A city internal API must be reachable only from inside the cluster. Which Service type should the administrator choose?
Select an answer to reveal the explanation.
Short Explanation
In-cluster only? ClusterIP is the private extension — no node-port billboard, no cloud LB.
Full Explanation
A city internal API that must be reachable only from inside the cluster should use Service type ClusterIP, which exposes the Service on an internal cluster IP without publishing it on node ports or a cloud load balancer. ClusterIP is the default private extension number for east-west and in-cluster north-south via Ingress/Gateway front doors—ideal when the API must not be directly advertised on every worker or via an external LB.
NodePort is not required for any in-cluster DNS name to resolve; ClusterIP Services resolve fine in-cluster. LoadBalancer is not the only type that creates Endpoints for ready Pods—Endpoints follow selectors for ClusterIP too. ExternalName does not allocate a virtual IP inside the Pod CIDR for east-west traffic; it returns a CNAME to an external name.
Exam caveat: ClusterIP alone is not a security boundary equivalent to NetworkPolicy, but it avoids extra node/LB exposure. Operational check: create a ClusterIP Service for the internal API, resolve it from another Pod, and confirm no NodePort or external LB was allocated. This distinction matters on the CKA because distractors often mix adjacent objects that sound related but solve a different control-plane problem.