KCNA Kubernetes Fundamentals Practice Question
You have a Kubernetes cluster with multiple namespaces. You need to allow communication only from pods with label 'app: frontend' to pods with label 'app: backend' in the same namespace. Which resource should you use?
⚠ Common exam trap
A common mix-up: candidates confuse RBAC (which controls API access) with network access control, assuming that a Role or RoleBinding can restrict pod-to-pod traffic, but RBAC has no effect on network-level communication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NetworkPolicy
NetworkPolicy is a Kubernetes resource that controls ingress and egress traffic between pods based on labels, namespaces, or IP blocks. By defining a NetworkPolicy with a podSelector matching 'app: backend' and an ingress rule that allows traffic only from pods with label 'app: frontend', you can restrict communication to only those pods in the same namespace. This is the correct approach because NetworkPolicy operates at Layer 3/4 (and optionally Layer 7 with Cilium) to enforce network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
RBAC Role
Why it's wrong here
RBAC roles control access to Kubernetes API resources, not network traffic between pods.
- ✓
NetworkPolicy
Why this is correct
NetworkPolicy defines rules for allowed ingress and egress traffic between pods based on pod labels, namespaces, or IP blocks.
- ✗
PodSecurityPolicy
Why it's wrong here
PodSecurityPolicy (deprecated) controls security aspects of pods, not network traffic.
- ✗
Service
Why it's wrong here
A Service provides a stable endpoint for a set of pods but does not restrict traffic from specific pods.
Go deeper
Related to this question
Learn chapter
Kubernetes Overview and Core Components
Key term
Namespaces
A Namespace in Kubernetes is a virtual cluster within a physical cluster that allows you to organize and isolate resources, like an apartment building with separate units for different tenants.
Key term
ReplicaSet and Replication
A ReplicaSet ensures a specified number of identical pod instances are running at all times in Kubernetes, using replication to maintain availability and stability.
About these practice questions
Courseiva writes every KCNA question from scratch — 833 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.