ICA Practice Test 3 — 10 Questions

Question 1

What happens if a request times out in Istio?

Accepted Answer

The proxy returns a 504 Gateway Timeout.. If a request exceeds the timeout, the proxy terminates the request and returns a 504 Gateway Timeout.

Answer

The request is retried automatically.

Answer

The proxy returns a 408 Request Timeout.

Answer

The request is passed to another healthy host.

Answer

The connection is closed without an error.

Question 2

When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?

Accepted Answer

The service is outside the mesh but managed by Istio policies.. It tells Istio that the service is external to the mesh, but it should be treated as a first-class citizen for routing and policy purposes.

Answer

The service is a local cluster service.

Answer

The service does not exist.

Answer

The service is inside the mesh.

Question 3

What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?

Accepted Answer

The request is allowed by default.. In Istio, a RequestAuthentication policy only validates JWTs if they are present. If no JWT is provided, the request is allowed by default unless an AuthorizationPolicy explicitly requires authentication. This is because RequestAuthentication does not enforce rejection; it only specifies how to validate tokens. To reject requests without valid tokens, you must pair it with an AuthorizationPolicy that requires a valid JWT.

Answer

The request is routed to the login page.

Answer

The request is rejected automatically.

Answer

The request is dropped.

Question 4

How do you specify the percentage of traffic that should experience a fault?

Accepted Answer

Using a 'percentage' object with a 'value' field.. In Istio's fault injection API, the percentage of requests affected by a fault is specified using a 'percentage' object containing a 'value' field (an integer 0–100), nested under the delay or abort fault. For example, an HTTPAbort fault uses 'percentage: {value: 50}' to abort half of matching requests. This is the documented schema for controlling fault scope in a VirtualService.

Answer

Using a 'weight' field.

Answer

Using a 'threshold' field.

Answer

Using the 'ratio' field.

Answer

Using a 'rate' field in the VirtualService.

Question 5

Which tool would you use to verify if a pod has an active mTLS connection?

Accepted Answer

istioctl proxy-config secret . The command `istioctl proxy-config secret ` lists the secrets (certificates) loaded in the Envoy sidecar, including the workload's mTLS certificate and the root CA. If mTLS is active, you will see the default or custom certificate with its validity and the ROOTCA. This directly confirms that the sidecar has an mTLS identity and is participating in mutual TLS.

Answer

istioctl proxy-config endpoint <pod-name>

Answer

istioctl dashboard envoy <pod-name>

Answer

kubectl get mTLS

Question 6

You need to route traffic to a service based on the 'x-user-type' header. How is this defined?

Accepted Answer

VirtualService match. The match field in a VirtualService can include a 'headers' condition with exact or regex matching.

Answer

ServiceEntry

Answer

DestinationRule subset

Answer

Gateway host

Question 7

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar

Question 8

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule

Question 9

How do you specify a header-based match in a VirtualService?

Accepted Answer

In the 'match' block. Header-based matching in Istio is configured inside the 'match' block of a VirtualService HTTP route, using the 'headers' field with a key and a StringMatch (exact, prefix, or regex). The match block is the conditional gate that determines which route applies to an incoming request. This is the canonical location for all request-matching criteria, including headers, URI, method, query params, and source labels.

Answer

In the 'subset' policy

Answer

In the 'destination' block

Answer

In the 'subset' definition

Question 10

Which THREE factors influence whether a service in the mesh will accept traffic?

Accepted Answer

AuthorizationPolicy rules. In an Istio service mesh, whether a workload accepts traffic is governed first by AuthorizationPolicy rules (A), which define ALLOW/DENY/CUSTOM enforcement on incoming requests and determine if a request is permitted to reach the workload. PeerAuthentication policy mode (C) also matters because it controls the mutual TLS mode (STRICT, PERMISSIVE, DISABLE) for incoming connections, so a client that cannot satisfy the required mTLS mode will be rejected before application-level authorization. Envoy proxy configuration state (D) is decisive as well, since the sidecar's listeners, filter chains, and route/RBAC configs actually enforce acceptance; if the proxy is misconfigured, stale, or not synced with istiod, traffic may be refused regardless of the intended policy. The other options do not directly determine acceptance: MeshConfig proxyMetadata (B) only injects environment metadata into proxies and does not by itself gate traffic, and the Kubernetes Service port definition (E) merely exposes/forwards traffic at the L4 Service level without enforcing mesh authorization or mTLS acceptance.

Answer

Global MeshConfig 'proxyMetadata' settings

Answer

Kubernetes Service Port definition