McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 51

Question 500

At Horizon observability, in a disposable simulated environment during a monitored release window: A temporary lab Service metrics-svc for Deployment metrics-api in observability needs access through an automatically allocated NodePort, not a public load balancer. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Manage Service selectors and target ports alongside the Deployment labels and container listening port.
  2. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  3. Include DNS as an explicit dependency when designing egress policies for isolated Pods.
  4. Limit NodePort exposure through network controls and remove temporary external test services.

Explanation

Correct Answer

D:

Limit NodePort exposure through network controls and remove temporary external test services. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=NodePort --port=8080 --target-port=3000. The relevant mechanism is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.

Incorrect Answers

A:

This routine guards against another mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The recurring exposure in the current case is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The matching preventive check is “Limit NodePort exposure through network controls and remove temporary external test services”.

B:

The suggested review tracks a different technical risk: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Here the sustained control must address: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Choose “Limit NodePort exposure through network controls and remove temporary external test services”.

C:

That safeguard is relevant to: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current failure instead follows from: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Its prevention measure is “Limit NodePort exposure through network controls and remove temporary external test services”.

Question 501

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A temporary lab Service dispatch-svc for Deployment dispatch-api in fulfillment needs access through an automatically allocated NodePort, not a public load balancer. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000.
  2. Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000.
  3. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"selector":{"app":"dispatch-api"}}}' after confirming the label is authoritative.
  4. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"ports":[{"port":9090,"targetPort":9000}]}}' for the lab's single-port Service.

Explanation

Correct Answer

B:

Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Validate the result with: Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Here the stated fault follows a different mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The corrective choice is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000”.

C:

This alternative is a response to another technical cause: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The reported case instead depends on: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The action that directly addresses it is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000”.

D:

The proposed action belongs to the mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the stated fault follows a different mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The corrective choice is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000”.

Question 502

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A temporary lab Service dispatch-svc for Deployment dispatch-api in fulfillment needs access through an automatically allocated NodePort, not a public load balancer. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  2. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  3. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  4. Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support.

Explanation

Correct Answer

C:

A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000. The direct acceptance evidence is: Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints.

Incorrect Answers

A:

The offered statement is true for this other mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. It does not explain the facts described here, which follow from: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.

B:

This principle describes a separate cause: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The reported condition is governed by: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The two mechanisms should not be conflated.

D:

The offered statement is true for this other mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. It does not explain the facts described here, which follow from: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.

Question 503

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A temporary lab Service dispatch-svc for Deployment dispatch-api in fulfillment needs access through an automatically allocated NodePort, not a public load balancer. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header.
  2. Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod.
  3. Run kubectl -n fulfillment get gateway regional-gw -o yaml and inspect Accepted and Programmed conditions.
  4. Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints.

Explanation

Correct Answer

D:

Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The intended action is: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000.

Incorrect Answers

A:

This observation would test a different technical dependency: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current issue is governed by: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Its decisive check is “Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints”.

B:

The alternative verifies a different condition: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The current case instead depends on: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Confirm that “Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints”.

C:

That test belongs to another control with this basis: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. In the current case, the governing reason is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The direct verification is “Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints”.

Question 504

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A temporary lab Service dispatch-svc for Deployment dispatch-api in fulfillment needs access through an automatically allocated NodePort, not a public load balancer. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Limit NodePort exposure through network controls and remove temporary external test services.
  2. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  3. Audit controller capability and exposed service access policies before enabling public ingress.
  4. Manage Service selectors and target ports alongside the Deployment labels and container listening port.

Explanation

Correct Answer

A:

Limit NodePort exposure through network controls and remove temporary external test services. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=NodePort --port=9090 --target-port=9000. The relevant mechanism is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.

Incorrect Answers

B:

That safeguard is relevant to: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The current failure instead follows from: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Its prevention measure is “Limit NodePort exposure through network controls and remove temporary external test services”.

C:

This routine guards against another mechanism: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The recurring exposure in the current case is: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The matching preventive check is “Limit NodePort exposure through network controls and remove temporary external test services”.

D:

The suggested review tracks a different technical risk: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Here the sustained control must address: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Choose “Limit NodePort exposure through network controls and remove temporary external test services”.

Question 505

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The platform has a configured load balancer controller and Deployment invoice-api in ledger needs externally managed Service invoice-svc. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.
  2. Run kubectl -n ledger port-forward service/invoice-svc 18080:80 in a temporary session.
  3. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080.
  4. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.

Explanation

Correct Answer

C:

Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080. This is the appropriate command-line action or first safe diagnostic. The technical reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Validate the result with: Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The case facts point instead to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Implement “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080” to address that specific condition.

B:

This alternative is a response to another technical cause: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The reported case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The action that directly addresses it is “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080”.

D:

The offered action targets: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The case facts point instead to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Implement “Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080” to address that specific condition.

Question 506

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The platform has a configured load balancer controller and Deployment invoice-api in ledger needs externally managed Service invoice-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  2. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  3. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  4. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Explanation

Correct Answer

D:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. This explains the stated condition. The corresponding action is: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080. The direct acceptance evidence is: Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices.

Incorrect Answers

A:

This principle describes a separate cause: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The reported condition is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The two mechanisms should not be conflated.

B:

The Service port is what clients connect to, while targetPort must reach the actual backend listener. That explanation applies to a different technical failure. Here the controlling principle is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

C:

The offered statement is true for this other mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. It does not explain the facts described here, which follow from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Question 507

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The platform has a configured load balancer controller and Deployment invoice-api in ledger needs externally managed Service invoice-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices.
  2. Run kubectl -n fulfillment get service dispatch-svc and inspect its EndpointSlices and port mapping.
  3. Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints.
  4. Run kubectl -n ledger describe ingress invoice-ingress and test the route through the controller address using the expected Host header.

Explanation

Correct Answer

A:

Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The intended action is: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080.

Incorrect Answers

B:

That test belongs to another control with this basis: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. In the current case, the governing reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The direct verification is “Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices”.

C:

This observation would test a different technical dependency: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The current issue is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its decisive check is “Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices”.

D:

The alternative verifies a different condition: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Confirm that “Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices”.

Question 508

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The platform has a configured load balancer controller and Deployment invoice-api in ledger needs externally managed Service invoice-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  2. Audit controller capability and exposed service access policies before enabling public ingress.
  3. Include EndpointSlice and readiness checks in Service connectivity runbooks.
  4. Include DNS as an explicit dependency when designing egress policies for isolated Pods.

Explanation

Correct Answer

B:

Audit controller capability and exposed service access policies before enabling public ingress. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=LoadBalancer --port=80 --target-port=8080. The relevant mechanism is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Incorrect Answers

A:

That safeguard is relevant to: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The current failure instead follows from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its prevention measure is “Audit controller capability and exposed service access policies before enabling public ingress”.

C:

The suggested review tracks a different technical risk: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. Here the sustained control must address: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Choose “Audit controller capability and exposed service access policies before enabling public ingress”.

D:

That safeguard is relevant to: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current failure instead follows from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its prevention measure is “Audit controller capability and exposed service access policies before enabling public ingress”.

Question 509

At Horizon observability, in a disposable simulated environment during a monitored release window: The platform has a configured load balancer controller and Deployment metrics-api in observability needs externally managed Service metrics-svc. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability patch service metrics-svc --type=merge -p '{"spec":{"ports":[{"port":8080,"targetPort":3000}]}}' for the lab's single-port Service.
  2. Run kubectl -n observability port-forward service/metrics-svc 18081:8080 in a temporary session.
  3. Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match.
  4. Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000.

Explanation

Correct Answer

D:

Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000. This is the appropriate command-line action or first safe diagnostic. The technical reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Validate the result with: Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The action that directly addresses it is “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000”.

B:

The proposed action belongs to the mechanism: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Here the stated fault follows a different mechanism: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The corrective choice is “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000”.

C:

The offered action targets: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The case facts point instead to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Implement “Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000” to address that specific condition.

Question 510

At Horizon observability, in a disposable simulated environment during a monitored release window: The platform has a configured load balancer controller and Deployment metrics-api in observability needs externally managed Service metrics-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  2. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  3. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  4. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

Explanation

Correct Answer

A:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. This explains the stated condition. The corresponding action is: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000. The direct acceptance evidence is: Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices.

Incorrect Answers

B:

The offered statement is true for this other mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. It does not explain the facts described here, which follow from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

C:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The two mechanisms should not be conflated.

D:

Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. That explanation applies to a different technical failure. Here the controlling principle is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.