ICA Practice Test 4 — 25 Questions

Question 1

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.

Question 2

Which THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?

Accepted Answer

interval. In Istio's DestinationRule, the outlierDetection block configures passive health checking (circuit breaking) that ejects unhealthy hosts from the load-balancing pool. Option A, interval, is correct because it defines the time interval between ejection sweep analyses of the hosts (e.g., 10s), controlling how often the outlier detection scan runs. Option B, baseEjectionTime, is correct because it specifies the minimum ejection duration for an outlier host, and the actual ejection time is multiplied by the number of times the host has been ejected. Option E, consecutive5xxErrors, is correct because it is the threshold of consecutive 5xx errors a host must return before it is ejected from the pool. Option C, requestRetryCount, is not part of outlierDetection; retry behavior is configured under the DestinationRule's trafficPolicy retries or the VirtualService retries block. Option D, maxConnectionTimeout, is not a valid outlierDetection field; connection pool timeouts are configured under connectionPool.tcp (e.g., connectTimeout) in the DestinationRule.

Answer

requestRetryCount

Answer

maxConnectionTimeout

Question 3

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 4

What is the standard path to install istioctl?

Accepted Answer

Binary download. Downloading the binary from the Istio release page is the standard method.

Answer

apt-get

Answer

kubectl plugin

Answer

npm install

Question 5

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn

Question 6

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

Accepted Answer

Gateway. In Istio, a Gateway resource configures the Envoy proxy at the edge of the mesh to accept inbound traffic on specified ports and protocols (HTTP, HTTPS, TCP, etc.). It is the required entry point definition that binds a load balancer or ingress IP to the mesh, and it is then referenced by a VirtualService to route traffic to internal services. Without a Gateway, external traffic has no defined listener to enter the mesh.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 7

What is the command to view the status of all pods including proxies?

Accepted Answer

kubectl get pods. In Istio, sidecar proxies run as containers inside the application pods, so they appear as additional containers in the pod's status. The standard Kubernetes command kubectl get pods shows each pod's status, including the number of ready containers (e.g., 2/2 when both the app and the istio-proxy sidecar are ready), which is how you verify proxy health alongside the app.

Answer

istioctl pods

Answer

istioctl status

Answer

kubectl describe proxy

Question 8

To test the resilience of your microservice architecture, you want to introduce a 5-second delay to 50% of the requests directed to the 'catalog-service'. Where do you define this configuration?

Accepted Answer

VirtualService. A VirtualService is used to define traffic routing rules, including fault injection such as delays and aborts. To introduce a 5-second delay to 50% of requests to 'catalog-service', you configure a fault delay in the VirtualService's HTTP route. This allows testing resilience without modifying the application.

Answer

DestinationRule

Answer

Gateway

Answer

ServiceEntry

Question 9

Which THREE items are included in an Istio SPIFFE ID?

Accepted Answer

Trust domain. An Istio SPIFFE ID follows the format spiffe:///ns//sa/, so the three components it includes are the trust domain (A), the namespace (D), and the service account (C). The trust domain (A) is the first segment after the spiffe:// scheme and identifies the identity's issuing authority, which in Istio defaults to cluster.local. The namespace (D) appears in the /ns/ path segment and scopes the workload identity to its Kubernetes namespace. The service account (C) appears in the /sa/ path segment and represents the Kubernetes service account under which the workload runs. Cluster Name (B) is not part of the SPIFFE ID format—it is a separate Istio concept used in multi-cluster configurations and mesh expansion. IP Address (E) is not encoded in a SPIFFE ID; Istio identities are based on service account and namespace, not network addresses.

Answer

Cluster Name

Answer

IP Address

Question 10

Which field in VirtualService is used for A/B testing?

Accepted Answer

weight. The weight field is used to split traffic between versions (subsets) for A/B testing.

Answer

redirect

Answer

match

Answer

subset

Question 11

Which TWO settings in a DestinationRule are used for load balancing?

Accepted Answer

loadBalancer.simple. TrafficPolicy includes the load balancing settings for a service.

Answer

connectionPool

Answer

outlierDetection

Answer

trafficPolicy.tls

Question 12

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. MeshConfig telemetry settings (B) are essential because the mesh-wide MeshConfig controls how Envoy sidecars emit telemetry, including access logging, metrics, and tracing defaults that determine whether observability data is generated at all. Tracing sampling rate (D) is essential because it governs what fraction of requests are captured as distributed traces; without an appropriate sampling rate, you either lose visibility into request flows or overwhelm the tracing backend. Telemetry resource configuration (E) is essential because the Telemetry API resources define providers, metrics, access logging, and tracing behavior per workload or namespace, directly shaping the observability signals collected across the mesh. Local sidecar memory limits (A) affect resource consumption and stability but do not determine what telemetry is produced or exported, and VirtualService timeouts (C) are traffic-management controls for request deadlines, not observability configuration.

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 13

Which actions can a VirtualService perform on a request? (Choose TWO)

Accepted Answer

route. In Istio, a VirtualService defines how requests are routed to a service within the mesh, and its core capabilities include the route action (option A), which specifies destination hosts, subsets, and weights for matching traffic, and the headers action (option C), which allows modification of request and response headers via header manipulation rules. Both route and headers are valid top-level HTTP route actions in the VirtualService specification, making A and C correct for this scenario. The scale action (option B) is not part of VirtualService; scaling is handled by Kubernetes workload resources such as Deployments or HorizontalPodAutoscalers. The filter action (option D) is not a VirtualService action; traffic filtering is achieved through route match conditions or EnvoyFilter resources. The replicate action (option E) does not exist in the VirtualService API; traffic mirroring is instead configured using the mirror and mirrorPercentage fields under a route.

Answer

scale

Answer

filter

Answer

replicate

Question 14

Which TWO are common causes for a service to be ejected by Outlier Detection?

Accepted Answer

Consecutive gateway failures.. Outlier detection in service meshes (e.g., Istio/Envoy) ejects a host from the load-balancing pool when it exhibits repeated failures at the connection or request level. Option A is correct because consecutive gateway failures—such as TCP connection failures, timeouts, or HTTP 502/503/504 responses classified as gateway errors—trigger the consecutive-gateway-failures ejection policy. Option B is correct because consecutive 5xx responses from the upstream service are counted by the consecutive-5xx ejection policy and cause the endpoint to be ejected once the threshold is exceeded. Options C and E are incorrect because high disk or CPU usage are resource-pressure conditions handled by metrics-based autoscaling or resource limits, not by outlier detection's failure counters. Option D is incorrect because the number of logged-in users is an application-level metric unrelated to the consecutive failure thresholds that outlier detection evaluates.

Answer

High disk usage on the pod.

Answer

Too many users logged in.

Answer

High CPU usage on the pod.

Question 15

Which THREE fields are found in the 'http' connectionPool configuration?

Accepted Answer

idleTimeout. http2MaxRequests, maxRequestsPerConnection, and idleTimeout are valid fields.

Answer

maxConnections

Answer

maxRetries

Question 16

You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?

Accepted Answer

It overrides the global policy for all workloads in the 'default' namespace.. In Istio, PeerAuthentication policies are scoped hierarchically: mesh-wide (root namespace, no selector), namespace-wide (a namespace, no selector), and workload-specific (with a selector). A namespace-wide policy in 'default' with no selector applies to all workloads in that namespace and takes precedence over the mesh-wide global policy for those workloads, effectively overriding it.

Answer

It is ignored.

Answer

It crashes the global policy.

Answer

It merges with the global policy.

Question 17

You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?

Accepted Answer

DestinationRule. Connection pool limits such as `maxConnections` and `http1MaxPendingRequests` are configured in the DestinationRule's `trafficPolicy.connectionPool` section, which applies to the destination service. This is where Istio exposes Envoy's circuit-breaking settings for outbound traffic to a service.

Answer

EnvoyFilter

Answer

ServiceEntry

Answer

VirtualService

Question 18

When configuring circuit breaking, what does 'maxRequestsPerConnection' control?

Accepted Answer

The number of requests per individual connection.. It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.

Answer

The number of concurrent requests.

Answer

The total number of requests sent to a service.

Answer

The latency of each request.

Answer

The size of the request body.

Question 19

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 20

What is the default behavior when no VirtualService is defined for a service?

Accepted Answer

Round-robin routing. In Istio, when a Kubernetes Service has no VirtualService attached, the sidecar proxies fall back to Envoy's default load-balancing behavior, which is round-robin across the healthy endpoints discovered via the service registry (Pilot/xDS). No routing rules means no traffic manipulation — the request simply flows to the next endpoint in rotation. This is the baseline behavior before any Istio traffic management is layered on.

Answer

Traffic is dropped

Answer

503 error

Answer

Traffic is blocked