CertArea
All Linux Foundation / CNCF exams

Free CKNE practice test: 30 questions with answers

30 original questions for Certified Kubernetes Network Engineer, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

CKNE exam guide: topics, cost and format

All 30 CKNE questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Services and Ingress (8 questions)

  1. Question 1

    An application must be exposed to clients outside the cluster through an HTTP host and path rule, with a single load balancer address. Which resource should be used?

    1. AA ClusterIP Service that exposes pods on an internal virtual address
    2. BA headless Service with no selector and manually managed Endpoints
    3. CAn Ingress with rules, served by an Ingress controller behind a LoadBalancer Service
    4. DA ConfigMap with the host name and path prefixes listed as key-value entries for the application
    Show answer and explanation
    Correct answer: C

    An Ingress defines host and path rules, and an Ingress controller exposed through a LoadBalancer provides one entry point. ClusterIP is internal, headless services do not route traffic, and ConfigMaps are not routing objects.

  2. Question 2

    An Ingress resource is created, but no traffic reaches the application. Which component is missing?

    1. AA PersistentVolumeClaim bound to a storage volume
    2. BAn Ingress controller that implements the Ingress resource
    3. CA ServiceAccount with cluster-admin bound by a RoleBinding in kube-system
    4. DA ResourceQuota capping pod count in a namespace
    Show answer and explanation
    Correct answer: B

    The Ingress resource is only configuration; an Ingress controller must be running to act on it. Storage claims, service accounts and quotas do not route HTTP traffic.

  3. Question 3

    A team wants TLS termination for an application exposed through an Ingress. Which configuration is required?

    1. AA TLS section in the Ingress that references a Secret containing the certificate and key
    2. BStoring the certificate in the pod's container image name as a tag suffix in CI
    3. CA plaintext password in the Ingress annotations that the controller decodes for termination
    4. DTurning off the Ingress controller and removing the IngressClass resource from the cluster
    Show answer and explanation
    Correct answer: A

    The TLS section references a Secret with the certificate and private key, which the controller uses for termination. Plaintext passwords, disabled controllers and image names are not TLS configuration.

  4. Question 4

    Which newer Kubernetes API provides a more expressive model for routing and gateways than Ingress, with separate roles for infrastructure and application teams?

    1. AJob API
    2. BConfigMap API
    3. CGateway API
    4. DCronJob API only
    Show answer and explanation
    Correct answer: C

    The Gateway API separates gateways managed by infrastructure teams from routes managed by application teams. Job, CronJob and ConfigMap are not gateway APIs.

  5. Question 5

    A Service with type LoadBalancer is created on a cluster without a cloud controller or load balancer implementation. What is the most likely result?

    1. AThe external IP stays pending because no load balancer controller provisions one
    2. BThe Service type is silently converted to ClusterIP by the API server during reconciliation
    3. CThe Service is removed entirely by the scheduler when pods are absent
    4. DThe external IP is set to the node name of one of the cluster's worker nodes
    Show answer and explanation
    Correct answer: A

    Without a load balancer implementation, the external address remains pending. The Service type does not change automatically, the scheduler does not delete Services, and node names are not external IPs.

  6. Question 6

    A Service's traffic must always reach pods on the same node that received the request, to preserve client source IPs. Which setting helps?

    1. AsessionAffinity: ClientIP only
    2. BclusterIP: None
    3. Ctype: ExternalName
    4. DexternalTrafficPolicy: Local
    Show answer and explanation
    Correct answer: D

    externalTrafficPolicy Local keeps traffic on the receiving node and preserves the client source IP. Session affinity controls stickiness, headless services remove virtual IPs, and ExternalName is a DNS alias.

  7. Question 7

    An endpoint slice for a Service is empty. The pods appear running. What is the most likely cause?

    1. AThe CoreDNS deployment is offline in kube-system, so Service DNS lookups are failing
    2. BThe pod names exceed the maximum length allowed by the endpoint slice controller
    3. CThe Service selector does not match the pod labels, or the pods are not Ready
    4. DThe cluster has too many worker nodes registered with the control plane scheduler in one zone
    Show answer and explanation
    Correct answer: C

    Endpoints come from Ready pods that match the selector, so a mismatch or unready pods leave the slice empty. Node counts, DNS and name length do not empty endpoint slices.

  8. Question 8

    A Service port must map external port 80 to container port 8080. Which fields express this?

    1. AexternalName: 8080, protocol: TCP
    2. Bport: 80 and targetPort: 8080
    3. CnodePort: 80 with type: NodePort
    4. DclusterIP: 8080, type: ClusterIP
    Show answer and explanation
    Correct answer: B

    port is the Service port and targetPort is the container port that traffic is forwarded to. The other fields do not express the mapping.

Kubernetes Networking Fundamentals (8 questions)

  1. Question 9

    Kubernetes requires that every pod receives its own IP address and can reach other pods without NAT. Which component implements this requirement?

    1. Aetcd cluster store
    2. BCoreDNS name server
    3. Ckube-scheduler pods
    4. DA CNI network plugin
    Show answer and explanation
    Correct answer: D

    The CNI plugin assigns pod IPs and sets up the routing that gives the flat pod network model. The scheduler places pods, etcd stores state, and CoreDNS resolves names.

  2. Question 10

    Two containers in the same pod need to communicate with each other. Which address do they use?

    1. AThe node's public IP, reached through an external NAT
    2. Blocalhost, because they share the pod's network namespace
    3. CA ClusterIP Service that forwards to the pod IP
    4. DA NodePort exposed on the pod's high host port
    Show answer and explanation
    Correct answer: B

    Containers in one pod share a network namespace, so they communicate over localhost. Node IPs, Services and NodePorts are not needed for in-pod communication.

  3. Question 11

    A Service of type ClusterIP is created. Which network does its virtual IP belong to?

    1. AThe cluster service IP range configured for the control plane
    2. BThe node's physical subnet, assigned by the host network configuration
    3. CThe public internet range, globally routable from external client networks
    4. DThe pod's container network interface, created for each pod by CNI
    Show answer and explanation
    Correct answer: A

    ClusterIP addresses come from the configured service CIDR and are virtual. They are not public addresses, not node subnets, and not pod interfaces.

  4. Question 12

    A NodePort Service is accessed on a node's IP address and a port in the high range. What forwards that traffic to the pods?

    1. AThe Ingress controller that proxies NodePort traffic to pod IPs directly
    2. BA VPN client on the node tunneling NodePort traffic to remote pods over WireGuard on each hop
    3. CThe kubelet on the node sending each packet to the pod manually over a VXLAN tunnel per pod
    4. Dkube-proxy programming rules on each node that route to the Service endpoints
    Show answer and explanation
    Correct answer: D

    kube-proxy programs node rules that forward NodePort and ClusterIP traffic to ready endpoints. The kubelet does not route traffic, and an Ingress controller is not required for NodePorts.

  5. Question 13

    Which kube-proxy mode uses kernel IPVS for load balancing across Service endpoints?

    1. Aiptables-only mode with no rules
    2. BDNS mode
    3. CIPVS mode
    4. DUserspace mode with a single thread
    Show answer and explanation
    Correct answer: C

    IPVS mode uses the Linux IP Virtual Server for efficient load balancing. The other descriptions do not match the kube-proxy modes.

  6. Question 14

    A pod needs a dedicated address that is reachable from outside the cluster without a Service. Which feature is most appropriate?

    1. AA permanent public IP for every pod by default, assigned by the cloud provider at scheduling time and kept across restarts
    2. BUsing the pod name as a stable address that the scheduler maps to the pod across moves
    3. CStoring the pod's IP in a ConfigMap that the kubelet refreshes on every restart to route traffic
    4. DHostnetwork or a dedicated routing design, with awareness that pod IPs are not stable across restarts
    Show answer and explanation
    Correct answer: D

    Pod IPs change when pods are recreated, and hostNetwork or specialized routing is used when a fixed address is needed. Default public IPs do not exist, ConfigMaps do not provide addressing, and pod names do not route traffic.

  7. Question 15

    Which DNS record format does a ClusterIP Service receive inside the cluster?

    1. Aservice.namespace.cluster.net
    2. Bservice.namespace.svc.cluster.local
    3. Cnamespace-service.dns.public.net
    4. Dpod-ip.service.k8s.local.net
    Show answer and explanation
    Correct answer: B

    Cluster DNS resolves services as service.namespace.svc.cluster.local by default. The other formats do not follow Kubernetes conventions.

  8. Question 16

    Pods in a namespace cannot resolve a Service in their own namespace by short name. Which component should be checked first?

    1. AThe Helm chart version used to install the application and its release values
    2. BThe pod's CPU limit and memory request set in the container resource spec
    3. CThe kube-scheduler logs and its pod binding decisions written to disk on the node
    4. DThe DNS configuration in the pod's resolv.conf and the CoreDNS service
    Show answer and explanation
    Correct answer: D

    Short-name resolution depends on the pod's search domains and CoreDNS. Scheduler logs, Helm versions and CPU limits do not affect name resolution.

Troubleshooting Network Connectivity (7 questions)

  1. Question 17

    A packet capture is needed to see whether traffic reaches a pod's interface. Which approach is most practical in a cluster?

    1. ATaking a screenshot of the dashboard and sharing it with the team to decide if traffic reaches the pod
    2. BReading the pod's labels and comparing them against the Service selector to see which pods match
    3. CRunning a debug container in the pod's network namespace or on the node and capturing on the relevant interface
    4. DPrinting the Service manifest and the Endpoints object to a file, then reviewing the YAML for port numbers and selectors and labels
    Show answer and explanation
    Correct answer: C

    Capturing in the pod's network namespace or on the node interface shows real packets. Screenshots, labels and manifests do not show traffic.

  2. Question 18

    Connections to a Service fail only from one node. Which check is most useful?

    1. AChanging the Service's selector to match every pod in the cluster and tuning readiness probes
    2. BDeleting that node from the cluster immediately without draining its workloads or reviewing logs
    3. CVerifying kube-proxy and the CNI state on that node compared with healthy nodes
    4. DChanging the container image of every pod in the namespace to a newer tag
    Show answer and explanation
    Correct answer: C

    Comparing the failing node's kube-proxy and CNI state with healthy nodes isolates the fault. Changing selectors, deleting the node immediately and changing images do not diagnose the node-specific failure.

  3. Question 19

    A team suspects that CoreDNS is returning stale records. Which check helps most?

    1. AComparing the record returned from inside a pod with the Service's current endpoints and checking the cache settings
    2. BIncreasing the number of replicas of the application without checking DNS and raising the HPA maximum for the frontend deployment
    3. CRestarting the Dashboard pod and clearing the browser cache on the operator's laptop over the weekend
    4. DChanging the node names in the kubeconfig and the cluster's inventory file, then re-running the join command on each worker
    Show answer and explanation
    Correct answer: A

    Comparing returned records with current endpoints and checking cache configuration identifies staleness. The other actions do not address DNS data.

  4. Question 20

    Which tool helps observe network flows between pods and identify dropped traffic by policy?

    1. AA calendar app that syncs team events and meeting reminders
    2. BA flow observability tool integrated with the CNI, such as Hubble for Cilium
    3. CA word processor with track changes and shared document review history
    4. DA printer driver utility that manages queue settings and paper trays
    Show answer and explanation
    Correct answer: B

    Flow observability tools show allowed and dropped flows with policy context. Word processors, printer utilities and calendars do not observe network traffic.

  5. Question 21

    Which two checks help diagnose a pod that cannot connect to an external API? (Choose two.)

    1. AChanging the pod's name to see if the connection changes
    2. BRestarting the cluster's Dashboard
    3. CIncreasing the Service's port number
    4. DTesting DNS resolution of the external host from the pod
    5. EVerifying egress rules and any NetworkPolicy applied to the pod
    Show answer and explanation
    Correct answer: D, E

    DNS resolution and egress policy checks identify the most common external connectivity failures. Renaming pods, restarting the Dashboard and changing unrelated ports do not address the cause.

  6. Question 22

    A pod in one namespace cannot reach a Service in another namespace by name, but it reaches the Service by IP. Which name format should be used?

    1. Apod IP address in the 10.244.0.0/16 range
    2. Bservice.namespace.svc.cluster.local
    3. Cnode name of the worker host
    4. Dservice name only, without the namespace
    Show answer and explanation
    Correct answer: B

    Cross-namespace names use the service and namespace with the cluster suffix. A short name only resolves in the same namespace, and pod IPs and node names are not Service DNS names.

  7. Question 23

    A pod can reach the internet by IP address but cannot resolve external names. Which component should be checked first?

    1. AThe pod's memory limit and CPU request in the workload's resource section
    2. BCoreDNS forwarding configuration and upstream DNS reachability
    3. CThe Service's type and its selector labels matching the backend pods
    4. DThe node's kernel version and the eBPF features compiled into the kernel
    Show answer and explanation
    Correct answer: B

    CoreDNS forwarders and upstream reachability explain external name failures when IPs work. Memory limits, Service types and kernel versions are not the first check.

Network Policies (7 questions)

  1. Question 24

    A namespace must deny all inbound traffic to its pods by default. Which NetworkPolicy achieves this?

    1. AAn ingress rule with no from selector admitting every source
    2. BAn egress-only policy with no ingress types in the namespace
    3. CAn empty podSelector with policyTypes Ingress and no ingress rules
    4. DA policy that selects no namespaces but permits every pod
    Show answer and explanation
    Correct answer: C

    An empty pod selector applies to all pods, and listing Ingress with no rules denies inbound traffic. Allow-all rules, egress-only policies and namespace-free selections do not implement default deny for ingress.

  2. Question 25

    A NetworkPolicy must allow pods labeled app=web to reach pods labeled app=db on TCP port 5432 only. Which part expresses the source?

    1. AA policy that sets hostNetwork true for web pods
    2. BThe ingress rule's from.podSelector matching app=web
    3. CThe egress rule's to.nodeSelector matching the web nodes
    4. DA ConfigMap listing the web pods
    Show answer and explanation
    Correct answer: B

    The ingress rule on the database pods names the source with from.podSelector. Node selectors, host networking and ConfigMaps do not express the source pod relationship.

  3. Question 26

    After applying a default-deny egress policy, pods cannot resolve names. Which rule restores DNS resolution without opening all egress?

    1. AAn egress rule allowing UDP and TCP port 53 to the CoreDNS pods in kube-system
    2. BAllowing ingress traffic from the kube-scheduler pods on port 10259
    3. CAn egress rule allowing traffic on every port to the public internet CIDR 0.0.0.0/0, unrestricted
    4. DRemoving the default-deny policy entirely and recreating it in the kube-system namespace
    Show answer and explanation
    Correct answer: A

    Allowing port 53 to CoreDNS restores name resolution while keeping other egress blocked. Opening all egress and removing the policy broaden access, and scheduler traffic is unrelated to DNS.

  4. Question 27

    Which two steps help validate that a NetworkPolicy works as intended? (Choose two.)

    1. ATesting allowed and denied connections from representative pods
    2. BConfirming the CNI plugin supports and enforces NetworkPolicy
    3. CAssuming the policy works because it was applied
    4. DChecking only the policy's name
    5. EDeleting the policy to see whether traffic changes
    Show answer and explanation
    Correct answer: A, B

    Testing both allowed and denied flows and confirming CNI enforcement validate the policy. Assumptions, name checks and deleting the policy to observe are not reliable validation methods.

  5. Question 28

    A policy must allow egress from a namespace only to a specific external CIDR on TCP port 443. Which NetworkPolicy elements express this?

    1. Aingress rule with from.namespaceSelector and podSelector
    2. Begress rule with to.ipBlock for the CIDR and ports for 443 over TCP
    3. CpolicyTypes set to Ingress alone, leaving egress unrestricted
    4. DnodeName selector for the CIDR range, matched against the target node's IP
    Show answer and explanation
    Correct answer: B

    An egress rule with ipBlock and a port of 443 over TCP restricts outbound traffic to that destination. Ingress rules, policy types alone and node name selectors do not express it.

  6. Question 29

    Multiple NetworkPolicies select the same pod. How are they combined?

    1. AThe last policy alphabetically overrides the others by name in the namespace's sorted list
    2. BPolicies cancel each other out when their allow rules overlap, so the pod is isolated from traffic
    3. CTheir allow rules are additive, so traffic is permitted if any policy allows it
    4. DJust the first policy applies and the rest are ignored, as the order of creation sets precedence
    Show answer and explanation
    Correct answer: C

    NetworkPolicies are additive, and a connection is allowed if any applied policy allows it. The other behaviors do not match the model.

  7. Question 30

    A default-deny policy is applied to a namespace, and monitoring tools in another namespace must scrape pods. Which rule allows this?

    1. ADisabling the default-deny policy permanently across the namespace after the monitoring rollout
    2. BA rule that allows every namespace with no ports, so traffic from the cluster reaches the pod
    3. CAn egress rule for the monitoring pods to the internet on TCP 443 and UDP 53, with the destination CIDR left open
    4. DAn ingress rule with a namespaceSelector for the monitoring namespace and the scrape port
    Show answer and explanation
    Correct answer: D

    An ingress rule that matches the monitoring namespace and scrape port allows only what is needed. Egress from monitoring pods, disabling default deny and allow-all rules broaden access too much.