KCNA Networking & Service Discovery 4 — Questions and Answers
Question 1: In a NetworkPolicy, what does an empty podSelector ({}) in the spec mean?
- No pods are selected
- All pods in the namespace are selected (Correct answer)
- Only pods without labels are selected
- All pods in the cluster are selected
Correct answer: All pods in the namespace are selected
An empty podSelector matches all pods in the namespace where the NetworkPolicy is defined, applying the policy to every pod there.
Question 2: Which Kubernetes object defines layer 7 (HTTP/HTTPS) routing rules for external access to cluster services?
- Service
- EndpointSlice
- Ingress (Correct answer)
- NetworkPolicy
Correct answer: Ingress
Ingress resources define HTTP and HTTPS routing rules, host-based routing, and TLS termination for externally accessible services.
Question 3: What is an EndpointSlice in Kubernetes?
- A slice of the cluster network CIDR
- A scalable group of network endpoints representing a subset of a Service's backends (Correct answer)
- A portion of an Ingress routing table
- A DNS zone file slice for large namespaces
Correct answer: A scalable group of network endpoints representing a subset of a Service's backends
EndpointSlices replaced Endpoints for scalability, grouping backend pod IPs and ports into slices of up to 100 entries per slice.
Question 4: Which kube-proxy mode uses Linux kernel's IPVS (IP Virtual Server) for load balancing?
- userspace mode
- iptables mode
- ipvs mode (Correct answer)
- ebpf mode
Correct answer: ipvs mode
IPVS mode in kube-proxy uses the kernel's IPVS framework, which offers better performance and more load balancing algorithms than iptables for large clusters.
Question 5: What does the 'externalTrafficPolicy: Local' setting on a NodePort or LoadBalancer Service do?
- Restricts Service access to the local namespace
- Preserves the client's source IP and only routes to pods on the receiving node (Correct answer)
- Routes all external traffic through the master node
- Disables SNAT for internal cluster traffic only
Correct answer: Preserves the client's source IP and only routes to pods on the receiving node
With Local policy, kube-proxy only forwards to pods on the same node that received the traffic, preserving the original client IP but potentially causing uneven load distribution.
Question 6: Which DNS record type does Kubernetes use for headless Service pods with a stable hostname (StatefulSet)?
- CNAME
- A record per pod hostname (Correct answer)
- SRV only
- MX record
Correct answer: A record per pod hostname
For headless Services backed by StatefulSets, each pod gets an A record of the form <pod-name>.<service-name>.<namespace>.svc.cluster.local.
Question 7: What is the cluster CIDR used for in Kubernetes networking?
- Assigning IPs to cluster nodes
- Assigning IP addresses to pods across the cluster (Correct answer)
- Defining the range for Service ClusterIPs
- Setting the IP range for Ingress controllers
Correct answer: Assigning IP addresses to pods across the cluster
The cluster CIDR (e.g., 10.244.0.0/16) is the IP address range from which pod IPs are allocated across all nodes.
KCNA Networking & Service Discovery 4
In a NetworkPolicy, what does an empty podSelector ({}) in the spec mean?