ICA Practice Test 3 — 10 Questions

Question 1

When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?

Accepted Answer

The service is outside the mesh but managed by Istio policies.. It tells Istio that the service is external to the mesh, but it should be treated as a first-class citizen for routing and policy purposes.

Answer

The service is a local cluster service.

Answer

The service does not exist.

Answer

The service is inside the mesh.

Question 2

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. To connect to an external service with mTLS, you need to define the service, configure egress, and provide the client certificates.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 3

Which of the following is true regarding Outlier Detection in Istio?

Accepted Answer

It automatically ejects instances that return 5xx errors.. Outlier Detection requires a destination rule and works by ejecting unhealthy instances based on their error rates.

Answer

It only works with TCP services.

Answer

It can be configured in a VirtualService.

Answer

It is used to rate limit traffic.

Answer

It requires an external monitoring tool.

Question 4

Which TWO are common causes for a service to be ejected by Outlier Detection?

Accepted Answer

Consecutive gateway failures.. Repeated 5xx errors and gateway failures are the two primary reasons.

Answer

High disk usage on the pod.

Answer

Too many users logged in.

Answer

High CPU usage on the pod.

Question 5

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Accepted Answer

The client proxy initiates mTLS handshakes.. STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.

Answer

All non-Istio traffic is automatically routed to the gateway.

Answer

The proxy automatically upgrades HTTP to HTTPS.

Question 6

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 7

Which THREE commands can be used to manage or inspect the Istio mesh configuration?

Accepted Answer

istioctl version. The 'istioctl' tool provides 'analyze', 'proxy-config', and 'version' commands for mesh inspection and management.

Answer

istioctl deploy

Answer

istioctl upgrade

Question 8

Which field in the trafficPolicy of a DestinationRule controls the maximum number of pending requests in the connection pool?

Accepted Answer

maxPendingRequests. maxRequestsPerConnection is used for HTTP/1.1 and maxPendingRequests for total pending requests.

Answer

maxRequests

Answer

pendingLimit

Answer

connectionLimit

Question 9

You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?

Accepted Answer

The namespace is excluded from Kiali's configuration.. If Kiali cannot find the service in the registry, it is likely because the namespace is not included in the Kiali configuration or the service lacks proper labels.

Answer

The sidecar is missing.

Answer

The Prometheus data retention period is too short.

Answer

The gateway is not configured correctly.

Question 10

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.