Services & Networking

CKA · 60 questions

• City application Pods on different worker nodes must communicate using Pod IPs. What connectivity model should administrators expect from a standard CNI setup (absent NetworkPolicy denials)?
• A county engineer claims every Pod shares the node's network namespace by default. What is the correct default networking behavior?
• A library frontend in namespace web cannot resolve a backend Service named catalog in namespace data using only the short name catalog. What DNS name should it use instead?
• A transit platform team debates whether enabling a CNI plugin is the same as enforcing NetworkPolicies. What distinction should they apply?
• A school-district Pod runs a main API container and a sidecar. How do those containers reach each other on the network by default?
• A public-health team notices that application clients lose connectivity after a Deployment recreates Pods, because clients were given Pod IPs. What should the administrator explain about Pod addressing?
• A building-permits application hard-coded a Pod IP in its config and failed after the Pod was rescheduled to another node. Which change restores stable reachability for other in-cluster callers?
• An open-data platform schedules Pods successfully on every node, but Pods on different nodes cannot ping each other. Control-plane and kubelet appear healthy. What should the administrator investigate first?
• A municipal Wi-Fi backend needs Pods to reach the public Internet for vendor API calls. At CKA administrator depth, how do Pods typically obtain outbound Internet access?
• Before blaming an application bug, a 911 platform team wants to confirm that one Service can resolve another Service by DNS inside the cluster. Which component should they verify is healthy?
• A city cluster must isolate Pods in the finance namespace so that, by default, no other Pods can reach them until explicit allow rules are added. Which NetworkPolicy approach achieves that default-deny posture for selected Pods?
• A county platform must allow only Pods labeled role=frontend to connect to Pods labeled app=api on TCP port 8080. Which NetworkPolicy design matches that requirement?
• A library namespace applies a strict egress NetworkPolicy that blocks nearly all outbound traffic. Name resolution for Services immediately fails. What egress allowance is typically still required?
• A transit team creates a NetworkPolicy whose podSelector matches only Pods with tier=backend. Unlabeled Pods in the same namespace still accept connections from anywhere. Why?
• A school-district admin proposes using a NetworkPolicy to stop developers from listing Secrets via kubectl. What misconception should the CKA candidate correct?
• Public-health API Pods should accept ingress from any Pod running in namespaces labeled team=intake. Which NetworkPolicy peer selector expresses that?
• Building-permits administrators apply several NetworkPolicy objects, but traffic is never filtered. Pods and Services look correct. What dependency is most likely missing?
• An open-data team wants one NetworkPolicy object to restrict both inbound connections to selected Pods and outbound connections from those Pods. What must they configure?
• Municipal HR applies a deny-all NetworkPolicy in a shared namespace and immediately loses access from their management Pods to the API Pods they still need. What operational lesson applies?
• A sanitation cluster wants to stop unrelated apps from talking east-west inside the same namespace without adopting CKS-only tooling. Which CKA-depth control fits?
• A city internal API must be reachable only from inside the cluster. Which Service type should the administrator choose?
• A county kiosk network needs to reach a demo app using each node's IP address on a static high port without a cloud load balancer. Which Service type fits?
• A library runs on a cloud Kubernetes environment and wants the platform to provision an external load balancer IP for a public web Service. Which Service type requests that?
• A transit Service shows no ready backends even though Pods are running. The Service selector is app=scheduler but Pods are labeled app=sched. What is the likely result?
• School-district clients time out connecting to a ClusterIP Service. Which objects should the administrator inspect to see which Pod IPs currently back the Service?
• Public-health Pods keep running but fail readiness probes. How does that affect a Service that selects those Pods?
• Building-permits developers need DNS that returns the Pod IPs themselves for direct discovery, not a single ClusterIP. Which Service configuration fits?
• An open-data portal Service listens on port 80 for clients but containers listen on port 8080. How should the Service map those ports?
• Municipal external users need HTTPS host-based routing to several in-cluster apps. Operators prefer not to expose NodePorts on every worker. Which exposure model is most appropriate?
• A 911 platform observes that Endpoints already list new Pod IPs after a rollout, yet a few connections still hit old backends for a short time. What should the administrator understand?
• A city platform team wants one shared north-south HTTP entrypoint that can host many municipal host and path routes with portable, role-friendly resources. Which Kubernetes approach best matches that goal?
• A county wants infrastructure operators to own the shared public entrypoint while application teams only attach their own HTTP routes. How should Gateway API ownership typically be split?
• A library consortium is tired of Ingress objects that only work after controller-specific annotations. What is a primary motivation for moving toward Gateway API?
• Transit needs citizen traffic for host schedules.city.example to reach the schedules Service through an existing Gateway listener. Which Gateway API action is correct?
• A school district creates Gateways but must choose which implementation will reconcile them. Which resource selects the controller that implements a Gateway?
• Public-health engineers ask whether adopting Gateway API means they can delete ClusterIP Services in front of their Pods. What should you tell them?
• Building-permits needs HTTPS termination on a Gateway listener using a certificate already stored in the cluster. What configuration approach fits Gateway API?
• After applying an HTTPRoute for an open-data API, operators want to confirm the shared Gateway actually accepted the attachment. Where should they look first?
• A municipal team applies Gateway, GatewayClass, and HTTPRoute objects, but no traffic is handled at the edge. What critical dependency is still missing?
• Sanitation must publish several citizen HTTP apps with host- and path-based routing on a shared entrypoint. When is Gateway API a better fit than exposing each app with only a raw NodePort?
• The city still runs ingress-nginx for legacy portals. What is the purpose of an Ingress resource in that model?
• A county creates several Ingress objects for internal tools, but none of the hostnames respond. What prerequisite is most likely missing?
• A library wants catalog.library.example and events.library.example to reach different backend Services through one Ingress. Which capability are they using?
• Transit runs more than one Ingress controller in the cluster and must ensure a new portal Ingress is handled by the nginx implementation. What should they set?
• A school district wants TLS for an Ingress hostname using a certificate already in a Kubernetes Secret. Where is that Secret referenced in the classic Ingress API?
• Public-health publishes an Ingress that returns edge errors for a citizen API. Investigation shows the Ingress backend Service name does not exist in the namespace. What is the correct diagnosis?
• Building-permits needs many HTTP apps reachable on one shared external entrypoint and IP-friendly hostname routing. Why choose Ingress (or Gateway API) over one LoadBalancer Service per app?
• Open-data platform engineers copy an Ingress that relies on many vendor annotations when switching controllers and routing breaks. What lesson should they take?
• A municipal CMS must send /v2 traffic to a green Service and keep / on blue through one hostname. Which Ingress capability provides that split?
• A 911-related portal’s Ingress objects look correct, yet every external route fails. Controllers and app Pods were not checked yet. What should operators verify early?
• City application Pods reach api.permits.svc.cluster.local successfully. Which component primarily provides that in-cluster Service DNS resolution?
• A county needs Pods to resolve an on-prem Active Directory DNS zone for internal directories. How is that commonly configured with CoreDNS?
• Library applications across many namespaces suddenly cannot resolve Service names even though the Service objects still exist. CoreDNS replicas recently crashed. What is the impact?
• Transit troubleshoots DNS from inside an application Pod and inspects /etc/resolv.conf. What should that file typically show regarding cluster DNS?
• A school district app resolves short name api inside its own namespace but fails when the same short name is used to reach a Service in another namespace. Why?
• A public-health cluster sees DNS latency during a surge. CoreDNS runs as a Deployment behind the cluster DNS Service. Which admin action correctly scales name resolution capacity?
• Building-permits pods report failures talking to an internal API. One symptom is NXDOMAIN from dig; another is connection refused after a name resolves to the Service ClusterIP. What distinction should the admin draw?
• An open-data portal needs DNS that returns Pod IPs for a discovery pattern similar to StatefulSet peers, not a single load-balanced ClusterIP. Which Service configuration produces that DNS behavior?
• Municipal SRE sees intermittent DNS failures for in-cluster names. Which first admin check best targets CoreDNS configuration and runtime behavior?
• The sanitation platform team asks which object supplies the stable ClusterIP that application Pods use as their nameserver for cluster DNS. What is the correct answer?