Reinforce ICA concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For ICA preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the ICA question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your ICA flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real ICA exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass ICA.
Sample cards from the ICA flashcard bank. Read the question, think of the answer, then read the explanation below.
In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
A shared 'cacerts' secret containing the root CA certificate.
For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.
You are performing a canary upgrade of the Istio control plane using the revision-based approach. After deploying the new revision, how do you verify which pods are currently pointing to the new control plane?
kubectl get pods -l istio.io/rev
You verify the configuration by checking the 'istio.io/rev' label on the pods to see which revision they are assigned to.
To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?
abort
The abort fault injection allows specifying a status code and percentage.
A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?
Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.
The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.
You need to route 10% of traffic to a new version of your service. Which object do you configure?
VirtualService
VirtualService allows weight-based routing to different subsets.
What is the main advantage of using Istio's 'locality-aware load balancing'?
It minimizes latency and egress costs by routing to local endpoints.
It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.
An application is experiencing intermittent errors. You decide to use outlier detection to eject unhealthy pods. Which field in the DestinationRule controls the ejection of hosts after a certain number of 5xx errors?
consecutive5xxErrors
The 'consecutive5xxErrors' field in the 'outlierDetection' section of a DestinationRule is used to eject unhealthy hosts.
When configuring circuit breaking, what does 'maxRequestsPerConnection' control?
The number of requests per individual connection.
It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.
What is the primary function of the 'PeerAuthentication' resource?
Configure mTLS mode for workloads.
PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.
You need to integrate an external database into the mesh that does not support mTLS. How do you configure it securely?
Define a ServiceEntry and use an EgressGateway for controlled access.
Use a ServiceEntry to define the external service, and an EgressGateway to handle TLS origination if needed, or simply restrict traffic via an AuthorizationPolicy.
You want to simulate a 5-second network latency for 10% of requests to the 'cart' service. Which VirtualService configuration is correct?
fault: { delay: { percentage: { value: 10 }, fixedDelay: 5s } }
The fault injection delay policy requires both a percentage and a fixedDelay duration.
How do you define a circuit breaker that limits the number of pending requests?
http1MaxPendingRequests
The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.
When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?
The number of requests that exceeded the timeout to an upstream service.
This metric indicates the number of requests that timed out while waiting for a response from the upstream service.
If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?
It allows both mTLS and plaintext.
PERMISSIVE mode allows both mTLS and plaintext traffic to coexist, which is ideal for migrations.
When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?
Gateway
The Gateway resource defines the entry point, including listeners, ports, and protocols.
In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?
Sidecar resource
Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.
When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?
HTTPRoute
HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.
Which component is responsible for the actual enforcement of circuit breaking and fault injection?
Envoy proxy
The Envoy proxy (sidecar) performs the enforcement based on the configuration pushed by Istiod.
What is the default value for 'consecutive5xx' in OutlierDetection?
5
The default value for consecutive5xx in Istio/Envoy is 5.
In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
A shared 'cacerts' secret containing the root CA certificate.
For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.
Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?
Telemetry
The Istio Telemetry component, often integrated into the sidecar and processed by the Istio control plane, handles data collection.
Which command is used to restart an Istio sidecar without restarting the application container?
You must restart the pod.
In Kubernetes, you cannot restart just one container in a pod. You must restart the pod.
When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?
The service is outside the mesh but managed by Istio policies.
It tells Istio that the service is external to the mesh, but it should be treated as a first-class citizen for routing and policy purposes.
The ICA flashcard bank covers all 5 official blueprint domains published by CNCF / Linux Foundation. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Advanced Scenarios
Istio Installation Upgrade And Configuration
Resilience And Fault Injection
Securing Workloads
Traffic Management
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that ICA questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.ICA questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective ICA study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free ICA flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 292+ original ICA flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official CNCF / Linux Foundation exam objectives.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official ICA exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included