
- ✗
ingress: - from: - namespaceSelector: {} podSelector: matchLabels: app: frontend - ipBlock: cidr: 10.0.0.0/8
Why it's wrong here
Incorrect. The `ipBlock` is placed under the same `from` entry as the `podSelector` and `namespaceSelector`, combining them with AND logic. The correct approach is to have two separate `from` entries.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.