hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A platform team is deploying a multi-tier…
A platform team is deploying a multi-tier application on GKE: a frontend Deployment, a backend Deployment, and a Redis StatefulSet. The backend must be reachable by name from the frontend, but not from outside the cluster. Which Kubernetes resource enables internal name-based service discovery?
⚠ Common exam trap
Google Cloud often tests the misconception that Ingress is used for internal service discovery, but Ingress is an external-facing layer-7 routing resource that requires a Service (typically ClusterIP or NodePort) to route traffic, and it does not provide internal DNS-based name resolution by itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A ClusterIP Service for the backend
A ClusterIP Service exposes the backend Pods on a stable, internal IP address that is only reachable from within the GKE cluster. The frontend can resolve the backend by the Service's DNS name (e.g., `backend.default.svc.cluster.local`) using the cluster's internal DNS (CoreDNS), enabling name-based service discovery without exposing the backend to external traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A NodePort Service for the backend
Why it's wrong here
NodePort exposes a backend Service on a reserved port on every node's IP address, making it reachable from external clients via any node's IP and that port. This defeats the stated requirement that the backend be accessible only from inside the cluster. Even though pods could still reach the Service through its ClusterIP, the NodePort creates an unintended public network path, increasing attack surface and violating the internal-only constraint.
- ✓
A ClusterIP Service for the backend
Why this is correct
A ClusterIP Service is the correct choice because it provisions a stable virtual IP and an internal DNS record (e.g., backend.default.svc.cluster.local) that is resolvable only within the cluster. Frontend pods can communicate with the backend by its service name, and kube-proxy load-balances traffic to the backend pods automatically. Because the Service is not published on any node IP or external load balancer, it remains strictly internal, fully matching the requirement.
- ✗
A LoadBalancer Service for the backend
Why it's wrong here
A LoadBalancer Service instructs the cloud provider to provision an external load balancer and assign a public IP, which opens the backend to internet traffic and outright violates the internal-only requirement. This type is intended for services that must be reached from outside the cluster, not for inter-pod communication. It also adds unnecessary cost and latency for a backend that should only be consumed by other workloads inside the cluster.
- ✗
A Kubernetes Ingress resource for the backend
Why it's wrong here
An Ingress resource is an HTTP(S) layer routing object that relies on an Ingress controller to direct external traffic to Services; it does not create a discoverable cluster-internal DNS name or stable VIP for pod-to-pod calls. A frontend pod cannot resolve the backend's service name through an Ingress, and the Ingress object itself is typically exposed to the outside world via a public IP. Therefore, using Ingress for the backend would neither satisfy internal service discovery nor keep the backend private.
Visual reference
Go deeper
Related to this question
Learn chapter
Google Cloud Platform Overview
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
Key term
GKE
GKE is Google's managed Kubernetes service that automates deploying, scaling, and managing containerized applications in the cloud.
About these practice questions
Courseiva writes every ACE question from scratch — 769 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.