ICA Practice Test 5 — 25 Questions

Question 1

What is the purpose of 'minHealthPercent' in the OutlierDetection configuration?

Accepted Answer

It limits the number of hosts that can be ejected to keep the cluster healthy.. It prevents the ejection of hosts if it would cause the total cluster health to fall below a specific percentage.

Answer

It sets the frequency of health checks.

Answer

It defines the threshold for the circuit breaker to trip.

Answer

It sets the minimum load for a host to be considered healthy.

Answer

It ensures at least this percentage of pods remain healthy.

Question 2

Which THREE of the following are valid sub-fields of 'outlierDetection'?

Accepted Answer

maxEjectionPercent. interval, baseEjectionTime, and maxEjectionPercent are core fields of outlierDetection.

Answer

consecutive5xx

Answer

retryOn

Answer

maxConnections

Question 3

Which TWO of the following are true about Istio Circuit Breakers?

Accepted Answer

They operate at the proxy level.. Circuit breaking is implemented in the proxy and applies to individual load balancer pools.

Answer

They require a central controller check.

Answer

They are configured via ServiceEntry.

Answer

They only trigger on 5xx errors.

Question 4

What is the correct syntax for a principal in an AuthorizationPolicy?

Accepted Answer

cluster.local/ns/default/sa/my-service. The principal follows the SPIFFE ID format: 'cluster.local/ns/default/sa/my-service'.

Answer

spiffe://my-service

Answer

default/my-service

Answer

my-service.default

Question 5

Which THREE factors influence whether a service in the mesh will accept traffic?

Accepted Answer

AuthorizationPolicy rules. Traffic acceptance depends on PeerAuthentication (mTLS), AuthorizationPolicy (access), and the Envoy proxy configuration (xDS).

Answer

Global MeshConfig 'proxyMetadata' settings

Answer

Kubernetes Service Port definition

Question 6

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 7

Which tool provides a GUI for visualizing your traffic management rules?

Accepted Answer

Kiali. Kiali is the standard visualization tool for Istio.

Answer

Prometheus

Answer

Grafana

Answer

istioctl

Question 8

Can you configure fault injection for specific traffic patterns, such as user headers?

Accepted Answer

Yes, by adding a 'match' criteria in the VirtualService.. Yes, fault injection can be scoped to specific route matches in a VirtualService.

Answer

No, fault injection is global for the service.

Answer

No, it must be applied via global EnvoyFilter.

Answer

Yes, but only via DestinationRule.

Answer

Yes, but only for egress traffic.

Question 9

Which THREE things are required for mTLS to be successful?

Accepted Answer

PeerAuthentication configuration. mTLS needs certificates issued to the workloads, a mutual agreement on using mTLS (PeerAuthentication), and sidecar proxies to perform the handshake.

Answer

External load balancer

Answer

Ingress Gateway

Question 10

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

Accepted Answer

Apply a PeerAuthentication with mode: PERMISSIVE using a selector that targets the legacy service.. You can apply a PeerAuthentication policy at the workload level (using 'selector') to override the namespace-wide policy.

Answer

Add an annotation 'sidecar.istio.io/inject: false'.

Answer

Delete the namespace-wide PeerAuthentication policy.

Answer

Use an AuthorizationPolicy to allow plaintext traffic.

Question 11

A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?

Accepted Answer

DestinationRule spec. DestinationRule uses 'subsets' that map to 'labels' on Kubernetes pods.

Answer

EnvoyFilter

Answer

VirtualService

Answer

Gateway spec

Question 12

A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?

Accepted Answer

istioctl proxy-config routes. istioctl proxy-config routes displays the routing table as understood by the Envoy proxy.

Answer

istioctl describe

Answer

istioctl analyze

Answer

kubectl logs

Question 13

What protocol does the Gateway resource support?

Accepted Answer

HTTP, HTTPS, GRPC, and TCP. Gateways support HTTP, HTTPS, GRPC, and TCP protocols.

Answer

Only HTTP

Answer

Only TCP

Answer

Only TLS

Question 14

In OutlierDetection, what is the effect of setting 'maxEjectionPercent' to 0?

Accepted Answer

It disables outlier detection.. Setting this to 0 effectively disables outlier detection, as no hosts can be ejected.

Answer

It makes the ejection time infinite.

Answer

It forces all hosts to be healthy.

Answer

It ejects hosts immediately.

Answer

It ejects all hosts.

Question 15

Which THREE components are involved in configuring a robust resilience strategy?

Accepted Answer

DestinationRule. VirtualService, DestinationRule, and Retries/Timeouts (within VS) are key.

Answer

ServiceEntry

Answer

IngressGateway

Question 16

Which THREE fields are found in the 'http' connectionPool configuration?

Accepted Answer

idleTimeout. http2MaxRequests, maxRequestsPerConnection, and idleTimeout are valid fields.

Answer

maxConnections

Answer

maxRetries

Question 17

Which resource is used to define the root certificate for a custom CA?

Accepted Answer

cacerts. The 'cacerts' secret in the 'istio-system' namespace is used to provide custom root certificates.

Answer

istio-ca-secret

Answer

root-secret

Answer

istio-root-ca

Question 18

A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?

Accepted Answer

VirtualService. VirtualService uses the weight field in the route block to distribute traffic percentages.

Answer

Sidecar

Answer

DestinationRule

Answer

Gateway

Question 19

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror

Question 20

What happens when a circuit breaker trips?

Accepted Answer

Traffic is no longer sent to the instance.. The circuit breaker stops sending traffic to the unhealthy host, protecting the system from overload.

Answer

The service is deleted.

Answer

All traffic is redirected to a static page.

Answer

The entire mesh is shut down.

Answer

The pod is restarted.