CKAD Services and Networking Practice Question
A user creates a Deployment with 3 replicas and a Service of type ClusterIP. The Service selects pods with label 'app: web'. The user wants external clients to access the application via a stable IP address. Which additional resource is required?
⚠ Common exam trap
CNCF often tests the misconception that a ClusterIP Service alone can be accessed externally, or that a NodePort Service provides a stable IP, when in fact NodePort exposes on ephemeral node IPs and ports, while Ingress provides a stable external endpoint with path-based routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
An Ingress resource
A ClusterIP Service is only reachable within the cluster. To expose a Deployment to external clients via a stable IP, an Ingress resource is required because it provides HTTP/HTTPS routing from outside the cluster to the Service, typically using a load balancer or a reverse proxy like NGINX. Ingress also offers a stable external IP (or hostname) and can manage TLS termination, making it the correct choice for external access with a stable endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A second Service of type NodePort
Why it's wrong here
A second Service of type NodePort would expose the deployment on a high port on every node, but clients must reach it via a node IP, which is not stable and may change if nodes are replaced. It also only provides L4 load balancing, so it cannot route HTTP traffic by hostname or path, unlike an Ingress which offers L7 routing and a fixed external entry point.
- ✗
A NetworkPolicy
Why it's wrong here
A NetworkPolicy acts as a distributed firewall that controls east-west traffic between pods using label selectors and port rules, but it does not create any network endpoint or IP address for external access. It can only restrict what is already allowed; it cannot make a deployment reachable from outside the cluster, so it is irrelevant to the need for external exposure.
- ✓
An Ingress resource
Why this is correct
An Ingress resource is the correct approach because it manages external HTTP(S) access to services using hostnames and URL paths, and it is backed by an ingress controller that typically provisions a stable external IP or load balancer. This gives clients a single, predictable address to reach the deployment, while also supporting TLS termination and advanced routing rules without creating multiple NodePorts.
- ✗
A ConfigMap
Why it's wrong here
A ConfigMap is a Kubernetes object designed solely for storing non-confidential configuration data as key-value pairs, which can be injected into pods as environment variables or configuration files. It contains no networking constructs, cannot be attached to a port, and does not generate any IP address or routing rule, so it has zero impact on external service exposure.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.