Services and Networking

CKAD · 60 questions

• Operators apply a NetworkPolicy that selects all Pods in a namespace and allows no ingress peers. What is the effective result until allow rules are added?
• Frontend Pods labeled app=frontend must reach backend Pods labeled app=backend on TCP 8080. Which NetworkPolicy approach allows that ingress?
• A shared monitoring namespace must scrape app Pods in another namespace. Which NetworkPolicy source matches that whole monitoring namespace?
• Egress from a payment Pod must be denied except DNS and one external payment gateway IP. What NetworkPolicy pattern fits?
• A NetworkPolicy selects only Pods with tier=api. What happens to Pods in the same namespace that lack that label?
• Two NetworkPolicies select the same Pod: one allows ingress from frontend, another allows ingress from monitoring. How do they combine?
• A cluster's CNI does not implement NetworkPolicy. What should an application developer expect after creating NetworkPolicy objects?
• App Pods are behind a default-deny ingress NetworkPolicy. External users reach the app through an Ingress controller. What additional allow is typically required?
• A policy should restrict only egress and leave ingress unspecified intentionally. What must be set so egress rules are honored as intended?
• After applying an egress default-deny NetworkPolicy, Pods can no longer resolve Service DNS names. What allow is missing?
• A city parking API listens on TCP 8080, but a NetworkPolicy allow rule lists protocol UDP and port 8080 for the same Pods. What happens to legitimate client traffic?
• A NetworkPolicy egress rule allows ipBlock.cidr: 10.0.0.0/8 but lists except: ["10.20.0.0/16"]. How should egress to 10.20.5.10 be treated relative to that rule?
• A frontend Deployment’s Pods are labeled app=web, but a NetworkPolicy that selects app=api only allows ingress from role=frontend. Clients still time out. What is the most likely policy cause?
• A platform team wants a namespace-wide default-deny ingress NetworkPolicy in permits. Which podSelector shape applies the policy to every Pod in that namespace?
• A municipal API gateway Pod is protected by a strict NetworkPolicy. Product still asks whether that alone authenticates callers. What should you tell them?
• After applying a new NetworkPolicy in permits, a previously healthy web-to-api path starts timing out. Pods remain Ready. What should you check first?
• For a 3-tier app in one namespace, db Pods should accept TCP 5432 only from Pods labeled tier=api, not from tier=web. Which NetworkPolicy approach fits?
• A CKAD-style task asks you to restrict a checkout Pod’s egress to its payment API Service Pods on TCP 8443. What is the appropriate focus?
• An admin jump tool Pod should accept SSH-like traffic on TCP 2222 only from the trusted CIDR 203.0.113.0/24. Which NetworkPolicy peer fits that ingress allow?
• In a new namespace with healthy Pods and no NetworkPolicy objects, what is the default Pod-to-Pod connectivity posture?
• A city permits microservice must be reachable by other in-cluster clients only, not published on node or cloud load-balancer fronts. Which Service type fits?
• A developer needs a short-lived external demo of a UI on a lab cluster without an Ingress controller. Which Service choice is reasonable for that temporary access?
• On a cloud Kubernetes cluster, a public parks website should get a provider-provisioned external address in front of its Service. Which type requests that?
• A Service selector is app=billing, but the Deployment Pods are labeled app=invoice. The Pods are Ready. What do you expect for Endpoints?
• Clients call Service port 80, the container listens on 8080, and traffic never arrives. Which mapping is correct to fix the blackhole?
• Why define a named container port (for example name: http) and set the Service targetPort: http instead of only numeric ports?
• You have a working Deployment and need a ClusterIP Service quickly for in-cluster callers. Which kubectl helper creates a Service from that Deployment?
• A legacy municipal UI keeps server-side session state in memory on one Pod. Which Service setting improves sticky routing by client IP?
• An application needs DNS that returns Pod IPs directly for custom client-side discovery instead of a single ClusterIP. Which Service configuration enables that pattern?
• Pods must call legacy.permits.example.com using an in-cluster DNS name legacy-permits. Which Service type creates a CNAME-style mapping for that external hostname?
• A Service exists, its Endpoints list Ready Pod IPs, yet curls to the Service port hang. Containers listen on 9090 but targetPort is 8080. What is wrong?
• By default, when a Pod fails its readiness probe, how does that affect Service traffic?
• One Service must expose application traffic on port 80 and metrics on port 9090 to the same Pods. What is required?
• A Service is ClusterIP and you need a brief external test on node IPs without recreating the object from scratch. What change accomplishes that exposure style?
• From a Pod in namespace web, what DNS name reliably reaches Service my-svc in namespace my-ns?
• A city recreation API should receive traffic only after its readiness probe succeeds. The Service currently has publishNotReadyAddresses set to true for a rare warm-up case that no longer applies. What should the developer do for normal app traffic?
• A permits desk app must talk to a legacy database that runs outside the cluster at a fixed IP. Which Service approach maps a stable in-cluster DNS name to that external backend?
• A library kiosk NodePort Service must preserve the client source IP for audit logs and avoid an extra SNAT hop on nodes that have local endpoints. Which Service field setting supports that goal?
• A parks-api Service suddenly includes unintended Pods from a batch Job that reused the label app=parks. What should the developer change so only the API Deployment Pods receive Service traffic?
• After deploying a ClusterIP Service for a civic payments API, the developer needs to verify in-cluster reachability before opening Ingress. What is the most appropriate quick check?
• The city needs HTTPS-ready HTTP routing so host permit.city.example path / reaches Service permit-ui on port 80. Which Ingress configuration expresses that intent?
• A civic portal Ingress must terminate HTTPS for host portal.city.example using an existing TLS certificate stored in the cluster. Where should the Ingress reference that material?
• An API Ingress must match only the literal path /v1/status and must not match /v1/status/details. Which pathType should the rule use?
• A developer creates a valid Ingress object for a clinic booking UI, but no external HTTP routing appears. Cluster admins confirm no Ingress controller is running. What does that imply for the developer?
• One hostname parks.city.example should send path /ui to Service parks-ui and path /api to Service parks-api. How should the Ingress express that split?
• Users hit an Ingress host and receive HTTP 503. kubectl shows the Ingress backend Service name is misspelled relative to the real Service. What should the developer fix first?
• A cluster runs two Ingress controllers. The developer must ensure the civic Ingress is handled by the controller associated with class nginx. Which field selects that controller?
• For CKAD-level portable Ingress design, which approach should the developer prefer when routing host and path traffic to Services?
• A team exposes several HTTP municipal apps publicly via many NodePorts and wants cleaner hostname-based routing on standard ports. Which change best matches that goal?
• A request reaches the Ingress controller but matches none of the defined host or path rules. What should the developer understand about that case?
• One Ingress should serve parks.example to Service parks-web and library.example to Service library-web. Which rule structure supports that name-based virtual hosting?
• HTTP rules on an Ingress work, but HTTPS for the listed host fails. kubectl shows the tls Secret name referenced by the Ingress does not exist. What is the likely diagnosis?
• An Ingress backend must target Service payments on port 8080, while Pods listen on containerPort 8080 mapped from Service port 80 via targetPort. Which port should the Ingress backend reference?
• For a simple canary, host app.city.example should send path / to Service app-stable and path /beta to Service app-canary. Which Ingress design achieves that split?
• An Ingress in namespace permits references backend Service permit-ui, but that Service only exists in namespace libraries. Typical CKAD-style Ingress backends fail. What should the developer do?
• A product owner wants automatic HTTP to HTTPS redirects for an Ingress. Which statement reflects correct CKAD-level expectations?
• After validating the green Deployment behind Service app-green, the team wants live Ingress traffic to cut over from Service app-blue. What is the appropriate Ingress change?
• kubectl describe Ingress shows ADDRESS empty after creating rules. The controller is still provisioning an external load balancer. How should the developer interpret that status?
• A telemetry agent exposes a proprietary TCP protocol on port 7000 and must be reachable from outside the cluster. Why is a standard Ingress rule a poor primary choice?
• Pods behind an Ingress are protected by a default-deny NetworkPolicy. External clients reach the Ingress controller, but app Pods never receive traffic. What additional NetworkPolicy consideration is required?