ICA Practice Exam 2 — 20 Questions

Question 1

When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?

Accepted Answer

The service is outside the mesh but managed by Istio policies.. It tells Istio that the service is external to the mesh, but it should be treated as a first-class citizen for routing and policy purposes.

Answer

The service is a local cluster service.

Answer

The service does not exist.

Answer

The service is inside the mesh.

Question 2

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. To connect to an external service with mTLS, you need to define the service, configure egress, and provide the client certificates.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 3

Which of the following is true regarding Outlier Detection in Istio?

Accepted Answer

It automatically ejects instances that return 5xx errors.. Outlier Detection requires a destination rule and works by ejecting unhealthy instances based on their error rates.

Answer

It only works with TCP services.

Answer

It can be configured in a VirtualService.

Answer

It is used to rate limit traffic.

Answer

It requires an external monitoring tool.

Question 4

Which TWO are common causes for a service to be ejected by Outlier Detection?

Accepted Answer

Consecutive gateway failures.. Repeated 5xx errors and gateway failures are the two primary reasons.

Answer

High disk usage on the pod.

Answer

Too many users logged in.

Answer

High CPU usage on the pod.

Question 5

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Accepted Answer

The client proxy initiates mTLS handshakes.. STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.

Answer

All non-Istio traffic is automatically routed to the gateway.

Answer

The proxy automatically upgrades HTTP to HTTPS.

Question 6

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 7

Which THREE commands can be used to manage or inspect the Istio mesh configuration?

Accepted Answer

istioctl version. The 'istioctl' tool provides 'analyze', 'proxy-config', and 'version' commands for mesh inspection and management.

Answer

istioctl deploy

Answer

istioctl upgrade

Question 8

Which field in the trafficPolicy of a DestinationRule controls the maximum number of pending requests in the connection pool?

Accepted Answer

maxPendingRequests. maxRequestsPerConnection is used for HTTP/1.1 and maxPendingRequests for total pending requests.

Answer

maxRequests

Answer

pendingLimit

Answer

connectionLimit

Question 9

You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?

Accepted Answer

The namespace is excluded from Kiali's configuration.. If Kiali cannot find the service in the registry, it is likely because the namespace is not included in the Kiali configuration or the service lacks proper labels.

Answer

The sidecar is missing.

Answer

The Prometheus data retention period is too short.

Answer

The gateway is not configured correctly.

Question 10

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.

Question 11

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 12

What is the default timeout for an HTTP request in Istio when no VirtualService is defined?

Accepted Answer

15 seconds. Istio defaults to 15 seconds for request timeouts if not explicitly configured.

Answer

5 seconds

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Answer

0 (no timeout)

Question 13

When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?

Accepted Answer

Port. Listeners define the protocol, port, and hostname bindings for the gateway.

Answer

Request retries

Answer

Circuit breaker policy

Answer

Service account

Question 14

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 15

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule

Question 16

When using Kiali to debug service communication, which TWO metrics are most useful for identifying performance bottlenecks?

Accepted Answer

Request latency (P99). Latency and request rates (throughput) are the primary indicators of performance issues.

Answer

Number of active connections

Answer

CPU usage of the sidecar

Answer

Memory usage of the application

Question 17

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 18

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 19

Which THREE items can you configure in a VirtualService to improve resilience?

Accepted Answer

Retries. Timeouts, Retries, and Fault Injection are all controlled within a VirtualService.

Answer

Connection Pool

Answer

Outlier Detection

Question 20

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus