CKAD Services and Networking Practice Question
Which Service type is used to expose a service externally on a static port on each worker node?
⚠ Common exam trap
A common mistake is confusing NodePort with LoadBalancer. LoadBalancer does not expose a static port on every node; it provisions an external load balancer with a single IP. NodePort is the correct type for a static port on every worker node.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodePort
A NodePort service exposes the application on a static port (in the range 30000-32767) on every worker node's IP address. This allows external traffic to reach the service by targeting any node's IP and the assigned NodePort, making it the correct choice for exposing a service externally on a static port per node.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
NodePort
Why this is correct
NodePort is correct because it directly answers the question: it opens a static port (typically in the 30000–32767 range) on every node's IP address, and kube-proxy routes traffic from that nodePort to the backing pods via the service's ClusterIP. Because the port is opened on each node, any client that can reach a node's IP can access the service at that nodeIP:nodePort. It is the only service type whose defining behavior is exactly this node-level static port exposure.
- ✗
ExternalName
Why it's wrong here
ExternalName is wrong because it never binds to a node port or provides a pod selector; instead it maps a service name to an external CNAME, such as a database host outside the cluster. When a pod resolves the service DNS, it gets the external DNS name's address rather than a cluster-internal virtual IP, so there is no port forwarding or node-level exposure at all. The question specifically asks for exposing on a static node port, which ExternalName cannot do by design.
- ✗
ClusterIP
Why it's wrong here
ClusterIP is wrong because it creates a virtual IP that is only reachable from within the cluster, such as from other pods or namespaces through the cluster's internal DNS and kube-proxy rules. It does not open any port on the node's external interfaces, so traffic from outside the cluster cannot reach it without an additional gateway like an Ingress or a different Service type. Thus it fails the question's requirement of external exposure on each node's IP.
- ✗
LoadBalancer
Why it's wrong here
LoadBalancer is wrong for this question even though it does expose a service externally, because it is a higher-level abstraction that provisions a cloud provider load balancer and assigns an external IP; behind the scenes, however, it also allocates a NodePort. The distinguishing feature the question asks for—'a static port on each node's IP'—is precisely the NodePort mechanism, not the load balancer's external IP. If the goal were simply external reachability, LoadBalancer would work, but the question emphasizes the node-port mechanism itself, making NodePort the direct answer.
Go deeper
Related to this question
About these practice questions
One of 160 original CKAD practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.