ICA Practice Test 13 — 15 Questions

Question 1

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

Accepted Answer

The traffic is encountering high error rates or being blocked by an Istio policy.. In Kiali's graph view, edge colors encode traffic health: green means healthy, yellow means degraded, and red means the request/response flow is failing. A red line specifically indicates that the destination workload is returning errors (typically 5xx) or that traffic is being denied by an Istio policy such as an AuthorizationPolicy or a misconfigured PeerAuthentication. Kiali derives this from Envoy sidecar telemetry (istio_requests_total), so the red edge is a symptom of actual request failures, not a topology or encryption state.

Answer

The services are located in different clusters.

Answer

The service is not part of the mesh.

Answer

The connection is encrypted using mTLS.

Question 2

Which of these are valid sub-commands for istioctl? (Choose TWO)

Accepted Answer

analyze. Option B, analyze, is a valid istioctl sub-command: `istioctl analyze` performs configuration analysis on Istio resources and reports potential issues such as misconfigurations or deprecated fields. Option C, proxy-config, is also valid: `istioctl proxy-config` (often abbreviated `pc`) retrieves Envoy configuration from a sidecar or gateway, with subcommands like `cluster`, `listener`, `route`, `endpoint`, and `bootstrap`. The other options are not istioctl sub-commands: restart and start are not provided by istioctl (workload restarts are done via kubectl or by deleting pods), and debug, while istioctl has diagnostic commands such as `proxy-status` and `experimental`, is not a valid top-level sub-command.

Answer

restart

Answer

start

Answer

debug

Question 3

Which type of routing allows you to route to different services based on URL path?

Accepted Answer

VirtualService. VirtualService 'match' can use 'uri' with 'prefix' or 'exact' matches to route to different services.

Answer

DestinationRule

Answer

Gateway

Answer

ServiceEntry

Question 4

A service is returning 5xx errors frequently. You want to eject instances that return 5 consecutive 5xx errors. Which OutlierDetection setting is required?

Accepted Answer

consecutive5xx: 5. The `consecutive5xx` field in Istio's OutlierDetection configuration is specifically designed to count consecutive 5xx HTTP response codes from an upstream host. When the count reaches the configured threshold (5 in this case), the host is ejected from the load balancing pool for a period defined by `baseEjectionTime`. This directly matches the requirement to eject instances after 5 consecutive 5xx errors, making `consecutive5xx: 5` the correct setting.

Answer

interval: 5s

Answer

maxEjectionPercent: 5

Answer

consecutiveErrors: 5

Answer

baseEjectionTime: 5s

Question 5

Which component is responsible for the actual enforcement of circuit breaking and fault injection?

Accepted Answer

Envoy proxy. The Envoy proxy (sidecar) performs the enforcement based on the configuration pushed by Istiod.

Answer

Kubernetes API Server

Answer

Istiod

Answer

Prometheus

Answer

Ingress Gateway

Question 6

You want to access an external API (e.g., api.google.com) from within your mesh. What must you configure?

Accepted Answer

ServiceEntry. ServiceEntry allows adding entries to the Istio internal service registry for external endpoints.

Answer

DestinationRule

Answer

VirtualService

Answer

EnvoyFilter

Question 7

You need to inspect the envoy config for a specific pod. Which command do you use?

Accepted Answer

istioctl proxy-config all. istioctl proxy-config all <pod-name> shows all configuration for that proxy.

Answer

istioctl get config

Answer

kubectl get proxy

Answer

istioctl inspect

Question 8

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

Accepted Answer

PERMISSIVE mTLS. Istio defaults to PERMISSIVE mode, which allows both mTLS and plaintext traffic.

Answer

STRICT mTLS

Answer

Plaintext only

Answer

Disabled

Question 9

Which THREE things happen when a request fails and a retry policy is active?

Accepted Answer

Checks if the error code matches 'retryOn'.. When a request fails and a retry policy is active, the policy first evaluates the failure by checking whether the returned error code matches the configured 'retryOn' conditions (option B), since only matching errors trigger a retry. If the error qualifies, the policy attempts the request again (option C), re-issuing the call to the target. Before that retry, it waits for the specified backoff period (option D), which may be fixed or exponential, to avoid overwhelming the endpoint. Option A is incorrect because host ejection is a separate outlier-detection mechanism, not an immediate retry-policy action. Option E is incorrect because opening the circuit breaker is governed by circuit-breaking thresholds, not by the retry policy itself.

Answer

Ejects the host immediately.

Answer

Opens the circuit breaker.

Question 10

What is the result of setting 'outlierDetection' in a DestinationRule?

Accepted Answer

Unhealthy endpoints are temporarily ejected from the load balancing pool.. The outlierDetection field in an Istio DestinationRule configures outlier ejection, which is Istio's implementation of passive health checking. When an endpoint in the load balancing pool returns a consecutive number of 5xx errors (default consecutive5xxErrors: 5) within a defined interval, Envoy ejects that endpoint from the pool for a base ejection time (default 30s), preventing traffic from being routed to the unhealthy pod. This is analogous to circuit breaking at the endpoint level and improves overall service reliability without requiring active health checks.

Answer

Logs are sent to a remote collector.

Answer

Traffic is automatically retried.

Answer

Connections are encrypted.

Question 11

Which parameters can be configured in a VirtualService retry policy? (Choose TWO)

Accepted Answer

attempts. In Istio's VirtualService HTTP retry policy, the retry block supports fields such as attempts, perTryTimeout, retryOn, and retryRemoteLocalities, so option B (attempts) is correct because it specifies the maximum number of retry attempts for a failed request, and option E (perTryTimeout) is correct because it sets the timeout for each individual retry attempt. The other options do not belong to the retry policy: maxConnections (A) and connectionPool (C) are DestinationRule traffic-policy settings controlling connection limits, and outlierDetection (D) is a DestinationRule setting for ejecting unhealthy hosts from the load-balancing pool.

Answer

maxConnections

Answer

connectionPool

Answer

outlierDetection

Question 12

When using IstioOperator to customize the installation, you want to change the number of replicas for the Istiod control plane. Where should this be defined?

Accepted Answer

spec.components.pilot.k8s.replicaCount. The IstioOperator API defines component-level Kubernetes settings under spec.components.<component>.k8s, so the Istiod replica count is set at spec.components.pilot.k8s.replicaCount. This is the canonical location for overriding the pilot (Istiod) Deployment's replica count during installation. The value is merged into the generated Istiod Deployment manifest, allowing you to scale the control plane declaratively via the operator.

Answer

spec.values.pilot.scaling

Answer

spec.meshConfig.pilot.replicas

Answer

spec.pilot.replicas

Question 13

Which items can be configured under DestinationRule trafficPolicy? (Choose THREE)

Accepted Answer

connectionPool. In Istio, a DestinationRule's trafficPolicy block governs how traffic is handled after routing has selected a destination, and it explicitly supports connectionPool (A), which sets TCP/HTTP connection limits such as maxConnections, http1MaxPendingRequests, and http2MaxRequests for the destination's sidecar connections. It also supports outlierDetection (D), which implements passive health checking by ejecting unhealthy hosts from the load-balancing pool based on consecutive 5xx errors or gateway failures. loadBalancer (E) is likewise a valid trafficPolicy field, configuring the algorithm (ROUND_ROBIN, LEAST_REQUEST, RANDOM, PASSTHROUGH) and consistent-hash options for distributing requests across the destination's endpoints. By contrast, rewrite (B) and headers (C) are HTTP route-level manipulations that belong to a VirtualService's route rules, not to DestinationRule trafficPolicy, so they are not configurable there.

Answer

rewrite

Answer

headers

Question 14

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

Accepted Answer

Allow all traffic.. By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.

Answer

Allow only traffic within the same namespace.

Answer

Deny all traffic.

Answer

Require mTLS for all traffic.

Question 15

A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?

Accepted Answer

DestinationRule. DestinationRule allows the configuration of traffic policies including circuit breaking via the outlierDetection field.

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter