ICA Practice Test 5 — 25 Questions

Question 1

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource defines the entry point, including listeners, ports, and protocols.

Answer

Service

Answer

Ingress

Answer

HTTPRoute

Question 2

Which TWO components must be configured to allow external traffic to enter the mesh?

Accepted Answer

VirtualService. In Istio, the Gateway resource (option C) is the component that configures the ingress/egress load balancer at the edge of the mesh, binding a port and hosts (e.g., servers: port 80, hosts: "*") so external traffic can reach the mesh. The VirtualService (option B) is required to bind to that Gateway via its gateways field and define the routing rules (match and route) that direct the incoming external requests to the appropriate destination service inside the mesh. Together, Gateway + VirtualService form the standard ingress path: the Gateway opens the door and the VirtualService decides where traffic goes. DestinationRule (A) only defines traffic policies like load balancing, connection pools, and subsets after routing occurs, so it is not required to admit external traffic. PeerAuthentication (D) configures mTLS authentication between workloads and does not expose services externally, and Sidecar (E) scopes sidecar proxy configuration per workload namespace rather than enabling ingress.

Answer

DestinationRule

Answer

PeerAuthentication

Answer

Sidecar

Question 3

You notice that a pod is being ejected by Outlier Detection despite only having occasional errors. How do you increase the interval between ejection scans?

Accepted Answer

Set outlierDetection.interval to a higher value.. To increase the interval between ejection scans in Istio's outlier detection, you set 'outlierDetection.interval' to a higher value. This field controls how often the ejection scan occurs. Increasing it reduces the frequency of scans, thus increasing the interval.

Answer

Disable outlierDetection.

Answer

Set outlierDetection.baseEjectionTime to a higher value.

Answer

Set outlierDetection.maxEjectionPercent to a higher value.

Answer

Set outlierDetection.consecutive5xx to a higher value.

Answer

Set connectionPool.tcp.maxConnections to a lower value.

Question 4

You need to limit the number of concurrent connections to the 'orders' service. Which field in the DestinationRule do you configure?

Accepted Answer

trafficPolicy.connectionPool.tcp.maxConnections. In Istio's DestinationRule, connectionPool.tcp.maxConnections limits the number of concurrent TCP connections to the upstream service. For the 'orders' service, this is the correct field to cap concurrent connections at the TCP layer.

Answer

trafficPolicy.connectionPool.http.maxRequests

Answer

trafficPolicy.circuitBreaker.maxConnections

Answer

trafficPolicy.outlierDetection.maxConnections

Answer

trafficPolicy.loadBalancer.maxConnections

Question 5

To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?

Accepted Answer

abort. The 'abort' fault injection setting in Istio is specifically designed to return an HTTP error code (such as 503) for a specified percentage of requests to a target service. By configuring an abort fault with an HTTP status of 503 and a percentage value of 20, you directly simulate service unavailability for 20% of traffic to the 'catalog' service. This is the intended mechanism for testing how applications handle HTTP error responses.

Answer

circuitBreaker

Answer

outlierDetection

Answer

delay

Question 6

What protocol does the Gateway resource support?

Accepted Answer

HTTP, HTTPS, GRPC, and TCP. Gateways support HTTP, HTTPS, GRPC, and TCP protocols.

Answer

Only HTTP

Answer

Only TCP

Answer

Only TLS

Question 7

Which THREE things are required for mTLS to be successful?

Accepted Answer

PeerAuthentication configuration. mTLS needs certificates issued to the workloads, a mutual agreement on using mTLS (PeerAuthentication), and sidecar proxies to perform the handshake.

Answer

External load balancer

Answer

Ingress Gateway

Question 8

How do you define a circuit breaker that limits the number of pending requests?

Accepted Answer

http1MaxPendingRequests. The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.

Answer

maxRequestsInQueue

Answer

maxPending

Answer

pendingRequestsLimit

Answer

maxPendingRequests

Question 9

What is the correct syntax for a principal in an AuthorizationPolicy?

Accepted Answer

cluster.local/ns/default/sa/my-service. The principal follows the SPIFFE ID format: 'cluster.local/ns/default/sa/my-service'.

Answer

spiffe://my-service

Answer

default/my-service

Answer

my-service.default

Question 10

How do you ensure that a workload ignores a global PeerAuthentication policy?

Accepted Answer

Apply a PeerAuthentication policy with a selector matching the specific workload.. A workload-specific PeerAuthentication policy (with a selector) will override a global (namespace or root) policy.

Answer

Use an AuthorizationPolicy to bypass mTLS.

Answer

Delete the global policy.

Answer

Set the 'mode' to 'DISABLE' in a DestinationRule.

Question 11

Which TWO settings are configured within the 'outlierDetection' block?

Accepted Answer

interval. In Istio's DestinationRule, the outlierDetection block configures passive health checking (circuit breaking) for a service's endpoints, and it includes the fields interval and consecutive5xxErrors. Option A (interval) is correct because it defines the time interval between ejection sweeps of the outlier detection analysis, e.g., interval: 10s. Option E (consecutive5xxErrors) is correct because it specifies the number of consecutive 5xx errors an endpoint must return before it is ejected from the load-balancing pool. Option B (maxRetries) is not part of outlierDetection; retry attempts are configured in the HTTP retry policy (e.g., retries/attempts under route or VirtualService). Option C (timeout) belongs to the traffic policy/route timeout settings, not outlierDetection. Option D (weight) is a load-balancer or subset routing field (e.g., in DestinationRule subsets or HTTP route destination weights), not an outlierDetection setting.

Answer

maxRetries

Answer

timeout

Answer

weight

Question 12

Which field in the VirtualService allows you to redirect an incoming request to a different path?

Accepted Answer

redirect. The 'redirect' field in the VirtualService route allows for URI or authority redirection.

Answer

rewrite

Answer

mirror

Answer

match

Question 13

What is the primary purpose of adding a timeout to a service call?

Accepted Answer

To prevent resource exhaustion from hanging requests.. A timeout on a service call ensures that if a downstream service does not respond within a specified period, the call is aborted. This prevents the calling service from indefinitely waiting, which can lead to thread pool exhaustion, memory buildup, and cascading failures. Thus, the primary purpose is to prevent resource exhaustion from hanging requests.

Answer

To hide errors from the user.

Answer

To load balance more effectively.

Answer

To increase throughput.

Answer

To encrypt traffic.

Question 14

Which THREE components are involved in the Istio certificate management process?

Accepted Answer

Istiod. The certificate lifecycle involves Istiod (CA), the control plane agent, and the workload sidecar/proxy.

Answer

Ingress Gateway

Answer

Kubernetes Secret

Question 15

You are performing a canary upgrade of Istio from version 1.19 to 1.20 using the `istioctl` tool. You have deployed a canary revision of Istiod and now need to migrate a subset of workloads to the new revision without disrupting existing traffic. Which command should you use to relabel the `default` namespace for canary migration, and what is the effect?

Accepted Answer

`kubectl label namespace default istio-injection- istio.io/rev=1-20 --overwrite`. To migrate a namespace to a canary revision, you must remove the `istio-injection` label and add the `istio.io/rev` label with the canary revision name. This ensures that only the new revision's injection webhook applies to new pods in that namespace. The `--overwrite` flag is necessary to update existing labels. This method allows gradual migration without disrupting existing traffic, as existing pods remain on the old revision until restarted.

Answer

`kubectl annotate namespace default istio.io/rev=1-20 --overwrite`

Answer

`kubectl label namespace default istio.io/rev=1-20 --overwrite`

Answer

`istioctl upgrade --revision 1-20 --namespace default`

Question 16

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 17

You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?

Accepted Answer

Configure an Egress Gateway and use a DestinationRule with client-side mTLS certificates.. You must use an Egress Gateway with mTLS configured to the external service.

Answer

Apply a RequestAuthentication policy.

Answer

Configure an Ingress Gateway.

Answer

Use a PeerAuthentication policy on the external service.

Question 18

You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?

Accepted Answer

timeout. In Istio's traffic management API, the timeout field on an HTTP route specifies how long a request may take before Envoy aborts it and returns a 504. Setting timeout: 2s on the route ensures any request exceeding two seconds fails immediately rather than hanging. This is the correct knob for bounding request latency at the mesh layer.

Answer

delay

Answer

maxConnections

Answer

maxRetries

Question 19

You want to configure your microservice to be more resilient. Which THREE of the following are valid fields within an 'outlierDetection' policy in a DestinationRule?

Accepted Answer

consecutive5xxErrors. In Istio's DestinationRule, the outlierDetection policy supports consecutive5xxErrors (A), which sets the number of consecutive 5xx errors that trigger ejection of a host from the load-balancing pool. It also supports interval (B), which defines the time interval between ejection sweep analyses of the hosts. And it supports baseEjectionTime (D), which specifies the minimum ejection duration for an outlier host, multiplied by the number of times it has been ejected. The options http2MaxRequests (C) and maxRequestsPerConnection (E) are not part of outlierDetection; they belong to the connectionPool settings (specifically the http and tcp subfields) of a DestinationRule's trafficPolicy, used for connection-pool limits rather than outlier ejection.

Answer

http2MaxRequests

Answer

maxRequestsPerConnection

Question 20

To strip a URL prefix before passing a request to a backend service, which field do you use?

Accepted Answer

rewrite. The rewrite field in a VirtualService can modify the URI path.

Answer

prefix

Answer

path

Answer

redirect