ICA Practice Exam 3 — 20 Questions

Question 1

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Redundancy across clusters and proper routing are essential for HA.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 2

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 3

You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?

Accepted Answer

The Sidecar resource is not scoped, causing the proxy to track all services in the mesh.. Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.

Answer

The ingress gateway has too many listeners.

Answer

The Kubernetes node is under-provisioned.

Answer

The MTU size is too small.

Question 4

What is the purpose of the 'istio-sidecar-injector' service in the Istio control plane?

Accepted Answer

To inject the Envoy proxy sidecar into pods. The sidecar injector is a MutatingAdmissionWebhook that intercepts pod creation requests to inject the proxy container.

Answer

To act as a load balancer for traffic

Answer

To monitor the health of pods

Answer

To store mesh configuration data

Question 5

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar

Question 6

Which field defines how long an ejected pod remains out of the rotation?

Accepted Answer

baseEjectionTime. baseEjectionTime determines the duration an instance is excluded from the load balancing pool.

Answer

maxEjectionPercent

Answer

interval

Answer

minHealthPercent

Answer

consecutive5xx

Question 7

In a VirtualService, where is the fault injection policy defined?

Accepted Answer

Within the 'http' route block.. The fault field is defined inside the route action block of a VirtualService.

Answer

Within the 'hosts' field.

Answer

Within the 'subset' definition.

Answer

Within the 'outlierDetection' block.

Answer

Within the 'trafficPolicy' block.

Question 8

Which THREE components are critical for establishing a secure multi-cluster 'primary-remote' configuration?

Accepted Answer

Remote cluster kubeconfig secret. Cross-cluster identity, trust, and API access are the core requirements.

Answer

Kiali visualization plugin

Answer

External DNS provider

Question 9

Which THREE features does the Kubernetes Gateway API offer that are significantly different from legacy Ingress?

Accepted Answer

Support for multiple protocols beyond HTTP/HTTPS. Gateway API is designed for better multi-tenancy, clearer roles, and advanced routing capabilities.

Answer

Automatic certificate management

Answer

Direct integration with Prometheus

Question 10

Which TWO options are required to properly implement an abort fault injection in a VirtualService?

Accepted Answer

httpStatus. To implement an abort, you must specify the 'percentage' and the 'httpStatus' code within the 'fault' block.

Answer

headers

Answer

match

Answer

fixedDelay

Question 11

You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?

Accepted Answer

Increase interval, increase consecutive5xx.. A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.

Answer

Decrease interval, decrease consecutive5xx.

Answer

Decrease interval, increase consecutive5xx.

Answer

Disable outlierDetection and use only circuitBreaking.

Answer

Increase interval, decrease consecutive5xx.

Question 12

You want to configure a circuit breaker that only allows 100 concurrent requests to a service. Which field is correct?

Accepted Answer

trafficPolicy.connectionPool.http.maxRequests. trafficPolicy.connectionPool.http.http1MaxPendingRequests or maxRequests (in versions) is used to control concurrency.

Answer

trafficPolicy.outlierDetection.maxRequests

Answer

trafficPolicy.connectionPool.http.http2MaxRequests

Answer

trafficPolicy.circuitBreaker.maxRequests

Answer

trafficPolicy.connectionPool.tcp.maxConnections

Question 13

Which TWO of the following are true regarding PeerAuthentication policies?

Accepted Answer

They must be applied in the 'istio-system' namespace to work globally.. They can be applied at mesh, namespace, or workload level, and the mode can be STRICT or PERMISSIVE.

Answer

They cannot be used with sidecar-less ambient mode.

Answer

They validate JWT tokens.

Answer

They support the 'DENY' action.

Question 14

What is the primary function of the 'istio-proxy' container in a pod?

Accepted Answer

Intercepting network traffic. It intercepts all network traffic to and from the application container.

Answer

Running the business logic

Answer

Managing Kubernetes API

Answer

Monitoring disk usage

Question 15

Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?

Accepted Answer

http. tcp, http, and http2 are the three protocol-specific pools within the connectionPool object.

Answer

grpc

Answer

tls

Question 16

Which TWO settings in a DestinationRule are used for load balancing?

Accepted Answer

loadBalancer.simple. TrafficPolicy includes the load balancing settings for a service.

Answer

connectionPool

Answer

outlierDetection

Answer

trafficPolicy.tls

Question 17

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Question 18

Which of the following is true about the 'principals' vs 'source.principals' fields?

Accepted Answer

They refer to the same concept.. They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.

Answer

Only 'principals' is valid.

Answer

Only 'source.principals' is valid.

Answer

They refer to different concepts.

Question 19

Which field in a VirtualService can you use to retry a request?

Accepted Answer

retries. The 'retries' field in the HTTP route block allows defining retry attempts and timeout per try.

Answer

attemptCount

Answer

retryPolicy

Answer

faultRetry

Answer

repeat

Question 20

Which TWO of the following are valid HTTP fault injection delay settings?

Accepted Answer

fixedDelay. fixedDelay and percentage are the two required components.

Answer

maxDelay

Answer

randomDelay

Answer

minDelay