CKA Services and Networking Practice Question
Which TWO of the following are valid ways to expose a Service externally? (Select TWO.)
⚠ Common exam trap
Candidates often confuse 'exposing externally' with any service type that has a DNS name or IP, but only NodePort and LoadBalancer provide direct external network access without additional components like Ingress or kubectl proxy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodePort
A NodePort service exposes the application on a static port (30000–32767) on every node's IP address, making it accessible externally via `<NodeIP>:<NodePort>`. A LoadBalancer service provisions an external load balancer (e.g., from a cloud provider) that routes traffic to the service, typically using a public IP. Both are explicitly designed for external access, unlike ClusterIP which is internal only.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NodePort
Why this is correct
NodePort exposes the Service on a static port allocated from the default range 30000-32767 on every node's IP. Clients outside the cluster can reach the Service by connecting to `<NodeIP>:<NodePort>` on any node, and kube-proxy forwards the traffic to the backing Pods. This gives external access without requiring a cloud provider, though the port must be unique across Services.
- ✗
Headless
Why it's wrong here
A Headless Service sets `clusterIP: None` so no stable virtual IP is created. Instead, the Service returns the IP addresses of individual endpoints directly through DNS, enabling pod-level discovery and stateful workloads. It does not expose the Service externally; it provides no NodePort or LoadBalancer, and has no single address for outside clients.
- ✓
LoadBalancer
Why this is correct
LoadBalancer extends NodePort by asking the cloud provider (such as AWS, GCP, or Azure) to provision an external load balancer with a public IP. Traffic arrives at the load balancer and is forwarded to the NodePort on each node, which then routes to the Service endpoints. This is the standard way to expose a Service to the internet with a stable public endpoint.
- ✗
ExternalName
Why it's wrong here
ExternalName maps the Service to a DNS name by returning a CNAME record, rather than routing traffic to Pods or exposing an internal port. It merely provides an in-cluster alias for an external service, such as `example.com` or a database running outside the cluster. It does not create any external exposure because no port, IP, or endpoint is added to the cluster.
- ✗
ClusterIP
Why it's wrong here
ClusterIP is the default Service type, creating a virtual IP address reachable only from within the cluster. The virtual IP is programmed into kube-proxy and cluster DNS, so Pods and nodes inside the network can access the Service, but clients outside the cluster cannot. It is useful for internal communication, not for exposing a Service externally.
Go deeper
Related to this question
About these practice questions
This CKA question is part of Courseiva's 302-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.