CKAD Services and Networking Practice Question
A ClusterIP service named 'db-service' in namespace 'data' is not reachable from a pod in the same namespace. The pod's /etc/resolv.conf shows 'search data.svc.cluster.local svc.cluster.local cluster.local'. Using the pod, which command tests DNS resolution for the service?
⚠ Common exam trap
It's easy for candidates to choose `ping` (option B) because they assume network connectivity testing is sufficient, but `ping` uses ICMP and does not test DNS resolution, which is the specific problem described in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nslookup db-service.data.svc.cluster.local
`nslookup` is a standard DNS lookup tool that queries the cluster's DNS server (CoreDNS/kube-dns) for the fully qualified domain name (FQDN) of the service. The FQDN `db-service.data.svc.cluster.local` matches the search domains in the pod's `/etc/resolv.conf`, so `nslookup` will resolve the service's ClusterIP, confirming DNS is working. This directly tests DNS resolution, which is the root cause when a service is unreachable by name.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
dig db-service.data.svc.cluster.local
Why it's wrong here
The 'dig' utility is a valid DNS lookup tool that can directly query Kubernetes DNS for the service's A record. However, most Kubernetes cluster images, especially minimal distros like Alpine or distroless, do not include dig by default. nslookup is much more commonly available in pods, making dig a possible but unreliable choice for in-pod DNS validation.
- ✗
ping db-service
Why it's wrong here
The ping command sends ICMP echo requests to an IP address and thus first resolves the hostname through the system's resolver, so a DNS misconfiguration can cause it to fail. But successful ping requires that the target host responds to ICMP, which Kubernetes services often don't (ClusterIP services only respond to TCP/UDP traffic, and ICMP may be blocked). Even if DNS works perfectly, ping to a ClusterIP will usually time out, so it can produce false negatives and is not a direct test of the DNS record itself.
- ✓
nslookup db-service.data.svc.cluster.local
Why this is correct
nslookup explicitly issues a DNS query to the cluster's configured resolvers (CoreDNS) and displays the returned IP address for the full service DNS name db-service.data.svc.cluster.local. It isolates the DNS lookup phase from any application-level connectivity, so a successful response confirms that the service's clusterIP is registered and resolvable. This is the most direct and broadly available diagnostic tool for checking DNS-based service discovery in Kubernetes.
- ✗
curl http://db-service:3306
Why it's wrong here
curl makes an HTTP request to a given host and port, meaning it first performs a DNS lookup but then expects an HTTP response. If DNS were fine but the service speaks the MySQL protocol (port 3306), curl would fail with a protocol error, while if DNS were broken it would fail with a resolution error—so it cannot distinguish between the two. It is only suitable for testing HTTP endpoints, and is not a targeted DNS verification tool for a database service.
Visual reference
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.