Traffic Management

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Which THREE settings are required in a VirtualService for a canary deployment?

You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?

Which TWO fields are mandatory in a Gateway resource?

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?

A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?

You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

What is the default Istio load balancing algorithm?

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?

A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?

You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Which command helps troubleshoot configuration issues by analyzing the cluster for errors?

What does the 'mirror' feature in a VirtualService do?

How do you specify a custom header match in a VirtualService?

Where do you define the hosts that a Gateway will listen on?

You need to inspect the envoy config for a specific pod. Which command do you use?

Which field in the DestinationRule allows defining different versions of a service?

You want to limit the number of concurrent connections to a service. Which field in the DestinationRule handles this?

What protocol does the Gateway resource support?

How do you handle SNI-based routing in a Gateway?

What is the purpose of the 'retryOn' field in a VirtualService?

If a VirtualService has a route to a service that has no pods matching the label, what happens?

You need to ensure that traffic is only routed to healthy pods. What feature does this?

What is the command to view the status of all pods including proxies?

Which command lists all virtual services in the current namespace?

You want to perform a 'headers' modification on an incoming request. Which resource allows this?

Which component is responsible for enforcing traffic policies in the data plane?

What is the primary function of the 'istio-proxy' container in a pod?

Which type of routing allows you to route to different services based on URL path?

Which field in the VirtualService allows you to redirect an incoming request to a different path?

What is the purpose of 'istioctl analyze'?

If you want to perform traffic shadowing, which field do you use?

What is the default behavior when no VirtualService is defined for a service?

Which tool provides a GUI for visualizing your traffic management rules?

What is the standard path to install istioctl?

Which resource type is used for mTLS policy?

You need to route traffic to a service based on the 'x-user-type' header. How is this defined?

What is the purpose of the 'istio-system' namespace?

Which field in VirtualService is used for A/B testing?

Which of the following are valid traffic management components in Istio? (Choose TWO)

Which parameters can be configured in a VirtualService retry policy? (Choose TWO)

You need to define a local service that is not in the cluster. How?

What information can you get from 'istioctl proxy-config'? (Choose THREE)

Which of the following are valid Gateway configurations? (Choose TWO)

Which items can be configured under DestinationRule trafficPolicy? (Choose THREE)

Which actions can a VirtualService perform on a request? (Choose TWO)

Which resources control mTLS settings? (Choose TWO)

Which of these are valid sub-commands for istioctl? (Choose TWO)

Which of the following are valid DestinationRule fields? (Choose THREE)

Which are valid match conditions in VirtualService? (Choose THREE)

To perform a canary deployment, you have two versions of a service. Which resource do you use to split traffic between them?

You need to expose a service to traffic outside the mesh using Istio. Which resource is required to configure the entry point for incoming traffic?

How do you implement a circuit breaker to eject a pod that returns 5xx errors?

You want to access an external API (e.g., api.google.com) from within your mesh. What must you configure?

You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?

Which field in the VirtualService allows you to redirect traffic to a different URI?

You want to route traffic to a specific version of a service based on a header. Where do you define the subset?

What is the function of the 'weight' parameter in a VirtualService route?

Where do you configure the hostnames that a Gateway should accept?

You want to inject a 5-second delay into requests for testing. Which resource allows this?

You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?

You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?

You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?

What is the primary purpose of the 'subset' field in a VirtualService destination?

Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?

When using a ServiceEntry for a TCP service, what protocol should be specified?

To strip a URL prefix before passing a request to a backend service, which field do you use?

Which load balancing policy would you choose to ensure requests from the same user always hit the same pod?

Which command is used to view the effective configuration of a specific Envoy proxy?

How do you specify a header-based match in a VirtualService?

What is the default load balancing policy if none is specified in the DestinationRule?

You want to limit the total number of concurrent connections to a service. Where is this defined?

Which resource is used to provide a unified entry point for multiple services?

Which THREE fields are found within the 'trafficPolicy' block of a DestinationRule?

Which TWO actions can a VirtualService perform on a request?

Which TWO resources are essential for configuring traffic splitting between versions?

Which TWO settings are configured within the 'outlierDetection' block?

Which THREE configurations affect the way traffic is distributed across pods?

Which THREE features are supported by the Istio 'trafficPolicy' in a DestinationRule?

Which TWO mechanisms are used to secure traffic within the mesh?

Which THREE are types of traffic management patterns?

Which THREE are valid load balancing policies in Istio?

Which TWO components must be configured to allow external traffic to enter the mesh?

Your team runs a payments service in the 'prod' namespace with a Kubernetes Service named 'payments' listening on port 8443. During a canary rollout you created a Gateway 'payments-gw' in the 'istio-system' namespace and a VirtualService 'payments-vs' in the 'prod' namespace that references the gateway as 'payments-gw'. Clients report HTTP 404 errors when calling the service, but the sidecar-injected payments pods show healthy endpoints and the Gateway pod logs report 'no matching route'. Which change resolves the routing failure?

A platform engineer is migrating a legacy service into the mesh. The service exposes an HTTP API on port 8080 but also a raw TCP admin port on 9090. The engineer wants the sidecar to treat port 8080 as HTTP so that Istio can apply request-level routing, while treating port 9090 as opaque TCP. Which configuration achieves this?

A team wants to shift 10 percent of traffic to a new version of a service for a canary, while keeping 90 percent on the stable version. Both versions are healthy and registered as subsets in a DestinationRule. Which VirtualService configuration accomplishes this?

A mesh operator needs to configure a DestinationRule so that the sidecar reuses existing HTTP/2 connections to an upstream service and automatically ejects endpoints that return repeated 5xx errors. Which two configuration elements are required to meet these goals? (Choose two.)

A developer needs to expose an internal service to external clients through the Istio ingress gateway on port 443 using TLS termination at the gateway. The service listens on port 80 inside the mesh. Which pairing of resources is required?