CKAD Services and Networking Practice Question
A developer deploys a set of Pods labeled app=frontend and wants to expose them internally within the cluster on a stable IP. Which resource should be used?
⚠ Common exam trap
A common mix-up: candidates confuse 'exposing internally' with 'exposing externally' and choose NodePort or LoadBalancer, forgetting that ClusterIP is the default and correct choice for internal-only stable IP access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service of type ClusterIP
A Service of type ClusterIP exposes the Pods on a stable internal IP address that is only reachable within the cluster. This is the default Service type and is ideal for internal communication between components, such as a frontend being accessed by a backend, without exposing the service outside the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service of type NodePort
Why it's wrong here
A NodePort Service exposes the Pods on a static port (30000–32767) on every node, making them reachable from outside the cluster via nodeIP:nodePort. For internal-only Pod-to-Pod communication, this is unnecessary and creates an external network exposure surface that increases security risk and consumes a node port that may conflict with other services. Since the frontend Pods only need to reach the backend inside the cluster, a ClusterIP Service provides the required stable internal IP without opening any external ingress path.
- ✗
Service of type LoadBalancer
Why it's wrong here
A LoadBalancer Service provisions a cloud provider load balancer (e.g., AWS ELB, GCP LB, Azure LB) and assigns a public IP address, providing external access to the Pods from the internet. This is completely overkill for internal access because the frontend Pods and backend Pods are already in the same cluster, and the load balancer introduces public exposure, additional cost, and cloud provider dependency. The correct internal solution is a ClusterIP Service, which is not exposed outside the cluster and is automatically discoverable by other Pods via DNS.
- ✓
Service of type ClusterIP
Why this is correct
A ClusterIP Service is the default and correct Service type for internal-only communication. It assigns a stable virtual IP from the cluster's service CIDR that is reachable only from inside the cluster, and it provides built-in load balancing across the backend Pods via iptables/IPVS rules managed by kube-proxy. The frontend Pods can reliably resolve the Service by DNS name and connect to it, without any external exposure, which exactly matches the requirement for a backend that should not be accessible from outside the cluster.
- ✗
Ingress resource
Why it's wrong here
An Ingress resource is not a Service type; it is a Kubernetes API object that manages external HTTP(S) traffic to Services, typically via an Ingress controller like NGINX or HAProxy. To route traffic, Ingress must point to a backend Service (often ClusterIP) that ultimately targets the Pods, so it does not itself provide a stable internal IP for frontend-to-backend communication. Adding an Ingress would introduce an unnecessary external routing layer and still require a Service, making it an incorrect and over-engineered choice for internal-only access.
Go deeper
Related to this question
About these practice questions
One of 826 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.