CKAD Services and Networking Practice Question
Which TWO statements about Ingress are correct?
⚠ Common exam trap
Many candidates confuse Ingress with a general-purpose load balancer and assume it can handle TCP/UDP traffic, but the standard Kubernetes Ingress API only supports HTTP and HTTPS (Layer 7) protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ingress can route traffic based on the requested hostname
An Ingress resource can route traffic based on the requested hostname using the `spec.rules.host` field. This allows multiple hostnames (e.g., `app1.example.com` and `app2.example.com`) to be served by the same Ingress controller, with each hostname directing traffic to different backend services. This host-based routing is a core feature of the Ingress API, as defined in the Kubernetes networking specification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An Ingress resource without an IngressClass will not work
Why it's wrong here
This statement is false because an Ingress resource without an explicit IngressClass will still work if a default IngressClass exists in the cluster. The default class is identified by the annotation `ingressclass.kubernetes.io/is-default-class: "true"` on an IngressClass object. If no default class is defined, the Ingress controller may ignore the resource, but the blanket claim that it never works is incorrect.
- ✗
Only one Ingress resource can exist per namespace
Why it's wrong here
This statement is false because Kubernetes places no limit on the number of Ingress resources per namespace. Multiple Ingress objects can coexist, each defining its own set of rules for hosts and paths. The ingress controller aggregates all rules and routes traffic accordingly, so splitting configurations across several Ingress resources is a common and supported practice.
- ✗
Ingress can handle non-HTTP protocols like TCP
Why it's wrong here
This statement is false because the Ingress API is specifically designed for HTTP and HTTPS traffic at Layer 7 (application layer). For non-HTTP protocols like TCP or UDP, you should use a Service of type LoadBalancer or NodePort, or rely on controller-specific TCP/UDP configuration outside the standard Ingress spec. The Ingress resource itself has no mechanism for routing raw TCP streams.
- ✓
Ingress can route traffic based on the requested hostname
Why this is correct
This statement is true because the Ingress spec includes a `host` field in each rule, allowing you to route requests based on the requested domain name. For example, you can direct `app.example.com` to one Service and `admin.example.com` to another, even within the same Ingress resource. This enables host-based virtual hosting, a standard feature of HTTP routing.
- ✓
TLS termination can be configured in the Ingress spec
Why this is correct
This statement is true because the Ingress spec contains a `tls` field where you can list hosts and reference a Kubernetes Secret that holds the TLS certificate and key. The Ingress controller uses this secret to terminate HTTPS connections, decrypting traffic before forwarding it over HTTP to the backend Service. This centralizes certificate management at the ingress layer.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.