ICA Practice Test 12 — 15 Questions

Question 1

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 2

You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?

Accepted Answer

Configure an Egress Gateway and use a DestinationRule with client-side mTLS certificates.. You must use an Egress Gateway with mTLS configured to the external service.

Answer

Apply a RequestAuthentication policy.

Answer

Configure an Ingress Gateway.

Answer

Use a PeerAuthentication policy on the external service.

Question 3

You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?

Accepted Answer

timeout. In Istio's traffic management API, the timeout field on an HTTP route specifies how long a request may take before Envoy aborts it and returns a 504. Setting timeout: 2s on the route ensures any request exceeding two seconds fails immediately rather than hanging. This is the correct knob for bounding request latency at the mesh layer.

Answer

delay

Answer

maxConnections

Answer

maxRetries

Question 4

You want to configure your microservice to be more resilient. Which THREE of the following are valid fields within an 'outlierDetection' policy in a DestinationRule?

Accepted Answer

consecutive5xxErrors. In Istio's DestinationRule, the outlierDetection policy supports consecutive5xxErrors (A), which sets the number of consecutive 5xx errors that trigger ejection of a host from the load-balancing pool. It also supports interval (B), which defines the time interval between ejection sweep analyses of the hosts. And it supports baseEjectionTime (D), which specifies the minimum ejection duration for an outlier host, multiplied by the number of times it has been ejected. The options http2MaxRequests (C) and maxRequestsPerConnection (E) are not part of outlierDetection; they belong to the connectionPool settings (specifically the http and tcp subfields) of a DestinationRule's trafficPolicy, used for connection-pool limits rather than outlier ejection.

Answer

http2MaxRequests

Answer

maxRequestsPerConnection

Question 5

To strip a URL prefix before passing a request to a backend service, which field do you use?

Accepted Answer

rewrite. The rewrite field in a VirtualService can modify the URI path.

Answer

prefix

Answer

path

Answer

redirect

Question 6

If you want to use a custom proxy image for your sidecars, where should this be specified in the IstioOperator configuration?

Accepted Answer

spec.values.global.proxy.image. The 'spec.values.global.proxy.image' field is used to override the default image for the sidecar proxies.

Answer

spec.components.proxy.image

Answer

spec.meshConfig.defaultConfig.proxyImage

Answer

spec.sidecarInjector.image

Question 7

You want to inject a 5-second delay into requests for testing. Which resource allows this?

Accepted Answer

VirtualService. A VirtualService is the Istio resource that defines traffic routing rules, including fault injection. The 'fault' stanza with 'delay' (fixedDelay or exponentialDelay) injects latency into requests matching the route, which is exactly what's needed to simulate a 5-second delay for chaos/resilience testing. This is a first-class VirtualService capability, not something you configure in DestinationRule or Gateway.

Answer

Sidecar

Answer

EnvoyFilter

Answer

DestinationRule

Answer

Gateway

Question 8

Which of the following are valid DestinationRule fields? (Choose THREE)

Accepted Answer

host. In Istio's networking API, a DestinationRule is defined by the fields host, trafficPolicy, and subsets, so options B, C, and D are correct. The host field (B) is required and specifies the name of the service (or the Kubernetes service FQDN) to which the routing rules apply. The trafficPolicy field (C) defines policies such as load balancing, connection pool settings, outlier detection, and TLS settings applied to traffic to that host. The subsets field (D) defines named subsets of the service's endpoints (via labels) so that VirtualService routes can direct traffic to specific versions. Options A (redirect) and E (match) are not DestinationRule fields: redirect is a route action used in VirtualService HTTP/TCP route destinations, and match is used in VirtualService route matching conditions, not in DestinationRule.

Answer

redirect

Answer

match

Question 9

You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?

Accepted Answer

Create a ServiceEntry. A ServiceEntry adds an external service to Istio's internal service registry, giving it a mesh-internal hostname, ports, and resolution mode. Once registered, mesh sidecars can route to the external dependency through Istio's traffic management (with policies, TLS origination, etc.). This is the canonical way to allow egress to services not in the Kubernetes registry.

Answer

Create a VirtualService

Answer

Create an EnvoyFilter

Answer

Create a DestinationRule

Question 10

Which field in the VirtualService allows you to redirect traffic to a different URI?

Accepted Answer

redirect. In Istio's VirtualService resource, the redirect field is specifically designed to issue an HTTP 301/302 redirect to a different URI or authority, replacing the original request target. It is mutually exclusive with route and rewrite, and is evaluated at the virtual host level before any route matching occurs. This makes redirect the correct field when the goal is to send clients to a new URI rather than transparently rewriting the path.

Answer

delegate

Answer

mirror

Answer

rewrite

Question 11

You need to define a local service that is not in the cluster. How?

Accepted Answer

ServiceEntry. ServiceEntry with location: MESH_INTERNAL allows defining services that are technically outside the K8s registry but internal to the mesh.

Answer

DestinationRule

Answer

VirtualService

Answer

Gateway

Question 12

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 13

What is the recommended way to test fault injection in a production environment?

Accepted Answer

Using header-based matches in a VirtualService.. Using header-based matching allows you to target faults to specific test traffic without impacting all users.

Answer

Injecting faults in the code.

Answer

Using a separate mesh for testing.

Answer

Enabling it for 1% of traffic using weight.

Answer

Applying it globally to all users.

Question 14

Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?

Accepted Answer

istioctl analyze. istioctl analyze performs static analysis of the Istio configuration in a cluster (or from files) and reports validation errors, warnings, and best-practice violations, such as misconfigured VirtualServices, missing sidecars, or deprecated fields. It is the canonical command for verifying configuration correctness and adherence to Istio's recommended patterns.

Answer

istioctl check

Answer

istioctl diagnose

Answer

istioctl verify

Question 15

Which resource is used to provide a unified entry point for multiple services?

Accepted Answer

Gateway. An Istio Gateway provides a unified entry point for multiple services by configuring a load balancer at the edge of the mesh to accept inbound HTTP/TCP traffic and route it to VirtualServices. A single Gateway resource can host multiple VirtualService bindings, each routing different hostnames or paths to different backend services, making it the canonical 'north-south' entry point in Istio.

Answer

ServiceEntry

Answer

VirtualService

Answer

EnvoyFilter