McAfee Secure

CNCF CKA Bundle

Exam Code: CKA

Exam Name Certified Kubernetes Administrator

Certification Provider: CNCF

Corresponding Certification: CKA

CNCF CKA Bundle $44.99
CKA Sample 1 CKA Sample 2 CKA Sample 3 CKA Sample 4 CKA Sample 5 CKA Sample 6 CKA Sample 7 CKA Sample 8 CKA Sample 9 CKA Sample 10

100% CNCF CKA Guaranteed Success With Testking Training Materials

Get Real CKA Exam Questions & Expert Verified Answers as Experienced on the Real Exam!

  • Questions & Answers

    CKA Questions & Answers

    58 Questions & Answers

    The ultimate exam preparation tool, Questions & Answers mirrors the actual CKA exam while allowing you to hone and measure every aspect of your test-taking ability.

  • CKA Video Course

    CKA Training Course

    138 Video Lectures

    CKA Video Course is developed by CNCF Professionals to help you pass the CKA exam.

    Description

    This course will improve your knowledge and skills required to pass Certified Kubernetes Administrator exam.
  • Study Guide

    CKA Study Guide

    268 PDF Pages

    Developed by industry experts, this 268-page guide spells out in painstaking detail all of the information you need to ace CKA exam.

Certified Kubernetes Administrator (CKA) Practice Tests

Satisfaction Guaranteed

Money Back Guarantee

Testking provides hassle-free money back guarantee with our products. That is because we have 100% trust in the abilities of our professional and experience product team, and our record is a proof of that.

99.6% PASS RATE
Total Cost: $194.97
Bundle Price: $149.98

Purchase Individually

  • Questions & Answers

    Questions & Answers

    58 Questions

    $124.99
  • CKA Video Course

    Training Course

    138 Video Lectures

    $39.99
  • Study Guide

    Study Guide

    268 PDF Pages

    $29.99

CNCF CKA Practice Test 72

Question 710

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A prepared HTTPRoute invoice-route in ledger must attach to approved Gateway internal-gw and route requests for invoice.example.test to Service invoice-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress.
  2. EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist.
  3. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.
  4. Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution.

Explanation

Correct Answer

C:

Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. This explains the stated condition. The corresponding action is: Run kubectl -n ledger apply -f ./gateway/invoice-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The direct acceptance evidence is: Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions.

Incorrect Answers

A:

This principle describes a separate cause: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The reported condition is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The two mechanisms should not be conflated.

B:

EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. That explanation applies to a different technical failure. Here the controlling principle is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

D:

This principle describes a separate cause: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The reported condition is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The two mechanisms should not be conflated.

Question 711

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A prepared HTTPRoute invoice-route in ledger must attach to approved Gateway internal-gw and route requests for invoice.example.test to Service invoice-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get gateway edge-gw -o yaml and inspect Accepted and Programmed conditions.
  2. Run kubectl -n ledger get service invoice-svc -o wide and inspect the allocated node port and endpoints.
  3. Run kubectl -n ledger get service invoice-svc and inspect its EndpointSlices and port mapping.
  4. Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions.

Explanation

Correct Answer

D:

Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The intended action is: Run kubectl -n ledger apply -f ./gateway/invoice-api-route.yaml after confirming parentRefs, hostnames and backendRefs.

Incorrect Answers

A:

The alternative verifies a different condition: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The current case instead depends on: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Confirm that “Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

B:

That test belongs to another control with this basis: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. In the current case, the governing reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The direct verification is “Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

C:

This observation would test a different technical dependency: A ClusterIP Service provides stable in-cluster virtual addressing and directs traffic to selected ready Pod endpoints. The current issue is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its decisive check is “Run kubectl -n ledger get httproute invoice-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

Question 712

At Northstar finance, in an isolated training cluster during a scheduled maintenance rehearsal: A prepared HTTPRoute invoice-route in ledger must attach to approved Gateway internal-gw and route requests for invoice.example.test to Service invoice-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  2. Audit controller capability and exposed service access policies before enabling public ingress.
  3. Limit NodePort exposure through network controls and remove temporary external test services.
  4. Review ingress class ownership and avoid exposing test applications outside intended environments.

Explanation

Correct Answer

A:

Treat cross-namespace route attachment and backend references as controlled trust boundaries. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n ledger apply -f ./gateway/invoice-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The relevant mechanism is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

Incorrect Answers

B:

This routine guards against another mechanism: LoadBalancer Services request external routing from a supported infrastructure controller; a bare cluster does not guarantee an external address. The recurring exposure in the current case is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The matching preventive check is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

C:

The suggested review tracks a different technical risk: A NodePort Service allocates a cluster-configured host port on each node while retaining its cluster IP routing. Here the sustained control must address: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Choose “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

D:

That safeguard is relevant to: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. The current failure instead follows from: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its prevention measure is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

Question 713

At Horizon observability, in a disposable simulated environment during a monitored release window: A prepared HTTPRoute metrics-route in observability must attach to approved Gateway edge-gw and route requests for metrics.example.test to Service metrics-svc. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-gateway.yaml after confirming GatewayClass and listener settings.
  2. Run kubectl -n observability port-forward service/metrics-svc 18081:8080 in a temporary session.
  3. Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs.
  4. Run kubectl -n observability get endpointslices -l kubernetes.io/service-name=metrics-svc -o wide.

Explanation

Correct Answer

C:

Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Validate the result with: Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

This alternative is a response to another technical cause: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The reported case instead depends on: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The action that directly addresses it is “Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs”.

B:

The proposed action belongs to the mechanism: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Here the stated fault follows a different mechanism: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The corrective choice is “Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs”.

D:

This alternative is a response to another technical cause: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The reported case instead depends on: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The action that directly addresses it is “Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs”.

Question 714

At Horizon observability, in a disposable simulated environment during a monitored release window: A prepared HTTPRoute metrics-route in observability must attach to approved Gateway edge-gw and route requests for metrics.example.test to Service metrics-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. The Service port is what clients connect to, while targetPort must reach the actual backend listener.
  2. Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support.
  3. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  4. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

Explanation

Correct Answer

D:

Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. This explains the stated condition. The corresponding action is: Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The direct acceptance evidence is: Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions.

Incorrect Answers

A:

The Service port is what clients connect to, while targetPort must reach the actual backend listener. That explanation applies to a different technical failure. Here the controlling principle is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

B:

The offered statement is true for this other mechanism: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. It does not explain the facts described here, which follow from: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

C:

This principle describes a separate cause: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The reported condition is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The two mechanisms should not be conflated.

Question 715

At Horizon observability, in a disposable simulated environment during a monitored release window: A prepared HTTPRoute metrics-route in observability must attach to approved Gateway edge-gw and route requests for metrics.example.test to Service metrics-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions.
  2. Run kubectl -n ledger get gateway internal-gw -o yaml and inspect Accepted and Programmed conditions.
  3. Run kubectl -n observability logs metrics-api-dns-test and look for a valid Service address before deleting the test Pod.
  4. Run kubectl -n observability describe networkpolicy metrics-api-deny-egress and test expected blocked destinations.

Explanation

Correct Answer

A:

Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The intended action is: Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs.

Incorrect Answers

B:

This observation would test a different technical dependency: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The current issue is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its decisive check is “Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

C:

The alternative verifies a different condition: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The current case instead depends on: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Confirm that “Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

D:

That test belongs to another control with this basis: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. In the current case, the governing reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The direct verification is “Run kubectl -n observability get httproute metrics-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

Question 716

At Horizon observability, in a disposable simulated environment during a monitored release window: A prepared HTTPRoute metrics-route in observability must attach to approved Gateway edge-gw and route requests for metrics.example.test to Service metrics-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Test security policies from allowed and denied sources rather than trusting YAML alone.
  2. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  3. Maintain lightweight in-cluster DNS canaries and verify Service creation and DNS freshness.
  4. Include EndpointSlice and readiness checks in Service connectivity runbooks.

Explanation

Correct Answer

B:

Treat cross-namespace route attachment and backend references as controlled trust boundaries. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n observability apply -f ./gateway/metrics-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The relevant mechanism is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

Incorrect Answers

A:

This routine guards against another mechanism: A selecting NetworkPolicy with ingress isolation and no allow rules denies new ingress to selected Pods except protocol-specific policy behavior; it does not itself control egress. The recurring exposure in the current case is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The matching preventive check is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

C:

That safeguard is relevant to: Cluster DNS should resolve Service names inside its configured domain; host-side DNS results do not prove in-cluster resolution. The current failure instead follows from: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its prevention measure is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

D:

This routine guards against another mechanism: EndpointSlices represent Service backend addresses and readiness; Service existence alone does not prove endpoints exist. The recurring exposure in the current case is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The matching preventive check is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

Question 717

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A prepared HTTPRoute dispatch-route in fulfillment must attach to approved Gateway regional-gw and route requests for dispatch.example.test to Service dispatch-svc. Work only within the stated target and verify before declaring success. Which command or initial safe diagnostic step best addresses the stated lab task?

  1. Run kubectl -n fulfillment create ingress dispatch-ingress --class=nginx --rule='dispatch.example.test/=dispatch-svc:9090' after confirming the Service exists.
  2. Run kubectl -n kube-system get configmap coredns -o yaml and review the Corefile.
  3. Run kubectl -n fulfillment apply -f ./policies/dispatch-api-dns.yaml where egress grants UDP and TCP 53 to validated DNS destinations.
  4. Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs.

Explanation

Correct Answer

D:

Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs. This is the appropriate command-line action or first safe diagnostic. The technical reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Validate the result with: Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions. Execute changes only in an authorized disposable lab or after normal production change controls.

Incorrect Answers

A:

The proposed action belongs to the mechanism: An Ingress resource declares HTTP host/path routing but requires an actual installed Ingress controller. Here the stated fault follows a different mechanism: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The corrective choice is “Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs”.

B:

The offered action targets: CoreDNS behavior is configured separately from Service definitions, and incorrect DNS plugins or cluster domain can break discovery cluster-wide. The case facts point instead to: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Implement “Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs” to address that specific condition.

C:

This alternative is a response to another technical cause: NetworkPolicy egress rules are additive and DNS lookup requires permitted traffic to the DNS server, not only a correct Service record. The reported case instead depends on: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The action that directly addresses it is “Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs”.

Question 718

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A prepared HTTPRoute dispatch-route in fulfillment must attach to approved Gateway regional-gw and route requests for dispatch.example.test to Service dispatch-svc. Work only within the stated target and verify before declaring success. Which Kubernetes behavior best explains the required change or diagnosis?

  1. Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.
  2. Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates.
  3. Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods.
  4. An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors.

Explanation

Correct Answer

A:

Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. This explains the stated condition. The corresponding action is: Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The direct acceptance evidence is: Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions.

Incorrect Answers

B:

This principle describes a separate cause: Ingress TLS termination relies on a controller and a referenced TLS Secret; updating a Service alone does not install certificates. The reported condition is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The two mechanisms should not be conflated.

C:

Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. That explanation applies to a different technical failure. Here the controlling principle is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

D:

The offered statement is true for this other mechanism: An ingress rule with a podSelector selects source Pods in its own namespace unless combined with other peer selectors. It does not explain the facts described here, which follow from: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

Question 719

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A prepared HTTPRoute dispatch-route in fulfillment must attach to approved Gateway regional-gw and route requests for dispatch.example.test to Service dispatch-svc. Work only within the stated target and verify before declaring success. Which observation best verifies the requested outcome rather than an unrelated state?

  1. Run kubectl -n observability get gateway edge-gw -o yaml and inspect Accepted and Programmed conditions.
  2. Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions.
  3. Run authorized connectivity probes from both approved and unapproved namespaces.
  4. Run kubectl -n fulfillment get endpointslices -l kubernetes.io/service-name=dispatch-svc and verify addresses for the intended Pods.

Explanation

Correct Answer

B:

Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions. This validates the affected object or control path, rather than only showing a command completed. The underlying reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The intended action is: Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs.

Incorrect Answers

A:

This observation would test a different technical dependency: Gateway API separates infrastructure listener ownership from application route attachments and depends on controller support. The current issue is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its decisive check is “Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

C:

That test belongs to another control with this basis: A namespaceSelector in a NetworkPolicy ingress peer matches namespace labels; it differs from matching arbitrary Pod labels across namespaces. In the current case, the governing reason is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. The direct verification is “Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

D:

This observation would test a different technical dependency: Services select matching Pods; an unmatched selector can leave EndpointSlices without usable backends despite healthy Pods. The current issue is governed by: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its decisive check is “Run kubectl -n fulfillment get httproute dispatch-route -o yaml and inspect parent acceptance and resolved-reference conditions”.

Question 720

At Pinecrest logistics, in a sandbox Kubernetes cluster during a recovery tabletop exercise: A prepared HTTPRoute dispatch-route in fulfillment must attach to approved Gateway regional-gw and route requests for dispatch.example.test to Service dispatch-svc. Work only within the stated target and verify before declaring success. Which operational control most directly prevents this failure or configuration drift?

  1. Check exposed Service port mappings against actual container listeners and named ports before releases.
  2. Model required system egress and incident recovery before enforcing default-deny behavior.
  3. Treat cross-namespace route attachment and backend references as controlled trust boundaries.
  4. Prefer short-lived diagnostic tunnels and avoid treating port-forward as a production ingress path.

Explanation

Correct Answer

C:

Treat cross-namespace route attachment and backend references as controlled trust boundaries. This reduces recurrence of the specific operational failure. It reinforces the action: Run kubectl -n fulfillment apply -f ./gateway/dispatch-api-route.yaml after confirming parentRefs, hostnames and backendRefs. The relevant mechanism is: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners.

Incorrect Answers

A:

The suggested review tracks a different technical risk: The Service port is what clients connect to, while targetPort must reach the actual backend listener. Here the sustained control must address: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Choose “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

B:

That safeguard is relevant to: An egress-isolating NetworkPolicy can block Pod outbound connections; DNS and required dependencies need explicit allowances. The current failure instead follows from: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Its prevention measure is “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.

D:

The suggested review tracks a different technical risk: Port-forwarding creates a client-side tunnel to a selected backend and does not change the Service type or network exposure. Here the sustained control must address: Gateway API HTTPRoutes express matching and backend behavior while Gateway resources own compatible listeners. Choose “Treat cross-namespace route attachment and backend references as controlled trust boundaries”.