ICA Practice Test 20 — 15 Questions

Question 1

You want to configure outlier detection to eject hosts that return 5xx errors. Is it possible to monitor more than just 5xx codes?

Accepted Answer

Yes, using the 'consecutiveGatewayFailure' field.. Outlier detection supports consecutive Gateway errors (502, 503, 504) as well as 5xx codes.

Answer

Yes, but only via an EnvoyFilter.

Answer

No, you must use circuit breaking for other codes.

Answer

Yes, using the 'regex' field.

Answer

No, only 5xx is supported.

Question 2

To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?

Accepted Answer

abort. The abort fault injection allows specifying a status code and percentage.

Answer

circuitBreaker

Answer

outlierDetection

Answer

delay

Question 3

You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?

Accepted Answer

Configure an AuthorizationPolicy in Namespace Y with a 'DENY' action for all principals.. AuthorizationPolicies are the primary tool for fine-grained access control. A 'deny-all' policy in the target namespace followed by explicit permit rules enforces strict isolation.

Answer

Set the global mesh config to 'REGISTRY_ONLY'.

Answer

Remove the service accounts from the mesh.

Answer

Use Kubernetes NetworkPolicies instead of Istio.

Question 4

Which setting is used to limit the number of retries for a request?

Accepted Answer

attempts. The 'retries' policy in a VirtualService allows you to define the number of attempts.

Answer

retryLimit

Answer

maxRetries

Answer

retryCount

Answer

maxAttempts

Question 5

Which of the following describes the difference between Circuit Breaking and Outlier Detection?

Accepted Answer

Circuit Breaking monitors request load, Outlier Detection monitors host health.. Circuit Breaking is for request limits (concurrency), while Outlier Detection is for host health (ejection).

Answer

Circuit Breaking is for ingress, Outlier Detection is for egress.

Answer

Circuit Breaking is proactive, Outlier Detection is reactive.

Answer

Outlier Detection is for connection pooling.

Answer

Circuit Breaking only works on TCP.

Question 6

How do you specify the percentage of traffic that should experience a fault?

Accepted Answer

Using a 'percentage' object with a 'value' field.. The 'percentage' field within the fault injection block uses a 'value' field (0-100).

Answer

Using a 'weight' field.

Answer

Using a 'threshold' field.

Answer

Using the 'ratio' field.

Answer

Using a 'rate' field in the VirtualService.

Question 7

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

Accepted Answer

To allow the control plane to manage the remote cluster's services.. The secret allows the control plane in the primary cluster to authenticate and access the Kubernetes API of the remote cluster.

Answer

To store custom headers for cross-cluster traffic.

Answer

To identify the cluster in the mesh.

Answer

To encrypt traffic between clusters.

Question 8

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

Accepted Answer

istiod. The istiod control plane watches the Kubernetes Gateway API resources and generates the corresponding Envoy proxy configuration.

Answer

The Kiali operator

Answer

The Envoy proxy sidecar

Answer

The ingress-gateway deployment

Question 9

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

Accepted Answer

The traffic is encountering high error rates or being blocked by an Istio policy.. In Kiali, a red line indicates that traffic is failing or being rejected by an Istio policy.

Answer

The services are located in different clusters.

Answer

The service is not part of the mesh.

Answer

The connection is encrypted using mTLS.

Question 10

What is the purpose of the 'PILOT_ENABLE_MTLS_OVERRIDE' environment variable in istiod?

Accepted Answer

Allows legacy sidecars to override mTLS settings.. This is a deprecated or legacy setting, but in specific contexts, it was used to allow sidecars to override global mTLS settings, though modern versions prefer AuthorizationPolicies.

Answer

Forces mTLS on all traffic.

Answer

Disables mTLS for testing.

Answer

Enables certificate rotation.

Question 11

You are troubleshooting a service that is failing to communicate with another service in a different namespace. Which TWO of the following items should you check to ensure connectivity?

Accepted Answer

PeerAuthentication settings. Communication requires both network routing (usually allowed by default) and Istio-level authorization.

Answer

Kiali's current theme settings.

Answer

The Istio ingress gateway version.

Answer

The number of sidecars running in the cluster.

Question 12

You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?

Accepted Answer

The application is not propagating the trace headers.. Tracing relies on the propagation of B3 or W3C Trace Context headers. If external services do not support this, the trace chain is broken.

Answer

The Jaeger collector is not configured in istio-system.

Answer

The sidecar is not configured for egress.

Answer

The MeshConfig 'sampling' value is too low.

Question 13

You want to implement a 'Deny-All' strategy for your mesh and explicitly whitelist only necessary traffic. What is the correct order to achieve this?

Accepted Answer

Create an AuthorizationPolicy with action 'DENY' and no rules, then add ALLOW policies.. Apply a global AuthorizationPolicy with action 'DENY' and selector 'matchLabels: {}', then apply granular 'ALLOW' policies for specific services.

Answer

Modify the Istio mesh configuration to default to DENY.

Answer

Use NetworkPolicies instead of AuthorizationPolicies.

Answer

Use PeerAuthentication to block all traffic.

Question 14

Which tool would you use to verify if a pod has an active mTLS connection?

Accepted Answer

istioctl proxy-config secret <pod-name>. The 'istioctl proxy-config secret' command shows the certificates loaded into the proxy, which is a good indicator of mTLS readiness.

Answer

istioctl proxy-config endpoint <pod-name>

Answer

istioctl dashboard envoy <pod-name>

Answer

kubectl get mTLS

Question 15

In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?

Accepted Answer

Service 'B' is not exported to the local cluster via an ExportTo policy.. Even with multi-cluster discovery, services must be explicitly defined in the mesh registry via ServiceEntry, or the internal DNS name must be resolvable.

Answer

The sidecar image versions differ.

Answer

The cluster network is not configured in meshConfig.

Answer

The istio-ingressgateway is not installed.