Featured resource
2025 Tech Upskilling Playbook
Tech Upskilling Playbook

Build future-ready tech teams and hit key business milestones with seven proven plays from industry leaders.

Check it out
  • Lab
    • Libraries: If you want this lab, consider one of these libraries.
    • Cloud
Google Cloud Platform icon
Labs

CKA Practice Exam: Part 3

Network policies are important for specifying which pods can talk to which. You can apply network policies to certain pods using their label selectors. In this part of the practice exam, you will be responsible for creating a `default-deny` policy, as well as explicitly stating communication over a certain port. This will simulate a possible exam question and have you show your expertise with pod communication and security.

Google Cloud Platform icon
Lab platform
Lab Info
Level
Intermediate
Last updated
Sep 23, 2025
Duration
1h 30m

Contact sales

By filling out this form and clicking submit, you acknowledge our privacy policy.
Table of Contents
  1. Challenge

    Create a deployment and a service to expose your web front end.
    1. Use the following command to create the YAML for your deployment:

      kubectl create deployment webfront-deploy  --image=nginx:1.7.8  --dry-run -o yaml > webfront-deploy.yaml
      
    2. Add container port 80, to have your final YAML look like this:

      apiVersion: apps/v1
      kind: Deployment
      metadata:
        creationTimestamp: null
        labels:
          app: webfront-deploy
        name: webfront-deploy
      spec:
        replicas: 1
        selector:
          matchLabels:
            app: webfront-deploy
        strategy: {}
        template:
          metadata:
            creationTimestamp: null
            labels:
              app: webfront-deploy
          spec:
            containers:
            - image: nginx:1.7.8
              name: nginx
              resources: {}
              ports:
              - containerPort: 80
      status: {}
      
    3. Use the following command to create your deployment:

      kubectl apply -f webfront-deploy.yaml
      
    4. Use the following command to scale up your deployment:

      kubectl scale deployment/webfront-deploy --replicas=2
      
    5. Use the following command to create the YAML for a service:

      kubectl expose deployment/webfront-deploy --port=80 --target-port=80 --type=NodePort --dry-run -o yaml > webfront-service.yaml
      
    6. Add the name and the nodePort, the complete YAML will look like this:

      apiVersion: v1
      kind: Service
      metadata:
        creationTimestamp: null
        labels:
          app: webfront-deploy
        name: webfront-service
      spec:
        ports:
        - port: 80
          protocol: TCP
          targetPort: 80
          nodePort: 30080
        selector:
          app: webfront-deploy
        type: NodePort
      status:
        loadBalancer: {}
      
    7. Use the following command to create the service:

      kubectl apply -f webfront-service.yaml
      
    8. Verify that you can communicate with your pod directly:

      kubectl run busybox --rm -it --image=busybox /bin/sh
      
      # wget -O- <pod_ip_address>:80
      # wget --spider --timeout=1 webfront-service
      
  2. Challenge

    Create a database server to serve as the backend database.

    Use the following command to create a Redis pod:

    kubectl run db-redis --image=redis --restart=Never
    
  3. Challenge

    Create a network policy that will deny communication by default.
    1. Use the following YAML (this is where you can use kubernetes.io and search "network policies" and then search for the text "default"):

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: default-deny
      spec:
        podSelector: {}
        policyTypes:
        - Ingress
      
    2. Use the following command to apply the network policy:

      kubectl apply -f default-deny.yaml
      
    3. Verify that communication has been disabled by default:

      kubectl run busybox --rm -it --image=busybox /bin/sh
      # wget -O- ≤pod_ip_address>:80
      
  4. Challenge

    Apply the labels and create a communication over port 6379 to the database server.
    1. Use the following commands to apply the labels:

      kubectl get po
      kubectl label po <pod_name> role=frontend
      kubectl label po db-redis role=db
      kubectl get po --show-labels
      
    2. Use the following YAML to create a network policy for the communication between the two labeled pods (copy from kubernetes.io website):

      apiVersion: networking.k8s.io/v1
      kind: NetworkPolicy
      metadata:
        name: redis-netpolicy
      spec:
        podSelector:
          matchLabels:
            role: db
        ingress:
        - from:
          - podSelector:
              matchLabels:
                role: frontend
          ports:
          - port: 6379
      
    3. Use the following command to create the network policy:

      kubectl apply -f redis-netpolicy.yaml
      
    4. Use the following command to view the network policies:

      kubectl get netpol
      
    5. Use the following command to describe the custom network policy:

      kubectl describe netpol redis-netpolicy
      
    6. Use the following command to show the labels on the pods:

      kubectl get po --show-labels
      
About the author

Pluralsight Skills gives leaders confidence they have the skills needed to execute technology strategy. Technology teams can benchmark expertise across roles, speed up release cycles and build reliable, secure products. By leveraging our expert content, skill assessments and one-of-a-kind analytics, keep up with the pace of change, put the right people on the right projects and boost productivity. It's the most effective path to developing tech skills at scale.

Real skill practice before real-world application

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Learn by doing

Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.

Follow your guide

All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.

Turn time into mastery

On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.

Get started with Pluralsight