KCNA NetworkPolicy podSelector Practice Question
You have a microservices application where Service A needs to communicate with Service B running in a different namespace ('backend'). Both namespaces have a NetworkPolicy that denies all ingress by default. You create a NetworkPolicy in the 'backend' namespace allowing ingress from pods with label 'app: frontend'. What else is needed for Service A to reach Service B?
⚠ Common exam trap
A common pitfall is to assume that a podSelector in an ingress rule can match pods across namespaces without a namespaceSelector. In reality, a podSelector only matches pods in the same namespace unless combined with a namespaceSelector.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector
A NetworkPolicy with only a podSelector in an ingress rule matches pods in the same namespace only. To allow cross-namespace traffic, you must include a namespaceSelector that selects the namespace of the source pods. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you enable Service A's pods to be allowed. Ensure Service A's pod also has the required label 'app: frontend'. Option A is wrong: a podSelector alone only matches pods in the same namespace. Option B is wrong: egress policies are not needed for inbound traffic. Option C is too permissive and unnecessary.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Ensure Service A's pod has the label 'app: frontend' on its pod spec
Why it's wrong here
Incorrect. A podSelector alone matches pods in the same namespace only, so adding the label to Service A's pod in the 'default' namespace will not allow ingress from the 'backend' namespace's NetworkPolicy.
- ✗
Add a similar NetworkPolicy in the 'default' namespace allowing egress to the 'backend' namespace
Why it's wrong here
Incorrect. Egress policies control outbound traffic from pods in the 'default' namespace, but the traffic direction is from Service A (default) to Service B (backend), so an ingress policy on the backend namespace controls access. Adding an egress policy is not necessary and does not allow the traffic.
- ✗
Change the NetworkPolicy to allow all ingress traffic from any source
Why it's wrong here
Incorrect. Changing the policy to allow all ingress is too permissive and violates security best practices. The proper approach is to use a namespaceSelector to restrict cross-namespace traffic.
- ✓
Add a label to the 'default' namespace matching the NetworkPolicy's namespaceSelector
Why this is correct
Correct. By adding a label to the 'default' namespace and including a namespaceSelector matching that label in the NetworkPolicy, you allow ingress from pods in the 'default' namespace. Combined with the podSelector for 'app: frontend', this enables Service A to reach Service B.
Go deeper
Related to this question
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.