ICA Practice Test 2 — 25 Questions

Question 1

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 2

Which THREE commands can be used to manage or inspect the Istio mesh configuration?

Accepted Answer

istioctl version. The 'istioctl' tool provides 'analyze', 'proxy-config', and 'version' commands for mesh inspection and management.

Answer

istioctl deploy

Answer

istioctl upgrade

Question 3

Which field in the trafficPolicy of a DestinationRule controls the maximum number of pending requests in the connection pool?

Accepted Answer

maxPendingRequests. maxRequestsPerConnection is used for HTTP/1.1 and maxPendingRequests for total pending requests.

Answer

maxRequests

Answer

pendingLimit

Answer

connectionLimit

Question 4

You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?

Accepted Answer

The namespace is excluded from Kiali's configuration.. If Kiali cannot find the service in the registry, it is likely because the namespace is not included in the Kiali configuration or the service lacks proper labels.

Answer

The sidecar is missing.

Answer

The Prometheus data retention period is too short.

Answer

The gateway is not configured correctly.

Question 5

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.

Question 6

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 7

What is the default timeout for an HTTP request in Istio when no VirtualService is defined?

Accepted Answer

15 seconds. Istio defaults to 15 seconds for request timeouts if not explicitly configured.

Answer

5 seconds

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Answer

0 (no timeout)

Question 8

When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?

Accepted Answer

Port. Listeners define the protocol, port, and hostname bindings for the gateway.

Answer

Request retries

Answer

Circuit breaker policy

Answer

Service account

Question 9

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 10

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule

Question 11

When using Kiali to debug service communication, which TWO metrics are most useful for identifying performance bottlenecks?

Accepted Answer

Request latency (P99). Latency and request rates (throughput) are the primary indicators of performance issues.

Answer

Number of active connections

Answer

CPU usage of the sidecar

Answer

Memory usage of the application

Question 12

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 13

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 14

Which THREE items can you configure in a VirtualService to improve resilience?

Accepted Answer

Retries. Timeouts, Retries, and Fault Injection are all controlled within a VirtualService.

Answer

Connection Pool

Answer

Outlier Detection

Question 15

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus

Question 16

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Redundancy across clusters and proper routing are essential for HA.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 17

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 18

You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?

Accepted Answer

The Sidecar resource is not scoped, causing the proxy to track all services in the mesh.. Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.

Answer

The ingress gateway has too many listeners.

Answer

The Kubernetes node is under-provisioned.

Answer

The MTU size is too small.

Question 19

What is the purpose of the 'istio-sidecar-injector' service in the Istio control plane?

Accepted Answer

To inject the Envoy proxy sidecar into pods. The sidecar injector is a MutatingAdmissionWebhook that intercepts pod creation requests to inject the proxy container.

Answer

To act as a load balancer for traffic

Answer

To monitor the health of pods

Answer

To store mesh configuration data

Question 20

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar