ICA Practice Test 2 — 30 Questions

Question 1

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 2

What is the default timeout for an HTTP request in Istio when no VirtualService is defined?

Accepted Answer

15 seconds. Istio defaults to 15 seconds for request timeouts if not explicitly configured.

Answer

5 seconds

Answer

10 seconds

Answer

30 seconds

Answer

60 seconds

Answer

0 (no timeout)

Question 3

When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?

Accepted Answer

Port. Listeners define the protocol, port, and hostname bindings for the gateway.

Answer

Request retries

Answer

Circuit breaker policy

Answer

Service account

Question 4

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 5

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule

Question 6

When using Kiali to debug service communication, which TWO metrics are most useful for identifying performance bottlenecks?

Accepted Answer

Request latency (P99). Latency and request rates (throughput) are the primary indicators of performance issues.

Answer

Number of active connections

Answer

CPU usage of the sidecar

Answer

Memory usage of the application

Question 7

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 8

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 9

Which THREE items can you configure in a VirtualService to improve resilience?

Accepted Answer

Retries. Timeouts, Retries, and Fault Injection are all controlled within a VirtualService.

Answer

Connection Pool

Answer

Outlier Detection

Question 10

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus

Question 11

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Redundancy across clusters and proper routing are essential for HA.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 12

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 13

You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?

Accepted Answer

The Sidecar resource is not scoped, causing the proxy to track all services in the mesh.. Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.

Answer

The ingress gateway has too many listeners.

Answer

The Kubernetes node is under-provisioned.

Answer

The MTU size is too small.

Question 14

What is the purpose of the 'istio-sidecar-injector' service in the Istio control plane?

Accepted Answer

To inject the Envoy proxy sidecar into pods. The sidecar injector is a MutatingAdmissionWebhook that intercepts pod creation requests to inject the proxy container.

Answer

To act as a load balancer for traffic

Answer

To monitor the health of pods

Answer

To store mesh configuration data

Question 15

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar

Question 16

Which field defines how long an ejected pod remains out of the rotation?

Accepted Answer

baseEjectionTime. baseEjectionTime determines the duration an instance is excluded from the load balancing pool.

Answer

maxEjectionPercent

Answer

interval

Answer

minHealthPercent

Answer

consecutive5xx

Question 17

In a VirtualService, where is the fault injection policy defined?

Accepted Answer

Within the 'http' route block.. The fault field is defined inside the route action block of a VirtualService.

Answer

Within the 'hosts' field.

Answer

Within the 'subset' definition.

Answer

Within the 'outlierDetection' block.

Answer

Within the 'trafficPolicy' block.

Question 18

Which THREE components are critical for establishing a secure multi-cluster 'primary-remote' configuration?

Accepted Answer

Remote cluster kubeconfig secret. Cross-cluster identity, trust, and API access are the core requirements.

Answer

Kiali visualization plugin

Answer

External DNS provider

Question 19

Which THREE features does the Kubernetes Gateway API offer that are significantly different from legacy Ingress?

Accepted Answer

Support for multiple protocols beyond HTTP/HTTPS. Gateway API is designed for better multi-tenancy, clearer roles, and advanced routing capabilities.

Answer

Automatic certificate management

Answer

Direct integration with Prometheus

Question 20

Which TWO options are required to properly implement an abort fault injection in a VirtualService?

Accepted Answer

httpStatus. To implement an abort, you must specify the 'percentage' and the 'httpStatus' code within the 'fault' block.

Answer

headers

Answer

match

Answer

fixedDelay