CKAD Services and Networking Practice Question
Which TWO statements about Ingress are correct? (Select 2)
⚠ Common exam trap
The CKAD exam often tests the distinction between Layer 7 (Ingress) and Layer 4 (Service) capabilities, trapping candidates who assume Ingress can handle TCP traffic or assign IPs like a LoadBalancer Service.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ingress can terminate TLS.
Ingress can terminate TLS by using a Secret that contains the TLS certificate and private key. When configured in the Ingress spec under `tls` and `secretName`, the Ingress controller decrypts HTTPS traffic before forwarding it to the backend Service, offloading TLS termination from the application pods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ingress can terminate TLS.
Why this is correct
The Ingress resource supports a TLS block that references a Secret holding the TLS private key and certificate. When configured, the Ingress controller terminates incoming HTTPS requests at the edge, decrypting them and forwarding unencrypted HTTP to backend Services. This offloads SSL/TLS processing from application pods and centralizes certificate management, making it a common practice in production clusters.
- ✗
Ingress provides a ClusterIP for internal access.
Why it's wrong here
An Ingress object has no ClusterIP because it is not a Service; ClusterIP is a virtual IP assigned only to a Service to provide stable internal load-balanced access to a set of pods. Ingress acts as an L7 routing layer that sits in front of Services and only exposes HTTP/HTTPS routes, relying on the underlying Service to actually route packets to endpoints. Thus, the statement conflates the functions of Ingress and Service, which are separate API resources.
- ✓
Ingress can route traffic based on the host header.
Why this is correct
Ingress rules allow traffic to be routed based on the Host header, a core Layer 7 feature. By defining multiple host entries in an Ingress spec, you can map different domain names—such as example.com and api.example.com—to different backend Services using the same ingress IP. This capability, known as name-based virtual hosting, is a primary reason Ingress is used to expose multiple services through a single external endpoint.
- ✗
Ingress can load balance TCP traffic.
Why it's wrong here
Ingress operates at Layer 7 and is specifically designed for HTTP/HTTPS traffic, not for raw TCP or UDP streams. While some Ingress controllers can be extended to handle TCP, the Kubernetes Ingress API itself is HTTP-centric; native TCP/UDP load balancing is done via Service types like NodePort or LoadBalancer. Therefore, saying Ingress can load balance TCP traffic is inaccurate because it would require a custom controller configuration and falls outside the standard Ingress contract.
- ✗
Ingress automatically assigns an external IP to the Service.
Why it's wrong here
The Ingress resource does not assign an external IP to a Service; its controller provisions the external load balancer and obtains an IP or hostname for the Ingress itself. The backend Service typically remains ClusterIP, an internal virtual IP, and is only reachable from within the cluster. The statement is incorrect because the Ingress object merely declares routing rules, while the controller is the component responsible for external exposure.
Go deeper
Related to this question
About these practice questions
This CKAD question is part of Courseiva's 826-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.