ICA Practice Test 5 — 10 Questions

Question 1

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.

Question 2

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Accepted Answer

It allows all requests.. An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.

Answer

It crashes the proxy.

Answer

It requires valid mTLS.

Answer

It denies all requests.

Question 3

Which of the following is a valid method for performing fault injection?

Accepted Answer

Using a VirtualService to inject delays.. Istio supports both delay and abort faults via VirtualService.

Answer

Using a ServiceEntry to redirect traffic.

Answer

Using a DestinationRule to drop connections.

Answer

Using an EnvoyFilter to rewrite headers.

Answer

Using a Gateway to block traffic.

Question 4

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror

Question 5

Which component is responsible for enforcing traffic policies in the data plane?

Accepted Answer

Envoy proxy. The Envoy proxy (injected as a sidecar) handles all data plane traffic management.

Answer

Ingress Gateway

Answer

istiod

Answer

Kiali

Question 6

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

Accepted Answer

It forwards the token to the application.. When set to true, the proxy forwards the original JWT to the application, allowing the application to use the token for backend calls.

Answer

It deletes the token from the request.

Answer

It encrypts the token.

Answer

It logs the token to the audit log.

Question 7

What is the purpose of the 'retryOn' field in a VirtualService?

Accepted Answer

To specify conditions for retrying. It specifies the conditions (e.g., 5xx, gateway-error) that trigger a retry.

Answer

To limit total attempts

Answer

To specify wait time

Answer

To enable circuit breaking

Question 8

What does the 'mirror' feature in a VirtualService do?

Accepted Answer

Sends a copy of live traffic to a test service. Mirroring sends a copy of traffic to a different service without affecting the primary response.

Answer

Splits traffic 50/50

Answer

Encrypts traffic

Answer

Retries failed requests

Question 9

What is the function of the 'weight' parameter in a VirtualService route?

Accepted Answer

To split traffic between multiple destinations. Weight determines the percentage of traffic directed to a specific destination.

Answer

To specify the TTL of a request

Answer

To limit bandwidth usage

Answer

To set the priority of a rule

Question 10

Which TWO fields are mandatory in a Gateway resource?

Accepted Answer

selector. In an Istio Gateway resource, the servers field (E) is mandatory because it defines the ports, protocols, hosts, and TLS settings that the gateway listens on—without at least one server entry the gateway has nothing to configure. The selector field (C) is also mandatory since it binds the Gateway to the specific Envoy proxy pods (via labels such as istio: ingressgateway) that should implement the configuration. The subsets field (A) belongs to a DestinationRule's traffic policy, not to a Gateway, so it is not required here. The tls field (B) is optional and only needed when a server terminates or originates TLS. The hosts field (D) is configured inside each server entry, not as a top-level mandatory Gateway field.

Answer

subsets

Answer

tls

Answer

hosts