CKA Troubleshooting Practice Question
You are trying to debug a network connectivity issue between two pods. Pod A can reach the internet but cannot reach Pod B's IP address. Which command should you use to test connectivity from within Pod A to Pod B's service?
⚠ Common exam trap
It's easy for candidates to confuse testing pod-to-service connectivity (which requires using the service DNS name from within the pod) with testing node-to-pod or DNS-only checks, leading them to pick options that bypass the pod's network namespace or only test DNS resolution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl exec pod-a -- curl http://service-b:80
It uses `kubectl exec` to run a command inside Pod A, then uses `curl` to reach Pod B's service by its DNS name (`service-b`) and port 80. This tests connectivity from Pod A's network namespace to the ClusterIP service, which is the correct way to verify pod-to-service communication within the cluster. Using the service name leverages Kubernetes internal DNS (CoreDNS) to resolve to the service's virtual IP, and `curl` sends an HTTP request to confirm reachability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl exec pod-a -- nslookup service-b
Why it's wrong here
This command only tests if Pod A can resolve the DNS name `service-b` to its corresponding ClusterIP address via CoreDNS. While successful DNS resolution is a prerequisite for network communication, it does not verify that a TCP connection can be established to the service's port 80, nor does it confirm that the application behind the service is actively listening and responding. A network policy, firewall rule, or an unresponsive application could still prevent actual HTTP connectivity even with correct DNS.
- ✗
curl http://<node-ip>:<nodeport>
Why it's wrong here
This command tests external connectivity to a service exposed via a NodePort, routing traffic from outside the Kubernetes cluster through a specific node's IP and port. It does not simulate the internal cluster network path from Pod A to Service B, which involves internal DNS resolution, ClusterIP routing, and kube-proxy's iptables/IPVS rules within the cluster's CNI network. Therefore, it fails to diagnose an issue specific to inter-pod communication within the cluster.
- ✗
ssh node-ip 'curl http://<pod-b-ip>:80'
Why it's wrong here
Executing `curl` directly on the node via SSH bypasses the network namespace and routing context of Pod A entirely. This test verifies connectivity from the node's perspective to Pod B's IP, which might differ significantly from Pod A's network path due to network policies, CNI plugin configurations, or specific routing rules applied within Pod A's isolated network environment. It does not accurately reflect the network conditions or potential issues experienced by Pod A.
- ✓
kubectl exec pod-a -- curl http://service-b:80
Why this is correct
This is the most effective command because `kubectl exec` runs `curl` directly within the network namespace of `pod-a`, simulating the exact origin of the communication. By targeting `http://service-b:80`, it simultaneously tests DNS resolution of the service name, the ability to establish a TCP connection to the service's ClusterIP on port 80, and the application's responsiveness. This provides a comprehensive end-to-end test from the perspective of the source pod.
Visual reference
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
kubectl Command Reference
kubectl is the command-line tool used to interact with and manage Kubernetes clusters by sending commands to the Kubernetes API.
Key term
ClusterIP NodePort LoadBalancer
ClusterIP, NodePort, and LoadBalancer are three types of Kubernetes Services that control how traffic reaches your application pods inside the cluster or from outside.
About these practice questions
One of 302 original CKA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.