Define and Enforce Network Policies CKA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   You are securing a Kubernetes cluster. The security team requires that no pod can initiate outbound connections to any destination by default, but you must allow pods in the 'frontend' namespace to reach the Kubernetes API server (which has the label 'app=kube-apiserver' and is in the 'kube-system' namespace). You create a NetworkPolicy in the 'frontend' namespace with an egress rule that selects all pods and allows traffic to the API server using a namespaceSelector. However, you notice that pods in 'frontend' can still reach other destinations. What is the most likely reason?

   • ANetworkPolicies only apply to ingress traffic, not egress, unless the CNI plugin is configured for egress.
   • BThe egress rule's namespaceSelector also matches the 'frontend' namespace, so pods can reach each other.
   • CThe namespaceSelector must be combined with a podSelector to match the API server pods.
   • DYou did not create a default deny-all egress policy in the 'frontend' namespace.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of a Kubernetes NetworkPolicy?

   • ATo restrict network traffic between pods based on labels and ports
   • BTo encrypt traffic between pods using TLS certificates
   • CTo provide DNS-based service discovery for pods
   • DTo control traffic between pods and external services
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is a prerequisite for NetworkPolicy enforcement in a Kubernetes cluster?

   • AThe kube-proxy must be configured with the `--network-policy` flag
   • BThe cluster must be running on a cloud provider
   • CThe cluster must have a service mesh installed
   • DThe CNI plugin must support NetworkPolicy enforcement
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the correct semantics of the `ipBlock` field in a NetworkPolicy rule?

   • AIt selects pods based on their node IP address
   • BIt selects pods by their IP address, but only within the same namespace
   • CIt selects pods based on their service account
   • DIt selects traffic from or to a specific IP address range, with optional exceptions
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   You need to allow ingress traffic to pods with label 'app=web' from pods with label 'tier=frontend' in the same namespace, and also from pods in the 'monitoring' namespace. You create a NetworkPolicy with two ingress rules: one with a podSelector and one with a namespaceSelector. After applying the policy, you notice that traffic from the 'monitoring' namespace is allowed, but traffic from the 'tier=frontend' pods is not. What is the most likely reason?

   • AThe namespaceSelector rule is overriding the podSelector rule.
   • BThe NetworkPolicy is missing an egress rule for the frontend pods.
   • CThe podSelector rule is missing a namespaceSelector, so it only applies to the default namespace.
   • DThe frontend pods do not have the label 'tier=frontend'.
   Reveal Solution Discussion Select an answer first