CKAD Services and Networking Practice Question
An admin wants to expose a Service only for internal cluster communication, without external access. Which Service type should they use?
⚠ Common exam trap
The CKAD exam often tests the misconception that ClusterIP is only for default or unspecified use, leading candidates to choose NodePort or LoadBalancer for 'internal' scenarios, but the trap here is that ClusterIP is explicitly designed for internal-only access and is the only type that does not expose the Service externally by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ClusterIP
ClusterIP is the default Kubernetes Service type and exposes the Service on a cluster-internal IP address, making it reachable only from within the cluster. This is the correct choice for internal cluster communication because no external endpoints are created, and traffic is routed via kube-proxy using iptables or IPVS rules.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ExternalName
Why it's wrong here
This type maps the Service to an external DNS name using a CNAME record. Traffic is redirected to a domain outside the cluster, such as a legacy system or a third-party API, rather than to any cluster pods. Since it intentionally points outward to an external DNS target, it cannot serve as an internal-only cluster endpoint.
- ✗
NodePort
Why it's wrong here
A NodePort Service exposes the same port on every node's IP address, making the Service reachable from outside the cluster via any node's IP and the assigned static port. Although it also gets a ClusterIP internally, the node-level binding and direct access path from external networks violate the requirement to keep the Service internal only.
- ✗
LoadBalancer
Why it's wrong here
This type provisions a dedicated load balancer from the cloud provider (or a controller like MetalLB), which assigns an external IP address that routes traffic directly into the cluster. It typically builds on NodePort and is explicitly designed for public-facing traffic, so it exposes the Service to the internet or external networks rather than keeping it cluster-internal.
- ✓
ClusterIP
Why this is correct
The ClusterIP type assigns a stable virtual IP from the Service CIDR that is reachable only from within the cluster. kube-proxy programs iptables or IPVS rules on every node to load-balance traffic to the backing pods, and the Service DNS name resolves to this internal IP. Since no host network path or external load balancer is involved, it remains isolated from traffic outside the cluster and is the default choice for internal-only services.
Go deeper
Related to this question
About these practice questions
One of 826 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.