CKAD Services and Networking Practice Question
When using 'kubectl expose', which flag creates a NodePort service?
⚠ Common exam trap
Watch out — candidates often confuse `--node-port` (which sets the specific port number) with the flag that actually creates the NodePort service type, or they assume `--port` alone changes the service type, when in fact `--type=NodePort` is required to override the default ClusterIP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
--type=NodePort
The `--type=NodePort` flag explicitly sets the service type to NodePort when using `kubectl expose`. This creates a service that exposes the application on a static port (30000-32767) on each cluster node, making it accessible externally via `<NodeIP>:<NodePort>`. Without this flag, the default service type is ClusterIP, which is only reachable within the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
--node-port
Why it's wrong here
The kubectl expose command does not have a --node-port flag. To set a specific node port on a NodePort service, you must edit the service manifest after creation or define the Service in a YAML file, because the nodePort field belongs to the service spec, not to the expose command's options. Without this, Kubernetes will allocate a random port in the 30000-32767 range.
- ✓
--type=NodePort
Why this is correct
Passing --type=NodePort to kubectl expose creates a Service of type NodePort, which opens a high-numbered port (default 30000-32767) on every node in the cluster and forwards traffic from that nodePort to the Service's clusterIP and then to the selected pods. This makes the workload reachable externally via any node's IP and that designated port, which is the only correct flag for the stated goal.
- ✗
--type=ClusterIP
Why it's wrong here
Setting --type=ClusterIP creates a Service with only a cluster-internal virtual IP, which is the default behavior when no --type is supplied. This does not produce a NodePort service, because ClusterIP is not externally reachable from outside the cluster; it only enables load-balanced access inside the cluster network. To get a node port, you must explicitly request the NodePort or LoadBalancer type.
- ✗
--port
Why it's wrong here
The --port flag designates the port on which the Service will listen, not the Service type. For example, --port=8080 tells the Service to accept traffic on TCP 8080, and it defaults to creating a ClusterIP Service unless --type is also specified. It never triggers the creation of a NodePort exposure by itself.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.