Google PCA Manage implementation of cloud architecture Practice Question
Exhibit
Refer to the exhibit. gcloud container clusters describe prod-cluster --region us-central1 ... networkPolicy: enabled: true provider: CALICO ... The cluster is using Calico network policies. A developer deploys a manifest that defines a NetworkPolicy that allows ingress from pods with label 'app: frontend' but the traffic is still blocked. The pod logs show no network error but the connection times out.
What is the most likely reason the NetworkPolicy is not taking effect?
⚠ Common exam trap
Google Cloud often tests the distinction between native Kubernetes NetworkPolicies and CNI-specific CRDs (like Calico), trapping candidates who assume all NetworkPolicies use the same API version and ignore the need to match the policy engine's schema.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.
The NetworkPolicy is not taking effect because the developer used the standard Kubernetes API version `networking.k8s.io/v1`, which defines a different schema and behavior than the Calico CRD `projectcalico.org/v3`. Calico NetworkPolicies support advanced features like order-of-precedence, global policies, and non-IP match criteria that are not available in the native Kubernetes NetworkPolicy API. When a Calico-specific policy is defined using the wrong API version, the cluster's policy engine (Calico) ignores it, resulting in no enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The developer used the networking.k8s.io/v1 API version instead of the Calico CRD projectcalico.org/v3.
Why this is correct
GKE with Calico expects Calico-specific CRDs for full functionality.
- ✗
The cluster has a global network policy that overrides per-namespace policies.
Why it's wrong here
GKE supports global policy but not implicitly overriding.
- ✗
The pod labels do not match because of a capitalization mismatch.
Why it's wrong here
Labels are case-sensitive but 'app: frontend' matches if correct.
- ✗
The NetworkPolicy is missing a spec.podSelector.matchLabels entry.
Why it's wrong here
Even if missing, default selects all pods.
Go deeper
Related to this question
Learn chapter
Virtual Machine Instances in Compute Engine
Key term
Software-defined Wide Area Network
A Software-defined Wide Area Network (SD-WAN) is a virtual network architecture that uses software to manage and optimize the connections between branch offices and data centers across a wide geographic area.
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
About these practice questions
Courseiva writes every PCA question from scratch — 955 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCA practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCA exam.