MENU
Context
A default-deny NetworkPolicy avoids to accidentally expose a Pod in a namespace that doesn't have any other NetworkPolicy defined.
Task
Create a new default-deny NetworkPolicy named defaultdeny in the namespace testing for all traffic of type Egress.
The new NetworkPolicy must deny all Egress traffic in the namespace testing.
Apply the newly created default-deny NetworkPolicy to all Pods running in namespace testing.
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
41 comments · newest first
MI
Mira
11 months ago
I’m not sure, can’t some services still need Egress?
AM
Amie
11 months ago
This is a must for any production environment!
ST
Stephaine
12 months ago
Wait, does this mean all outgoing traffic is blocked?
MA
Mariann
12 months ago
Totally agree, better safe than sorry.
QU
Queen
1 year ago
Default-deny is a solid security practice!
ST
Stephaine
1 year ago
I recall that we had a similar question where we had to allow specific traffic. This time it feels like the opposite, so I hope I remember the deny rules correctly.
BE
Benedict
1 year ago
I’m a bit confused about the namespace part. Do I need to specify the namespace in the YAML file or just apply it in the right context?
RO
Rosita
1 year ago
I think the default-deny policy should just have an empty `ingress` and `egress` section, right? That’s how we did it in the practice questions.
WA
Wava
1 year ago
I remember we practiced creating NetworkPolicies, but I’m not entirely sure about the exact syntax for the default-deny policy.
UL
Ulysses
1 year ago
Whoa, this is a tricky one. I need to be really careful to get all the details right, or I could end up locking myself out of the namespace. Let me think this through step-by-step.
JO
Jolanda
1 year ago
Okay, I think I've got a good handle on this. I'll create the NetworkPolicy, make sure it's denying all Egress traffic, and then apply it to the namespace.
MA
Maile
1 year ago
Hmm, I'm a bit unsure about the specifics of how to apply the NetworkPolicy to all Pods in the namespace. I'll need to review the documentation on that.
BU
Bulah
1 year ago
This looks straightforward enough. I'll start by creating the new NetworkPolicy with the required settings.
BR
Broderick
1 year ago
Hmm, I'm a bit confused on how to approach this. The front-end load is throwing me off. I'll need to review the formula for this.
MA
Maybelle
1 year ago
I feel like detection mode plays a role in how the IPS responds to threats, but I'm unsure if that would explain the connection dropping.
WI
Winfred
1 year ago
Option D looks promising - the compute.networkViewer role plus the compute.networks.use permission. That should give the networking team the read-only access they need.
PE
Percy
2 years ago
Well, well, well, looks like we've got a sneaky little network policy question here. But I'm not falling for it - C is the way to go, folks!
LA
Lashaunda
2 years ago
Great, C it is for the default-deny NetworkPolicy in the testing namespace.
KE
Kenneth
2 years ago
Let's go with C then, it seems like the safest choice for this scenario.
LO
Louann
2 years ago
I agree, C seems like the best option to deny all Egress traffic.
VE
Veronica
2 years ago
I think C is the correct choice for this network policy.
MA
Magnolia
2 years ago
Haha, I love how they're trying to trick us with the 'default-allow' option. Nice try, but I'm too smart for that. C all the way!
JU
Jules
2 years ago
We're too smart for their tricks.
RI
Ria
2 years ago
Definitely, option C is the way to go.
VE
Veronika
2 years ago
I agree, they can't fool us with that 'default-allow' option.
RE
Reita
2 years ago
Sanjuana: Agreed, C all the way!
SA
Sanjuana
2 years ago
Definitely, option C is the way to go.
DU
Dudley
2 years ago
I know right, they can't fool us with that 'default-allow' option.
GI
Gilberto
2 years ago
Oh boy, this one's a toughie. But I'll trust my gut and go with C. Gotta keep those Pods locked down, you know?
GL
Glenn
2 years ago
Hmm, I'm not sure. The question mentions a 'default-deny NetworkPolicy', but option A shows a 'default-allow' policy. I think I'll go with C just to be safe.
DE
Detra
2 years ago
I agree, let's go with C.
TH
Therese
2 years ago
I think C is the safest option.
EL
Elly
2 years ago
I think the correct answer is C. The question clearly states that the new NetworkPolicy must deny all Egress traffic in the namespace testing, and the image for option C shows the correct configuration for that.
MA
Ma
2 years ago
Let's go with option C then. It aligns with the task of denying all Egress traffic in the namespace testing.
LO
Loise
2 years ago
The image for option C matches the requirements specified in the question for denying all Egress traffic.
JU
Justine
2 years ago
Yes, option C is the best choice for creating a default-deny NetworkPolicy in this scenario.
CA
Cammy
2 years ago
I agree, option C is the correct answer. It denies all Egress traffic in the namespace testing.
CR
Crista
2 years ago
That makes sense. It's important to have strict controls in place for Egress traffic.
MA
Marjory
2 years ago
I believe the purpose is to avoid accidentally exposing a Pod in a namespace without any other NetworkPolicy.
CR
Crista
2 years ago
Yes, we need to create a new default-deny NetworkPolicy named defaultdeny in the namespace testing.
MA
Marjory
2 years ago
I think the question is about creating a default-deny NetworkPolicy.