CKAD Services and Networking Practice Question
What is the correct command to forward a local port to a pod for debugging?
⚠ Common exam trap
A common mix-up: candidates confuse `kubectl port-forward` with `kubectl expose` or `kubectl proxy`, mistakenly thinking those commands also provide local port access, when in fact only `port-forward` creates a direct local-to-pod tunnel for debugging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kubectl port-forward pod/my-pod 8080:80
`kubectl port-forward` creates a tunnel from a local port (8080) to a target port (80) on a pod, enabling direct network access for debugging without exposing the pod externally. This command is specifically designed for forwarding traffic to pods, services, or deployments in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kubectl expose pod my-pod --port=8080
Why it's wrong here
kubectl expose pod my-pod --port=8080 creates a Service object that gives the pod a stable in-cluster IP and DNS name for other workloads to reach it. It does not open a tunnel from your local machine to the pod; the service is only reachable inside the cluster unless you also add a NodePort or LoadBalancer type. To access a specific pod's port from your local environment, you need `kubectl port-forward` or a service with an external-facing type, so this command is not the correct port-forwarding tool.
- ✗
kubectl attach pod/my-pod
Why it's wrong here
kubectl attach pod/my-pod connects your terminal to the standard input/output/error streams of a container running in the pod, much like `docker attach` for existing containers. It is designed for interactive debugging and logging, not for forwarding network traffic or exposing a pod's port to the host machine. Running this command does not create a local listening port, and it will not let you send arbitrary TCP requests to the pod's application port, so it cannot be used for port forwarding.
- ✓
kubectl port-forward pod/my-pod 8080:80
Why this is correct
kubectl port-forward pod/my-pod 8080:80 is the correct way to forward a local port to a pod. The syntax requires a resource type and name (`pod/my-pod`), followed by a pair of ports where the first is the local port (8080) and the second is the target port on the pod (80). The command establishes a bidirectional TCP tunnel between your local machine and the pod, allowing you to access services that are not exposed externally, such as a database or a debug endpoint, as if they were running locally.
- ✗
kubectl proxy pod/my-pod 8080:80
Why it's wrong here
kubectl proxy pod/my-pod 8080:80 is incorrect because `kubectl proxy` does not accept a pod name or port mapping; it starts an HTTP proxy server in front of the Kubernetes API server. The primary purpose of `kubectl proxy` is to allow local access to the API server's endpoints, typically using `kubectl proxy` alone (which listens on 127.0.0.1:8001). It does not connect to a pod's network namespace, so passing a pod argument and a port mapping like `8080:80` is not valid and would not forward traffic to the pod.
Go deeper
Related to this question
About these practice questions
One of 826 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.