hardMultiple ChoiceObjective-mapped
Google ACE Practice Question: A team runs a Kubernetes Deployment with 3…
A team runs a Kubernetes Deployment with 3 replicas behind a Service. They want to expose it externally with HTTPS and route traffic based on URL paths (/api → backend service, / → frontend service). Which Kubernetes resource handles path-based routing at Layer 7?
⚠ Common exam trap
Google Cloud often tests the misconception that a LoadBalancer Service can handle Layer 7 routing, but in Kubernetes, LoadBalancer Services are strictly Layer 4 and cannot inspect HTTP paths; candidates must remember that path-based routing requires an Ingress resource with a compatible controller.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A Kubernetes Ingress resource with path rules
A Kubernetes Ingress resource is the native API object designed for Layer 7 (HTTP/HTTPS) routing, including path-based routing. It allows you to define rules that map URL paths (e.g., /api, /) to different backend Services, and it typically works with an Ingress controller (e.g., NGINX, HAProxy) that terminates TLS and performs the routing. This directly meets the requirement for external HTTPS exposure and path-based traffic splitting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A LoadBalancer Service with path routing rules
Why it's wrong here
A LoadBalancer Service in GKE provisions a pass-through Layer 4 load balancer (TCP/UDP) that forwards raw packets to backend nodes. It does not terminate HTTP or parse URL paths; the forwarding decision is based solely on IP, port, and protocol. While you can attach a Service to an Ingress, the Service itself never applies path rules. Thus a standalone LoadBalancer Service with path routing rules is not a supported or functional configuration.
- ✓
A Kubernetes Ingress resource with path rules
Why this is correct
The Kubernetes Ingress resource is specifically designed to expose HTTP(S) workloads with rules for hostnames and URL paths. When deployed on GKE, the built-in Ingress controller provisions a GCP Application Load Balancer (HTTP(S) Load Balancer) that maintains URL maps and path rules at the edge. This enables TLS termination, path-based routing, and forwarding to backend Services. Therefore a Kubernetes Ingress resource with path rules is the correct way to perform HTTP path-based routing on GKE.
- ✗
A NodePort Service with iptables path routing rules
Why it's wrong here
A NodePort Service opens a static port on every cluster node, but this is purely Layer 4 TCP/UDP forwarding. iptables rules can perform DNAT and load balancing at the network layer, but they do not inspect HTTP request URIs or method headers. Path-based routing requires an HTTP reverse proxy that terminates the request and evaluates URL paths, which iptables cannot do. Therefore this combination cannot route to different backends based on HTTP paths.
- ✗
Multiple ClusterIP Services with DNS SRV records for path routing
Why it's wrong here
Multiple ClusterIP Services expose only a cluster-internal virtual IP, and DNS SRV records provide service discovery information like port numbers and weights. Neither mechanism is an HTTP router: SRV records are simply lookup metadata consumed by clients, not rules that forward requests to different services. Even if you resolved a service from SRV, there is no concept of inspecting the HTTP path to choose among services. Path-based routing demands an L7 proxy, so this setup cannot implement HTTP path routing.
Go deeper
Related to this question
Learn chapter
Google Kubernetes Engine (GKE)
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
Key term
Ingress
Ingress is a Kubernetes API object that manages external access to services within a cluster, typically via HTTP or HTTPS routing rules.
About these practice questions
One of 769 original ACE practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ACE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ACE exam.