CKAD Services and Networking Practice Question
You need to allow ingress traffic to pods in namespace 'api' only from pods in namespace 'frontend' that have label 'role: proxy'. Which NetworkPolicy ingress rule correctly implements this?
⚠ Common exam trap
The trap here is that candidates often forget that when namespaceSelector and podSelector are combined in the same 'from' block, they are ANDed, not ORed, leading them to pick options that are too broad (like A or D) or that mix unrelated rules (like C).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ingress: - from: - namespaceSelector: matchLabels: name: frontend podSelector: matchLabels: role: proxy
It combines a namespaceSelector (to match the 'frontend' namespace) with a podSelector (to match pods with label 'role: proxy') in the same ingress rule. This ensures that only traffic from pods in the 'frontend' namespace that also have the label 'role: proxy' is allowed, fulfilling the requirement precisely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ingress: - from: - namespaceSelector: matchLabels: name: frontend
Why it's wrong here
This rule selects the entire frontend namespace as an allowed peer, because a namespaceSelector on its own matches every pod inside any namespace carrying the label name=frontend. Without a paired podSelector, you are permitting traffic from all workloads in that namespace—including database pods, utilities, or any future deployment—not just the proxy processes you intend to allow. The missing podSelector makes the rule overly permissive and fails the requirement to restrict ingress to pods with role=proxy.
- ✓
ingress: - from: - namespaceSelector: matchLabels: name: frontend podSelector: matchLabels: role: proxy
Why this is correct
This rule correctly combines a namespaceSelector and a podSelector within the same ingress peer, and in NetworkPolicy semantics, these two selectors are ANDed when they appear together in a single peer. Thus, only pods that simultaneously satisfy both labels—role=proxy on the pod itself, and the pod's namespace having name=frontend—are allowed as sources. This exactly matches the stated requirement, ensuring no other pods from the frontend namespace, and no proxies from other namespaces, can connect.
- ✗
ingress: - from: - ipBlock: cidr: 0.0.0.0/0 - podSelector: matchLabels: role: proxy
Why it's wrong here
This rule contains two separate peers inside the same ingress rule: an ipBlock covering 0.0.0.0/0 and a podSelector requiring role=proxy. Because multiple peers within a single rule are ORed, traffic from any IP address anywhere satisfies the ipBlock, effectively permitting inbound traffic from the entire internet regardless of the podSelector. The podSelector does not restrict the ipBlock at all; it merely adds a second, redundant allowance for local pods, so the rule fails to limit ingress to only the intended proxy pods.
- ✗
ingress: - from: - podSelector: matchLabels: role: proxy
Why it's wrong here
This rule relies only on a podSelector for role=proxy, which in NetworkPolicy semantics matches pods in the same namespace as the NetworkPolicy itself. If the policy is applied in the api namespace, this rule allows traffic from any proxy pod in api, but says nothing about the frontend namespace. To allow cross-namespace traffic, you must also include a namespaceSelector, so this rule is too narrow and does not satisfy the requirement to allow traffic specifically from proxies in the frontend namespace.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.