☁️ Free practice test question from: KCNA (KCNA)

Ingress Policies are additive for allows: If multiple ingress policies apply to a pod and any of them allow traffic from a particular source, that traffic is allowed (unless explicitly denied by another policy). This means Policy-A and Policy-B will be OR-ed together for allow rules.

Deny policies override allow policies: If any ingress policy explicitly denies traffic from a particular source, that traffic is blocked, regardless of whether other policies would have allowed it. Policy-C is a deny policy.

A) Policy-C takes precedence and blocks all traffic from 10.0.0.0/16, regardless of other policies: While Policy-C will block traffic from the specified CIDR, it doesn't necessarily take absolute precedence over all other policies in every scenario. Allow policies from other sources would still be evaluated.

C) The last policy applied (Policy-C) overwrites previous policies: Network Policies are not evaluated based on the order they were applied. They are all evaluated together based on their selectors and rules.

D) All three policies operate independently, creating a logical OR - traffic is allowed if it matches ANY of the three policies: This is incorrect because Policy-C is a deny policy and will restrict traffic, not allow it.