McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 64

Question 630

At Horizon observability, in a disposable simulated environment during a monitored release window: A reviewed ./policies/metrics-api-deny-egress.yaml selects the application in observability and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.
  2. An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.
  3. An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.
  4. A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

Explanation

Correct Answer

C:

An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. This explains the stated condition. The corresponding action is: Run kubectl -n observability apply -f ./policies/metrics-api-deny-egress.yaml after reviewing impact on DNS and observability. The direct acceptance evidence is: Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations.

Incorrect Answers

A:

Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. That explanation applies to a different technical failure. Here the controlling principle is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

B:

The offered statement is true for this other mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. It does not explain the facts described here, which follow from: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

D:

A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. That explanation applies to a different technical failure. Here the controlling principle is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Question 631

At Horizon observability, in a disposable simulated environment during a monitored release window: A reviewed ./policies/metrics-api-deny-egress.yaml selects the application in observability and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability describe ingress metrics-ingress and test the route through the controller address using the expected Host header.
  2. Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod.
  3. Run positive and negative network connectivity tests from Pods with and without the trusted source label.
  4. Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations.

Explanation

Correct Answer

D:

Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The intended action is: Run kubectl -n observability apply -f ./policies/metrics-api-deny-egress.yaml after reviewing impact on DNS and observability.

Incorrect Answers

A:

That test belongs to another control with this basis: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. In the current case, the governing reason is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The direct verification is “Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations”.

B:

This observation would test a different technical dependency: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The current issue is governed by: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Its decisive check is “Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations”.

C:

The alternative verifies a different condition: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The current case instead depends on: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Confirm that “Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations”.

Question 632

At Horizon observability, in a disposable simulated environment during a monitored release window: A reviewed ./policies/metrics-api-deny-egress.yaml selects the application in observability and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Model required system egress and incident recovery before enforcing default-deny behavior.
  2. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  3. Test security policies from allowed and denied sources rather than trusting YAML alone.
  4. Review ingress class ownership and avoid exposing test applications outside intended environments.

Explanation

Correct Answer

A:

Model required system egress and incident recovery before enforcing default-deny behavior. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability apply -f ./policies/metrics-api-deny-egress.yaml after reviewing impact on DNS and observability. The relevant mechanism is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Incorrect Answers

B:

The suggested review tracks a different technical risk: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Here the sustained control must address: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Choose “Model required system egress and incident recovery before enforcing default-deny behavior”.

C:

That safeguard is relevant to: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current failure instead follows from: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Its prevention measure is “Model required system egress and incident recovery before enforcing default-deny behavior”.

D:

This routine guards against another mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The recurring exposure in the current case is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The matching preventive check is “Model required system egress and incident recovery before enforcing default-deny behavior”.

Question 633

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed ./policies/dispatch-api-deny-egress.yaml selects the application in fulfillment and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment expose deployment dispatch-api --name=dispatch-svc --type=ClusterIP --port=9090 --target-port=9000.
  2. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  3. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability.
  4. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"selector":{"app":"dispatch-api"}}}' after confirming the label is authoritative.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability. This is the appropriate command-line action or first safe diagnostic. The technical reason is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Validate the result with: Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. Here the stated fault follows a different mechanism: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The corrective choice is “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability”.

B:

The offered action targets: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The case facts point instead to: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Implement “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability” to address that specific condition.

D:

The proposed action belongs to the mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. Here the stated fault follows a different mechanism: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The corrective choice is “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability”.

Question 634

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed ./policies/dispatch-api-deny-egress.yaml selects the application in fulfillment and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  3. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  4. An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Explanation

Correct Answer

D:

An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability. The direct acceptance evidence is: Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations.

Incorrect Answers

A:

The offered statement is true for this other mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. It does not explain the facts described here, which follow from: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

B:

This principle describes a separate cause: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The reported condition is governed by: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The two mechanisms should not be conflated.

C:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. That explanation applies to a different technical failure. Here the controlling principle is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Question 635

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed ./policies/dispatch-api-deny-egress.yaml selects the application in fulfillment and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations.
  2. Run kubectl -n fulfillment describe ingress dispatch-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.
  3. Run positive and negative network connectivity tests from Pods with and without the trusted source label.
  4. Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc and verify addresses for the intended Pods.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The intended action is: Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability.

Incorrect Answers

B:

The alternative verifies a different condition: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The current case instead depends on: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Confirm that “Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations”.

C:

That test belongs to another control with this basis: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. In the current case, the governing reason is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The direct verification is “Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations”.

D:

This observation would test a different technical dependency: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The current issue is governed by: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Its decisive check is “Run kubectl -n fulfillment describe networkpolicy dispatch-api-deny-egress and test expected blocked destinations”.

Question 636

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A reviewed ./policies/dispatch-api-deny-egress.yaml selects the application in fulfillment and defines egress isolation without allow exceptions. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Check gateway class/controller compatibility and delegate route attachment privileges deliberately.
  2. Model required system egress and incident recovery before enforcing default-deny behavior.
  3. Test Service selectors against actual Pod template labels during deployments and renames.
  4. Test security policies from allowed and denied sources rather than trusting YAML alone.

Explanation

Correct Answer

B:

Model required system egress and incident recovery before enforcing default-deny behavior. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-egress.yaml after reviewing impact on DNS and observability. The relevant mechanism is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Incorrect Answers

A:

The suggested review tracks a different technical risk: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. Here the sustained control must address: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Choose “Model required system egress and incident recovery before enforcing default-deny behavior”.

C:

This routine guards against another mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The recurring exposure in the current case is: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The matching preventive check is “Model required system egress and incident recovery before enforcing default-deny behavior”.

D:

The suggested review tracks a different technical risk: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the sustained control must address: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Choose “Model required system egress and incident recovery before enforcing default-deny behavior”.

Question 637

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: After egress isolation, app=invoice-api in ledger must be allowed to query cluster DNS using reviewed manifest ./policies/invoice-api-dns.yaml. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability apply -f ./policies/metrics-api-deny-egress.yaml after reviewing impact on DNS and observability.
  2. Run kubectl -n fulfillment run dispatch-api-dns-test --image=busybox:1.36 --restart=Never --command -- nslookup dispatch-svc.fulfillment.svc.cluster.local and inspect the Pod logs.
  3. Run kubectl -n ledger get endpointslices -l kubernetes.io/service-name=invoice-svc -o wide.
  4. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.

Explanation

Correct Answer

D:

Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations. This is the appropriate command-line action or first safe diagnostic. The technical reason is: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Validate the result with: Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The case facts point instead to: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Implement “Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations” to address that specific condition.

B:

This alternative is a response to another technical cause: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The reported case instead depends on: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The action that directly addresses it is “Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations”.

C:

The proposed action belongs to the mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. Here the stated fault follows a different mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The corrective choice is “Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations”.

Question 638

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: After egress isolation, app=invoice-api in ledger must be allowed to query cluster DNS using reviewed manifest ./policies/invoice-api-dns.yaml. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.
  3. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.
  4. An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances.

Explanation

Correct Answer

A:

NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. This explains the stated condition. The corresponding action is: Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations. The direct acceptance evidence is: Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation.

Incorrect Answers

B:

Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. That explanation applies to a different technical failure. Here the controlling principle is: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.

C:

The offered statement is true for this other mechanism: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. It does not explain the facts described here, which follow from: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.

D:

This principle describes a separate cause: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The reported condition is governed by: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The two mechanisms should not be conflated.

Question 639

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: After egress isolation, app=invoice-api in ledger must be allowed to query cluster DNS using reviewed manifest ./policies/invoice-api-dns.yaml. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.
  2. Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation.
  3. Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices.
  4. Run kubectl -n ledger get networkpolicy invoice-api-deny-ingress -o yaml and perform an authorized denied-connection probe.

Explanation

Correct Answer

B:

Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The intended action is: Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.

Incorrect Answers

A:

The alternative verifies a different condition: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The current case instead depends on: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Confirm that “Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation”.

C:

This observation would test a different technical dependency: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current issue is governed by: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Its decisive check is “Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation”.

D:

The alternative verifies a different condition: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current case instead depends on: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Confirm that “Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation”.

Question 640

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: After egress isolation, app=invoice-api in ledger must be allowed to query cluster DNS using reviewed manifest ./policies/invoice-api-dns.yaml. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test Service selectors against actual Pod template labels during deployments and renames.
  2. Verify peer label governance and avoid permitting all namespace workloads accidentally.
  3. Include DNS as an explicit dependency when designing egress policies for isolated Pods.
  4. Test security policies from allowed and denied sources rather than trusting YAML alone.

Explanation

Correct Answer

C:

Include DNS as an explicit dependency when designing egress policies for isolated Pods. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations. The relevant mechanism is: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.

Incorrect Answers

A:

That safeguard is relevant to: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The current failure instead follows from: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Its prevention measure is “Include DNS as an explicit dependency when designing egress policies for isolated Pods”.

B:

This routine guards against another mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The recurring exposure in the current case is: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The matching preventive check is “Include DNS as an explicit dependency when designing egress policies for isolated Pods”.

D:

That safeguard is relevant to: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current failure instead follows from: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. Its prevention measure is “Include DNS as an explicit dependency when designing egress policies for isolated Pods”.