ICA Practice Test 13 — 15 Questions

Question 1

Which type of routing allows you to route to different services based on URL path?

Accepted Answer

VirtualService. VirtualService 'match' can use 'uri' with 'prefix' or 'exact' matches to route to different services.

Answer

DestinationRule

Answer

Gateway

Answer

ServiceEntry

Question 2

Which criteria can be used in a VirtualService 'match' block? (Choose THREE)

Accepted Answer

uri. VirtualService matches support URI, HTTP headers, and source labels.

Answer

connectionPool

Answer

weight

Question 3

When using a ServiceEntry for a TCP service, what protocol should be specified?

Accepted Answer

TCP. The resolution must be set to DNS or STATIC, and the protocol must match the traffic type (TCP).

Answer

HTTP

Answer

HTTPS

Answer

GRPC

Question 4

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Accepted Answer

It defaults to ALLOW.. If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.

Answer

The request is rejected.

Answer

It defaults to DENY.

Answer

The policy is invalid.

Question 5

How do you define a circuit breaker that trips after 3 consecutive errors?

Accepted Answer

DestinationRule. The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.

Answer

ServiceEntry

Answer

Gateway

Answer

VirtualService

Question 6

Which are valid match conditions in VirtualService? (Choose THREE)

Accepted Answer

headers. Match conditions include headers, uri, and port.

Answer

timeout

Answer

weight

Question 7

Which protocol is used for the Istio data plane mTLS communication?

Accepted Answer

TLS 1.2/1.3. Istio uses mutual TLS (mTLS) over HTTP/2 or standard HTTP to provide encryption and identity.

Answer

VPN

Answer

SSH

Answer

IPsec

Question 8

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?

Accepted Answer

RequestAuthentication. RequestAuthentication is specifically designed to configure how Istio validates JWT tokens.

Answer

AuthorizationPolicy

Answer

ServiceEntry

Answer

PeerAuthentication

Question 9

Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?

Accepted Answer

Requests are rejected when mTLS is not used by the client.. Correct operation is confirmed by successful communication under STRICT mode (using sidecars) and by observing mTLS metrics/logs.

Answer

Traffic from outside the mesh can reach the service in STRICT mode without modification.

Answer

All traffic is logged in plain text in the Envoy logs.

Answer

The API server allows non-mTLS traffic by default.

Question 10

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

Accepted Answer

PERMISSIVE mTLS. Istio defaults to PERMISSIVE mode, which allows both mTLS and plaintext traffic.

Answer

STRICT mTLS

Answer

Plaintext only

Answer

Disabled

Question 11

Which TWO of the following are true regarding the RequestAuthentication resource?

Accepted Answer

It can be applied to specific workloads using a selector.. RequestAuthentication is used to validate JWTs and can be applied at the namespace or workload level.

Answer

It enforces that the request MUST have a JWT token.

Answer

It handles the issuance of JWT tokens.

Answer

It replaces the need for PeerAuthentication.

Question 12

What is the default Istio load balancing algorithm?

Accepted Answer

ROUND_ROBIN. ROUND_ROBIN is the default load balancing strategy in Istio.

Answer

RANDOM

Answer

PASSTHROUGH

Answer

LEAST_CONN

Question 13

You need to ensure that traffic is only routed to healthy pods. What feature does this?

Accepted Answer

DestinationRule outlierDetection. Outlier detection in DestinationRule ejects unhealthy hosts from the load balancing pool.

Answer

ServiceEntry registry

Answer

PeerAuthentication

Answer

VirtualService weight

Question 14

Which resource type is used for mTLS policy?

Accepted Answer

PeerAuthentication. PeerAuthentication is the specific CRD for mTLS.

Answer

VirtualService

Answer

DestinationRule

Answer

Gateway

Question 15

What is the function of the 'weight' parameter in a VirtualService route?

Accepted Answer

To split traffic between multiple destinations. Weight determines the percentage of traffic directed to a specific destination.

Answer

To specify the TTL of a request

Answer

To limit bandwidth usage

Answer

To set the priority of a rule