ICA Practice Test 10 — 10 Questions

Question 1

Which TWO of the following are valid sources for an AuthorizationPolicy?

Accepted Answer

principals. AuthorizationPolicies can match based on 'principals' (identity) and 'namespaces'.

Answer

headers

Answer

httpMethods

Answer

jwtClaims

Question 2

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 3

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 4

You need to inspect the envoy config for a specific pod. Which command do you use?

Accepted Answer

istioctl proxy-config all. istioctl proxy-config all <pod-name> shows all configuration for that proxy.

Answer

istioctl get config

Answer

kubectl get proxy

Answer

istioctl inspect

Question 5

Which command lists all virtual services in the current namespace?

Accepted Answer

kubectl get virtualservices. kubectl get virtualservices is the standard command to list this CRD.

Answer

istioctl virtualservices

Answer

istioctl get vs

Answer

istioctl list virtualservice

Question 6

What is the purpose of 'istioctl analyze'?

Accepted Answer

Identify configuration issues. To identify configuration issues across the mesh.

Answer

Scale deployments

Answer

Check proxy version

Answer

Visualize traffic

Question 7

Which of the following is a valid method for performing fault injection?

Accepted Answer

Using a VirtualService to inject delays.. Istio supports both delay and abort faults via VirtualService.

Answer

Using a ServiceEntry to redirect traffic.

Answer

Using a DestinationRule to drop connections.

Answer

Using an EnvoyFilter to rewrite headers.

Answer

Using a Gateway to block traffic.

Question 8

What happens if a request times out in Istio?

Accepted Answer

The proxy returns a 504 Gateway Timeout.. If a request exceeds the timeout, the proxy terminates the request and returns a 504 Gateway Timeout.

Answer

The request is retried automatically.

Answer

The proxy returns a 408 Request Timeout.

Answer

The request is passed to another healthy host.

Answer

The connection is closed without an error.

Question 9

You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?

Accepted Answer

Set source.namespaces: ['prod'] in the rule.. AuthorizationPolicy uses the 'source' field to restrict traffic by namespace using the 'namespaces' attribute.

Answer

Set source.principals: ['prod'] in the rule.

Answer

Set source.ipBlocks: ['prod'] in the rule.

Answer

Set source.remoteIp: ['prod'] in the rule.

Question 10

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

Accepted Answer

The sidecar fetches it directly from the URL specified in the 'jwksUri' field of the RequestAuthentication resource.. The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.

Answer

It is hardcoded in the Envoy binary.

Answer

The Istio Control Plane (istiod) fetches it and pushes it to the sidecar.

Answer

The user must manually upload the public key as a Kubernetes Secret.