CKA Networking 2 — Questions and Answers
Question 1: Which Kubernetes resource defines a stable virtual IP address that load-balances traffic to a set of Pods?
- Ingress
- Service (Correct answer)
- Endpoint
- NetworkPolicy
Correct answer: Service
A Service provides a stable ClusterIP virtual address that kube-proxy routes to the matching Pod endpoints.
Question 2: What is the default behavior of a NetworkPolicy when it first selects a Pod?
- All traffic is still allowed until a rule explicitly denies it
- All ingress to the Pod is denied; egress is unchanged (Correct answer)
- All ingress and egress to the Pod is denied
- Only inter-namespace traffic is denied
Correct answer: All ingress to the Pod is denied; egress is unchanged
Applying any NetworkPolicy that selects a Pod immediately blocks all ingress to that Pod; egress is only restricted when an egress rule is also present.
Question 3: Which Service type provisions an external load balancer from the cloud provider?
- ClusterIP
- NodePort
- LoadBalancer (Correct answer)
- ExternalName
Correct answer: LoadBalancer
A Service of type LoadBalancer triggers the cloud controller manager to allocate an external LB with a public IP.
Question 4: What CNI plugin feature is required for enforcing Kubernetes NetworkPolicies?
- IPAM (IP Address Management)
- Network policy enforcement support (Correct answer)
- BGP route advertisement
- Overlay encapsulation (VXLAN)
Correct answer: Network policy enforcement support
NetworkPolicy enforcement is not built into Kubernetes itself; the CNI plugin (e.g., Calico, Cilium) must support and implement it.
Question 5: Which field in a Service spec selects the backend Pods that the Service routes traffic to?
- matchLabels under selector (Correct answer)
- podSelector
- endpointSlices
- targetRef
Correct answer: matchLabels under selector
The Service's spec.selector map matches Pod labels to build the Endpoints/EndpointSlices that receive traffic.
Question 6: A Pod needs to reach an external hostname 'db.example.com'. Which DNS resolution path does it use by default?
- The node's /etc/resolv.conf directly
- The cluster DNS (CoreDNS) which then forwards to upstream resolvers (Correct answer)
- An external DNS server configured in the CNI
- The kube-apiserver DNS endpoint
Correct answer: The cluster DNS (CoreDNS) which then forwards to upstream resolvers
Pod DNS queries go to the cluster DNS (CoreDNS) first; CoreDNS forwards unresolved names to the upstream resolver configured in its Corefile.
Question 7: What is the port range used by NodePort Services by default?
- 1024–65535
- 8000–9000
- 30000–32767 (Correct answer)
- 10000–40000
Correct answer: 30000–32767
Kubernetes allocates NodePort values from the range 30000–32767 by default, configurable via --service-node-port-range on kube-apiserver.
CKA Networking 2
Which Kubernetes resource defines a stable virtual IP address that load-balances traffic to a set of Pods?