ICA Practice Test 4 — 10 Questions

Question 1

Which TWO mechanisms are used to secure traffic within the mesh?

Accepted Answer

PeerAuthentication. In Istio, PeerAuthentication is the correct mechanism for securing traffic within the mesh because it defines the mutual TLS (mTLS) mode (STRICT, PERMISSIVE, DISABLE) that governs how workloads authenticate each other's identities at the transport level. AuthorizationPolicy is also correct because it enforces access control on in-mesh traffic, deciding which identities (derived from mTLS) may perform which operations on which workloads. Together, PeerAuthentication establishes the cryptographic identity and encryption for service-to-service communication, while AuthorizationPolicy uses that identity to allow or deny requests inside the mesh. Gateway is not correct here because it manages ingress/egress traffic at the mesh edge, not intra-mesh security. VirtualService is not correct because it handles routing rules such as traffic splitting and retries, not security. ServiceEntry is not correct because it registers external services into the mesh registry, which is a service-discovery concern rather than a security mechanism.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 2

Which tool provides a GUI for visualizing your traffic management rules?

Accepted Answer

Kiali. Kiali is the standard visualization tool for Istio.

Answer

Prometheus

Answer

Grafana

Answer

istioctl

Question 3

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

Accepted Answer

The sidecar fetches it directly from the URL specified in the 'jwksUri' field of the RequestAuthentication resource.. The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.

Answer

It is hardcoded in the Envoy binary.

Answer

The Istio Control Plane (istiod) fetches it and pushes it to the sidecar.

Answer

The user must manually upload the public key as a Kubernetes Secret.

Question 4

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 5

Which of the following are valid Gateway configurations? (Choose TWO)

Accepted Answer

servers. In Istio's Gateway resource, the `servers` field (option A) is a valid top-level configuration that defines the ports, protocols, hosts, and TLS settings the gateway listens on, making it a required part of any Gateway spec. The `selector` field (option C) is also valid and specifies which Envoy proxy pods (via label matching, e.g., `istio: ingressgateway`) should apply the gateway configuration. Options B (`subsets`) and E (`endpoints`) belong to DestinationRule and Service/Endpoint resources respectively, not Gateway, and option D (`retry`) is a traffic-policy setting found in VirtualService or DestinationRule, so none of these are valid Gateway fields.

Answer

subsets

Answer

retry

Answer

endpoints

Question 6

Where do you define the hosts that a Gateway will listen on?

Accepted Answer

Gateway. The hosts field inside the servers block of a Gateway resource defines the hostnames.

Answer

ServiceEntry

Answer

DestinationRule

Answer

VirtualService

Question 7

Which of the following describes the role of the 'trust-domain' in Istio?

Accepted Answer

It defines the root of trust for identity.. The trust domain identifies the administrative boundary for identities. It is used to construct the SPIFFE ID.

Answer

It is used for load balancing.

Answer

It determines the namespace scope of policies.

Answer

It limits the number of concurrent connections.

Question 8

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

Accepted Answer

To allow the control plane to manage the remote cluster's services.. In Istio's multi-cluster model with a shared (primary) control plane, the istio-remote-secret is a Secret created in the primary cluster that contains the kubeconfig credentials for a remote cluster. It allows the primary control plane (istiod) to connect to and manage the remote cluster's API server — discovering its services, endpoints, and injecting configuration — so the remote cluster's workloads participate in the mesh.

Answer

To store custom headers for cross-cluster traffic.

Answer

To identify the cluster in the mesh.

Answer

To encrypt traffic between clusters.

Question 9

Which field defines how long an ejected pod remains out of the rotation?

Accepted Answer

baseEjectionTime. baseEjectionTime determines the duration an instance is excluded from the load balancing pool.

Answer

maxEjectionPercent

Answer

interval

Answer

minHealthPercent

Answer

consecutive5xx

Question 10

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.