McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 52

Question 510

At Horizon observability, in a disposable simulated environment during a monitored release window: The platform has a configured load balancer controller and Deployment metrics-api in observability needs externally managed Service metrics-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  2. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  3. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  4. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

Explanation

Correct Answer

A:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. This explains the stated condition. The corresponding action is: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000. The direct acceptance evidence is: Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices.

Incorrect Answers

B:

The offered statement is true for this other mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. It does not explain the facts described here, which follow from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

C:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The two mechanisms should not be conflated.

D:

Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. That explanation applies to a different technical failure. Here the controlling principle is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Question 511

At Horizon observability, in a disposable simulated environment during a monitored release window: The platform has a configured load balancer controller and Deployment metrics-api in observability needs externally managed Service metrics-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get service invoice-svc -o wide and inspect the allocated node port and endpoints.
  2. Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices.
  3. Run kubectl -n observability get networkpolicy metrics-api-deny-ingress -o yaml and perform an authorized denied-connection probe.
  4. Run kubectl -n observability get gateway edge-gw -o yaml and inspect Accepted and Programmed conditions.

Explanation

Correct Answer

B:

Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The intended action is: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000.

Incorrect Answers

A:

That test belongs to another control with this basis: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. In the current case, the governing reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The direct verification is “Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices”.

C:

The alternative verifies a different condition: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Confirm that “Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices”.

D:

That test belongs to another control with this basis: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. In the current case, the governing reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The direct verification is “Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices”.

Question 512

At Horizon observability, in a disposable simulated environment during a monitored release window: The platform has a configured load balancer controller and Deployment metrics-api in observability needs externally managed Service metrics-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review ingress class ownership and avoid exposing test applications outside intended environments.
  2. Check exposed Service port mappings against actual container listeners and named ports before releases.
  3. Audit controller capability and exposed service access policies before enabling public ingress.
  4. Track TLS Secret renewal and enforce appropriate ingress-controller security policies.

Explanation

Correct Answer

C:

Audit controller capability and exposed service access policies before enabling public ingress. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=LoadBalancer --port=8080 --target-port=3000. The relevant mechanism is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Incorrect Answers

A:

This routine guards against another mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The recurring exposure in the current case is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The matching preventive check is “Audit controller capability and exposed service access policies before enabling public ingress”.

B:

The suggested review tracks a different technical risk: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the sustained control must address: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Choose “Audit controller capability and exposed service access policies before enabling public ingress”.

D:

This routine guards against another mechanism: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The recurring exposure in the current case is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The matching preventive check is “Audit controller capability and exposed service access policies before enabling public ingress”.

Question 513

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The platform has a configured load balancer controller and Deployment dispatch-api in fulfillment needs externally managed Service dispatch-svc. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000.
  2. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.
  3. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090.
  4. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000. This is the appropriate command-line action or first safe diagnostic. The technical reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Validate the result with: Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The offered action targets: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The case facts point instead to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Implement “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000” to address that specific condition.

C:

This alternative is a response to another technical cause: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The reported case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The action that directly addresses it is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000”.

D:

The proposed action belongs to the mechanism: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Here the stated fault follows a different mechanism: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The corrective choice is “Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000”.

Question 514

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The platform has a configured load balancer controller and Deployment dispatch-api in fulfillment needs externally managed Service dispatch-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  2. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  3. An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.
  4. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.

Explanation

Correct Answer

B:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000. The direct acceptance evidence is: Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices.

Incorrect Answers

A:

The offered statement is true for this other mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. It does not explain the facts described here, which follow from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

C:

An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. That explanation applies to a different technical failure. Here the controlling principle is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

D:

The offered statement is true for this other mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. It does not explain the facts described here, which follow from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Question 515

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The platform has a configured load balancer controller and Deployment dispatch-api in fulfillment needs externally managed Service dispatch-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run an in-Pod nslookup dispatch-svc.fulfillment.svc.cluster.local and confirm name resolution under isolation.
  2. Run kubectl -n fulfillment get service dispatch-svc -o wide and inspect the allocated node port and endpoints.
  3. Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices.
  4. Run kubectl -n fulfillment get networkpolicy dispatch-api-deny-ingress -o yaml and perform an authorized denied-connection probe.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The intended action is: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000.

Incorrect Answers

A:

This observation would test a different technical dependency: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current issue is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its decisive check is “Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices”.

B:

The alternative verifies a different condition: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The current case instead depends on: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Confirm that “Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices”.

D:

This observation would test a different technical dependency: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current issue is governed by: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its decisive check is “Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices”.

Question 516

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The platform has a configured load balancer controller and Deployment dispatch-api in fulfillment needs externally managed Service dispatch-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test security policies from allowed and denied sources rather than trusting YAML alone.
  2. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  3. Review ingress class ownership and avoid exposing test applications outside intended environments.
  4. Audit controller capability and exposed service access policies before enabling public ingress.

Explanation

Correct Answer

D:

Audit controller capability and exposed service access policies before enabling public ingress. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000. The relevant mechanism is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the sustained control must address: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Choose “Audit controller capability and exposed service access policies before enabling public ingress”.

B:

That safeguard is relevant to: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The current failure instead follows from: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Its prevention measure is “Audit controller capability and exposed service access policies before enabling public ingress”.

C:

This routine guards against another mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The recurring exposure in the current case is: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The matching preventive check is “Audit controller capability and exposed service access policies before enabling public ingress”.

Question 517

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service invoice-svc in ledger targets no Pods because its selector says app=legacy while Deployment invoice-api labels Pods app=invoice-api. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system rollout restart deployment/coredns after the approved change.
  2. Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative.
  3. Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs.
  4. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.

Explanation

Correct Answer

B:

Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Validate the result with: Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The case facts point instead to: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Implement “Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative” to address that specific condition.

C:

The proposed action belongs to the mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Here the stated fault follows a different mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The corrective choice is “Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative”.

D:

The offered action targets: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The case facts point instead to: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Implement “Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative” to address that specific condition.

Question 518

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service invoice-svc in ledger targets no Pods because its selector says app=legacy while Deployment invoice-api labels Pods app=invoice-api. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  2. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.
  3. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  4. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

Explanation

Correct Answer

C:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. This explains the stated condition. The corresponding action is: Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative. The direct acceptance evidence is: Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods.

Incorrect Answers

A:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The two mechanisms should not be conflated.

B:

EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. That explanation applies to a different technical failure. Here the controlling principle is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.

D:

This principle describes a separate cause: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The reported condition is governed by: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The two mechanisms should not be conflated.

Question 519

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service invoice-svc in ledger targets no Pods because its selector says app=legacy while Deployment invoice-api labels Pods app=invoice-api. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions.
  2. Run kubectl -n ledger describe service invoice-svc and perform a connection test to port 80.
  3. Run kubectl -n observability describe service metrics-svc and perform a connection test to port 8080.
  4. Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods.

Explanation

Correct Answer

D:

Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The intended action is: Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative.

Incorrect Answers

A:

The alternative verifies a different condition: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The current case instead depends on: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Confirm that “Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods”.

B:

That test belongs to another control with this basis: The Service port is what clients connect to, while targetPort must reach the actual backend listener. In the current case, the governing reason is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The direct verification is “Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods”.

C:

This observation would test a different technical dependency: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The current issue is governed by: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Its decisive check is “Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods”.

Question 520

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service invoice-svc in ledger targets no Pods because its selector says app=legacy while Deployment invoice-api labels Pods app=invoice-api. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test Service selectors against actual Pod template labels during deployments and renames.
  2. Check gateway class/controller compatibility and delegate route attachment privileges deliberately.
  3. Audit controller capability and exposed service access policies before enabling public ingress.
  4. Monitor DNS replica readiness, restart trends and upstream resolution errors.

Explanation

Correct Answer

A:

Test Service selectors against actual Pod template labels during deployments and renames. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger patch service invoice-svc --type=merge -p '{"spec":{"selector":{"app":"invoice-api"}}}' after confirming the label is authoritative. The relevant mechanism is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.

Incorrect Answers

B:

This routine guards against another mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The recurring exposure in the current case is: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The matching preventive check is “Test Service selectors against actual Pod template labels during deployments and renames”.

C:

The suggested review tracks a different technical risk: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Here the sustained control must address: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Choose “Test Service selectors against actual Pod template labels during deployments and renames”.

D:

That safeguard is relevant to: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The current failure instead follows from: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Its prevention measure is “Test Service selectors against actual Pod template labels during deployments and renames”.