Linux Foundation / CNCF CKNE: Certified Kubernetes Network Engineer

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Services and Ingress

   An application must be exposed to clients outside the cluster through an HTTP host and path rule, with a single load balancer address. Which resource should be used?

   1. AA ClusterIP Service that exposes pods on an internal virtual address
   2. BA headless Service with no selector and manually managed Endpoints
   3. CAn Ingress with rules, served by an Ingress controller behind a LoadBalancer Service
   4. DA ConfigMap with the host name and path prefixes listed as key-value entries for the application
   Show answer and explanationHide answer

   Correct answer: C

   An Ingress defines host and path rules, and an Ingress controller exposed through a LoadBalancer provides one entry point. ClusterIP is internal, headless services do not route traffic, and ConfigMaps are not routing objects.

2. Question 2Kubernetes Networking Fundamentals

   Kubernetes requires that every pod receives its own IP address and can reach other pods without NAT. Which component implements this requirement?

   1. Aetcd cluster store
   2. BCoreDNS name server
   3. Ckube-scheduler pods
   4. DA CNI network plugin
   Show answer and explanationHide answer

   Correct answer: D

   The CNI plugin assigns pod IPs and sets up the routing that gives the flat pod network model. The scheduler places pods, etcd stores state, and CoreDNS resolves names.

3. Question 3Troubleshooting Network Connectivity

   A packet capture is needed to see whether traffic reaches a pod's interface. Which approach is most practical in a cluster?

   1. ATaking a screenshot of the dashboard and sharing it with the team to decide if traffic reaches the pod
   2. BReading the pod's labels and comparing them against the Service selector to see which pods match
   3. CRunning a debug container in the pod's network namespace or on the node and capturing on the relevant interface
   4. DPrinting the Service manifest and the Endpoints object to a file, then reviewing the YAML for port numbers and selectors and labels
   Show answer and explanationHide answer

   Correct answer: C

   Capturing in the pod's network namespace or on the node interface shows real packets. Screenshots, labels and manifests do not show traffic.

4. Question 4Network Policies

   A namespace must deny all inbound traffic to its pods by default. Which NetworkPolicy achieves this?

   1. AAn ingress rule with no from selector admitting every source
   2. BAn egress-only policy with no ingress types in the namespace
   3. CAn empty podSelector with policyTypes Ingress and no ingress rules
   4. DA policy that selects no namespaces but permits every pod
   Show answer and explanationHide answer

   Correct answer: C

   An empty pod selector applies to all pods, and listing Ingress with no rules denies inbound traffic. Allow-all rules, egress-only policies and namespace-free selections do not implement default deny for ingress.

5. Question 5Services and Ingress

   An Ingress resource is created, but no traffic reaches the application. Which component is missing?

   1. AA PersistentVolumeClaim bound to a storage volume
   2. BAn Ingress controller that implements the Ingress resource
   3. CA ServiceAccount with cluster-admin bound by a RoleBinding in kube-system
   4. DA ResourceQuota capping pod count in a namespace
   Show answer and explanationHide answer

   Correct answer: B

   The Ingress resource is only configuration; an Ingress controller must be running to act on it. Storage claims, service accounts and quotas do not route HTTP traffic.