ICA Practice Test 15 — 15 Questions

Question 1

How do you handle SNI-based routing in a Gateway?

Accepted Answer

Gateway TLS section. The TLS block in the Gateway server configuration handles SNI and certificate management.

Answer

VirtualService

Answer

DestinationRule

Answer

ServiceEntry

Question 2

When multiple AuthorizationPolicies target the same workload, how are they combined?

Accepted Answer

Policies are unioned (OR logic) for ALLOW actions.. If multiple policies are applied to the same workload, they are evaluated using an additive approach (OR logic) for ALLOW policies within the same namespace.

Answer

The most specific policy wins, others are ignored.

Answer

The first policy encountered in the API server wins.

Answer

All policies must match (AND logic).

Question 3

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn

Question 4

What is the purpose of the 'sidecar' resource in Istio?

Accepted Answer

To limit the configuration sent to a proxy. Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.

Answer

To encrypt traffic

Answer

To manage external services

Answer

To define load balancing

Question 5

How do you specify a custom header match in a VirtualService?

Accepted Answer

Using the match field in a VirtualService. The match block within a VirtualService route supports header matching using the headers key.

Answer

Using a DestinationRule

Answer

Using a ServiceEntry

Answer

Using a Gateway

Question 6

What happens if you have two VirtualServices for the same host?

Accepted Answer

They are merged. Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.

Answer

The last one wins

Answer

Both ignored

Answer

Error thrown

Question 7

Which protocols can be defined in a Gateway server? (Choose THREE)

Accepted Answer

TCP. Gateways support HTTP, HTTPS, and TCP.

Answer

UDP

Answer

FTP

Question 8

To strip a URL prefix before passing a request to a backend service, which field do you use?

Accepted Answer

rewrite. The rewrite field in a VirtualService can modify the URI path.

Answer

prefix

Answer

path

Answer

redirect

Question 9

Which TWO mechanisms are used to secure traffic within the mesh?

Accepted Answer

PeerAuthentication. PeerAuthentication (for mTLS mode) and AuthorizationPolicy (for access control) are key.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 10

You want to limit the number of concurrent connections to a service. Which field in the DestinationRule handles this?

Accepted Answer

connectionPool. The connectionPool field in the trafficPolicy allows setting maxConnections for circuit breaking.

Answer

outlierDetection

Answer

loadBalancer

Answer

portLevelSettings

Question 11

How do you configure an Istio Gateway to handle HTTPS?

Accepted Answer

Gateway. A Gateway requires a 'servers' block with 'tls' settings and a reference to a Kubernetes secret.

Answer

DestinationRule

Answer

VirtualService

Answer

ServiceEntry

Question 12

You need to expose a service to traffic outside the mesh using Istio. Which resource is required to configure the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource describes a load balancer operating at the edge of the mesh.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 13

You want to perform a 'headers' modification on an incoming request. Which resource allows this?

Accepted Answer

VirtualService. VirtualService allows header manipulation (add, remove, replace) in the route action.

Answer

DestinationRule

Answer

EnvoyFilter

Answer

Gateway

Question 14

You have multiple VirtualServices for the same host. How does Istio determine which one to use?

Accepted Answer

Istio merges them. Istio merges them based on the configuration logic, but you should avoid duplicate rules to prevent unpredictable behavior.

Answer

Alphabetical order

Answer

The one in the default namespace

Answer

The latest one applied

Question 15

Which TWO parameters are used to define a 'match' criteria in a VirtualService?

Accepted Answer

headers. Headers and authority (or URI) are valid match conditions.

Answer

timeout

Answer

subset

Answer

retries