ICA Practice Questions 2 — 50 Questions

Question 1

You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?

Accepted Answer

Increase interval, increase consecutive5xx.. A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.

Answer

Decrease interval, decrease consecutive5xx.

Answer

Decrease interval, increase consecutive5xx.

Answer

Disable outlierDetection and use only circuitBreaking.

Answer

Increase interval, decrease consecutive5xx.

Question 2

You want to configure a circuit breaker that only allows 100 concurrent requests to a service. Which field is correct?

Accepted Answer

trafficPolicy.connectionPool.http.maxRequests. trafficPolicy.connectionPool.http.http1MaxPendingRequests or maxRequests (in versions) is used to control concurrency.

Answer

trafficPolicy.outlierDetection.maxRequests

Answer

trafficPolicy.connectionPool.http.http2MaxRequests

Answer

trafficPolicy.circuitBreaker.maxRequests

Answer

trafficPolicy.connectionPool.tcp.maxConnections

Question 3

Which TWO of the following are true regarding PeerAuthentication policies?

Accepted Answer

They must be applied in the 'istio-system' namespace to work globally.. They can be applied at mesh, namespace, or workload level, and the mode can be STRICT or PERMISSIVE.

Answer

They cannot be used with sidecar-less ambient mode.

Answer

They validate JWT tokens.

Answer

They support the 'DENY' action.

Question 4

What is the primary function of the 'istio-proxy' container in a pod?

Accepted Answer

Intercepting network traffic. It intercepts all network traffic to and from the application container.

Answer

Running the business logic

Answer

Managing Kubernetes API

Answer

Monitoring disk usage

Question 5

Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?

Accepted Answer

http. tcp, http, and http2 are the three protocol-specific pools within the connectionPool object.

Answer

grpc

Answer

tls

Question 6

Which TWO settings in a DestinationRule are used for load balancing?

Accepted Answer

loadBalancer.simple. TrafficPolicy includes the load balancing settings for a service.

Answer

connectionPool

Answer

outlierDetection

Answer

trafficPolicy.tls

Question 7

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Question 8

Which of the following is true about the 'principals' vs 'source.principals' fields?

Accepted Answer

They refer to the same concept.. They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.

Answer

Only 'principals' is valid.

Answer

Only 'source.principals' is valid.

Answer

They refer to different concepts.

Question 9

Which field in a VirtualService can you use to retry a request?

Accepted Answer

retries. The 'retries' field in the HTTP route block allows defining retry attempts and timeout per try.

Answer

attemptCount

Answer

retryPolicy

Answer

faultRetry

Answer

repeat

Question 10

Which TWO of the following are valid HTTP fault injection delay settings?

Accepted Answer

fixedDelay. fixedDelay and percentage are the two required components.

Answer

maxDelay

Answer

randomDelay

Answer

minDelay

Question 11

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

Accepted Answer

Health status (errors/warnings). The Graph view shows the topology of the mesh and the traffic flow.

Answer

Kubernetes node IP addresses

Answer

Sidecar image versions

Answer

User login history

Question 12

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 13

If you want to use a custom proxy image for your sidecars, where should this be specified in the IstioOperator configuration?

Accepted Answer

spec.values.global.proxy.image. The 'spec.values.global.proxy.image' field is used to override the default image for the sidecar proxies.

Answer

spec.components.proxy.image

Answer

spec.meshConfig.defaultConfig.proxyImage

Answer

spec.sidecarInjector.image

Question 14

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

Accepted Answer

Define a RequestAuthentication resource specifying the issuer and jwksUri.. To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.

Answer

Apply a PeerAuthentication resource with mode STRICT.

Answer

Create an EnvoyFilter to parse the JWT.

Question 15

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

Accepted Answer

RequestAuthentication for issuer, then AuthorizationPolicy to verify.. You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.

Answer

Only DestinationRule.

Answer

Only ServiceEntry.

Answer

Only PeerAuthentication.

Question 16

Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?

Accepted Answer

source.principal. The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.

Answer

destination.port

Answer

connection.mtls

Answer

request.auth.principal

Question 17

Which TWO of the following are valid ways to verify the status of an Istio control plane deployment?

Accepted Answer

istioctl verify-install. Using 'istioctl verify-install' checks the health of the control plane, and checking the status of the 'istiod' deployment via kubectl is a standard Kubernetes verification method.

Answer

istioctl proxy-status

Answer

istioctl mesh-check

Answer

kubectl describe ingressgateway

Question 18

When using 'maxRequests' in connectionPool, what happens when the threshold is reached?

Accepted Answer

Additional requests are rejected with a 503.. In Envoy, maxRequests is a circuit-breaking limit that rejects new requests with a 503 error when the limit is exceeded.

Answer

The client is disconnected.

Answer

The timeout is extended.

Answer

Requests are queued until capacity is available.

Answer

The service is automatically scaled.

Question 19

You are testing resilience. You want to inject an HTTP 503 error for 20% of traffic to the 'catalog' service. Which fault setting is correct?

Accepted Answer

abort: { status: 503, percentage: { value: 20 } }. The fault injection abort policy requires an HTTP status code and a percentage.

Answer

abort: { code: 503, percent: 20 }

Answer

fault: { abort: 503, rate: 0.2 }

Answer

abort: { status: 503, ratio: 0.2 }

Answer

error: { status: 503, percentage: 20 }

Question 20

What is the recommended way to test fault injection in a production environment?

Accepted Answer

Using header-based matches in a VirtualService.. Using header-based matching allows you to target faults to specific test traffic without impacting all users.

Answer

Injecting faults in the code.

Answer

Using a separate mesh for testing.

Answer

Enabling it for 1% of traffic using weight.

Answer

Applying it globally to all users.