CNCF / Linux Foundation · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
A shared 'cacerts' secret containing the root CA certificate.
All clusters must trust the same root CA to validate identities across cluster boundaries.
A ServiceEntry with 'resolution: DNS'.
An AuthorizationPolicy allowing all traffic.
An EgressGateway with TLS origination.
When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?
istiod
Istiod acts as the controller for Gateway API resources, translating them into xDS configuration for Envoy.
The Kiali operator
The Envoy proxy sidecar
The ingress-gateway deployment
You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?
The services are located in different clusters.
The traffic is encountering high error rates or being blocked by an Istio policy.
Kiali uses color coding to visualize health status; red indicates failures or policy rejections.
The service is not part of the mesh.
The connection is encrypted using mTLS.
When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?
Service
Gateway
In Gateway API, the Gateway resource defines the load balancer entry point.
Ingress
HTTPRoute
In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?
DestinationRule
VirtualService
PeerAuthentication
Sidecar resource
The Sidecar resource allows fine-grained control over the services and namespaces visible to a proxy.
You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?
Configure an AuthorizationPolicy in Namespace Y with a 'DENY' action for all principals.
A default deny policy ensures that no cross-namespace traffic is allowed unless explicitly permitted.
Set the global mesh config to 'REGISTRY_ONLY'.
Remove the service accounts from the mesh.
Use Kubernetes NetworkPolicies instead of Istio.
Want more Advanced Scenarios practice?
Practice this domainYou are performing a canary upgrade of the Istio control plane using the revision-based approach. After deploying the new revision, how do you verify which pods are currently pointing to the new control plane?
istioctl upgrade status
istioctl proxy-config endpoint
kubectl describe svc istiod
kubectl get pods -l istio.io/rev
This identifies pods associated with specific revisions.
Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?
istioctl analyze
This is the correct command for diagnostic analysis.
istioctl check
istioctl diagnose
istioctl verify
When using IstioOperator to customize the installation, you want to change the number of replicas for the Istiod control plane. Where should this be defined?
spec.values.pilot.scaling
spec.meshConfig.pilot.replicas
spec.pilot.replicas
spec.components.pilot.k8s.replicaCount
This field directly controls the replica count for the pilot component.
A team wants to enable sidecar injection for a specific namespace without modifying the deployment manifests. What is the most efficient way to achieve this?
istioctl inject -n <namespace>
kubectl apply -f sidecar-injector.yaml
kubectl label namespace <name> istio-injection=enabled
Labels are the standard way to trigger injection.
kubectl annotate namespace <name> istio-injection=enabled
You need to add a custom CA certificate to the Istio control plane during installation. How do you pass this using IstioOperator?
spec.values.global.certificates.caCertificates
This provides the required path for custom CA certificates.
spec.meshConfig.caCertificates
spec.components.pilot.k8s.env
spec.security.ca.path
You need to configure the IstioOperator CR to disable mTLS globally for a legacy migration. Which field correctly sets the global peer authentication policy?
spec.components.pilot.mtls: false
spec.meshConfig.mtls: false
spec.values.global.mtls.enabled: false
This is the correct path for the Helm-based configuration in IstioOperator.
spec.security.globalMtls: false
Want more Istio Installation Upgrade And Configuration practice?
Practice this domainWhich THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?
interval
Defines the duration of the analysis window.
baseEjectionTime
Defines how long a host stays ejected.
requestRetryCount
maxConnectionTimeout
consecutive5xxErrors
Monitors failures to determine ejection.
Which TWO fields are required when configuring an 'abort' fault injection in a VirtualService?
httpStatus
Defines the error code to return.
maxDuration
grpcStatus
delay
percentage
Defines the frequency of the injected fault.
To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?
circuitBreaker
outlierDetection
delay
abort
Abort is the correct mechanism for simulating service errors.
You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?
DestinationRule
Connection pool settings are defined in the DestinationRule under trafficPolicy.
EnvoyFilter
ServiceEntry
VirtualService
You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?
Sidecar
VirtualService
DestinationRule
DestinationRule is the correct resource to define connectionPool settings.
EnvoyFilter
You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?
It is ejected for 30 seconds
baseEjectionTime defines the duration of the ejection.
It is ejected for 1 second
It is removed permanently
It is ignored because the interval is too small
Want more Resilience And Fault Injection practice?
Practice this domainWhich TWO of the following are valid modes for PeerAuthentication?
ENABLED
OPTIONAL
STRICT
Forces mTLS for all connections.
PERMISSIVE
Allows both mTLS and plaintext traffic.
DISABLED
A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?
Configure the Gateway to filter by IP.
Use a ServiceEntry to restrict traffic.
Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.
ipBlocks is the correct field for CIDR-based authorization.
Create a PeerAuthentication policy with 'ipBlocks'.
What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?
Allow only traffic within the same namespace.
Deny all traffic.
Require mTLS for all traffic.
Allow all traffic.
Without policies, Istio does not restrict access.
You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?
Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.
The 'when' clause allows checking specific claims against values.
Use the 'principals' field.
Use the 'from' field in the 'source' object.
Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.
Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?
Envoy Proxy
Envoy is the data plane component that enforces security policies locally on the pod.
Citadel
Ingress Gateway
Istiod
Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?
Apply a PeerAuthentication resource with mode STRICT.
Define a RequestAuthentication resource specifying the issuer and jwksUri.
This tells Istio how to validate the JWT.
Create an EnvoyFilter to parse the JWT.
Ensure the application client sends the JWT in the 'Authorization: Bearer <token>' header.
The token must be provided by the client in the request header for Envoy to validate it.
Use an AuthorizationPolicy to validate specific claims like 'iss' or 'sub'.
AuthorizationPolicy is used to restrict access based on the claims extracted from the JWT.
Want more Securing Workloads practice?
Practice this domainYou need to route 10% of traffic to a new version of your service. Which object do you configure?
VirtualService
VirtualService supports weighted routing rules.
DestinationRule
ServiceEntry
Gateway
Which THREE settings are required in a VirtualService for a canary deployment?
tcp
http routes
Routes define the destination subsets.
tls
weight
Weight is essential for split traffic.
hosts
The host defines which service the rules apply to.
You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?
Gateway
VirtualService
The 'timeout' field is defined in the HTTPRoute object.
DestinationRule
ServiceEntry
Which TWO fields are mandatory in a Gateway resource?
subsets
tls
selector
Selector binds the resource to a specific ingress controller.
hosts
servers
Servers define the ports and protocols.
You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?
ServiceEntry
Gateway
Gateway defines the entry point for traffic entering the mesh.
VirtualService
DestinationRule
A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?
EnvoyFilter
VirtualService
DestinationRule spec
The subset labels must match the pod labels in the DR spec.
Gateway spec
Want more Traffic Management practice?
Practice this domainThe ICA exam is performance-based — there are no multiple-choice questions. It is a hands-on lab exam completed within 120 minutes. You complete practical tasks in a live or simulated environment. Courseiva practice questions cover the underlying concepts.
Hands-on labs and command-line tasks in a live Kubernetes cluster.
The exam covers 5 domains: Advanced Scenarios, Istio Installation Upgrade And Configuration, Resilience And Fault Injection, Securing Workloads, Traffic Management. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official CNCF / Linux Foundation ICA exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.