ICA Practice Exam 1 — 20 Questions

Question 1

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 2

An application is experiencing intermittent errors. You decide to use outlier detection to eject unhealthy pods. Which field in the DestinationRule controls the ejection of hosts after a certain number of 5xx errors?

Accepted Answer

consecutive5xxErrors. The 'consecutive5xxErrors' field in the 'outlierDetection' section of a DestinationRule is used to eject unhealthy hosts.

Answer

baseEjectionTime

Answer

interval

Answer

maxConnections

Question 3

When configuring circuit breaking, what does 'maxRequestsPerConnection' control?

Accepted Answer

The number of requests per individual connection.. It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.

Answer

The number of concurrent requests.

Answer

The total number of requests sent to a service.

Answer

The latency of each request.

Answer

The size of the request body.

Question 4

What is the primary function of the 'PeerAuthentication' resource?

Accepted Answer

Configure mTLS mode for workloads.. PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.

Answer

Apply rate limits to requests.

Answer

Limit egress traffic to external sites.

Answer

Route traffic based on headers.

Question 5

You need to integrate an external database into the mesh that does not support mTLS. How do you configure it securely?

Accepted Answer

Define a ServiceEntry and use an EgressGateway for controlled access.. Use a ServiceEntry to define the external service, and an EgressGateway to handle TLS origination if needed, or simply restrict traffic via an AuthorizationPolicy.

Answer

Run a sidecar on the database server.

Answer

Enable 'PERMISSIVE' mTLS mode for the entire mesh.

Answer

Create a Kubernetes Service with the database IP.

Question 6

You want to simulate a 5-second network latency for 10% of requests to the 'cart' service. Which VirtualService configuration is correct?

Accepted Answer

fault: { delay: { percentage: { value: 10 }, fixedDelay: 5s } }. The fault injection delay policy requires both a percentage and a fixedDelay duration.

Answer

fault: { delay: { fixedDelay: 5s } }

Answer

fault: { delay: 5s, weight: 0.1 }

Answer

fault: { delay: { percentage: 10, latency: 5s } }

Answer

fault: { abort: { percentage: 10, duration: 5s } }

Question 7

How do you define a circuit breaker that limits the number of pending requests?

Accepted Answer

http1MaxPendingRequests. The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.

Answer

maxRequestsInQueue

Answer

maxPending

Answer

pendingRequestsLimit

Answer

maxPendingRequests

Question 8

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Accepted Answer

The number of requests that exceeded the timeout to an upstream service.. This metric indicates the number of requests that timed out while waiting for a response from the upstream service.

Answer

The average time of all requests.

Answer

The total number of upstream connections.

Answer

The number of successful requests.

Question 9

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Accepted Answer

from. An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).

Answer

action

Answer

selector

Question 10

If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?

Accepted Answer

It allows both mTLS and plaintext.. PERMISSIVE mode allows both mTLS and plaintext traffic to coexist, which is ideal for migrations.

Answer

It requires plaintext only.

Answer

It requires mTLS only.

Answer

It disables all security.

Question 11

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource defines the entry point, including listeners, ports, and protocols.

Answer

Service

Answer

Ingress

Answer

HTTPRoute

Question 12

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 13

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

Accepted Answer

HTTPRoute. HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 14

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 15

Which component is responsible for the actual enforcement of circuit breaking and fault injection?

Accepted Answer

Envoy proxy. The Envoy proxy (sidecar) performs the enforcement based on the configuration pushed by Istiod.

Answer

Kubernetes API Server

Answer

Istiod

Answer

Prometheus

Answer

Ingress Gateway

Question 16

What is the default value for 'consecutive5xx' in OutlierDetection?

Accepted Answer

5. The default value for consecutive5xx in Istio/Envoy is 5.

Answer

10

Answer

20

Answer

0

Answer

1

Question 17

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Accepted Answer

A shared 'cacerts' secret containing the root CA certificate.. For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.

Answer

A ServiceEntry with 'resolution: DNS'.

Answer

An AuthorizationPolicy allowing all traffic.

Answer

An EgressGateway with TLS origination.

Question 18

Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?

Accepted Answer

Telemetry. The Istio Telemetry component, often integrated into the sidecar and processed by the Istio control plane, handles data collection.

Answer

Envoy

Answer

Jaeger

Answer

Kiali

Question 19

Which command is used to restart an Istio sidecar without restarting the application container?

Accepted Answer

You must restart the pod.. In Kubernetes, you cannot restart just one container in a pod. You must restart the pod.

Answer

istioctl proxy-config restart

Answer

kubectl exec to the sidecar and kill process.

Answer

istioctl inject --restart

Question 20

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. istioctl is the primary diagnostic tool for Istio.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh