A cluster uses Calico with NetworkPolicies. A new Pod in namespace 'payments' cannot reach a database Pod in namespace 'data' on port 5432. The NetworkPolicy in 'data' allows ingress from 'payments' on port 5432. You verify the policy is applied and the Pods are running. What is the most likely cause?

The Service for the database has no endpoints

The database Pod is on a different node than the payments Pod

The Calico IP pool is configured with 'natOutgoing: false'

The 'payments' namespace has a default-deny egress policy

A ClusterIP Service is not reachable from a Pod on the same node. The Service has correct endpoints. You inspect the node's iptables rules and see a chain named 'KUBE-SVC-XXXX' but no rules in it. What is the most likely cause?

kube-proxy is in IPVS mode and the iptables chain is a leftover

The endpoints are in a different namespace than the Service

The Service's 'clusterIP' is set to 'None' (headless)

The node's iptables rules are corrupted and need a full flush

Certified Kubernetes Administrator (CKA)

Domain 2Objective 5

Troubleshoot Services and Networking CKA Practice Questions (Page 4)

Part of the Troubleshooting domain, which accounts for 30% of the CKA exam. Linux Foundation does not publish an official question count, but from its 120-minute exam (~50–80 total, ~15–24 in this domain), expect 3–5 from this objective — we provide 24 practice questions to prepare you well beyond it. (estimate)

24questions here

5free pages

8concepts

30%of the exam

Questions 16–20

16foundation · easy
You apply an Ingress resource, but external traffic is not being routed. Which command would you use to check the status and rules of the Ingress resource?
Select an answer first
17expert · hard
A cluster uses Calico with NetworkPolicies. A new Pod in namespace 'payments' cannot reach a database Pod in namespace 'data' on port 5432. The NetworkPolicy in 'data' allows ingress from 'payments' on port 5432. You verify the policy is applied and the Pods are running. What is the most likely cause?
Select an answer first
18foundation · easy
A Pod inside the cluster cannot resolve the DNS name of a Service in the same namespace. Which component is primarily responsible for resolving Service names to ClusterIPs?
Select an answer first
19application · medium
A ClusterIP Service is not reachable from a Pod on the same node. The Service has correct endpoints. You inspect the node's iptables rules and see a chain named 'KUBE-SVC-XXXX' but no rules in it. What is the most likely cause?
Select an answer first
20foundation · easy
A Service is not load-balancing traffic correctly. You suspect the rules that forward traffic to backend Pods are incorrect. Which component is responsible for programming these rules?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CKA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Foundation. “CKA” is a trademark of its owner, used for identification only.

Troubleshoot Services and Networking CKA Practice Questions (Page 4)

Questions 16–20

You apply an Ingress resource, but external traffic is not being routed. Which command would you use to check the status and rules of the Ingress resource?

A Pod inside the cluster cannot resolve the DNS name of a Service in the same namespace. Which component is primarily responsible for resolving Service names to ClusterIPs?

A ClusterIP Service is not reachable from a Pod on the same node. The Service has correct endpoints. You inspect the node's iptables rules and see a chain named 'KUBE-SVC-XXXX' but no rules in it. What is the most likely cause?

A Service is not load-balancing traffic correctly. You suspect the rules that forward traffic to backend Pods are incorrect. Which component is responsible for programming these rules?

Keep studying — Troubleshooting