KCNA Container Orchestration Practice Question
A developer wants to expose a set of pods running a web application on a stable IP address. Which Kubernetes resource should they create?
⚠ Common exam trap
The CNCF exam often tests the distinction between Ingress and Service, where candidates mistakenly choose Ingress for stable IP exposure, but Ingress only provides host/path-based routing and requires a Service to actually reach pods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service
A Service in Kubernetes provides a stable IP address and DNS name to expose a set of pods, abstracting away pod IP changes due to scaling or restarts. It acts as a load balancer across the pods, typically using ClusterIP (default), NodePort, or LoadBalancer types. This directly meets the requirement of exposing pods on a stable IP.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Service
Why this is correct
A Service provides a stable virtual IP and DNS name that fronts a dynamically changing set of pod endpoints, selected by labels. Pods themselves are ephemeral, so the Service abstraction delivers the persistent address the web application requires.
- ✗
ConfigMap
Why it's wrong here
ConfigMap stores non-confidential configuration as key-value pairs consumed by pods; it provides no stable IP address or load-balancing. It is tempting because it is a common way to inject application settings into pods, and would be the correct choice for externalising environment variables or config files rather than exposing a service.
- ✗
Ingress
Why it's wrong here
Ingress routes HTTP and HTTPS traffic to services using host or path rules, but it relies on a separately provisioned load balancer for the address, so it supplies no stable IP itself. It is tempting for exposing web applications, and would be correct when name-based HTTP routing to multiple services is required.
- ✗
NetworkPolicy
Why it's wrong here
NetworkPolicy controls pod-level ingress and egress filtering; it neither allocates nor advertises an IP address, so no stable address results. It is tempting because it governs how pods communicate, and it would be correct when the requirement is to restrict which namespaces or pods may reach the web application.
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.