# Which field in a CiliumNetworkPolicy egress rule allows traffic to the IPs behind a domain name?

Cilium, Easy (Beginner), Policies. https://k8wiz.com/uquiz/which-field-in-a-ciliumnetworkpolicy-egress-rule-allows-traffic-to-the-ips-behind-a-domain-name

- A. toServices
- B. toCIDRSet
- C. toFQDNs
- D. toEntities

**Answer:** toFQDNs

**Explanation:** toFQDNs takes matchName or matchPattern entries, and Cilium fills in the matching IPs from the DNS answers its proxy sees. That keeps the policy correct when a provider's IPs change. toCIDRSet needs the IP ranges written out, and toEntities selects groups such as world or cluster.