ICA Practice Test 4 — 25 Questions

Question 1

What is the consequence of having a timeout that is shorter than the average latency of the service?

Accepted Answer

Increased 504 Gateway Timeout errors.. If the timeout is too short, requests will be terminated prematurely, causing valid requests to fail.

Answer

Faster response times.

Answer

Increased throughput.

Answer

Automatic retries.

Answer

Better connection pooling.

Question 2

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 3

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

Accepted Answer

Allow all traffic.. By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.

Answer

Allow only traffic within the same namespace.

Answer

Deny all traffic.

Answer

Require mTLS for all traffic.

Question 4

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.

Question 5

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Accepted Answer

It allows all requests.. An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.

Answer

It crashes the proxy.

Answer

It requires valid mTLS.

Answer

It denies all requests.

Question 6

Which TWO Istio components can be configured via the 'spec.components' section in IstioOperator?

Accepted Answer

pilot. Both 'pilot' (the core control plane) and 'ingressGateways' are core components configurable under 'spec.components'.

Answer

prometheus

Answer

kiali

Answer

jaeger

Question 7

Which TWO of the following are valid fault injection types in Istio?

Accepted Answer

delay. Istio natively supports abort (returning an error) and delay (simulating latency).

Answer

retry

Answer

timeout

Answer

redirect

Question 8

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

Accepted Answer

Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.. The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.

Answer

Configure the Gateway to filter by IP.

Answer

Use a ServiceEntry to restrict traffic.

Answer

Create a PeerAuthentication policy with 'ipBlocks'.

Question 9

Which THREE components are involved in the Istio certificate management process?

Accepted Answer

Istiod. The certificate lifecycle involves Istiod (CA), the control plane agent, and the workload sidecar/proxy.

Answer

Ingress Gateway

Answer

Kubernetes Secret

Question 10

When a request fails, where can you check the reason for the failure in the Istio ecosystem?

Accepted Answer

Kiali. Kiali provides visual traffic flow analysis and error code identification.

Answer

DestinationRule status

Answer

istioctl analyze

Answer

Gateway logs

Question 11

How do you define a regex match in a VirtualService?

Accepted Answer

regex field. The match block URI uses the 'regex' field for pattern matching.

Answer

uri-regex

Answer

match-regex

Answer

pattern field

Question 12

What information can you get from 'istioctl proxy-config'? (Choose THREE)

Accepted Answer

clusters. proxy-config allows viewing routes, endpoints, and clusters.

Answer

virtualservices

Answer

deployments

Question 13

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

Accepted Answer

Envoy Proxy. The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.

Answer

Citadel

Answer

Ingress Gateway

Answer

Istiod

Question 14

How do you ensure that a workload ignores a global PeerAuthentication policy?

Accepted Answer

Apply a PeerAuthentication policy with a selector matching the specific workload.. A workload-specific PeerAuthentication policy (with a selector) will override a global (namespace or root) policy.

Answer

Use an AuthorizationPolicy to bypass mTLS.

Answer

Delete the global policy.

Answer

Set the 'mode' to 'DISABLE' in a DestinationRule.

Question 15

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Accepted Answer

Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.. A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.

Answer

Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.

Answer

Apply a global MeshConfig setting to enforce mTLS.

Answer

Create an AuthorizationPolicy that denies all traffic without a client certificate.

Question 16

Which TWO of the following are valid sources for an AuthorizationPolicy?

Accepted Answer

principals. AuthorizationPolicies can match based on 'principals' (identity) and 'namespaces'.

Answer

headers

Answer

httpMethods

Answer

jwtClaims

Question 17

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 18

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 19

You need to inspect the envoy config for a specific pod. Which command do you use?

Accepted Answer

istioctl proxy-config all. istioctl proxy-config all <pod-name> shows all configuration for that proxy.

Answer

istioctl get config

Answer

kubectl get proxy

Answer

istioctl inspect

Question 20

Which command lists all virtual services in the current namespace?

Accepted Answer

kubectl get virtualservices. kubectl get virtualservices is the standard command to list this CRD.

Answer

istioctl virtualservices

Answer

istioctl get vs

Answer

istioctl list virtualservice