CKA Services and Networking Practice Question
You want to debug a Service that is not reachable. Which kubectl command can you use to forward a local port to a pod in the Service?
⚠ Common exam trap
Many candidates confuse `kubectl port-forward` with `kubectl expose` or `kubectl proxy`, thinking any command that 'exposes' or 'proxies' can forward a local port, but only `port-forward` directly creates a local-to-pod tunnel for debugging a specific Service endpoint.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl port-forward svc/my-service 8080:80
`kubectl port-forward svc/my-service 8080:80` creates a local TCP tunnel from port 8080 on your workstation to port 80 on a pod selected by the Service `my-service`. This allows you to reach the Service's backend pod directly without exposing it externally, which is a standard debugging technique for testing connectivity to a Service that appears unreachable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl expose deployment my-deployment --type=NodePort
Why it's wrong here
kubectl expose deployment my-deployment --type=NodePort creates a new Kubernetes Service resource of type NodePort, or modifies an existing one, to expose the specified deployment. This command is designed to make a workload accessible from outside the cluster via a port on each node, but it does not establish a local port forwarding tunnel to an *existing* service for debugging its reachability. It's about externalizing a deployment, not debugging an existing service's internal connectivity locally.
- ✓
kubectl port-forward svc/my-service 8080:80
Why this is correct
kubectl port-forward svc/my-service 8080:80 is the correct command because it establishes a secure, temporary tunnel from your local machine's port 8080 to port 80 on a pod backing the specified my-service. This allows you to directly access the service from your local machine, bypassing any external network configurations or ingress controllers. It's an ideal method for debugging an unreachable service by testing its internal functionality and connectivity directly.
- ✗
kubectl exec -it my-pod -- curl localhost:80
Why it's wrong here
kubectl exec -it my-pod -- curl localhost:80 executes the curl command *inside* the specified my-pod to test connectivity to localhost:80 from *within* that pod's network namespace. While useful for diagnosing issues from the pod's perspective, it does not create any network tunnel or port forwarding from your *local machine* to the service or pod. Therefore, it cannot be used to debug the service's reachability *from your local environment*.
- ✗
kubectl proxy
Why it's wrong here
kubectl proxy creates a local HTTP proxy server that allows direct access to the Kubernetes API server on your local machine, typically on port 8001. This is primarily used for interacting with the Kubernetes API programmatically or via a web browser, bypassing authentication for API requests. It does not establish a port forwarding tunnel to an application service or a specific pod for debugging application-level network reachability.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.