ICA Practice Exam 4 — 20 Questions

Question 1

Which command is used to view the effective configuration of a specific Envoy proxy?

Accepted Answer

istioctl proxy-config. istioctl proxy-config is the standard tool for inspecting sidecar config.

Answer

istioctl dashboard

Answer

kubectl get virtualservice

Answer

kubectl describe

Question 2

What is the primary purpose of the 'subset' field in a VirtualService destination?

Accepted Answer

To route to a specific version/label set. The 'subset' field in a VirtualService destination references a named subset defined in a DestinationRule, which is a label selector that identifies a specific version or group of pods (e.g., version: v2). This is how Istio routes traffic to a particular deployment version for canary or blue/green releases.

Answer

To specify a namespace

Answer

To handle failover

Answer

To limit traffic to one pod

Question 3

How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?

Accepted Answer

istioctl proxy-config. The `istioctl proxy-config` command retrieves the actual Envoy configuration (clusters, listeners, routes, endpoints) from a specific sidecar, allowing you to verify what is currently pushed without Kiali. It queries the Envoy admin API on the proxy and formats the output. This is the standard CLI method for inspecting sidecar config.

Answer

istioctl analyze

Answer

kubectl get virtualservice

Answer

kubectl describe pod

Question 4

Which profile is recommended for a production environment where high availability and performance are required?

Accepted Answer

default. The 'default' profile is the recommended choice for production environments because it installs the core Istio components (istiod and a production-grade ingress gateway) with sensible resource requests and without the demo-only extras. It balances functionality, performance, and resource footprint, making it suitable for high-availability deployments. The minimal profile strips components needed for production traffic management, while demo is explicitly not for production.

Answer

minimal

Answer

empty

Answer

demo

Question 5

A team wants to enable sidecar injection for a specific namespace without modifying the deployment manifests. What is the most efficient way to achieve this?

Accepted Answer

kubectl label namespace <name> istio-injection=enabled. The most efficient way to enable sidecar injection for a namespace without modifying deployment manifests is to label the namespace with istio-injection=enabled. Istio's mutating webhook checks this label when pods are created and automatically injects the sidecar container. This is a namespace-level configuration that requires no changes to individual workloads.

Answer

istioctl inject -n <namespace>

Answer

kubectl apply -f sidecar-injector.yaml

Answer

kubectl annotate namespace <name> istio-injection=enabled

Question 6

Which of the following is NOT a valid action in an Istio AuthorizationPolicy?

Accepted Answer

REDIRECT. Istio AuthorizationPolicy supports exactly three actions: ALLOW, DENY, and AUDIT. REDIRECT is not a valid action — it is a feature of VirtualService (HTTP redirect) and RequestAuthentication/Envoy routing, not of AuthorizationPolicy. AUDIT is valid and logs requests that match the policy without allowing or denying them, which is why it is included as a legitimate action.

Answer

AUDIT

Answer

ALLOW

Answer

DENY

Question 7

Which TWO of the following are valid fault injection types in Istio?

Accepted Answer

delay. Istio natively supports abort (returning an error) and delay (simulating latency).

Answer

retry

Answer

timeout

Answer

redirect

Question 8

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

Accepted Answer

Apply a PeerAuthentication with mode: PERMISSIVE using a selector that targets the legacy service.. You can apply a PeerAuthentication policy at the workload level (using 'selector') to override the namespace-wide policy.

Answer

Add an annotation 'sidecar.istio.io/inject: false'.

Answer

Delete the namespace-wide PeerAuthentication policy.

Answer

Use an AuthorizationPolicy to allow plaintext traffic.

Question 9

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?

Accepted Answer

RequestAuthentication. RequestAuthentication is specifically designed to configure how Istio validates JWT tokens.

Answer

AuthorizationPolicy

Answer

ServiceEntry

Answer

PeerAuthentication

Question 10

What is the primary function of the 'istio-proxy' container in a pod?

Accepted Answer

Intercepting network traffic. It intercepts all network traffic to and from the application container.

Answer

Running the business logic

Answer

Managing Kubernetes API

Answer

Monitoring disk usage

Question 11

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

Accepted Answer

Envoy Proxy. The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.

Answer

Citadel

Answer

Ingress Gateway

Answer

Istiod

Question 12

How do you implement a circuit breaker to eject a pod that returns 5xx errors?

Accepted Answer

DestinationRule outlierDetection. Circuit breaking in Istio is implemented via DestinationRule's outlierDetection field, which configures Envoy's outlier detection to eject endpoints that return consecutive 5xx errors (or gateway errors) from the load balancing pool for a specified interval. The key parameters are consecutive5xxErrors, interval, baseEjectionTime, and maxEjectionPercent. This is the canonical Istio mechanism for passive health checking and circuit breaking at the destination level.

Answer

PeerAuthentication

Answer

VirtualService fault injection

Answer

VirtualService retry policy

Question 13

What is the default load balancing policy if none is specified in the DestinationRule?

Accepted Answer

ROUND_ROBIN. Istio defaults to ROUND_ROBIN if not specified.

Answer

RANDOM

Answer

LEAST_CONN

Answer

PASSTHROUGH

Question 14

What is the primary purpose of the 'RequestAuthentication' resource?

Accepted Answer

To define JWT validation requirements.. RequestAuthentication is used to define which JWT issuers are trusted and how to validate tokens.

Answer

To issue new JWTs.

Answer

To store user credentials.

Answer

To encrypt traffic between services.

Question 15

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 16

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.

Question 17

Which THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?

Accepted Answer

interval. In Istio's DestinationRule, the outlierDetection block configures passive health checking (circuit breaking) that ejects unhealthy hosts from the load-balancing pool. Option A, interval, is correct because it defines the time interval between ejection sweep analyses of the hosts (e.g., 10s), controlling how often the outlier detection scan runs. Option B, baseEjectionTime, is correct because it specifies the minimum ejection duration for an outlier host, and the actual ejection time is multiplied by the number of times the host has been ejected. Option E, consecutive5xxErrors, is correct because it is the threshold of consecutive 5xx errors a host must return before it is ejected from the pool. Option C, requestRetryCount, is not part of outlierDetection; retry behavior is configured under the DestinationRule's trafficPolicy retries or the VirtualService retries block. Option D, maxConnectionTimeout, is not a valid outlierDetection field; connection pool timeouts are configured under connectionPool.tcp (e.g., connectTimeout) in the DestinationRule.

Answer

requestRetryCount

Answer

maxConnectionTimeout

Question 18

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 19

What is the standard path to install istioctl?

Accepted Answer

Binary download. Downloading the binary from the Istio release page is the standard method.

Answer

apt-get

Answer

kubectl plugin

Answer

npm install

Question 20

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn