CKAD Services and Networking Practice Question
You have an Ingress with TLS configured. The Ingress controller returns a certificate error when accessing via HTTPS. The secret 'my-tls' exists in the same namespace. Which of the following is the most likely cause?
⚠ Common exam trap
Many candidates assume a certificate error always means the certificate is invalid or untrusted, but the CKAD exam tests the specific Kubernetes configuration issue where the secret name in the Ingress TLS section does not match the actual Secret object name.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret name in the TLS section of the Ingress does not match the actual secret name
The most likely cause is that the secret name specified in the TLS section of the Ingress resource does not match the actual name of the Secret object. When TLS is configured, the Ingress controller reads the `secretName` field to fetch the certificate and key; a mismatch causes the controller to fail to load the TLS material, resulting in a certificate error. Since the secret exists in the same namespace, the only plausible issue is a naming mismatch.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The secret name in the TLS section of the Ingress does not match the actual secret name
Why this is correct
The TLS block in an Ingress references a Kubernetes Secret by name to obtain the certificate and private key. If the name in the TLS section does not exactly match the name of an existing Secret in the Ingress's namespace, the controller cannot locate the Secret, so it cannot load the certificate. This typically results in the controller reporting a certificate fetch error or falling back to serving a default certificate, which is often the observable symptom in this scenario.
- ✗
The Ingress controller does not support TLS
Why it's wrong here
Modern Ingress controllers (nginx, AWS ALB, GCE, Traefik, etc.) natively support TLS termination by reading the tls section of the Ingress resource and retrieving the referenced Secret. The Kubernetes Ingress API has had TLS support since its inception, and virtually all conformant controllers implement it. Saying the controller does not support TLS is an overly broad and incorrect statement because the issue described is a specific runtime failure, not a missing feature.
- ✗
The secret is in a different namespace than the Ingress
Why it's wrong here
Kubernetes Secrets are namespaced objects, and an Ingress can only reference a Secret within the same namespace. If the Secret exists elsewhere, the controller will be unable to retrieve it and will log an error similar to the secret not being found. This is a common misconfiguration, but the prompt specifically states the certificate error is caused by a secret name mismatch, not by a cross-namespace reference. In practice, a cross-namespace Secret would also cause a fetch error, but that is a different root cause.
- ✗
The certificate is not signed by a trusted CA
Why it's wrong here
A certificate that is not signed by a trusted CA (e.g., a self-signed or internally signed certificate) does not prevent the Ingress controller from loading it. The controller simply serves the certificate, and clients' browsers will show a security warning because the chain is not trusted by the client. This would not produce a certificate error on the controller side; it would only be visible as a client-side TLS validation failure. Therefore, while a CA trust issue is a real TLS concern, it does not match the described symptom of a certificate fetch error.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKAD question from scratch — 160 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKAD practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKAD exam.