Reinforce ICA concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For ICA preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the ICA question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your ICA flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real ICA exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass ICA.
Sample cards from the ICA flashcard bank. Read the question, think of the answer, then read the explanation below.
Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?
istioctl analyze
istioctl analyze performs static analysis of the Istio configuration in a cluster (or from files) and reports validation errors, warnings, and best-practice violations, such as misconfigured VirtualServices, missing sidecars, or deprecated fields. It is the canonical command for verifying configuration correctness and adherence to Istio's recommended patterns.
When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?
istiod
istiod is the Istio control plane component that watches Gateway API resources (Gateway and HTTPRoute) and translates them into Envoy xDS configuration pushed to the gateway proxy pods. When you define a Gateway resource, istiod's config controller reconciles it and generates the corresponding listener, route, cluster, and endpoint configuration for the Envoy data plane.
To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?
abort
The 'abort' fault injection setting in Istio is specifically designed to return an HTTP error code (such as 503) for a specified percentage of requests to a target service. By configuring an abort fault with an HTTP status of 503 and a percentage value of 20, you directly simulate service unavailability for 20% of traffic to the 'catalog' service. This is the intended mechanism for testing how applications handle HTTP error responses.
You need to route 10% of traffic to a new version of your service. Which object do you configure?
VirtualService
VirtualService allows weight-based routing to different subsets.
A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?
Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.
The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.
You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?
timeout
The timeout setting is defined within the route rule of a VirtualService.
If you want to perform traffic shadowing, which field do you use?
mirror
The mirror field in a VirtualService enables traffic shadowing.
You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?
The legacy service is not using an Istio sidecar to handle mTLS handshakes.
A PeerAuthentication policy with mode: STRICT at the namespace scope requires all inbound traffic to workloads in that namespace to use Istio mutual TLS. Only workloads with an Istio sidecar proxy can originate and terminate mTLS, so a legacy service without a sidecar cannot complete the mTLS handshake and its connections fail. The fix is either to inject a sidecar into the legacy service or to use a permissive mode or port-level exception during migration.
What does an AuthorizationPolicy's 'operation' field represent?
HTTP methods and paths.
The operation field defines the methods (GET, POST) and paths allowed or denied.
If a VirtualService has a route to a service that has no pods matching the label, what happens?
503 Service Unavailable
In Istio, a VirtualService route points to a Kubernetes Service by name. If that Service has no endpoints because no pods match its label selector, Envoy has no healthy upstream cluster members to route to. Istio's default behavior in this case is to return HTTP 503 Service Unavailable (with the 'no healthy upstream' response flag), rather than silently dropping or rerouting traffic.
You want to route traffic to a specific version of a service based on a header. Where do you define the subset?
DestinationRule
In Istio, a DestinationRule defines the named subsets of a service (for example, v1 and v2) by selecting pods with specific labels. A VirtualService then references those subsets when routing traffic, so the subset definition itself lives in the DestinationRule. This separation lets routing rules (VirtualService) stay decoupled from the actual pod groupings (DestinationRule).
Which command is used to display the currently active PeerAuthentication policies in the mesh?
kubectl get peerauthentication -A
The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.
You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?
Update label and restart pods
To move a namespace from revision 1-18 to 1-19, you update the istio.io/rev label on the namespace from 1-18 to 1-19 and then restart the pods so the sidecar injector (mutating webhook) re-injects the new revision's proxy. Istio does not automatically restart pods on label change, so the restart is mandatory for the new sidecar to take effect.
You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?
Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.
A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.
What is the result of applying an AuthorizationPolicy that has no 'action' field?
It defaults to ALLOW.
If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.
Which resource is used to configure circuit breaking for a service?
DestinationRule
DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.
What is the main advantage of using Istio's 'locality-aware load balancing'?
It minimizes latency and egress costs by routing to local endpoints.
It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.
You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?
DestinationRule
The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.
Which field in the DestinationRule allows defining different versions of a service?
subsets
The subsets block in DestinationRule allows grouping pods by label to create versions.
Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?
The proxy cannot reach the JWKS URI.
A RequestAuthentication policy in Istio validates JWTs by fetching the JSON Web Key Set (JWKS) from the issuer's specified JWKS URI. If the proxy cannot reach that URI (due to network policies, DNS failures, or the endpoint being down), it cannot retrieve the public keys needed to verify the token's signature, causing validation to fail even when the issuer claim is correct. This is a common operational issue in service meshes where egress restrictions or misconfigured service entries block access to external identity providers.
What is the purpose of 'istioctl analyze'?
Identify configuration issues
To identify configuration issues across the mesh.
The ICA flashcard bank covers all 5 official blueprint domains published by CNCF / Linux Foundation. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Istio Installation Upgrade And Configuration
Advanced Scenarios
Resilience And Fault Injection
Traffic Management
Securing Workloads
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that ICA questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.ICA questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective ICA study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free ICA flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 234+ original ICA flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official CNCF / Linux Foundation exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official ICA exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included