1. Home
2. All questions
3. Networking

CKA study material: Networking

147 questions of the 1000 in the CKA — Certified Kubernetes Administrator quiz. Each opens with its answer, the reasoning and where that is written down.

Challenge yourself on this topic → Study as cards

The questions

1. 12. Under what circumstance can nodes run without kube-proxy?
2. 13. How does kube-proxy handle Service traffic when the operating system offers a packet filtering layer?
3. 16. Which addon does the documentation treat as effectively mandatory in every cluster?
4. 33. Which CNI specification version does the Kubernetes project recommend a plugin be compatible with?
5. 34. What changed about CNI plugin management in Kubernetes 1.24? Choose two.
6. 35. Besides the CNI plugin, what must the container runtime provide for every Pod sandbox?
7. 36. A Pod using hostPort gets no traffic on the node's port. Which CNI configuration setting is likely missing?
8. 63. What must be true of the Pod network CIDR chosen for a cluster?
9. 65. How many Pod networks may be installed in one cluster?
10. 84. Which kernel setting commonly has to be enabled by hand before cluster networking works?
11. 140. What kind of Service does a StatefulSet use to control its Pods' DNS domain?
12. 209. Which Service type performs no proxying and simply resolves to another DNS name?
13. 213. A Service sets internalTrafficPolicy to Local. What happens to traffic from a Pod on a node with no local endpoints?
14. 234. A cluster's Service range is 10.96.0.0/16. Which address do many installers give the DNS Service by convention?
15. 241. Which proxy modes are available to kube-proxy on a Linux node? Choose two.
16. 242. How does kube-proxy in iptables mode choose a backend Pod for a new connection?
17. 243. What is the recommended replacement for kube-proxy's deprecated ipvs mode?
18. 244. Which kernel version does kube-proxy's nftables mode require?
19. 245. Why is it recommended to name kube-proxy's mode explicitly in its configuration?
20. 246. Which Service field sends a given client's connections to the same Pod each time?
21. 251. A namespace holds no NetworkPolicy objects. What traffic is permitted to and from its Pods?
22. 252. When does a Pod become isolated for egress?
23. 253. A NetworkPolicy restricts inbound traffic to a set of Pods. What is the effect on their outbound traffic?
24. 254. Two NetworkPolicies select the same Pod with different ingress rules. What traffic is allowed?
25. 255. What must hold for a connection from one Pod to another to be allowed? Choose two.
26. 256. A NetworkPolicy allows an inbound connection. Must a matching rule also permit the reply?
27. 257. A Pod is isolated for ingress by a policy with no matching rule. Which traffic still reaches it?
28. 258. How is a namespace-wide default-deny for ingress written?
29. 259. A NetworkPolicy omits policyTypes but contains egress rules. Which types are set?
30. 260. Which peer selectors may a NetworkPolicy rule use? Choose two.
31. 261. A policy names namespaceSelector and podSelector inside a single from entry. What does it match?
32. 262. A NetworkPolicy is applied successfully but traffic is not restricted at all. What is the likeliest cause?
33. 263. Which protocols does NetworkPolicy cover? Choose two.
34. 264. Which field lets one NetworkPolicy rule cover a range of ports?
35. 265. How does a NetworkPolicy target a namespace by its name?
36. 266. A Pod in the test namespace cannot resolve a Service called data that lives in prod. Which two statements explain it? Choose two.
37. 267. Which component writes each Pod's /etc/resolv.conf?
38. 268. What does the DNS A record for a normal, non-headless Service resolve to?
39. 269. A client resolves a headless Service's DNS name. What comes back?
40. 270. Which record type does cluster DNS create for a Service's named ports?
41. 271. What is a Pod's hostname by default?
42. 272. A Pod sets hostname foo and subdomain bar in namespace my-namespace. What is its FQDN?
43. 273. For DNS to publish records for a Pod's subdomain, what else must exist?
44. 274. Which dnsPolicy is used when a Pod does not set one?
45. 275. What does dnsPolicy Default actually do?
46. 276. A hostNetwork Pod with dnsPolicy ClusterFirst cannot resolve Service names. What should be set?
47. 277. A Pod sets dnsPolicy None. Where must its nameservers come from?
48. 278. Which are among the four networking problems Kubernetes addresses? Choose two.
49. 279. How does Kubernetes avoid making applications coordinate host port numbers?
50. 280. Which components assign the cluster's non-overlapping address ranges? Choose two.
51. 281. Which addresses count toward the network model in a dual-stack cluster?
52. 282. Why is the cluster DNS Service still named kube-dns when CoreDNS implements it?
53. 283. Which kubelet flags configure a container's DNS? Choose two.
54. 284. What does the kubelet's --resolv-conf flag control? Choose two.
55. 285. Where is CoreDNS configured in a standard cluster?
56. 286. Which zones does the default Corefile's kubernetes plugin serve? Choose two.
57. 287. Where does the default Corefile send queries that fall outside the cluster zones?
58. 288. Which record type does cluster DNS use for reverse lookups of Pod and Service addresses?
59. 289. Which control plane ports are correct? Choose two.
60. 290. Which port serves the kubelet API on both control-plane and worker nodes?
61. 291. A load balancer's health check targets a node port and fails. Which kube-proxy port serves health checks?
62. 292. External clients cannot reach a NodePort Service through a firewall. Which range must be open?
63. 293. Which two statements about Kubernetes' default ports are correct? Choose two.
64. 294. Where does a Service's default address family come from?
65. 295. How do PreferDualStack and RequireDualStack differ? Choose two.
66. 296. Which part of a Service's ipFamilies may be changed after creation?
67. 297. On a dual-stack Service, which field is authoritative for the addresses assigned?
68. 298. A Service is created on a dual-stack cluster without setting ipFamilyPolicy. What is it?
69. 299. What does a label selector's comma mean, and what operators are set-based? Choose two.
70. 300. What are the length limits on a label key?
71. 386. Which test distinguishes a DNS fault from a proxying fault for a Service?
72. 391. A Service is defined correctly and has endpoints, yet traffic still fails. Which policy object should be reviewed?
73. 411. kube-proxy logs a failure to retrieve the node IP and falls back to 127.0.0.1. What happened?
74. 490. A colleague cannot reach a port-forwarded application from another machine. Why?
75. 504. A cluster runs a CNI plugin that implements Service routing in its own dataplane. What does that make possible for the node components?
76. 541. A cluster still relies on SSH tunnels for control-plane-to-node traffic. What is the documented replacement?
77. 545. An engineer installs a CNI plugin whose manifest assumes 10.244.0.0/16, but Pods never get addresses in that range. What was most likely missed at kubeadm init?
78. 548. You are choosing a Pod CIDR for a new cluster. Which two statements are correct? Choose two.
79. 556. After running kubeadm reset you plan to reuse the machine as a worker in a different cluster. What does reset leave behind?
80. 649. Which DaemonSet Pods get an automatic toleration for the node.kubernetes.io/network-unavailable taint?
81. 704. A Service of type ExternalName maps db to db.example.com. What does a Pod's DNS lookup of db return?
82. 708. Which two statements describe a headless Service? Choose two.
83. 715. A Service sets trafficDistribution to PreferSameZone. What does this guarantee?
84. 723. Why is externalTrafficPolicy: Local often chosen for a LoadBalancer Service?
85. 727. In iptables proxy mode, how is a backend chosen for a new connection to a Service?
86. 728. An operator is choosing a kube-proxy mode for a new Linux cluster and is considering ipvs. What is the current guidance?
87. 729. Which two capabilities does IPVS proxy mode offer that iptables mode does not? Choose two.
88. 743. A dual-stack Service serves both IPv4 and IPv6. How many EndpointSlices does it have at a minimum?
89. 746. In Gateway API, what is the relationship between a Gateway and a GatewayClass?
90. 750. A NodePort Service has three backing Pods on three of a cluster's ten nodes. Which nodes answer on the allocated node port?
91. 751. Three different components allocate the three address ranges in a cluster. Which two pairings are correct? Choose two.
92. 752. An engineer proposes a Pod CIDR that partially overlaps the Service CIDR to save address space. Why is this rejected?
93. 753. A node's interfaces carry several addresses, but Kubernetes only ever uses one of them. Which does it consider?
94. 754. You are writing firewall rules for a control plane node. Which two inbound ports are needed by default? Choose two.
95. 755. Which protocols must be permitted for the NodePort range on a worker node?
96. 756. A namespace contains no NetworkPolicy objects at all. What traffic may its Pods send and receive?
97. 757. A NetworkPolicy selects a Pod, lists an ingress rule, and sets policyTypes to ["Ingress"]. What is the Pod's egress isolation?
98. 758. Two NetworkPolicies select the same Pod and permit different ingress sources. What may reach the Pod?
99. 759. Pod A's namespace has a default-deny egress policy. Pod B's namespace has an ingress policy explicitly allowing A. Can A reach B?
100. 760. A NetworkPolicy allows Pod A to open a connection to Pod B on port 8080. What about the responses B sends back?
101. 761. A Pod is isolated for ingress by a policy that names no peers. The kubelet's liveness probe still succeeds. Why?
102. 762. A from block contains two list entries: one with a namespaceSelector and one with a podSelector. What does it allow?
103. 763. Why does the documentation say ipBlock should name cluster-external addresses?
104. 764. A team wants to allow a namespace broad egress but block one specific external CIDR. What does the NetworkPolicy API support?
105. 765. Which two things can a NetworkPolicy not do? Choose two.
106. 766. An incident responder applies a restrictive NetworkPolicy to cut off a compromised Pod's live connections. What should they expect?
107. 767. A NetworkPolicy is applied successfully but traffic it should block still flows. What is the first thing to check?
108. 768. A Pod resolves the DNS name of a headless Service. What does it get back?
109. 769. A Pod in namespace test cannot resolve the name data, which is a Service in namespace prod. What should the client use?
110. 770. Reading a Pod's /etc/resolv.conf you find options ndots:5. What does the kubelet write it for?
111. 771. For which Service ports does cluster DNS create SRV records?
112. 772. A Pod manifest omits dnsPolicy entirely. Which policy applies?
113. 773. A Pod with hostNetwork: true and dnsPolicy: ClusterFirst cannot resolve any in-cluster Service names. Why?
114. 774. A Pod sets dnsPolicy to None. What must accompany it?
115. 775. How many nameservers may a Pod's dnsConfig list?
116. 776. A Pod uses dnsPolicy ClusterFirst and adds options in its dnsConfig. What happens to the options the policy would have produced?
117. 777. What limits does Kubernetes place on a Pod's DNS search domain list?
118. 778. Which two Pod spec fields shape the DNS name a Pod is given under a headless Service? Choose two.
119. 779. An administrator needs to change how cluster DNS forwards external queries. Where is that configured?
120. 780. In the default Corefile, which two plugins divide the work of answering queries? Choose two.
121. 781. Which CoreDNS plugin exists to catch a configuration in which queries would be forwarded back to CoreDNS itself?
122. 782. A cluster must send queries for internal.example.com to a particular corporate nameserver. How is that expressed in CoreDNS?
123. 783. After editing the CoreDNS ConfigMap, an operator wonders whether to restart the CoreDNS Deployment. What does the default configuration provide?
124. 784. A Service sets ipFamilyPolicy to RequireDualStack and is applied to a single-stack cluster. What happens?
125. 785. Which field determines a dual-stack Service's primary IP family?
126. 786. An engineer looks for the kubelet's --network-plugin and --cni-bin-dir flags on a current release and cannot find them. What changed?
127. 787. A cluster operator is evaluating a CNI plugin that declares compatibility with CNI specification v0.3.1 only. What does the Kubernetes project require?
128. 788. A cluster deploys NodeLocal DNSCache. Which two effects does it have on a Pod's DNS queries? Choose two.
129. 789. What change must applications make to benefit from NodeLocal DNSCache?
130. 790. Cluster DNS has stopped working. Which two checks does the troubleshooting guide begin with? Choose two.
131. 791. How is a default-deny ingress policy for a namespace written?
132. 792. After a default-deny egress policy is applied to a namespace, its Pods can no longer resolve any names. What is missing?
133. 793. A namespace has an allow-all ingress policy. A second policy is added that permits only one source. What can now reach the Pods?
134. 794. A NetworkPolicy rule sets endPort: 32768 but omits port. Why is that invalid?
135. 795. A NetworkPolicy using endPort is applied, but traffic to the middle of the range is still blocked. What should be verified?
136. 796. A NetworkPolicy must permit traffic from the namespace named monitoring, which carries no custom labels. What can the namespaceSelector match on?
137. 797. You need a NetworkPolicy that limits who may reach an nginx Service. What does the policy actually select?
138. 798. Two containers in the same Pod need to talk to each other. Which networking problem is that, in the documentation's terms?
139. 799. A cluster's API server is reached on port 443 rather than 6443. What does that tell you?
140. 800. A NetworkPolicy in namespace web has an ingress rule whose from block contains only a podSelector matching app=api. Which Pods does it admit?
141. 873. A Service name will not resolve from inside a Pod. Which lookup isolates cluster DNS itself as the problem?
142. 880. A Pod cannot reach itself through its own Service IP. Which two hairpin-mode values allow that to work? Choose two.
143. 881. The kubelet was started with --hairpin-mode=promiscuous-bridge, but hairpin traffic still fails. Where is the effective mode confirmed?
144. 882. A Service is configured correctly and its Pods are healthy, but only some clients can reach it. What should be ruled out before deep proxy debugging?
145. 908. hostPort does not work in a cluster. Which capability does it depend on?
146. 959. A containerd log shows "incompatible CNI versions; config is 1.0.0, plugin supports ...". What is wrong?
147. 960. Pods start normally but cannot be stopped, and the runtime reports "invalid version: the version is empty" from StopPodSandbox. What is missing?