ICA Practice Test 2 — 25 Questions

Question 1

You need to route traffic to a service based on the 'x-user-type' header. How is this defined?

Accepted Answer

VirtualService match. The match field in a VirtualService can include a 'headers' condition with exact or regex matching.

Answer

ServiceEntry

Answer

DestinationRule subset

Answer

Gateway host

Question 2

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar

Question 3

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule

Question 4

How do you specify a header-based match in a VirtualService?

Accepted Answer

In the 'match' block. Header-based matching in Istio is configured inside the 'match' block of a VirtualService HTTP route, using the 'headers' field with a key and a StringMatch (exact, prefix, or regex). The match block is the conditional gate that determines which route applies to an incoming request. This is the canonical location for all request-matching criteria, including headers, URI, method, query params, and source labels.

Answer

In the 'subset' policy

Answer

In the 'destination' block

Answer

In the 'subset' definition

Question 5

Which THREE factors influence whether a service in the mesh will accept traffic?

Accepted Answer

AuthorizationPolicy rules. In an Istio service mesh, whether a workload accepts traffic is governed first by AuthorizationPolicy rules (A), which define ALLOW/DENY/CUSTOM enforcement on incoming requests and determine if a request is permitted to reach the workload. PeerAuthentication policy mode (C) also matters because it controls the mutual TLS mode (STRICT, PERMISSIVE, DISABLE) for incoming connections, so a client that cannot satisfy the required mTLS mode will be rejected before application-level authorization. Envoy proxy configuration state (D) is decisive as well, since the sidecar's listeners, filter chains, and route/RBAC configs actually enforce acceptance; if the proxy is misconfigured, stale, or not synced with istiod, traffic may be refused regardless of the intended policy. The other options do not directly determine acceptance: MeshConfig proxyMetadata (B) only injects environment metadata into proxies and does not by itself gate traffic, and the Kubernetes Service port definition (E) merely exposes/forwards traffic at the L4 Service level without enforcing mesh authorization or mTLS acceptance.

Answer

Global MeshConfig 'proxyMetadata' settings

Answer

Kubernetes Service Port definition

Question 6

Which TWO mechanisms are used to secure traffic within the mesh?

Accepted Answer

PeerAuthentication. In Istio, PeerAuthentication is the correct mechanism for securing traffic within the mesh because it defines the mutual TLS (mTLS) mode (STRICT, PERMISSIVE, DISABLE) that governs how workloads authenticate each other's identities at the transport level. AuthorizationPolicy is also correct because it enforces access control on in-mesh traffic, deciding which identities (derived from mTLS) may perform which operations on which workloads. Together, PeerAuthentication establishes the cryptographic identity and encryption for service-to-service communication, while AuthorizationPolicy uses that identity to allow or deny requests inside the mesh. Gateway is not correct here because it manages ingress/egress traffic at the mesh edge, not intra-mesh security. VirtualService is not correct because it handles routing rules such as traffic splitting and retries, not security. ServiceEntry is not correct because it registers external services into the mesh registry, which is a service-discovery concern rather than a security mechanism.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 7

Which tool provides a GUI for visualizing your traffic management rules?

Accepted Answer

Kiali. Kiali is the standard visualization tool for Istio.

Answer

Prometheus

Answer

Grafana

Answer

istioctl

Question 8

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

Accepted Answer

The sidecar fetches it directly from the URL specified in the 'jwksUri' field of the RequestAuthentication resource.. The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.

Answer

It is hardcoded in the Envoy binary.

Answer

The Istio Control Plane (istiod) fetches it and pushes it to the sidecar.

Answer

The user must manually upload the public key as a Kubernetes Secret.

Question 9

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 10

Which of the following are valid Gateway configurations? (Choose TWO)

Accepted Answer

servers. In Istio's Gateway resource, the `servers` field (option A) is a valid top-level configuration that defines the ports, protocols, hosts, and TLS settings the gateway listens on, making it a required part of any Gateway spec. The `selector` field (option C) is also valid and specifies which Envoy proxy pods (via label matching, e.g., `istio: ingressgateway`) should apply the gateway configuration. Options B (`subsets`) and E (`endpoints`) belong to DestinationRule and Service/Endpoint resources respectively, not Gateway, and option D (`retry`) is a traffic-policy setting found in VirtualService or DestinationRule, so none of these are valid Gateway fields.

Answer

subsets

Answer

retry

Answer

endpoints

Question 11

Where do you define the hosts that a Gateway will listen on?

Accepted Answer

Gateway. The hosts field inside the servers block of a Gateway resource defines the hostnames.

Answer

ServiceEntry

Answer

DestinationRule

Answer

VirtualService

Question 12

Which of the following describes the role of the 'trust-domain' in Istio?

Accepted Answer

It defines the root of trust for identity.. The trust domain identifies the administrative boundary for identities. It is used to construct the SPIFFE ID.

Answer

It is used for load balancing.

Answer

It determines the namespace scope of policies.

Answer

It limits the number of concurrent connections.

Question 13

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

Accepted Answer

To allow the control plane to manage the remote cluster's services.. In Istio's multi-cluster model with a shared (primary) control plane, the istio-remote-secret is a Secret created in the primary cluster that contains the kubeconfig credentials for a remote cluster. It allows the primary control plane (istiod) to connect to and manage the remote cluster's API server — discovering its services, endpoints, and injecting configuration — so the remote cluster's workloads participate in the mesh.

Answer

To store custom headers for cross-cluster traffic.

Answer

To identify the cluster in the mesh.

Answer

To encrypt traffic between clusters.

Question 14

Which field defines how long an ejected pod remains out of the rotation?

Accepted Answer

baseEjectionTime. baseEjectionTime determines the duration an instance is excluded from the load balancing pool.

Answer

maxEjectionPercent

Answer

interval

Answer

minHealthPercent

Answer

consecutive5xx

Question 15

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Question 16

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.

Question 17

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Accepted Answer

It allows all requests.. An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.

Answer

It crashes the proxy.

Answer

It requires valid mTLS.

Answer

It denies all requests.

Question 18

Which of the following is a valid method for performing fault injection?

Accepted Answer

Using a VirtualService to inject delays.. Istio supports both delay and abort faults via VirtualService.

Answer

Using a ServiceEntry to redirect traffic.

Answer

Using a DestinationRule to drop connections.

Answer

Using an EnvoyFilter to rewrite headers.

Answer

Using a Gateway to block traffic.

Question 19

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror

Question 20

Which component is responsible for enforcing traffic policies in the data plane?

Accepted Answer

Envoy proxy. The Envoy proxy (injected as a sidecar) handles all data plane traffic management.

Answer

Ingress Gateway

Answer

istiod

Answer

Kiali