McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 57

Question 560

At Horizon observability, in a disposable simulated environment during a monitored release window: An operator needs a temporary localhost tunnel to Service metrics-svc in observability to debug port 8080 without exposing a public endpoint. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Include EndpointSlice and readiness checks in Service connectivity runbooks.
  2. Check exposed Service port mappings against actual container listeners and named ports before releases.
  3. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  4. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.

Explanation

Correct Answer

C:

Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability port-forward service/metrics-svc 18081:8080 in a temporary session. The relevant mechanism is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.

Incorrect Answers

A:

This routine guards against another mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The recurring exposure in the current case is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The matching preventive check is “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

B:

The suggested review tracks a different technical risk: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the sustained control must address: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Choose “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

D:

This routine guards against another mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The recurring exposure in the current case is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The matching preventive check is “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

Question 561

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An operator needs a temporary localhost tunnel to Service dispatch-svc in fulfillment to debug port 9090 without exposing a public endpoint. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session.
  2. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"selector":{"app":"dispatch-api"}}}' after confirming the label is authoritative.
  3. Run kubectl -n observability expose deployment metrics-api --name=metrics-svc --type=ClusterIP --port=8080 --target-port=3000.
  4. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-peer.yaml after verifying podSelector rules match the source identity.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Validate the result with: Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The offered action targets: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The case facts point instead to: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Implement “Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session” to address that specific condition.

C:

This alternative is a response to another technical cause: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The reported case instead depends on: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The action that directly addresses it is “Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session”.

D:

The proposed action belongs to the mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Here the stated fault follows a different mechanism: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The corrective choice is “Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session”.

Question 562

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An operator needs a temporary localhost tunnel to Service dispatch-svc in fulfillment to debug port 9090 without exposing a public endpoint. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  2. Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.
  3. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  4. The Service port is what clients connect to, while targetPort must reach the actual backend listener.

Explanation

Correct Answer

B:

Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session. The direct acceptance evidence is: Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active.

Incorrect Answers

A:

The offered statement is true for this other mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. It does not explain the facts described here, which follow from: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.

C:

A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. That explanation applies to a different technical failure. Here the controlling principle is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.

D:

The offered statement is true for this other mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. It does not explain the facts described here, which follow from: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.

Question 563

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An operator needs a temporary localhost tunnel to Service dispatch-svc in fulfillment to debug port 9090 without exposing a public endpoint. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations.
  2. Run kubectl -n fulfillment get networkpolicy dispatch-api-deny-ingress -o yaml and perform an authorized denied-connection probe.
  3. Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active.
  4. Run positive and negative network connectivity tests from Pods with and without the trusted source label.

Explanation

Correct Answer

C:

Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The intended action is: Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session.

Incorrect Answers

A:

This observation would test a different technical dependency: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The current issue is governed by: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Its decisive check is “Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active”.

B:

The alternative verifies a different condition: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current case instead depends on: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Confirm that “Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active”.

D:

This observation would test a different technical dependency: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The current issue is governed by: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Its decisive check is “Run curl -fsS http://127.0.0.1:18082/healthz from another local shell while the tunnel is active”.

Question 564

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: An operator needs a temporary localhost tunnel to Service dispatch-svc in fulfillment to debug port 9090 without exposing a public endpoint. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Manage Service selectors and target ports alongside the Deployment labels and container listening port.
  2. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  3. Model required system egress and incident recovery before enforcing default-deny behavior.
  4. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.

Explanation

Correct Answer

D:

Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment port-forward service/dispatch-svc 18082:9090 in a temporary session. The relevant mechanism is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Here the sustained control must address: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Choose “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

B:

That safeguard is relevant to: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The current failure instead follows from: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Its prevention measure is “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

C:

This routine guards against another mechanism: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The recurring exposure in the current case is: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The matching preventive check is “Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path”.

Question 565

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods in namespace ledger cannot resolve the local Service invoice-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger port-forward service/invoice-svc 18080:80 in a temporary session.
  2. Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs.
  3. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  4. Run kubectl -n ledger apply -f ./policies/invoice-api-peer.yaml after verifying podSelector rules match the source identity.

Explanation

Correct Answer

B:

Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Validate the result with: Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The case facts point instead to: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Implement “Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs” to address that specific condition.

C:

The proposed action belongs to the mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Here the stated fault follows a different mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The corrective choice is “Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs”.

D:

The offered action targets: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The case facts point instead to: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Implement “Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs” to address that specific condition.

Question 566

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods in namespace ledger cannot resolve the local Service invoice-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  2. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  3. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  4. An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Explanation

Correct Answer

C:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. This explains the stated condition. The corresponding action is: Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs. The direct acceptance evidence is: Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod.

Incorrect Answers

A:

This principle describes a separate cause: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The reported condition is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The two mechanisms should not be conflated.

B:

Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. That explanation applies to a different technical failure. Here the controlling principle is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

D:

This principle describes a separate cause: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The reported condition is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The two mechanisms should not be conflated.

Question 567

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods in namespace ledger cannot resolve the local Service invoice-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping.
  2. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.
  3. Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc and verify addresses for the intended Pods.
  4. Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod.

Explanation

Correct Answer

D:

Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The intended action is: Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs.

Incorrect Answers

A:

The alternative verifies a different condition: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The current case instead depends on: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Confirm that “Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod”.

B:

That test belongs to another control with this basis: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. In the current case, the governing reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The direct verification is “Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod”.

C:

This observation would test a different technical dependency: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The current issue is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its decisive check is “Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod”.

Question 568

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Pods in namespace ledger cannot resolve the local Service invoice-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  2. Test Service selectors against actual Pod template labels during deployments and renames.
  3. Check exposed Service port mappings against actual container listeners and named ports before releases.
  4. Audit controller capability and exposed service access policies before enabling public ingress.

Explanation

Correct Answer

A:

Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger run invoice-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup invoice-svc.ledger.svc.cluster.local and inspect the Pod logs. The relevant mechanism is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Incorrect Answers

B:

This routine guards against another mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The recurring exposure in the current case is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The matching preventive check is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

C:

The suggested review tracks a different technical risk: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the sustained control must address: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Choose “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

D:

That safeguard is relevant to: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current failure instead follows from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its prevention measure is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

Question 569

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods in namespace observability cannot resolve the local Service metrics-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability port-forward service/metrics-svc 18081:8080 in a temporary session.
  2. Run kubectl -n observability apply -f ./policies/metrics-api-peer.yaml after verifying podSelector rules match the source identity.
  3. Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs.
  4. Run kubectl -n observability patch service metrics-svc --type=merge -p '{"spec":{"ports":[{"port":8080,"targetPort":3000}]}}' for the lab's single-port Service.

Explanation

Correct Answer

C:

Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Validate the result with: Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The reported case instead depends on: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The action that directly addresses it is “Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs”.

B:

The proposed action belongs to the mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Here the stated fault follows a different mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The corrective choice is “Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs”.

D:

This alternative is a response to another technical cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported case instead depends on: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The action that directly addresses it is “Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs”.

Question 570

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods in namespace observability cannot resolve the local Service metrics-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  3. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  4. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Explanation

Correct Answer

D:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. This explains the stated condition. The corresponding action is: Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs. The direct acceptance evidence is: Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod.

Incorrect Answers

A:

NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. That explanation applies to a different technical failure. Here the controlling principle is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

B:

The offered statement is true for this other mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. It does not explain the facts described here, which follow from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

C:

This principle describes a separate cause: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The reported condition is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The two mechanisms should not be conflated.