CKAD Certified CKAD 3 — Questions and Answers
Question 1: You want to expose a Deployment internally within the cluster on port 80. Which Service type should you use?
- NodePort
- LoadBalancer
- ClusterIP (Correct answer)
- ExternalName
Correct answer: ClusterIP
ClusterIP creates a virtual IP reachable only within the cluster, suitable for internal service-to-service communication.
Question 2: Which Ingress annotation is commonly used to rewrite the request path before forwarding to a backend?
- nginx.ingress.kubernetes.io/ssl-redirect
- nginx.ingress.kubernetes.io/rewrite-target (Correct answer)
- nginx.ingress.kubernetes.io/proxy-pass
- nginx.ingress.kubernetes.io/path-prefix
Correct answer: nginx.ingress.kubernetes.io/rewrite-target
The rewrite-target annotation tells the NGINX ingress controller to rewrite the URI before proxying to the upstream service.
Question 3: A NetworkPolicy selects pods with podSelector: {} and has no ingress rules. What is the effect?
- All traffic is allowed to selected pods
- All ingress traffic to selected pods is denied (Correct answer)
- Only egress traffic is blocked
- The policy has no effect without ingress rules
Correct answer: All ingress traffic to selected pods is denied
An empty ingress array with no rules blocks all inbound traffic to pods matched by the selector.
Question 4: Which field in a Service spec routes traffic to pods based on their labels?
- spec.podSelector
- spec.selector (Correct answer)
- spec.labelMatch
- spec.targetPods
Correct answer: spec.selector
spec.selector in a Service matches pods whose labels equal the selector, determining which pods receive traffic.
Question 5: What is the purpose of a headless Service (clusterIP: None) in Kubernetes?
- To disable load balancing and expose each pod IP via DNS directly (Correct answer)
- To block external access to the pods
- To assign a static external IP to the Service
- To skip kube-proxy entirely and route via eBPF
Correct answer: To disable load balancing and expose each pod IP via DNS directly
A headless Service returns individual pod IPs in DNS responses instead of a single virtual ClusterIP, enabling direct pod addressing.
Question 6: You need traffic from Pods in namespace 'monitoring' to reach Pods in namespace 'app'. Which NetworkPolicy resource namespace should the policy live in?
- monitoring
- app (Correct answer)
- kube-system
- default
Correct answer: app
NetworkPolicies that control ingress to pods in the 'app' namespace must be created in the 'app' namespace.
Question 7: Which kubectl command creates a Service of type ClusterIP exposing port 8080 for a Deployment named 'api'?
- kubectl expose deployment api --port=8080 --type=ClusterIP (Correct answer)
- kubectl create service api --port=8080
- kubectl apply service api --port=8080 --type=ClusterIP
- kubectl expose api --port=8080 --clusterip
Correct answer: kubectl expose deployment api --port=8080 --type=ClusterIP
kubectl expose deployment creates a Service targeting the Deployment's pods; --type=ClusterIP is the default but can be specified explicitly.
CKAD Certified CKAD 3
You want to expose a Deployment internally within the cluster on port 80.
Which Service type should you use?