ICA Practice Exam 3 — 20 Questions

Question 1

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.

Question 2

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Accepted Answer

It allows all requests.. An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.

Answer

It crashes the proxy.

Answer

It requires valid mTLS.

Answer

It denies all requests.

Question 3

Which of the following is a valid method for performing fault injection?

Accepted Answer

Using a VirtualService to inject delays.. Istio supports both delay and abort faults via VirtualService.

Answer

Using a ServiceEntry to redirect traffic.

Answer

Using a DestinationRule to drop connections.

Answer

Using an EnvoyFilter to rewrite headers.

Answer

Using a Gateway to block traffic.

Question 4

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror

Question 5

Which component is responsible for enforcing traffic policies in the data plane?

Accepted Answer

Envoy proxy. The Envoy proxy (injected as a sidecar) handles all data plane traffic management.

Answer

Ingress Gateway

Answer

istiod

Answer

Kiali

Question 6

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

Accepted Answer

It forwards the token to the application.. When set to true, the proxy forwards the original JWT to the application, allowing the application to use the token for backend calls.

Answer

It deletes the token from the request.

Answer

It encrypts the token.

Answer

It logs the token to the audit log.

Question 7

What is the purpose of the 'retryOn' field in a VirtualService?

Accepted Answer

To specify conditions for retrying. It specifies the conditions (e.g., 5xx, gateway-error) that trigger a retry.

Answer

To limit total attempts

Answer

To specify wait time

Answer

To enable circuit breaking

Question 8

What does the 'mirror' feature in a VirtualService do?

Accepted Answer

Sends a copy of live traffic to a test service. Mirroring sends a copy of traffic to a different service without affecting the primary response.

Answer

Splits traffic 50/50

Answer

Encrypts traffic

Answer

Retries failed requests

Question 9

What is the function of the 'weight' parameter in a VirtualService route?

Accepted Answer

To split traffic between multiple destinations. Weight determines the percentage of traffic directed to a specific destination.

Answer

To specify the TTL of a request

Answer

To limit bandwidth usage

Answer

To set the priority of a rule

Question 10

Which TWO fields are mandatory in a Gateway resource?

Accepted Answer

selector. In an Istio Gateway resource, the servers field (E) is mandatory because it defines the ports, protocols, hosts, and TLS settings that the gateway listens on—without at least one server entry the gateway has nothing to configure. The selector field (C) is also mandatory since it binds the Gateway to the specific Envoy proxy pods (via labels such as istio: ingressgateway) that should implement the configuration. The subsets field (A) belongs to a DestinationRule's traffic policy, not to a Gateway, so it is not required here. The tls field (B) is optional and only needed when a server terminates or originates TLS. The hosts field (D) is configured inside each server entry, not as a top-level mandatory Gateway field.

Answer

subsets

Answer

tls

Answer

hosts

Question 11

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

Accepted Answer

Health status (errors/warnings). Option B is correct because the Kiali Graph view overlays health status on the topology, coloring nodes and edges to indicate errors and warnings (for example, red for errors and yellow for warnings) so operators can quickly spot unhealthy services. Option C is correct because the Graph view's core purpose is visualizing service-to-service traffic flow within the Istio service mesh, showing how requests move between workloads, services, and other mesh components. Option A is not shown, as the graph depicts mesh entities like services and workloads rather than Kubernetes node IP addresses. Option D is not displayed, since sidecar (Envoy proxy) image versions are not part of the graph's traffic topology visualization. Option E is not included, as user login history is unrelated to the Kiali Graph view's traffic and health representation.

Answer

Kubernetes node IP addresses

Answer

Sidecar image versions

Answer

User login history

Question 12

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Locality-aware load balancing (B) is recommended because Istio's LocalityLoadBalancerSetting prioritizes endpoints in the same region/zone before failing over to remote localities, reducing latency and cross-cluster traffic while preserving availability. Cross-cluster service failover (D) is correct because Istio's multi-cluster mesh (via east-west gateways and remote secrets) lets a service in one cluster route to healthy endpoints in another cluster when local endpoints fail, which is the core of HA across clusters. Running the control plane in multiple clusters (E) is correct because deploying istiod in each cluster (replicated control plane model) removes a single point of failure and lets each cluster's sidecars obtain configuration even if another cluster's control plane is unreachable. Disabling mTLS (A) is not recommended: it weakens zero-trust security and does not meaningfully improve HA, and mTLS overhead is minimal. Using a single ingress gateway for all traffic (C) is not recommended because it creates a single point of failure and a cross-cluster bottleneck, contradicting HA design.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 13

Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?

Accepted Answer

ServiceEntry and DestinationRule. A ServiceEntry is needed to register the database host, and a DestinationRule is needed to define TLS settings.

Answer

Only PeerAuthentication

Answer

Only Gateway

Answer

Only VirtualService

Question 14

How do you specify a custom header match in a VirtualService?

Accepted Answer

Using the match field in a VirtualService. The match block within a VirtualService route supports header matching using the headers key.

Answer

Using a DestinationRule

Answer

Using a ServiceEntry

Answer

Using a Gateway

Question 15

Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?

Accepted Answer

http. In an Istio DestinationRule, the connectionPool field is a TrafficPolicy-level setting that contains three protocol-specific sub-fields: tcp, http, and http2. Option A (http) is correct because connectionPool.http configures HTTP/1.1 connection pool limits such as http1MaxPendingRequests, http1MaxRequestsPerConnection, maxRequestsPerConnection, and idleTimeout. Option B (http2) is correct because connectionPool.http2 configures HTTP/2-specific limits such as maxRequestsPerConnection and idleTimeout for HTTP/2 traffic. Option E (tcp) is correct because connectionPool.tcp configures TCP-level settings including maxConnections, connectTimeout, and tcpKeepalive. Option C (grpc) is not a connectionPool sub-field; gRPC traffic is governed through the http2 pool settings. Option D (tls) is not part of connectionPool; TLS-related settings in a DestinationRule live under trafficPolicy.tls (e.g., mode, clientCertificate) or under the port-level tls block.

Answer

grpc

Answer

tls

Question 16

What is the primary function of the 'root-cert.pem' file in the Istio control plane?

Accepted Answer

To establish the chain of trust for mTLS.. root-cert.pem is the root CA certificate used by Istio's Citadel (istiod) to sign intermediate CA certificates, which in turn sign workload certificates. It anchors the chain of trust that enables mutual TLS between sidecars, so every workload certificate can be verified back to this root. Without a shared root, mTLS handshakes between meshes or across clusters fail.

Answer

To authorize HTTP requests.

Answer

To authenticate JWT tokens.

Answer

To encrypt user data in transit.

Question 17

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus

Question 18

You are installing Istio for a development cluster and want to use a predefined configuration that includes the core components but disables unnecessary features like telemetry to save resources. Which profile should you choose?

Accepted Answer

minimal. The 'minimal' profile is designed for development and testing environments where only the core Istio control plane components (istiod) are installed, with optional add-ons like telemetry, tracing, and ingress gateways disabled to conserve resources. It provides the essential service mesh functionality without the overhead of observability and traffic management extras. This matches the requirement of a predefined configuration that includes core components but disables unnecessary features like telemetry.

Answer

preview

Answer

demo

Answer

default

Question 19

Can you configure fault injection for specific traffic patterns, such as user headers?

Accepted Answer

Yes, by adding a 'match' criteria in the VirtualService.. Yes, fault injection can be scoped to specific route matches in a VirtualService.

Answer

No, fault injection is global for the service.

Answer

No, it must be applied via global EnvoyFilter.

Answer

Yes, but only via DestinationRule.

Answer

Yes, but only for egress traffic.

Question 20

What is the consequence of having a timeout that is shorter than the average latency of the service?

Accepted Answer

Increased 504 Gateway Timeout errors.. If the timeout is too short, requests will be terminated prematurely, causing valid requests to fail.

Answer

Faster response times.

Answer

Increased throughput.

Answer

Automatic retries.

Answer

Better connection pooling.