KCNA Networking & Service Discovery 3 — Questions and Answers
Question 1: Which CNI plugin feature allows enforcement of NetworkPolicy objects?
- IPAM (IP Address Management)
- Network policy enforcement by the CNI plugin (Correct answer)
- Pod-to-node routing
- Service load balancing
Correct answer: Network policy enforcement by the CNI plugin
NetworkPolicy enforcement requires a CNI plugin that supports it (e.g., Calico, Cilium, Weave); the base CNI spec handles IP assignment and routing but not policy.
Question 2: What is the default behavior for pod-to-pod communication when NO NetworkPolicy is applied?
- All ingress is denied by default
- All traffic is allowed between all pods (Correct answer)
- Only same-namespace traffic is allowed
- Traffic is allowed only within the same node
Correct answer: All traffic is allowed between all pods
Without any NetworkPolicy, Kubernetes allows all pod-to-pod communication across the entire cluster by default.
Question 3: Which Ingress feature allows routing different URL paths to different backend Services?
- Host-based routing
- Path-based routing (Correct answer)
- Port-based routing
- Header-based routing
Correct answer: Path-based routing
Ingress path rules let you map HTTP paths like /api to one Service and /static to another Service within the same Ingress resource.
Question 4: What is the role of CoreDNS in a Kubernetes cluster?
- Assigns ClusterIP addresses to Services
- Provides DNS resolution for Service and pod names within the cluster (Correct answer)
- Routes traffic between nodes using BGP
- Manages TLS certificates for Ingress resources
Correct answer: Provides DNS resolution for Service and pod names within the cluster
CoreDNS runs as a Deployment in the cluster and serves DNS queries, resolving Service names and pod hostnames to their respective IP addresses.
Question 5: A Service of type ExternalName maps to what kind of resource?
- An external IP address
- A CNAME record pointing to an external DNS name (Correct answer)
- A NodePort on every cluster node
- A pod running outside the cluster
Correct answer: A CNAME record pointing to an external DNS name
ExternalName Services create a DNS CNAME record that aliases the Service name to an external hostname, enabling cluster-internal resolution of external services.
Question 6: Which field in a Service spec controls which port is exposed on the node when using NodePort type?
- port
- targetPort
- nodePort (Correct answer)
- containerPort
Correct answer: nodePort
The nodePort field (30000–32767 range) specifies which port on all cluster nodes is used to forward traffic to the Service.
Question 7: What does the 'sessionAffinity: ClientIP' setting on a Service do?
- Routes all requests from the same client IP to the same pod (Correct answer)
- Enables sticky sessions based on HTTP cookies
- Pins sessions to a specific node
- Applies source NAT based on client IP
Correct answer: Routes all requests from the same client IP to the same pod
ClientIP session affinity configures kube-proxy to forward all requests from a given client IP to the same backend pod for a configurable timeout period.
KCNA Networking & Service Discovery 3
Which CNI plugin feature allows enforcement of NetworkPolicy objects?