McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 58

Question 570

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods in namespace observability cannot resolve the local Service metrics-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  3. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  4. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Explanation

Correct Answer

D:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. This explains the stated condition. The corresponding action is: Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs. The direct acceptance evidence is: Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod.

Incorrect Answers

A:

NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. That explanation applies to a different technical failure. Here the controlling principle is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

B:

The offered statement is true for this other mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. It does not explain the facts described here, which follow from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

C:

This principle describes a separate cause: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The reported condition is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The two mechanisms should not be conflated.

Question 571

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods in namespace observability cannot resolve the local Service metrics-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod.
  2. Run kubectl -n observability describe service metrics-svc and perform a connection test to port 8080.
  3. Run kubectl -n observability get networkpolicy metrics-api-deny-ingress -o yaml and perform an authorized denied-connection probe.
  4. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.

Explanation

Correct Answer

A:

Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The intended action is: Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs.

Incorrect Answers

B:

This observation would test a different technical dependency: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The current issue is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its decisive check is “Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod”.

C:

The alternative verifies a different condition: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current case instead depends on: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Confirm that “Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod”.

D:

That test belongs to another control with this basis: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. In the current case, the governing reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The direct verification is “Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod”.

Question 572

At Horizon observability, in a disposable simulated environment during a monitored release window: Pods in namespace observability cannot resolve the local Service metrics-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  2. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  3. Track TLS Secret renewal and enforce appropriate ingress-controller security policies.
  4. Monitor DNS replica readiness, restart trends and upstream resolution errors.

Explanation

Correct Answer

B:

Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability run metrics-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup metrics-svc.observability.svc.cluster.local and inspect the Pod logs. The relevant mechanism is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Incorrect Answers

A:

This routine guards against another mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The recurring exposure in the current case is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The matching preventive check is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

C:

That safeguard is relevant to: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The current failure instead follows from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its prevention measure is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

D:

This routine guards against another mechanism: DNS resolution may fail when CoreDNS replicas are unhealthy even when the requested Service and Pod endpoints exist. The recurring exposure in the current case is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The matching preventive check is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

Question 573

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods in namespace fulfillment cannot resolve the local Service dispatch-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  2. Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=LoadBalancer --port=9090 --target-port=9000.
  3. Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs.
  4. Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs.

Explanation

Correct Answer

D:

Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Validate the result with: Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Here the stated fault follows a different mechanism: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The corrective choice is “Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs”.

B:

The offered action targets: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The case facts point instead to: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Implement “Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs” to address that specific condition.

C:

This alternative is a response to another technical cause: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The reported case instead depends on: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The action that directly addresses it is “Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs”.

Question 574

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods in namespace fulfillment cannot resolve the local Service dispatch-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  2. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  3. A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints.
  4. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Explanation

Correct Answer

A:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs. The direct acceptance evidence is: Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod.

Incorrect Answers

B:

This principle describes a separate cause: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The reported condition is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The two mechanisms should not be conflated.

C:

A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. That explanation applies to a different technical failure. Here the controlling principle is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

D:

The offered statement is true for this other mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. It does not explain the facts described here, which follow from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Question 575

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods in namespace fulfillment cannot resolve the local Service dispatch-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.
  2. Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod.
  3. Run kubectl -n fulfillment describe ingress dispatch-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.
  4. Run kubectl -n fulfillment describe service dispatch-svc and perform a connection test to port 9090.

Explanation

Correct Answer

B:

Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The intended action is: Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs.

Incorrect Answers

A:

This observation would test a different technical dependency: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The current issue is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its decisive check is “Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod”.

C:

That test belongs to another control with this basis: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. In the current case, the governing reason is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The direct verification is “Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod”.

D:

This observation would test a different technical dependency: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The current issue is governed by: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its decisive check is “Run kubectl -n fulfillment logs dispatch-api-dns-test and look for a valid Service address before deleting the test Pod”.

Question 576

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Pods in namespace fulfillment cannot resolve the local Service dispatch-svc by its fully qualified name; test cluster DNS from inside a disposable Pod. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review ingress class ownership and avoid exposing test applications outside intended environments.
  2. Review CoreDNS configuration diffs and keep a tested prior version before changes.
  3. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  4. Include DNS as an explicit dependency when designing egress policies for isolated Pods.

Explanation

Correct Answer

C:

Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs. The relevant mechanism is: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Incorrect Answers

A:

The suggested review tracks a different technical risk: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Here the sustained control must address: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Choose “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

B:

That safeguard is relevant to: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The current failure instead follows from: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Its prevention measure is “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

D:

The suggested review tracks a different technical risk: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Here the sustained control must address: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. Choose “Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness”.

Question 577

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  2. Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80.
  3. Run kubectl -n ledger apply -f ./policies/invoice-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.
  4. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.

Explanation

Correct Answer

A:

Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. This is the appropriate command-line action or first safe diagnostic. The technical reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Validate the result with: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

This alternative is a response to another technical cause: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The reported case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The action that directly addresses it is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

C:

The proposed action belongs to the mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the stated fault follows a different mechanism: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The corrective choice is “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile”.

D:

The offered action targets: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The case facts point instead to: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Implement “Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile” to address that specific condition.

Question 578

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.
  3. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.
  4. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Explanation

Correct Answer

B:

CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. This explains the stated condition. The corresponding action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The direct acceptance evidence is: Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.

Incorrect Answers

A:

This principle describes a separate cause: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The reported condition is governed by: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The two mechanisms should not be conflated.

C:

The offered statement is true for this other mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. It does not explain the facts described here, which follow from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

D:

This principle describes a separate cause: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The reported condition is governed by: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The two mechanisms should not be conflated.

Question 579

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions.
  2. Run kubectl -n ledger get service invoice-svc -o wide and inspect the allocated node port and endpoints.
  3. Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data.
  4. Run authorized connectivity probes from both approved and unapproved namespaces.

Explanation

Correct Answer

C:

Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The intended action is: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.

Incorrect Answers

A:

The alternative verifies a different condition: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The current case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Confirm that “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

B:

That test belongs to another control with this basis: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. In the current case, the governing reason is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The direct verification is “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

D:

The alternative verifies a different condition: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The current case instead depends on: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Confirm that “Compare the Corefile's Kubernetes plugin zone with expected cluster.local and sample Pod resolv.conf data”.

Question 580

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: The CoreDNS configuration of the lab cluster must be inspected before editing service discovery behavior. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review ingress class ownership and avoid exposing test applications outside intended environments.
  2. Stage CoreDNS changes and preserve rollback capability before restarting cluster-wide DNS.
  3. Audit controller capability and exposed service access policies before enabling public ingress.
  4. Review CoreDNS configuration diffs and keep a tested prior version before changes.

Explanation

Correct Answer

D:

Review CoreDNS configuration diffs and keep a tested prior version before changes. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile. The relevant mechanism is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide.

Incorrect Answers

A:

That safeguard is relevant to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current failure instead follows from: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Its prevention measure is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

B:

This routine guards against another mechanism: CoreDNS Pods need a restart when configuration update behavior requires it; a Deployment restart replaces Pods under its rollout strategy. The recurring exposure in the current case is: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The matching preventive check is “Review CoreDNS configuration diffs and keep a tested prior version before changes”.

C:

The suggested review tracks a different technical risk: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Here the sustained control must address: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. Choose “Review CoreDNS configuration diffs and keep a tested prior version before changes”.