McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 69

Question 680

At Horizon observability, in a disposable simulated environment during a monitored release window: The lab cluster has an Ingress controller named nginx; an Ingress metrics-ingress in observability must route metrics.example.test path / to Service metrics-svc port 8080. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Review ingress class ownership and avoid exposing test applications outside intended environments.
  2. Include EndpointSlice and readiness checks in Service connectivity runbooks.
  3. Test security policies from allowed and denied sources rather than trusting YAML alone.
  4. Include DNS as an explicit dependency when designing egress policies for isolated Pods.

Explanation

Correct Answer

A:

Review ingress class ownership and avoid exposing test applications outside intended environments. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability create ingress metrics-ingress --class=nginx --rule='metrics.example.test/=metrics-svc:8080' after confirming the Service exists. The relevant mechanism is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.

Incorrect Answers

B:

The suggested review tracks a different technical risk: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. Here the sustained control must address: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Choose “Review ingress class ownership and avoid exposing test applications outside intended environments”.

C:

That safeguard is relevant to: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The current failure instead follows from: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Its prevention measure is “Review ingress class ownership and avoid exposing test applications outside intended environments”.

D:

This routine guards against another mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The recurring exposure in the current case is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The matching preventive check is “Review ingress class ownership and avoid exposing test applications outside intended environments”.

Question 681

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The lab cluster has an Ingress controller named nginx; an Ingress dispatch-ingress in fulfillment must route dispatch.example.test path / to Service dispatch-svc port 9090. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment patch service dispatch-svc --type=merge -p '{"spec":{"ports":[{"port":9090,"targetPort":9000}]}}' for the lab's single-port Service.
  2. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  3. Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists.
  4. Run kubectl -n observability apply -f ./policies/metrics-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.

Explanation

Correct Answer

C:

Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists. This is the appropriate command-line action or first safe diagnostic. The technical reason is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Validate the result with: Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the stated fault follows a different mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The corrective choice is “Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists”.

B:

The offered action targets: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The case facts point instead to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Implement “Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists” to address that specific condition.

D:

The proposed action belongs to the mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the stated fault follows a different mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The corrective choice is “Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists”.

Question 682

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The lab cluster has an Ingress controller named nginx; an Ingress dispatch-ingress in fulfillment must route dispatch.example.test path / to Service dispatch-svc port 9090. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record.
  2. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  3. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.
  4. An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.

Explanation

Correct Answer

D:

An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists. The direct acceptance evidence is: Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header.

Incorrect Answers

A:

The offered statement is true for this other mechanism: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. It does not explain the facts described here, which follow from: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.

B:

This principle describes a separate cause: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The reported condition is governed by: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The two mechanisms should not be conflated.

C:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. That explanation applies to a different technical failure. Here the controlling principle is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.

Question 683

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The lab cluster has an Ingress controller named nginx; an Ingress dispatch-ingress in fulfillment must route dispatch.example.test path / to Service dispatch-svc port 9090. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header.
  2. Run kubectl -n fulfillment get service dispatch-svc and inspect external address assignment plus ready EndpointSlices.
  3. Run kubectl -n fulfillment get networkpolicy dispatch-api-deny-ingress -o yaml and perform an authorized denied-connection probe.
  4. Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc and verify addresses for the intended Pods.

Explanation

Correct Answer

A:

Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The intended action is: Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists.

Incorrect Answers

B:

The alternative verifies a different condition: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current case instead depends on: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Confirm that “Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header”.

C:

That test belongs to another control with this basis: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. In the current case, the governing reason is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The direct verification is “Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header”.

D:

This observation would test a different technical dependency: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The current issue is governed by: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Its decisive check is “Run kubectl -n fulfillment describe ingress dispatch-ingress and test the route through the controller address using the expected Host header”.

Question 684

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: The lab cluster has an Ingress controller named nginx; an Ingress dispatch-ingress in fulfillment must route dispatch.example.test path / to Service dispatch-svc port 9090. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Audit controller capability and exposed service access policies before enabling public ingress.
  2. Review ingress class ownership and avoid exposing test applications outside intended environments.
  3. Check gateway class/controller compatibility and delegate route attachment privileges deliberately.
  4. Model required system egress and incident recovery before enforcing default-deny behavior.

Explanation

Correct Answer

B:

Review ingress class ownership and avoid exposing test applications outside intended environments. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists. The relevant mechanism is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller.

Incorrect Answers

A:

The suggested review tracks a different technical risk: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. Here the sustained control must address: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Choose “Review ingress class ownership and avoid exposing test applications outside intended environments”.

C:

This routine guards against another mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The recurring exposure in the current case is: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The matching preventive check is “Review ingress class ownership and avoid exposing test applications outside intended environments”.

D:

The suggested review tracks a different technical risk: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. Here the sustained control must address: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Choose “Review ingress class ownership and avoid exposing test applications outside intended environments”.

Question 685

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An existing Ingress invoice-ingress in namespace ledger needs its TLS host and precreated Secret references applied from reviewed file ./ingress/invoice-api-tls.yaml. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n ledger apply -f ./gateway/invoice-api-route.yaml after confirming parentRefs, hostnames and backendRefs.
  2. Run kubectl -n ledger apply -f ./policies/invoice-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  3. Run kubectl -n ledger apply -f ./gateway/invoice-api-gateway.yaml after confirming GatewayClass and listener settings.
  4. Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match.

Explanation

Correct Answer

D:

Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Validate the result with: Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The offered action targets: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The case facts point instead to: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Implement “Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match” to address that specific condition.

B:

This alternative is a response to another technical cause: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The reported case instead depends on: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The action that directly addresses it is “Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match”.

C:

The proposed action belongs to the mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. Here the stated fault follows a different mechanism: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The corrective choice is “Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match”.

Question 686

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An existing Ingress invoice-ingress in namespace ledger needs its TLS host and precreated Secret references applied from reviewed file ./ingress/invoice-api-tls.yaml. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  2. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.
  3. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  4. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.

Explanation

Correct Answer

A:

Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. This explains the stated condition. The corresponding action is: Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match. The direct acceptance evidence is: Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.

Incorrect Answers

B:

Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. That explanation applies to a different technical failure. Here the controlling principle is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

C:

The offered statement is true for this other mechanism: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. It does not explain the facts described here, which follow from: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

D:

This principle describes a separate cause: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The reported condition is governed by: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The two mechanisms should not be conflated.

Question 687

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An existing Ingress invoice-ingress in namespace ledger needs its TLS host and precreated Secret references applied from reviewed file ./ingress/invoice-api-tls.yaml. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run authorized connectivity probes from both approved and unapproved namespaces.
  2. Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.
  3. Run kubectl -n ledger get service invoice-svc and inspect external address assignment plus ready EndpointSlices.
  4. Run an in-Pod nslookup invoice-svc.ledger.svc.cluster.local and confirm name resolution under isolation.

Explanation

Correct Answer

B:

Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The intended action is: Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match.

Incorrect Answers

A:

The alternative verifies a different condition: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. The current case instead depends on: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Confirm that “Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test”.

C:

This observation would test a different technical dependency: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The current issue is governed by: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Its decisive check is “Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test”.

D:

The alternative verifies a different condition: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The current case instead depends on: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Confirm that “Run kubectl -n ledger describe ingress invoice-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test”.

Question 688

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: An existing Ingress invoice-ingress in namespace ledger needs its TLS host and precreated Secret references applied from reviewed file ./ingress/invoice-api-tls.yaml. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Include EndpointSlice and readiness checks in Service connectivity runbooks.
  2. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.
  3. Track TLS Secret renewal and enforce appropriate ingress-controller security policies.
  4. Verify peer label governance and avoid permitting all namespace workloads accidentally.

Explanation

Correct Answer

C:

Track TLS Secret renewal and enforce appropriate ingress-controller security policies. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger apply -f ./ingress/invoice-api-tls.yaml after checking secret type and host match. The relevant mechanism is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

Incorrect Answers

A:

That safeguard is relevant to: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The current failure instead follows from: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Its prevention measure is “Track TLS Secret renewal and enforce appropriate ingress-controller security policies”.

B:

This routine guards against another mechanism: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The recurring exposure in the current case is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The matching preventive check is “Track TLS Secret renewal and enforce appropriate ingress-controller security policies”.

D:

That safeguard is relevant to: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The current failure instead follows from: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Its prevention measure is “Track TLS Secret renewal and enforce appropriate ingress-controller security policies”.

Question 689

At Horizon observability, in a disposable simulated environment during a monitored release window: An existing Ingress metrics-ingress in namespace observability needs its TLS host and precreated Secret references applied from reviewed file ./ingress/metrics-api-tls.yaml. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match.
  2. Run kubectl -n observability apply -f ./policies/metrics-api-deny-ingress.yaml after validating selectors and the CNI's policy enforcement support.
  3. Run kubectl -n observability port-forward service/metrics-svc 18081:8080 in a temporary session.
  4. Run kubectl -n observability apply -f ./policies/metrics-api-peer.yaml after verifying podSelector rules match the source identity.

Explanation

Correct Answer

A:

Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Validate the result with: Run kubectl -n observability describe ingress metrics-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

B:

The proposed action belongs to the mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. Here the stated fault follows a different mechanism: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The corrective choice is “Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match”.

C:

The offered action targets: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. The case facts point instead to: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. Implement “Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match” to address that specific condition.

D:

This alternative is a response to another technical cause: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. The reported case instead depends on: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The action that directly addresses it is “Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match”.

Question 690

At Horizon observability, in a disposable simulated environment during a monitored release window: An existing Ingress metrics-ingress in namespace observability needs its TLS host and precreated Secret references applied from reviewed file ./ingress/metrics-api-tls.yaml. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  2. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  3. A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing.
  4. LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address.

Explanation

Correct Answer

B:

Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. This explains the stated condition. The corresponding action is: Run kubectl -n observability apply -f ./ingress/metrics-api-tls.yaml after checking secret type and host match. The direct acceptance evidence is: Run kubectl -n observability describe ingress metrics-ingress and verify its TLS mapping, then perform a certificate-validating HTTPS test.

Incorrect Answers

A:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. That explanation applies to a different technical failure. Here the controlling principle is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.

C:

This principle describes a separate cause: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. The reported condition is governed by: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The two mechanisms should not be conflated.

D:

LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. That explanation applies to a different technical failure. Here the controlling principle is: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.