CKAD Services and Networking Practice Question
You need to allow ingress traffic to pods with label 'app: web' from pods with label 'role: frontend' in the same namespace, and also from any pod in namespace 'monitoring'. Which NetworkPolicy egress/ingress rule correctly implements this?
⚠ Common exam trap
The trap is misunderstanding how NetworkPolicy selectors combine. Within a single 'from' item, selectors are ANDed; multiple 'from' items are ORed. Option B incorrectly combines both selectors in one 'from' item (AND), requiring pods to match both conditions. Option A and C correctly use separate 'from' items (OR), allowing frontend pods (same namespace, because a bare podSelector defaults to the namespace of the policy) or all pods from the monitoring namespace. Option D is also valid with two separate ingress rules.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
spec: podSelector: matchLabels: app: web ingress: - from: - namespaceSelector: matchLabels: name: monitoring - podSelector: matchLabels: role: frontend
It defines two separate ingress rules: one allowing traffic from pods with label 'role: frontend' in the same namespace, and another allowing traffic from any pod in namespace 'monitoring'. In Kubernetes NetworkPolicy, when multiple items are listed under 'from' in an ingress rule, they are ORed; however, here each rule is independent, so the first rule matches pods with 'role: frontend' (no namespaceSelector, so same namespace), and the second rule matches all pods in the 'monitoring' namespace (no podSelector, so all pods). This satisfies the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
spec: podSelector: matchLabels: app: web ingress: - from: - namespaceSelector: matchLabels: name: monitoring - podSelector: matchLabels: role: frontend
Why this is correct
Uses separate 'from' items, so traffic from either a namespace matching 'name: monitoring' OR pods with label 'role: frontend' is allowed. However, the podSelector alone (without a namespaceSelector) matches pods in any namespace, so it allows frontend pods from all namespaces, not just the same namespace.
- ✗
spec: podSelector: matchLabels: app: web ingress: - from: - podSelector: matchLabels: role: frontend namespaceSelector: matchLabels: name: monitoring
Why it's wrong here
Combines both selectors in a single 'from' item, meaning the rule requires both conditions to be true simultaneously (AND logic). This would only match pods that are both 'role: frontend' AND in a namespace labeled 'name: monitoring', which does not meet the requirement.
- ✓
spec: podSelector: matchLabels: app: web ingress: - from: - podSelector: matchLabels: role: frontend - namespaceSelector: matchLabels: name: monitoring
Why this is correct
Correct. Uses two separate 'from' items: first allows pods with 'role: frontend' in the same namespace (no namespaceSelector, so default to same namespace); second allows all pods in namespace with label 'name: monitoring' (no podSelector, so all pods). This matches the requirement exactly.
- ✗
spec: podSelector: matchLabels: app: web ingress: - from: - podSelector: matchLabels: role: frontend - from: - namespaceSelector: matchLabels: name: monitoring
Why it's wrong here
Uses two separate 'from' blocks, but the first one (podSelector alone) matches 'role: frontend' pods in any namespace, not just the same namespace. The second block correctly allows all pods in the monitoring namespace. The first block incorrectly opens access from frontend pods in all namespaces.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.