KCNA Kubernetes Fundamentals Practice Question
Which two of the following are valid ways to expose a Pod's container port to other resources? (Select two.)
⚠ Common exam trap
A common mistake is assuming that setting a containerPort in the Pod spec alone exposes the port to other resources; it only documents the port. Similarly, hostNetwork exposes the Pod's ports on the node's network but is not a standard Kubernetes service discovery method. The correct production approach is to create a Service (ClusterIP) to expose the Pod, and optionally an Ingress for HTTP-based routing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a Service of type ClusterIP pointing to the Pod's port
Option A is correct because a Service of type ClusterIP provides a stable virtual IP and DNS name that load-balances traffic to the Pod's target port, making the container port reachable by other resources inside the cluster. Option D is correct because an Ingress routes external HTTP/HTTPS traffic to a Service (which then forwards to the Pod's container port), thereby exposing the port to resources outside the cluster. Option B is not a valid exposure method by itself: containerPort is purely informational metadata in the Pod spec and does not publish or open the port. Option C is incorrect because hostNetwork: true makes the Pod share the node's network namespace, but it does not expose a specific container port to other resources as a Kubernetes networking construct. Option E is incorrect because kubectl port-forward is a temporary debugging tunnel from a local machine to a Pod, not a way to expose a container port to other cluster resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a Service of type ClusterIP pointing to the Pod's port
Why this is correct
A ClusterIP Service provides a stable virtual IP and DNS name that load-balances to the pod's target port, letting other in-cluster resources reach the container. It satisfies internal exposure without requiring node-level or external access.
- ✗
Add a containerPort field in the Pod spec
Why it's wrong here
containerPort is informational; it does not create a network endpoint.
- ✗
Set the pod's hostNetwork to true
Why it's wrong here
hostNetwork makes the pod use the node's network but is not a typical exposure method; it bypasses Service.
- ✓
Create an Ingress that routes to the Service
Why this is correct
An Ingress defines HTTP and HTTPS routing rules that forward external requests to a backing Service, which then reaches the pod's container port. It satisfies exposing the port to resources outside the cluster via layer 7 routing.
- ✗
Use kubectl port-forward
Why it's wrong here
port-forward is for local access, not for cluster-wide exposure.
Go deeper
Related to this question
About these practice questions
This KCNA question is part of Courseiva's 930-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.