ICA Practice Test 14 — 15 Questions

Question 1

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

Accepted Answer

RequestAuthentication for issuer, then AuthorizationPolicy to verify.. You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.

Answer

Only DestinationRule.

Answer

Only ServiceEntry.

Answer

Only PeerAuthentication.

Question 2

You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?

Accepted Answer

VirtualService. Timeouts are a property of the route in a VirtualService.

Answer

Gateway

Answer

DestinationRule

Answer

ServiceEntry

Question 3

What is the default Istio load balancing algorithm?

Accepted Answer

ROUND_ROBIN. ROUND_ROBIN is the default load balancing strategy in Istio.

Answer

RANDOM

Answer

PASSTHROUGH

Answer

LEAST_CONN

Question 4

In OutlierDetection, what is the effect of setting 'maxEjectionPercent' to 0?

Accepted Answer

It disables outlier detection.. Setting this to 0 effectively disables outlier detection, as no hosts can be ejected.

Answer

It makes the ejection time infinite.

Answer

It forces all hosts to be healthy.

Answer

It ejects hosts immediately.

Answer

It ejects all hosts.

Question 5

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Accepted Answer

The number of requests that exceeded the timeout to an upstream service.. This metric indicates the number of requests that timed out while waiting for a response from the upstream service.

Answer

The average time of all requests.

Answer

The total number of upstream connections.

Answer

The number of successful requests.

Question 6

You want to perform a 'headers' modification on an incoming request. Which resource allows this?

Accepted Answer

VirtualService. VirtualService allows header manipulation (add, remove, replace) in the route action.

Answer

DestinationRule

Answer

EnvoyFilter

Answer

Gateway

Question 7

Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?

Accepted Answer

Istiod. Istiod is the control plane component responsible for distributing configuration to sidecars via the xDS protocol.

Answer

Kubernetes API Server

Answer

Prometheus

Answer

Envoy

Question 8

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

Accepted Answer

HTTPRoute. HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 9

How do you handle SNI-based routing in a Gateway?

Accepted Answer

Gateway TLS section. The TLS block in the Gateway server configuration handles SNI and certificate management.

Answer

VirtualService

Answer

DestinationRule

Answer

ServiceEntry

Question 10

You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?

Accepted Answer

Ensure DestinationRule subsets match VirtualService destination labels. In Istio, a VirtualService routes traffic to destination hosts, and when it references subsets (e.g., v1, v2), those subset names must be defined in a corresponding DestinationRule with matching labels. If the DestinationRule subsets do not match the labels used by the VirtualService destinations, routing fails or traffic is misdirected. Verifying that subset labels align between the two resources is the standard first troubleshooting step for VirtualService routing problems.

Answer

Delete the Gateway

Answer

Increase the sidecar memory limit

Answer

Restart the ingress gateway

Question 11

Which resources control mTLS settings? (Choose TWO)

Accepted Answer

DestinationRule. In Istio, mTLS settings are controlled by two resources: DestinationRule and PeerAuthentication. DestinationRule (B) is correct because its trafficPolicy.tls.mode field (e.g., ISTIO_MUTUAL, DISABLE, SIMPLE, MUTUAL) configures how a client sidecar initiates TLS/mTLS to an upstream service. PeerAuthentication (C) is correct because its mtls.mode field (STRICT, PERMISSIVE, DISABLE) defines the server-side policy for whether a workload accepts mTLS connections. Gateway (A) configures ingress/egress TLS termination for external traffic, not service-to-service mTLS policy. ServiceEntry (D) registers external services into the mesh and does not set mTLS modes. VirtualService (E) handles routing rules (hosts, routes, retries) and has no mTLS configuration field.

Answer

Gateway

Answer

ServiceEntry

Answer

VirtualService

Question 12

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

Accepted Answer

Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.. The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.

Answer

Configure the Gateway to filter by IP.

Answer

Use a ServiceEntry to restrict traffic.

Answer

Create a PeerAuthentication policy with 'ipBlocks'.

Question 13

What is the default value for 'consecutive5xx' in OutlierDetection?

Accepted Answer

5. The default value for consecutive5xx in Istio/Envoy is 5.

Answer

10

Answer

20

Answer

0

Answer

1

Question 14

When using a ServiceEntry for a TCP service, what protocol should be specified?

Accepted Answer

TCP. The resolution must be set to DNS or STATIC, and the protocol must match the traffic type (TCP).

Answer

HTTP

Answer

HTTPS

Answer

GRPC

Question 15

You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?

Accepted Answer

mirroring. Traffic mirroring allows sending a copy of traffic to a different service without affecting the main response.

Answer

subsetting

Answer

fault injection

Answer

canary