CKAD Services and Networking Practice Question
Which THREE statements about Ingress are correct? (Choose three.)
⚠ Common exam trap
The CKAD exam often tests the distinction between Layer 7 (Ingress) and Layer 4 (Service) routing, so candidates mistakenly think Ingress can route based on source IP or destination port, which are Layer 3/4 concepts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ingress can terminate TLS connections.
Ingress can terminate TLS connections by referencing a Secret that contains the TLS certificate and private key. When a TLS section is defined in the Ingress spec, the Ingress controller terminates the HTTPS connection at the edge and forwards plain HTTP traffic to the backend services. This is a core feature for securing ingress traffic in Kubernetes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ingress can terminate TLS connections.
Why this is correct
Ingress controllers can terminate TLS by decrypting HTTPS traffic at the edge, using a Kubernetes secret of type kubernetes.io/tls that holds the certificate and private key. The spec.tls field maps a hostname to that secret, and after decryption, requests are forwarded to backend services over HTTP. This offloads encryption overhead from backend pods and is a standard feature of every major ingress controller.
- ✓
Ingress can route traffic based on host header.
Why this is correct
Each Ingress rule can include a host field, enabling the controller to match the HTTP Host header of an incoming request and route it to a specific backend service. For instance, api.example.com can point to one Service while www.example.com points to another, even if they share the same load balancer IP. If the host is omitted, the rule matches all traffic to the IP address, effectively acting as a catch-all.
- ✗
Ingress can route traffic based on source IP.
Why it's wrong here
Ingress is an HTTP layer-7 object; it inspects the request URL and Host header but has no access to the TCP socket's source IP address. Routing decisions based on client IP are the domain of NetworkPolicy resources, which control pod-to-pod traffic at the network layer, or IP-based rules in an external load balancer. No Ingress spec field exists for source IP matching, so this statement is incorrect.
- ✓
Ingress can route traffic based on URL path.
Why this is correct
Path-based routing is a core Ingress capability defined via spec.rules.http.paths, where each path prefix or exact string maps to a different backend Service. For example, requests to /api are forwarded to an API server, while /dashboard goes to a web UI. Controllers implement this using prefix matching (or regex with annotations) and this is one of the primary reasons to use Ingress instead of a simple Service.
- ✗
Ingress can route traffic based on destination port.
Why it's wrong here
Ingress is designed to route HTTP/HTTPS traffic on ports 80 and 443; it does not inspect or route based on destination port because all external connections arrive at these two ports. The backend Service's targetPort is an implementation detail of the Service, not an Ingress routing criterion. Port-based routing falls under layer-4 load balancing, which is provided by Service type LoadBalancer or TCP/UDP-enabled ingress controllers, not by the Ingress API itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 826 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.