Build fluency in the vocabulary of restricting which pods are allowed to talk to which other pods.
0 / 5 completed
1 / 5
At standup, a dev mentions restricting which pods are allowed to send traffic to which other pods, since Kubernetes allows any pod to reach any other pod by default with no such restriction in place. What Kubernetes object provides this?
A NetworkPolicy restricts which pods are allowed to send traffic to which other pods, since Kubernetes otherwise allows any pod to reach any other pod by default with no such restriction. A ResourceQuota constrains CPU and memory consumption within a namespace, which is an entirely separate concern from pod-to-pod connectivity. This restriction is what lets a cluster enforce least-privilege network access between its workloads.
2 / 5
During a design review, the team wants a pod to be blocked from making any outbound connection at all unless an explicit rule allows it, rather than allowing every outbound connection by default. Which capability supports this?
A default-deny egress NetworkPolicy blocks a pod from making any outbound connection at all unless an explicit rule permits it, flipping the cluster's default-allow posture into a least-privilege one. Allowing every outbound connection by default leaves a compromised pod free to reach any destination it wants. This default-deny approach is a foundational building block of a zero-trust network posture inside a cluster.
3 / 5
In a code review, a dev notices a NetworkPolicy's rule combines a podSelector with a namespaceSelector, so it only allows traffic from pods carrying a specific label within a specific namespace. What does this represent?
Scoped ingress matching that combines a podSelector with a namespaceSelector allows traffic only from pods carrying a specific label within a specific namespace, rather than trusting any pod anywhere in the cluster. Allowing traffic from any pod in any namespace, with no such scoping, undermines the precision a NetworkPolicy is meant to provide. This combined selector matching is what lets a policy express a genuinely narrow, intentional trust relationship between workloads.
4 / 5
An incident report shows a compromised pod was able to exfiltrate data to an external destination because the cluster had no NetworkPolicy at all, so every pod's outbound traffic was allowed by the platform's default. What practice would prevent this?
Applying a default-deny NetworkPolicy and only explicitly allowing the specific traffic a workload genuinely needs limits the blast radius of a compromised pod, since it can no longer reach an arbitrary external destination. Leaving every namespace with no policy applied is exactly what allowed the data exfiltration this incident describes. This default-deny-plus-explicit-allow pattern is a standard defense-in-depth practice for any cluster handling sensitive data.
5 / 5
During a PR review, a teammate asks why the team enforces a NetworkPolicy in addition to already running mutual TLS between services in a service mesh. What is the reasoning?
Mutual TLS authenticates and encrypts traffic between services but doesn't stop an unauthorized connection from being attempted at the network layer in the first place, since it operates above the raw connectivity layer. A NetworkPolicy blocks that connectivity outright at the CNI level, providing a layer of defense that doesn't depend on every workload correctly participating in the mesh. The tradeoff is the added complexity of maintaining two overlapping but distinct security mechanisms across the cluster.
What does the "Kubernetes NetworkPolicy Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to kubernetes networkpolicy vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 14 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.