ICA Practice Test 3 — 30 Questions

Question 1

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

Accepted Answer

Health status (errors/warnings). The Graph view shows the topology of the mesh and the traffic flow.

Answer

Kubernetes node IP addresses

Answer

Sidecar image versions

Answer

User login history

Question 2

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 3

If you want to use a custom proxy image for your sidecars, where should this be specified in the IstioOperator configuration?

Accepted Answer

spec.values.global.proxy.image. The 'spec.values.global.proxy.image' field is used to override the default image for the sidecar proxies.

Answer

spec.components.proxy.image

Answer

spec.meshConfig.defaultConfig.proxyImage

Answer

spec.sidecarInjector.image

Question 4

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

Accepted Answer

Define a RequestAuthentication resource specifying the issuer and jwksUri.. To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.

Answer

Apply a PeerAuthentication resource with mode STRICT.

Answer

Create an EnvoyFilter to parse the JWT.

Question 5

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

Accepted Answer

RequestAuthentication for issuer, then AuthorizationPolicy to verify.. You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.

Answer

Only DestinationRule.

Answer

Only ServiceEntry.

Answer

Only PeerAuthentication.

Question 6

Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?

Accepted Answer

source.principal. The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.

Answer

destination.port

Answer

connection.mtls

Answer

request.auth.principal

Question 7

Which TWO of the following are valid ways to verify the status of an Istio control plane deployment?

Accepted Answer

istioctl verify-install. Using 'istioctl verify-install' checks the health of the control plane, and checking the status of the 'istiod' deployment via kubectl is a standard Kubernetes verification method.

Answer

istioctl proxy-status

Answer

istioctl mesh-check

Answer

kubectl describe ingressgateway

Question 8

When using 'maxRequests' in connectionPool, what happens when the threshold is reached?

Accepted Answer

Additional requests are rejected with a 503.. In Envoy, maxRequests is a circuit-breaking limit that rejects new requests with a 503 error when the limit is exceeded.

Answer

The client is disconnected.

Answer

The timeout is extended.

Answer

Requests are queued until capacity is available.

Answer

The service is automatically scaled.

Question 9

You are testing resilience. You want to inject an HTTP 503 error for 20% of traffic to the 'catalog' service. Which fault setting is correct?

Accepted Answer

abort: { status: 503, percentage: { value: 20 } }. The fault injection abort policy requires an HTTP status code and a percentage.

Answer

abort: { code: 503, percent: 20 }

Answer

fault: { abort: 503, rate: 0.2 }

Answer

abort: { status: 503, ratio: 0.2 }

Answer

error: { status: 503, percentage: 20 }

Question 10

What is the recommended way to test fault injection in a production environment?

Accepted Answer

Using header-based matches in a VirtualService.. Using header-based matching allows you to target faults to specific test traffic without impacting all users.

Answer

Injecting faults in the code.

Answer

Using a separate mesh for testing.

Answer

Enabling it for 1% of traffic using weight.

Answer

Applying it globally to all users.

Question 11

Which TWO conditions can trigger Outlier Detection ejection?

Accepted Answer

consecutive5xx. Outlier detection uses both consecutive 5xx errors and consecutive gateway failures.

Answer

maxConnections

Answer

timeout

Answer

latencyThreshold

Answer

maxRequests

Question 12

Which TWO of the following are valid connectionPool fields?

Accepted Answer

tcp. http and tcp are the base protocol pools.

Answer

udp

Answer

smtp

Answer

ftp

Question 13

What is the primary purpose of the 'RequestAuthentication' resource?

Accepted Answer

To define JWT validation requirements.. RequestAuthentication is used to define which JWT issuers are trusted and how to validate tokens.

Answer

To issue new JWTs.

Answer

To store user credentials.

Answer

To encrypt traffic between services.

Question 14

Which THREE actions occur when you label a namespace with 'istio-injection=enabled'?

Accepted Answer

New pods created in the namespace are injected with a sidecar. The webhook controller is notified, existing pods are not affected, but new pods will have the sidecar injected automatically.

Answer

The istiod deployment is scaled up

Answer

All existing pods are immediately restarted

Question 15

You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?

Accepted Answer

timeout. The timeout setting is defined within the route rule of a VirtualService.

Answer

deadline

Answer

maxRequestDuration

Answer

requestTimeout

Question 16

What is the consequence of having a timeout that is shorter than the average latency of the service?

Accepted Answer

Increased 504 Gateway Timeout errors.. If the timeout is too short, requests will be terminated prematurely, causing valid requests to fail.

Answer

Faster response times.

Answer

Increased throughput.

Answer

Automatic retries.

Answer

Better connection pooling.

Question 17

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 18

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

Accepted Answer

Allow all traffic.. By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.

Answer

Allow only traffic within the same namespace.

Answer

Deny all traffic.

Answer

Require mTLS for all traffic.

Question 19

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.

Question 20

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Accepted Answer

It allows all requests.. An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.

Answer

It crashes the proxy.

Answer

It requires valid mTLS.

Answer

It denies all requests.