ICA Practice Test 10 — 10 Questions

Question 1

You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?

Accepted Answer

It overrides the global policy for all workloads in the 'default' namespace.. In Istio, PeerAuthentication policies are scoped hierarchically: mesh-wide (root namespace, no selector), namespace-wide (a namespace, no selector), and workload-specific (with a selector). A namespace-wide policy in 'default' with no selector applies to all workloads in that namespace and takes precedence over the mesh-wide global policy for those workloads, effectively overriding it.

Answer

It is ignored.

Answer

It crashes the global policy.

Answer

It merges with the global policy.

Question 2

You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?

Accepted Answer

DestinationRule. Connection pool limits such as `maxConnections` and `http1MaxPendingRequests` are configured in the DestinationRule's `trafficPolicy.connectionPool` section, which applies to the destination service. This is where Istio exposes Envoy's circuit-breaking settings for outbound traffic to a service.

Answer

EnvoyFilter

Answer

ServiceEntry

Answer

VirtualService

Question 3

When configuring circuit breaking, what does 'maxRequestsPerConnection' control?

Accepted Answer

The number of requests per individual connection.. It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.

Answer

The number of concurrent requests.

Answer

The total number of requests sent to a service.

Answer

The latency of each request.

Answer

The size of the request body.

Question 4

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 5

What is the default behavior when no VirtualService is defined for a service?

Accepted Answer

Round-robin routing. In Istio, when a Kubernetes Service has no VirtualService attached, the sidecar proxies fall back to Envoy's default load-balancing behavior, which is round-robin across the healthy endpoints discovered via the service registry (Pilot/xDS). No routing rules means no traffic manipulation — the request simply flows to the next endpoint in rotation. This is the baseline behavior before any Istio traffic management is layered on.

Answer

Traffic is dropped

Answer

503 error

Answer

Traffic is blocked

Question 6

Which TWO of the following are valid fields within a DestinationRule's 'trafficPolicy'?

Accepted Answer

connectionPool. In Istio's DestinationRule, the trafficPolicy block supports connectionPool (D), which configures TCP/HTTP connection pool limits such as maxConnections, http1MaxPendingRequests, and http2MaxRequests for the destination workloads, and outlierDetection (E), which defines passive health checking via consecutive5xxErrors, interval, and baseEjectionTime to eject unhealthy endpoints. Both are legitimate subfields of trafficPolicy and are applied per destination (or per subset/port override). By contrast, retryPolicy (A) is a field of a VirtualService's HTTP route, not a DestinationRule trafficPolicy. virtualHosts (B) is a top-level field of a VirtualService (and of Envoy route configuration), not part of DestinationRule. faultInjection (C) is also configured in a VirtualService's HTTP route, not in a DestinationRule trafficPolicy.

Answer

retryPolicy

Answer

virtualHosts

Answer

faultInjection

Question 7

What happens when a circuit breaker trips?

Accepted Answer

Traffic is no longer sent to the instance.. The circuit breaker stops sending traffic to the unhealthy host, protecting the system from overload.

Answer

The service is deleted.

Answer

All traffic is redirected to a static page.

Answer

The entire mesh is shut down.

Answer

The pod is restarted.

Question 8

How can you restrict traffic to a service based on the presence of a specific request header?

Accepted Answer

Use the 'when' field with 'request.headers'.. In Istio's AuthorizationPolicy, the 'when' field defines additional conditions that must be satisfied for the rule to apply, and 'request.headers' is a supported attribute key. Using 'when' with 'request.headers["X-Custom"]' matching a specific value restricts traffic based on the presence or value of a request header.

Answer

Use the 'from' field.

Answer

Use an EnvFilter.

Answer

Use the 'to' field.

Question 9

You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?

Accepted Answer

VirtualService. Retry behavior for failed requests in Istio is configured in the VirtualService under the HTTP route's retries field. You specify attempts, perTryTimeout, retryOn conditions (e.g., 5xx, gateway-error, connect-failure), and retryRemoteLocalities. This is the correct location because VirtualService controls request routing and resilience policies at the route level.

Answer

ServiceEntry

Answer

DestinationRule

Answer

Gateway

Question 10

You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?

Accepted Answer

Increase interval, increase consecutive5xx.. A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.

Answer

Decrease interval, decrease consecutive5xx.

Answer

Decrease interval, increase consecutive5xx.

Answer

Disable outlierDetection and use only circuitBreaking.

Answer

Increase interval, decrease consecutive5xx.