CKA Networking 3 — Questions and Answers
Question 1: Which kube-proxy mode uses Linux iptables rules to implement Service load balancing?
- userspace
- iptables (Correct answer)
- ipvs
- ebpf
Correct answer: iptables
In iptables mode, kube-proxy writes DNAT rules to redirect ClusterIP traffic to a random Pod endpoint.
Question 2: An Ingress resource requires which cluster component to actually route HTTP traffic?
- kube-proxy
- CoreDNS
- An Ingress controller (Correct answer)
- kubelet
Correct answer: An Ingress controller
An Ingress resource is only a configuration object; an Ingress controller (e.g., nginx-ingress, Traefik) must be deployed to act on it.
Question 3: Which DNS record type does a headless Service (clusterIP: None) return for Pod lookups?
- CNAME pointing to a single load-balanced IP
- A records for each individual Pod IP (Correct answer)
- SRV records only
- PTR records
Correct answer: A records for each individual Pod IP
A headless Service returns individual A records for each Pod IP, enabling clients to discover all endpoints directly.
Question 4: What does the `externalTrafficPolicy: Local` setting on a LoadBalancer Service do?
- Restricts the Service to internal cluster traffic only
- Preserves the client source IP and only routes to local node Pods (Correct answer)
- Disables health checks on the load balancer
- Converts the Service to ClusterIP type
Correct answer: Preserves the client source IP and only routes to local node Pods
With Local policy, kube-proxy only forwards external traffic to Pods on the same node, preserving the original client IP without SNAT.
Question 5: A NetworkPolicy egress rule with an empty `to: []` field means:
- Egress to all destinations is allowed
- Egress to all destinations is denied (Correct answer)
- The rule is invalid and ignored
- Only egress within the namespace is allowed
Correct answer: Egress to all destinations is denied
An egress rule with no `to` entries (empty list) matches no destination, effectively blocking all egress when combined with a policyTypes: [Egress] selection.
Question 6: Which object automatically tracks the IP addresses and ports of Pods backing a Service in large clusters (1000+ endpoints)?
- Endpoints
- EndpointSlices (Correct answer)
- ServiceEntry
- PodIPPool
Correct answer: EndpointSlices
EndpointSlices shard endpoint data into smaller objects (default 100 endpoints each), reducing API server load compared to single large Endpoints objects.
Question 7: Which Ingress annotation is commonly used with the nginx Ingress controller to enable TLS termination?
- kubernetes.io/tls-acme: 'true'
- nginx.ingress.kubernetes.io/ssl-redirect: 'true'
- spec.tls with secretName referencing a TLS Secret (Correct answer)
- ingress.kubernetes.io/force-ssl-redirect
Correct answer: spec.tls with secretName referencing a TLS Secret
TLS termination on an Ingress is configured via spec.tls, referencing a Secret that holds the certificate and key.
CKA Networking 3
Which kube-proxy mode uses Linux iptables rules to implement Service load balancing?