ICA Practice Test 2 — 10 Questions

Question 1

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource defines the entry point, including listeners, ports, and protocols.

Answer

Service

Answer

Ingress

Answer

HTTPRoute

Question 2

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 3

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

Accepted Answer

HTTPRoute. HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 4

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 5

Which component is responsible for the actual enforcement of circuit breaking and fault injection?

Accepted Answer

Envoy proxy. The Envoy proxy (sidecar) performs the enforcement based on the configuration pushed by Istiod.

Answer

Kubernetes API Server

Answer

Istiod

Answer

Prometheus

Answer

Ingress Gateway

Question 6

What is the default value for 'consecutive5xx' in OutlierDetection?

Accepted Answer

5. The default value for consecutive5xx in Istio/Envoy is 5.

Answer

10

Answer

20

Answer

0

Answer

1

Question 7

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Accepted Answer

A shared 'cacerts' secret containing the root CA certificate.. For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.

Answer

A ServiceEntry with 'resolution: DNS'.

Answer

An AuthorizationPolicy allowing all traffic.

Answer

An EgressGateway with TLS origination.

Question 8

Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?

Accepted Answer

Telemetry. The Istio Telemetry component, often integrated into the sidecar and processed by the Istio control plane, handles data collection.

Answer

Envoy

Answer

Jaeger

Answer

Kiali

Question 9

Which command is used to restart an Istio sidecar without restarting the application container?

Accepted Answer

You must restart the pod.. In Kubernetes, you cannot restart just one container in a pod. You must restart the pod.

Answer

istioctl proxy-config restart

Answer

kubectl exec to the sidecar and kill process.

Answer

istioctl inject --restart

Question 10

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. istioctl is the primary diagnostic tool for Istio.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh