Study. uk . com
  1. Home
  2. All questions
  3. Question 764

CKA study material · question 764 of 1000

A team wants to allow a namespace broad egress but block one specific external CIDR. What does the NetworkPolicy API support?

  1. An except field on the ipBlock covering the excluded range
  2. A policy with an explicit deny rule for that CIDR
  3. A deny policy with a higher precedence value
  4. Neither a deny rule nor precedence; only allow rules exist
Show the answer

Answer: D. Neither a deny rule nor precedence; only allow rules exist

The NetworkPolicy model is deny by default with allow rules added, and it offers no way to explicitly deny, so an exception cannot be carved out of a broader permit through a deny.

Source: Network Policies (Kubernetes) — What you can't do with network policies

Challenge yourself on this topic → Study as cards