Kubernetes Container Orchestration Networking Services 3 — Questions and Answers
Question 1: In a NetworkPolicy, what happens to pods that have no NetworkPolicy selecting them?
- All ingress and egress are blocked
- Only ingress is blocked
- All ingress and egress are allowed (Correct answer)
- Pods are evicted
Correct answer: All ingress and egress are allowed
By default, pods not selected by any NetworkPolicy are non-isolated and accept all incoming and outgoing traffic.
Question 2: Which CNI plugin is known for enforcing NetworkPolicy and using eBPF for high-performance networking?
- Flannel
- Weave Net
- Calico
- Cilium (Correct answer)
Correct answer: Cilium
Cilium uses eBPF to implement networking and security policies at the kernel level, offering high throughput and fine-grained NetworkPolicy enforcement.
Question 3: What does the podSelector field in a NetworkPolicy's spec select?
- The pods in other namespaces to allow traffic from
- The pods in the same namespace that the policy applies to (Correct answer)
- The nodes where the policy is enforced
- The service accounts allowed to connect
Correct answer: The pods in the same namespace that the policy applies to
The spec.podSelector field selects the group of pods within the policy's namespace to which the NetworkPolicy rules apply.
Question 4: A NetworkPolicy with an empty podSelector ({}) applies to which pods in the namespace?
- No pods
- Only pods with no labels
- All pods in the namespace (Correct answer)
- All pods across all namespaces
Correct answer: All pods in the namespace
An empty podSelector matches all pods in the namespace, making the policy's rules apply cluster-wide within that namespace.
Question 5: Which NetworkPolicy policyType would you specify to restrict outbound traffic from selected pods?
- Ingress
- Egress (Correct answer)
- Bidirectional
- ClusterPolicy
Correct answer: Egress
Setting policyTypes to include Egress in a NetworkPolicy allows you to define rules that restrict or permit outgoing traffic from the selected pods.
Question 6: What is the purpose of the namespaceSelector field in a NetworkPolicy ingress rule?
- Selects which namespaces the policy is created in
- Allows traffic from pods in namespaces matching the label selector (Correct answer)
- Restricts the policy to a single namespace
- Defines DNS search domains
Correct answer: Allows traffic from pods in namespaces matching the label selector
namespaceSelector in an ingress from block permits traffic from pods residing in namespaces whose labels match the selector.
Question 7: Which Kubernetes resource defines rules that specify how groups of pods are allowed to communicate with each other and external endpoints?
- Service
- Ingress
- NetworkPolicy (Correct answer)
- EndpointSlice
Correct answer: NetworkPolicy
NetworkPolicy is the Kubernetes resource used to specify pod-level network isolation rules for both ingress and egress traffic.
Kubernetes Container Orchestration Networking Services 3
In a NetworkPolicy, what happens to pods that have no NetworkPolicy selecting them?