McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 67

Question 660

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A policy ./policies/dispatch-api-peer.yaml is ready to permit Pod-to-Pod traffic only from trusted labels in namespace fulfillment. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  2. Test security policies from allowed and denied sources rather than trusting YAML alone.
  3. Include DNS as an explicit dependency when designing egress policies for isolated Pods.
  4. Verify peer label governance and avoid permitting all namespace workloads accidentally.

Explanation

Correct Answer

D:

Verify peer label governance and avoid permitting all namespace workloads accidentally. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment apply -f ./policies/dispatch-api-peer.yaml after verifying podSelector rules match the source identity. The relevant mechanism is: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.

Incorrect Answers

A:

The suggested review tracks a different technical risk: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Here the sustained control must address: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Choose “Verify peer label governance and avoid permitting all namespace workloads accidentally”.

B:

That safeguard is relevant to: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current failure instead follows from: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Its prevention measure is “Verify peer label governance and avoid permitting all namespace workloads accidentally”.

C:

This routine guards against another mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The recurring exposure in the current case is: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The matching preventive check is “Verify peer label governance and avoid permitting all namespace workloads accidentally”.

Question 661

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service backend Pods for invoice-api in ledger must accept port 80 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger apply -f ./policies/invoice-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.
  2. Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80.
  3. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-peer.yaml after verifying podSelector rules match the source identity.
  4. Run kubectl -n observability apply -f ./policies/metrics-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.

Explanation

Correct Answer

B:

Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Validate the result with: Run authorized connectivity probes from both approved and unapproved namespaces. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The case facts point instead to: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Implement “Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80” to address that specific condition.

C:

The proposed action belongs to the mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. Here the stated fault follows a different mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The corrective choice is “Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80”.

D:

The offered action targets: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The case facts point instead to: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Implement “Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80” to address that specific condition.

Question 662

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service backend Pods for invoice-api in ledger must accept port 80 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  2. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  3. A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.
  4. An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.

Explanation

Correct Answer

C:

A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. This explains the stated condition. The corresponding action is: Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80. The direct acceptance evidence is: Run authorized connectivity probes from both approved and unapproved namespaces.

Incorrect Answers

A:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The two mechanisms should not be conflated.

B:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. That explanation applies to a different technical failure. Here the controlling principle is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

D:

This principle describes a separate cause: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The reported condition is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The two mechanisms should not be conflated.

Question 663

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service backend Pods for invoice-api in ledger must accept port 80 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions.
  2. Run kubectl -n ledger logs invoice-api-dns-test and look for a valid Service address before deleting the test Pod.
  3. Run kubectl -n ledger describe ingress invoice-ingress and test the route through the controller address using the expected Host header.
  4. Run authorized connectivity probes from both approved and unapproved namespaces.

Explanation

Correct Answer

D:

Run authorized connectivity probes from both approved and unapproved namespaces. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The intended action is: Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80.

Incorrect Answers

A:

The alternative verifies a different condition: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The current case instead depends on: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Confirm that “Run authorized connectivity probes from both approved and unapproved namespaces”.

B:

That test belongs to another control with this basis: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. In the current case, the governing reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The direct verification is “Run authorized connectivity probes from both approved and unapproved namespaces”.

C:

This observation would test a different technical dependency: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current issue is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Its decisive check is “Run authorized connectivity probes from both approved and unapproved namespaces”.

Question 664

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: Service backend Pods for invoice-api in ledger must accept port 80 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  2. Test Service selectors against actual Pod template labels during deployments and renames.
  3. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  4. Review ingress class ownership and avoid exposing test applications outside intended environments.

Explanation

Correct Answer

A:

Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger apply -f ./policies/invoice-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 80. The relevant mechanism is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

Incorrect Answers

B:

This routine guards against another mechanism: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The recurring exposure in the current case is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The matching preventive check is “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

C:

The suggested review tracks a different technical risk: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Here the sustained control must address: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Choose “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

D:

That safeguard is relevant to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current failure instead follows from: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Its prevention measure is “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

Question 665

At Horizon observability, in a disposable simulated environment during a monitored release window: Service backend Pods for metrics-api in observability must accept port 8080 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger expose deployment invoice-api --name=invoice-svc --type=ClusterIP --port=80 --target-port=8080.
  2. Run kubectl -n observability create ingress metrics-ingress --class=nginx --rule='metrics.example.test/=metrics-svc:8080' after confirming the Service exists.
  3. Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080.
  4. Run kubectl -n observability apply -f ./policies/metrics-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.

Explanation

Correct Answer

C:

Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Validate the result with: Run authorized connectivity probes from both approved and unapproved namespaces. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The reported case instead depends on: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The action that directly addresses it is “Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080”.

B:

The proposed action belongs to the mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Here the stated fault follows a different mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The corrective choice is “Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080”.

D:

This alternative is a response to another technical cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported case instead depends on: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The action that directly addresses it is “Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080”.

Question 666

At Horizon observability, in a disposable simulated environment during a monitored release window: Service backend Pods for metrics-api in observability must accept port 8080 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  2. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  3. Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support.
  4. A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

Explanation

Correct Answer

D:

A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. This explains the stated condition. The corresponding action is: Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080. The direct acceptance evidence is: Run authorized connectivity probes from both approved and unapproved namespaces.

Incorrect Answers

A:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. That explanation applies to a different technical failure. Here the controlling principle is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

B:

The offered statement is true for this other mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. It does not explain the facts described here, which follow from: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

C:

This principle describes a separate cause: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The reported condition is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The two mechanisms should not be conflated.

Question 667

At Horizon observability, in a disposable simulated environment during a monitored release window: Service backend Pods for metrics-api in observability must accept port 8080 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run authorized connectivity probes from both approved and unapproved namespaces.
  2. Run kubectl -n observability get service metrics-svc and inspect external address assignment plus ready EndpointSlices.
  3. Run kubectl -n fulfillment get networkpolicy dispatch-api-deny-ingress -o yaml and perform an authorized denied-connection probe.
  4. Run kubectl -n observability get service metrics-svc -o wide and inspect the allocated node port and endpoints.

Explanation

Correct Answer

A:

Run authorized connectivity probes from both approved and unapproved namespaces. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The intended action is: Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080.

Incorrect Answers

B:

This observation would test a different technical dependency: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current issue is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Its decisive check is “Run authorized connectivity probes from both approved and unapproved namespaces”.

C:

The alternative verifies a different condition: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current case instead depends on: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Confirm that “Run authorized connectivity probes from both approved and unapproved namespaces”.

D:

That test belongs to another control with this basis: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. In the current case, the governing reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The direct verification is “Run authorized connectivity probes from both approved and unapproved namespaces”.

Question 668

At Horizon observability, in a disposable simulated environment during a monitored release window: Service backend Pods for metrics-api in observability must accept port 8080 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Check exposed Service port mappings against actual container listeners and named ports before releases.
  2. Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams.
  3. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  4. Test security policies from allowed and denied sources rather than trusting YAML alone.

Explanation

Correct Answer

B:

Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability apply -f ./policies/metrics-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 8080. The relevant mechanism is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

Incorrect Answers

A:

This routine guards against another mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. The recurring exposure in the current case is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The matching preventive check is “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

C:

That safeguard is relevant to: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The current failure instead follows from: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Its prevention measure is “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

D:

This routine guards against another mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The recurring exposure in the current case is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The matching preventive check is “Maintain namespace label ownership and validate that policy selectors cannot be self-assigned by untrusted teams”.

Question 669

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service backend Pods for dispatch-api in fulfillment must accept port 9090 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.
  2. Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs.
  3. Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-gateway.yaml after confirming GatewayClass and listener settings.
  4. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090.

Explanation

Correct Answer

D:

Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090. This is the appropriate command-line action or first safe diagnostic. The technical reason is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Validate the result with: Run authorized connectivity probes from both approved and unapproved namespaces. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the stated fault follows a different mechanism: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The corrective choice is “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090”.

B:

The offered action targets: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The case facts point instead to: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. Implement “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090” to address that specific condition.

C:

This alternative is a response to another technical cause: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The reported case instead depends on: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The action that directly addresses it is “Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090”.

Question 670

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: Service backend Pods for dispatch-api in fulfillment must accept port 9090 traffic from a namespace carrying label access=approved via a reviewed policy file. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.
  2. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  3. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  4. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.

Explanation

Correct Answer

A:

A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment apply -f ./policies/dispatch-api-cross-namespace.yaml after confirming its namespaceSelector and TCP port 9090. The direct acceptance evidence is: Run authorized connectivity probes from both approved and unapproved namespaces.

Incorrect Answers

B:

This principle describes a separate cause: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The reported condition is governed by: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The two mechanisms should not be conflated.

C:

A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. That explanation applies to a different technical failure. Here the controlling principle is: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.

D:

The offered statement is true for this other mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. It does not explain the facts described here, which follow from: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces.