Services and Networking →mediumMultiple ChoiceObjective-mapped

CKA Services and Networking Practice Question

An administrator runs `kubectl port-forward service/my-svc 8080:80`. What does this command do?

⚠ Common exam trap

Many exam-takers confuse the direction of the port mapping: candidates often think the first port is the remote port and the second is the local port, but `kubectl port-forward` always uses the format `local_port:remote_port`.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Forwards local port 8080 to port 80 on the Service

`kubectl port-forward` creates a tunnel from a local port to a pod (or service) in the cluster. When targeting a Service, it selects one of the Service's endpoints (a pod) and forwards traffic from localhost:8080 to port 80 on that pod. This allows direct access to the Service without exposing it externally.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Creates a new Service with port mapping 8080:80
Why it's wrong here
kubectl port-forward does not create, modify, or configure any Kubernetes API objects — it is purely a client-side operation that establishes a tunnel between your local workstation and a specific pod, service, or deployment. The string '8080:80' is parsed as 'local-port:remote-port', not as a Service spec, so no Service with port 8080 targeting port 80 is ever created in the cluster. Running this command will not appear in `kubectl get services` and has no effect on cluster networking beyond the temporary tunnel itself.
✗
Forwards port 8080 from the Service to port 80 on the local machine
Why it's wrong here
This statement reverses both the value order and the direction of the tunnel. The syntax `kubectl port-forward <resource> <local>:<remote>` means the first number is the port on your local machine and the second is the port on the remote resource, so '8080:80' maps local port 8080 to the Service's port 80. The tunnel does not originate on the Service side; instead, your local client connects to the Kubernetes API server, which opens a connection to the Service's endpoint, so traffic always flows from your local machine into the cluster, never from the Service back to your local machine.
✗
Forwards port 80 from the local machine to port 8080 on the Service
Why it's wrong here
Here the two port numbers are simply inverted relative to the correct interpretation. The command '8080:80' tells kubectl to bind port 8080 on your local machine and connect it to port 80 on the Service; saying 'forwards port 80 from the local machine to port 8080 on the Service' incorrectly assumes the first value is remote and the second is local, which is not how the positional arguments work. Additionally, the direction is local-to-remote, not remote-to-local, so both the mapping and the direction are reversed compared to what the command actually does.
✓
Forwards local port 8080 to port 80 on the Service
Why this is correct
The command `kubectl port-forward service/<name> 8080:80` correctly creates a local listener on port 8080 and forwards traffic through the Kubernetes API server to a pod that backs the specified Service, reaching that pod on its port 80. The format is always <local>:<remote>, so the left side of the colon is the port that appears on your workstation (localhost:8080) and the right side is the intended destination port inside the cluster (the Service's port 80). This lets you reach a cluster-internal Service endpoint without exposing it publicly, which is useful for debugging, accessing a private web UI, or testing a preview of an application running inside the cluster.

Go deeper

CKA Services and Networking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question