ICA Practice Test 1 — 10 Questions

Question 1

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 2

An application is experiencing intermittent errors. You decide to use outlier detection to eject unhealthy pods. Which field in the DestinationRule controls the ejection of hosts after a certain number of 5xx errors?

Accepted Answer

consecutive5xxErrors. The 'consecutive5xxErrors' field in the 'outlierDetection' section of a DestinationRule is used to eject unhealthy hosts.

Answer

baseEjectionTime

Answer

interval

Answer

maxConnections

Question 3

When configuring circuit breaking, what does 'maxRequestsPerConnection' control?

Accepted Answer

The number of requests per individual connection.. It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.

Answer

The number of concurrent requests.

Answer

The total number of requests sent to a service.

Answer

The latency of each request.

Answer

The size of the request body.

Question 4

What is the primary function of the 'PeerAuthentication' resource?

Accepted Answer

Configure mTLS mode for workloads.. PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.

Answer

Apply rate limits to requests.

Answer

Limit egress traffic to external sites.

Answer

Route traffic based on headers.

Question 5

You need to integrate an external database into the mesh that does not support mTLS. How do you configure it securely?

Accepted Answer

Define a ServiceEntry and use an EgressGateway for controlled access.. Use a ServiceEntry to define the external service, and an EgressGateway to handle TLS origination if needed, or simply restrict traffic via an AuthorizationPolicy.

Answer

Run a sidecar on the database server.

Answer

Enable 'PERMISSIVE' mTLS mode for the entire mesh.

Answer

Create a Kubernetes Service with the database IP.

Question 6

You want to simulate a 5-second network latency for 10% of requests to the 'cart' service. Which VirtualService configuration is correct?

Accepted Answer

fault: { delay: { percentage: { value: 10 }, fixedDelay: 5s } }. The fault injection delay policy requires both a percentage and a fixedDelay duration.

Answer

fault: { delay: { fixedDelay: 5s } }

Answer

fault: { delay: 5s, weight: 0.1 }

Answer

fault: { delay: { percentage: 10, latency: 5s } }

Answer

fault: { abort: { percentage: 10, duration: 5s } }

Question 7

How do you define a circuit breaker that limits the number of pending requests?

Accepted Answer

http1MaxPendingRequests. The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.

Answer

maxRequestsInQueue

Answer

maxPending

Answer

pendingRequestsLimit

Answer

maxPendingRequests

Question 8

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Accepted Answer

The number of requests that exceeded the timeout to an upstream service.. This metric indicates the number of requests that timed out while waiting for a response from the upstream service.

Answer

The average time of all requests.

Answer

The total number of upstream connections.

Answer

The number of successful requests.

Question 9

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Accepted Answer

from. An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).

Answer

action

Answer

selector

Question 10

If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?

Accepted Answer

It allows both mTLS and plaintext.. PERMISSIVE mode allows both mTLS and plaintext traffic to coexist, which is ideal for migrations.

Answer

It requires plaintext only.

Answer

It requires mTLS only.

Answer

It disables all security.