A CKAD-style task asks you to restrict a checkout Pod’s egress to its payment API Service Pods on TCP 8443. What is the appropriate focus?
Select an answer to reveal the explanation.
Short Explanation
CKAD cares about the app’s hallway doors—checkout to payment—not rebuilding the courthouse security system. Scope the NetworkPolicy to that egress path and port. Leave apiserver hardening and CNI installs for admin/security exams.
Full Explanation
A CKAD-style task that asks you to restrict a checkout Pod’s egress to its payment API Service Pods on TCP 8443 wants application-scoped NetworkPolicy work. Write NetworkPolicy egress rules and matching selects for that application path to the payment Pods/port; leave cluster-admin API hardening out of scope. CKAD cares about the app’s hallway doors—checkout to payment—not rebuilding the courthouse security system. Scope the NetworkPolicy to the stated egress path and port for the municipal checkout flow.
Hardening kube-apiserver admission and etcd peer encryption before writing any NetworkPolicy is important platform engineering but not the focus of this application task. Installing a CNI plugin from scratch and reconfiguring node-level iptables personally exceeds typical CKAD application scope. Disabling CoreDNS so egress policies can only use raw Pod IPs breaks Service DNS and is unnecessary to write a correct egress policy toward payment Pods.
Exam caveat: answer the least-privilege application policy asked; do not expand into cluster bootstrap or control-plane hardening. If you use egress default-deny, remember DNS allows as well. Operational check: apply the egress policy on checkout, verify payment on TCP 8443 works, verify unrelated egress fails, and include a DNS allow when default-deny egress is used. Attach the policy manifests to the municipal checkout change request for auditability and rollback clarity.