KCNA Kubernetes Fundamentals Practice Question
Which component on a worker node is responsible for enforcing the network rules and implementing Service abstractions?
⚠ Common exam trap
A common misconception is that kubelet or the container runtime handles Service networking, but kube-proxy is the dedicated component for implementing network rules and Service abstractions on each node.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kube-proxy
kube-proxy is the component on each worker node that implements Service abstractions by maintaining network rules (iptables, IPVS, or userspace) that allow traffic to reach Pods from inside or outside the cluster. It watches the Kubernetes API server for changes to Services and EndpointSlices, then updates the node's packet filtering rules to forward traffic to the correct backend Pods, handling load balancing and session affinity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
kube-proxy
Why this is correct
kube-proxy runs on each worker node, programming iptables or IPVS rules that translate Service virtual IPs into Pod endpoints. The kubelet manages container lifecycle, while the scheduler and controller manager run in the control plane, so neither enforces Service networking.
- ✗
kubelet
Why it's wrong here
The kubelet manages pod lifecycle on the node, mounting volumes, reporting status and running probes; it does not program iptables or IPVS rules. kube-proxy handles that. The kubelet would be correct for questions about pod supervision or node registration, not Service abstraction enforcement.
- ✗
container runtime
Why it's wrong here
The container runtime starts and stops containers via the CRI, handling images and sandboxing; it never touches network rule programming. kube-proxy implements Service abstractions. The runtime is the right answer when asked what actually executes containers on a node.
- ✗
kube-scheduler
Why it's wrong here
kube-scheduler runs in the control plane, assigning pending pods to nodes based on resource and affinity constraints. It performs no on-node network enforcement. It would be correct for questions about pod placement decisions, not for implementing Service abstractions or network rules.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which component runs on every node and is responsible for maintaining network rules that allow communication to Pods from network endpoints?
medium- A.kube-controller-manager
- ✓ B.kube-proxy
- C.container runtime
- D.kubelet
Why B: B is correct because kube-proxy is the component that runs on every node in a Kubernetes cluster and is responsible for maintaining network rules (e.g., iptables, IPVS, or userspace proxy) that allow network communication to Pods from network endpoints, both inside and outside the cluster. It implements the Kubernetes Service concept by managing the mapping of Service IPs to backend Pod IPs and performing load balancing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.