McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 49

Question 480

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Deployment dispatch-api in fulfillment requires maxUnavailable=0 and maxSurge=1 for a RollingUpdate rollout in the lab. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Use reviewed scaling boundaries and monitor HPA ownership before manual replica changes.
  2. Review resource sizing against actual usage and avoid scheduling on unsupported limits alone.
  3. Assess capacity for surge Pods and measure availability during upgrades.
  4. Version nonsecret application settings and avoid putting credentials into ConfigMaps.

Explanation

Correct Answer

C:

Assess capacity for surge Pods and measure availability during upgrades. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment patch deployment dispatch-api --type=merge -p '{"spec":{"strategy":{"type":"RollingUpdate","rollingUpdate":{"maxUnavailable":0,"maxSurge":1}}}}'. The relevant mechanism is: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Scaling the Deployment changes desired replica count through its controller; editing an individual Pod would not preserve the desired state. Here the sustained control must address: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. Choose “Assess capacity for surge Pods and measure availability during upgrades”.

B:

That safeguard is relevant to: Requests inform scheduling and limits cap runtime consumption; the settings play different roles. The current failure instead follows from: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. Its prevention measure is “Assess capacity for surge Pods and measure availability during upgrades”.

D:

The suggested review tracks a different technical risk: ConfigMaps hold ordinary configuration data; their existence does not automatically inject values into running Pods. Here the sustained control must address: Deployment rolling-update parameters govern how many old Pods may be unavailable and extra Pods may be created during replacement. Choose “Assess capacity for surge Pods and measure availability during upgrades”.

Question 481

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Deployment invoice-api in namespace ledger needs an internal ClusterIP Service invoice-svc exposing port 80 to container port 8080. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.
  2. Run kubectl -n observability patch service metrics-svc --type=merge -p '{"spec":{"ports":[{"port":8080,"targetPort":3000}]}}' for the lab's single-port Service.
  3. Run kubectl -n ledger port-forward service/invoice-svc 18080:80 in a temporary session.
  4. Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative.

Explanation

Correct Answer

A:

Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Validate the result with: Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

This alternative is a response to another technical cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The action that directly addresses it is “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080”.

C:

The proposed action belongs to the mechanism: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Here the stated fault follows a different mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The corrective choice is “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080”.

D:

The offered action targets: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The case facts point instead to: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Implement “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080” to address that specific condition.

Question 482

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Deployment invoice-api in namespace ledger needs an internal ClusterIP Service invoice-svc exposing port 80 to container port 8080. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  2. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  3. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.
  4. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.

Explanation

Correct Answer

B:

A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. This explains the stated condition. The corresponding action is: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080. The direct acceptance evidence is: Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping.

Incorrect Answers

A:

This principle describes a separate cause: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The reported condition is governed by: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The two mechanisms should not be conflated.

C:

The offered statement is true for this other mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. It does not explain the facts described here, which follow from: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

D:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The two mechanisms should not be conflated.

Question 483

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Deployment invoice-api in namespace ledger needs an internal ClusterIP Service invoice-svc exposing port 80 to container port 8080. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices.
  2. Compare listed endpoints against the matching ready Pods and expected selector for invoice-svc.
  3. Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping.
  4. Run kubectl -n ledger get gateway internal-gw -o yaml and inspect Accepted and Programmed conditions.

Explanation

Correct Answer

C:

Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The intended action is: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.

Incorrect Answers

A:

The alternative verifies a different condition: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Confirm that “Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping”.

B:

That test belongs to another control with this basis: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. In the current case, the governing reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The direct verification is “Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping”.

D:

The alternative verifies a different condition: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The current case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Confirm that “Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping”.

Question 484

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Deployment invoice-api in namespace ledger needs an internal ClusterIP Service invoice-svc exposing port 80 to container port 8080. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  2. Check gateway class/controller compatibility and delegate route attachment privileges deliberately.
  3. Limit NodePort exposure through network controls and remove temporary external test services.
  4. Manage Service selectors and target ports alongside the Deployment labels and container listening port.

Explanation

Correct Answer

D:

Manage Service selectors and target ports alongside the Deployment labels and container listening port. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080. The relevant mechanism is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

Incorrect Answers

A:

That safeguard is relevant to: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The current failure instead follows from: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Its prevention measure is “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

B:

This routine guards against another mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The recurring exposure in the current case is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The matching preventive check is “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

C:

The suggested review tracks a different technical risk: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Here the sustained control must address: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Choose “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

Question 485

At Horizon observability, in a disposable simulated environment during a monitored release window: Deployment metrics-api in namespace observability needs an internal ClusterIP Service metrics-svc exposing port 8080 to container port 3000. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability patch service metrics-svc --type=merge -p '{"spec":{"ports":[{"port":8080,"targetPort":3000}]}}' for the lab's single-port Service.
  2. Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000.
  3. Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"ports":[{"port":80,"targetPort":8080}]}}' for the lab's single-port Service.
  4. Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080.

Explanation

Correct Answer

B:

Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Validate the result with: Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The action that directly addresses it is “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000”.

C:

The offered action targets: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The case facts point instead to: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Implement “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000” to address that specific condition.

D:

This alternative is a response to another technical cause: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The reported case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The action that directly addresses it is “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000”.

Question 486

At Horizon observability, in a disposable simulated environment during a monitored release window: Deployment metrics-api in namespace observability needs an internal ClusterIP Service metrics-svc exposing port 8080 to container port 3000. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  2. An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.
  3. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  4. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.

Explanation

Correct Answer

C:

A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. This explains the stated condition. The corresponding action is: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000. The direct acceptance evidence is: Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping.

Incorrect Answers

A:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. That explanation applies to a different technical failure. Here the controlling principle is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

B:

The offered statement is true for this other mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. It does not explain the facts described here, which follow from: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

D:

A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. That explanation applies to a different technical failure. Here the controlling principle is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

Question 487

At Horizon observability, in a disposable simulated environment during a monitored release window: Deployment metrics-api in namespace observability needs an internal ClusterIP Service metrics-svc exposing port 8080 to container port 3000. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Compare listed endpoints against the matching ready Pods and expected selector for metrics-svc.
  2. Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices.
  3. Run kubectl -n observability describe ingress metrics-ingress and test the route through the controller address using the expected Host header.
  4. Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping.

Explanation

Correct Answer

D:

Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The intended action is: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000.

Incorrect Answers

A:

That test belongs to another control with this basis: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. In the current case, the governing reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The direct verification is “Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping”.

B:

This observation would test a different technical dependency: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current issue is governed by: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Its decisive check is “Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping”.

C:

The alternative verifies a different condition: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current case instead depends on: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Confirm that “Run kubectl -n observability get service metrics-svc and inspect its EndpointSlices and port mapping”.

Question 488

At Horizon observability, in a disposable simulated environment during a monitored release window: Deployment metrics-api in namespace observability needs an internal ClusterIP Service metrics-svc exposing port 8080 to container port 3000. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Manage Service selectors and target ports alongside the Deployment labels and container listening port.
  2. Limit NodePort exposure through network controls and remove temporary external test services.
  3. Include DNS as an explicit dependency when designing egress policies for isolated Pods.
  4. Track TLS Secret renewal and enforce appropriate ingress-controller security policies.

Explanation

Correct Answer

A:

Manage Service selectors and target ports alongside the Deployment labels and container listening port. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000. The relevant mechanism is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

Incorrect Answers

B:

The suggested review tracks a different technical risk: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Here the sustained control must address: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Choose “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

C:

That safeguard is relevant to: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current failure instead follows from: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Its prevention measure is “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

D:

This routine guards against another mechanism: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The recurring exposure in the current case is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The matching preventive check is “Manage Service selectors and target ports alongside the Deployment labels and container listening port”.

Question 489

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Deployment dispatch-api in namespace fulfillment needs an internal ClusterIP Service dispatch-svc exposing port 9090 to container port 9000. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=NodePort --port=80 --target-port=8080.
  2. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"selector":{"app":"dispatch-api"}}}' after confirming the label is authoritative.
  3. Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000.
  4. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Validate the result with: Run kubectl -n fulfillment get service dispatch-svc and inspect its EndpointSlices and port mapping. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Here the stated fault follows a different mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The corrective choice is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000”.

B:

The offered action targets: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The case facts point instead to: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Implement “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000” to address that specific condition.

D:

The proposed action belongs to the mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Here the stated fault follows a different mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The corrective choice is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000”.

Question 490

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Deployment dispatch-api in namespace fulfillment needs an internal ClusterIP Service dispatch-svc exposing port 9090 to container port 9000. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support.
  2. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  3. DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist.
  4. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

Explanation

Correct Answer

D:

A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000. The direct acceptance evidence is: Run kubectl -n fulfillment get service dispatch-svc and inspect its EndpointSlices and port mapping.

Incorrect Answers

A:

The offered statement is true for this other mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. It does not explain the facts described here, which follow from: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.

B:

This principle describes a separate cause: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The reported condition is governed by: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The two mechanisms should not be conflated.

C:

DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. That explanation applies to a different technical failure. Here the controlling principle is: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.