CKAD Services and Networking Practice Question
An Ingress resource is configured with TLS termination. The secret referenced in the Ingress is present, but the Ingress controller returns 404. What is the most likely cause?
⚠ Common exam trap
Candidates often assume that a 404 error with TLS configured indicates a certificate or secret issue, but in Kubernetes, the Ingress controller returns a 404 when the backend Service lacks ready endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The backend Service does not have any endpoints
When an Ingress returns a 404 error despite TLS being configured and the secret present, the most common cause is that the backend Service has no healthy endpoints. The Ingress controller routes traffic to the Service's endpoints (pods), and if none are ready (e.g., due to failed readiness probes or scaled-to-zero replicas), the controller has no target to forward requests to, resulting in a 404 response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IngressClass annotation is missing
Why it's wrong here
An IngressClass annotation tells the Ingress controller which IngressClass implementation should reconcile the resource. If absent, the controller may fall back to a default class or simply ignore the Ingress, leaving it unmanaged, but this produces no routing or 404 response—the resource is just skipped. The symptom of a missing IngressClass is typically a non-functional Ingress with no error page, not an HTTP 404.
- ✗
The Ingress controller is not installed
Why it's wrong here
When no Ingress controller is installed, the Ingress resource is stored in etcd but nothing watches it to generate proxy configuration or update the controller's data plane. Requests to the hostname or path defined in the Ingress will be handled by whatever else is in front, or they'll hit the existing default backend, so a 404 is not the expected outcome of a missing controller. The controller’s absence means Ingress rules are never enforced, not that a specific error status is returned.
- ✓
The backend Service does not have any endpoints
Why this is correct
The Ingress controller dynamically discovers the backend Service's endpoints (via EndpointSlices) and configures its proxy to forward traffic to those IPs. If the Service selector matches no pods or the pods are not Ready, the endpoint list is empty, leaving no upstream target for the proxy to route to; the controller therefore responds with HTTP 404 for that host/path. This is a classic cause of '404 Not Found' even when Ingress and Service definitions appear valid, so checking `kubectl get endpoints <service>` is the standard diagnostic step.
- ✗
The TLS certificate is expired
Why it's wrong here
An expired TLS certificate causes the client to reject the server certificate during the TLS handshake, resulting in a security warning or a connection error like `ERR_CERT_DATE_INVALID` rather than an HTTP 404. The 404 is an application-layer response generated by the server after a successful TLS termination; TLS expiration prevents the handshake from succeeding altogether, so the server never receives the HTTP request to generate a 404. This mismatch in the failure layer makes TLS expiry unrelated to a 404 symptom.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 160-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.