ICA Practice Test 19 — 15 Questions

Question 1

Which TWO fields are required when configuring an 'abort' fault injection in a VirtualService?

Accepted Answer

httpStatus. Abort requires both the percentage and the specific status code to be returned.

Answer

maxDuration

Answer

grpcStatus

Answer

delay

Question 2

Which 'istioctl' command is used to verify that the current Istio configuration in a cluster is valid and follows best practices?

Accepted Answer

istioctl analyze. The 'istioctl analyze' command inspects the cluster and identifies configuration errors or warnings.

Answer

istioctl check

Answer

istioctl diagnose

Answer

istioctl verify

Question 3

Which TWO fields in the IstioOperator CR are commonly used to configure ingress gateway resources?

Accepted Answer

spec.components.ingressGateways. The 'spec.components.ingressGateways' and 'spec.values.gateways.istio-ingressgateway' are the standard configuration areas for gateway resources.

Answer

spec.gateways.enabled

Answer

spec.pilot.gateways

Answer

spec.meshConfig.ingress

Question 4

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. You must update the 'istio.io/rev' label on the namespace to the new revision and then perform a rolling restart of the pods in that namespace.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically

Question 5

In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?

Accepted Answer

The remote cluster's kubeconfig is missing from the primary cluster's secret store.. In a shared control plane model, the primary cluster's control plane must be able to reach the remote cluster's Kubernetes API server to watch for service changes and push endpoints.

Answer

The mesh expansion service is not running on the remote cluster.

Answer

The Istio sidecar injection is disabled on the remote cluster.

Answer

The global namespace is missing a ServiceEntry.

Question 6

A team wants to enable sidecar injection for a specific namespace without modifying the deployment manifests. What is the most efficient way to achieve this?

Accepted Answer

kubectl label namespace <name> istio-injection=enabled. Labeling the namespace with 'istio-injection=enabled' triggers the sidecar injector webhook to automatically inject proxies into new pods.

Answer

istioctl inject -n <namespace>

Answer

kubectl apply -f sidecar-injector.yaml

Answer

kubectl annotate namespace <name> istio-injection=enabled

Question 7

You want to configure your microservice to be more resilient. Which THREE of the following are valid fields within an 'outlierDetection' policy in a DestinationRule?

Accepted Answer

consecutive5xxErrors. The outlierDetection object supports consecutive5xxErrors, interval, and baseEjectionTime.

Answer

http2MaxRequests

Answer

maxRequestsPerConnection

Question 8

Which THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?

Accepted Answer

interval. The standard fields include consecutive5xxErrors, interval, and baseEjectionTime.

Answer

requestRetryCount

Answer

maxConnectionTimeout

Question 9

You want to ensure that a request to the 'search' service fails fast if it takes longer than 2 seconds. How is this configured?

Accepted Answer

In the VirtualService, set 'timeout: 2s' in the route rule.. The timeout field in a VirtualService route rule controls the request duration limit.

Answer

In the EnvoyFilter, set 'timeout: 2s'.

Answer

In the Gateway, set 'timeout: 2s'.

Answer

In the DestinationRule, set 'timeout: 2s'.

Answer

In the ServiceEntry, set 'timeout: 2s'.

Question 10

Which TWO of the following are valid fields within a DestinationRule's 'trafficPolicy'?

Accepted Answer

connectionPool. connectionPool and outlierDetection are primary components of the trafficPolicy.

Answer

retryPolicy

Answer

virtualHosts

Answer

faultInjection

Question 11

You need to limit the number of concurrent connections to the 'orders' service. Which field in the DestinationRule do you configure?

Accepted Answer

trafficPolicy.connectionPool.tcp.maxConnections. The connectionPool settings within a DestinationRule allow you to control maxConnections for TCP or maxRequestsPerConnection for HTTP.

Answer

trafficPolicy.connectionPool.http.maxRequests

Answer

trafficPolicy.circuitBreaker.maxConnections

Answer

trafficPolicy.outlierDetection.maxConnections

Answer

trafficPolicy.loadBalancer.maxConnections

Question 12

A service is returning 5xx errors frequently. You want to eject instances that return 5 consecutive 5xx errors. Which OutlierDetection setting is required?

Accepted Answer

consecutive5xx: 5. consecutive5xx is the field used to trigger ejection based on the count of 5xx errors.

Answer

interval: 5s

Answer

maxEjectionPercent: 5

Answer

consecutiveErrors: 5

Answer

baseEjectionTime: 5s

Question 13

What is the primary purpose of adding a timeout to a service call?

Accepted Answer

To prevent resource exhaustion from hanging requests.. Timeouts prevent resources from being held indefinitely by slow or hung services.

Answer

To hide errors from the user.

Answer

To load balance more effectively.

Answer

To increase throughput.

Answer

To encrypt traffic.

Question 14

If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?

Accepted Answer

DENY policies always take precedence over ALLOW policies.. The 'DENY' action takes precedence over 'ALLOW'. If any DENY policy matches, the request is rejected regardless of any ALLOW policy.

Answer

ALLOW policies take precedence.

Answer

The policy with the highest priority field wins.

Answer

The policy applied most recently wins.

Question 15

You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?

Accepted Answer

DestinationRule. Connection pool settings are configured under trafficPolicy in the DestinationRule.

Answer

EnvoyFilter

Answer

ServiceEntry

Answer

VirtualService