Services and Networking →hardMultiple ChoiceObjective-mapped

CKAD Services and Networking Practice Question

You apply the following Ingress manifest:

apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: app-ingress spec: ingressClassName: nginx rules: - host: example.com http: paths: - path: /api pathType: Prefix backend: service: name: api-service port: number: 80

The Ingress controller logs show a 404 error when accessing 'http://example.com/api'. The service 'api-service' exists and is reachable via ClusterIP. What is the most likely cause?

⚠ Common exam trap

The CKAD exam often tests the misconception that a 404 error from an Ingress controller implies a missing service or wrong path, when in fact the Ingress resource itself is not being processed due to a missing or misconfigured IngressClass.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The IngressClass 'nginx' is not installed or configured

The Ingress controller logs a 404 error because the Ingress resource references `ingressClassName: nginx`, but the NGINX Ingress Controller is not installed or its IngressClass resource is not configured in the cluster. Without a matching IngressClass, the controller ignores this Ingress, so no routing rules are applied, and the default backend (if any) or the controller itself returns a 404. The service exists and is reachable, but the Ingress controller never processes the rules.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The service 'api-service' is in a different namespace
Why it's wrong here
This is not the cause. An Ingress is namespace-scoped and can only reference a Service that exists in the same namespace; if 'api-service' were in a different namespace, the Ingress controller would fail to resolve the backend and return a 503 or 404. Since the manifest is applied and the Service is presumably in the same namespace, the problem must lie elsewhere.
✗
The service port (80) does not match the container port
Why it's wrong here
This is not the cause either. The Service's 'port' is the port on which the Service is exposed inside the cluster, while 'targetPort' points to the container's actual listening port. The Ingress routes to the Service's 'port', not directly to the container port, so a mismatch between Service 'port' and container port is valid as long as 'targetPort' matches the container port. Therefore, this does not explain the 404 behavior.
✓
The IngressClass 'nginx' is not installed or configured
Why this is correct
This is the correct explanation. The Ingress resource specifies 'ingressClassName: nginx', but if no IngressClass named 'nginx' exists, or the NGINX Ingress controller is not installed and configured to watch that class, the Ingress will have no active controller to reconcile it. As a result, no forwarding rules are programmed into any reverse proxy, and requests to '/api' produce a 404. Without a matching IngressClass and running controller, the Ingress is effectively inert.
✗
The path '/api' should be pathType: Exact
Why it's wrong here
This is not the problem. With pathType: Prefix, the path '/api' matches requests to '/api' and to '/api/' as well as any subpaths, which is exactly the desired routing behavior. Changing to pathType: Exact would only match the literal '/api' and would break requests to '/api/', making the issue worse. The 404 is therefore not caused by the pathType selection.

Go deeper

CKAD Services and Networking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question