CKS Monitoring, Logging and Runtime Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: db-egress spec: podSelector: {} policyTypes: - Egress egress: - to: - ipBlock: cidr: 0.0.0.0/0 ports: - port: 5432

  Why it's wrong here

  The ipBlock CIDR 0.0.0.0/0 matches every possible IPv4 destination, so this policy would permit egress to any IP address on TCP port 5432, not just the database at 10.0.0.5. Although the port restriction narrows the traffic type, the destination scope is far too broad, violating least-privilege by enabling connections to arbitrary hosts on that port. Because policyTypes includes Egress, all other egress is denied, but this rule still allows far more than intended, making it incorrect.

• ✗

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: db-egress spec: podSelector: {} policyTypes: - Egress egress: - to: - podSelector: matchLabels: app: db

  Why it's wrong here

  A podSelector in an egress rule matches destination pods inside the same Kubernetes namespace, not arbitrary external IP addresses. The database at 10.0.0.5 is outside the cluster, so this rule cannot match it and will effectively be a no-op for that traffic. Additionally, this rule omits any port restriction, so even if the database were an in-cluster pod labeled app=db, it would permit all ports, not just 5432.

• ✗

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: db-egress spec: podSelector: {} policyTypes: - Egress egress: []

  Why it's wrong here

  With policyTypes set to Egress and an empty egress array, the NetworkPolicy installs a default-deny rule for all outbound traffic from the selected pods, allowing nothing. The desired connection to 10.0.0.5:5432 is therefore blocked, because no egress rule explicitly permits it. An empty egress list is equivalent to having no egress rules at all, so it cannot satisfy an allow requirement.

• ✓

  apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: db-egress spec: podSelector: {} policyTypes: - Egress egress: - to: - ipBlock: cidr: 10.0.0.5/32 ports: - port: 5432

  Why this is correct

  The ipBlock with CIDR 10.0.0.5/32 precisely identifies the database's IP address, and the port 5432 restricts traffic to the database listener, thereby permitting only the intended communication. Because policyTypes includes Egress and this is the sole egress rule, it also establishes an implicit default-deny for any other outbound traffic, aligning with least-privilege security. This is the correct configuration for allowing egress to a specific external IP and port.

Go deeper

Related to this question