200-901 Application Deployment and Security Practice Question
In a Kubernetes deployment, a developer needs to expose a set of pods internally within the cluster on a stable IP address. The pods are stateless and serve HTTP traffic. Which Service type should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ClusterIP
ClusterIP exposes the service on a cluster-internal IP, making it reachable only within the cluster. NodePort and LoadBalancer expose externally. ExternalName maps to an external DNS name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
LoadBalancer
Why it's wrong here
LoadBalancer provisions an external cloud load balancer with a public address, exposing the service outside the cluster. The requirement is internal-only access on a stable IP. ClusterIP is the correct type for reaching stateless HTTP pods from within the cluster.
- ✗
ExternalName
Why it's wrong here
ExternalName maps a Service to an external DNS name via CNAME and creates no cluster IP or proxy, so it cannot provide a stable internal address for pods. It is correct when redirecting in-cluster clients to an external host such as a managed database.
- ✗
NodePort
Why it's wrong here
NodePort exposes the service on a static port on every cluster node’s IP, making it reachable from outside the cluster, which violates the requirement for internal-only access. It is tempting because it provides a stable IP (the node’s IP) and a fixed port, and would be correct when external clients need to access the pods directly without a load balancer.
- ✓
ClusterIP
Why this is correct
ClusterIP assigns a stable virtual IP reachable only from inside the cluster, exactly matching the internal exposure requirement. It load-balances HTTP traffic across the stateless pods via kube-proxy rules, without provisioning external load balancers or node ports. NodePort and LoadBalancer would expose the service externally, which the scenario does not request.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.