ICA Practice Test 7 — 10 Questions

Question 1

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

Accepted Answer

Health status (errors/warnings). The Graph view shows the topology of the mesh and the traffic flow.

Answer

Kubernetes node IP addresses

Answer

Sidecar image versions

Answer

User login history

Question 2

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 3

If you want to use a custom proxy image for your sidecars, where should this be specified in the IstioOperator configuration?

Accepted Answer

spec.values.global.proxy.image. The 'spec.values.global.proxy.image' field is used to override the default image for the sidecar proxies.

Answer

spec.components.proxy.image

Answer

spec.meshConfig.defaultConfig.proxyImage

Answer

spec.sidecarInjector.image

Question 4

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

Accepted Answer

Define a RequestAuthentication resource specifying the issuer and jwksUri.. To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.

Answer

Apply a PeerAuthentication resource with mode STRICT.

Answer

Create an EnvoyFilter to parse the JWT.

Question 5

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

Accepted Answer

RequestAuthentication for issuer, then AuthorizationPolicy to verify.. You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.

Answer

Only DestinationRule.

Answer

Only ServiceEntry.

Answer

Only PeerAuthentication.

Question 6

Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?

Accepted Answer

source.principal. The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.

Answer

destination.port

Answer

connection.mtls

Answer

request.auth.principal

Question 7

Which TWO of the following are valid ways to verify the status of an Istio control plane deployment?

Accepted Answer

istioctl verify-install. Using 'istioctl verify-install' checks the health of the control plane, and checking the status of the 'istiod' deployment via kubectl is a standard Kubernetes verification method.

Answer

istioctl proxy-status

Answer

istioctl mesh-check

Answer

kubectl describe ingressgateway

Question 8

When using 'maxRequests' in connectionPool, what happens when the threshold is reached?

Accepted Answer

Additional requests are rejected with a 503.. In Envoy, maxRequests is a circuit-breaking limit that rejects new requests with a 503 error when the limit is exceeded.

Answer

The client is disconnected.

Answer

The timeout is extended.

Answer

Requests are queued until capacity is available.

Answer

The service is automatically scaled.

Question 9

You are testing resilience. You want to inject an HTTP 503 error for 20% of traffic to the 'catalog' service. Which fault setting is correct?

Accepted Answer

abort: { status: 503, percentage: { value: 20 } }. The fault injection abort policy requires an HTTP status code and a percentage.

Answer

abort: { code: 503, percent: 20 }

Answer

fault: { abort: 503, rate: 0.2 }

Answer

abort: { status: 503, ratio: 0.2 }

Answer

error: { status: 503, percentage: 20 }

Question 10

What is the recommended way to test fault injection in a production environment?

Accepted Answer

Using header-based matches in a VirtualService.. Using header-based matching allows you to target faults to specific test traffic without impacting all users.

Answer

Injecting faults in the code.

Answer

Using a separate mesh for testing.

Answer

Enabling it for 1% of traffic using weight.

Answer

Applying it globally to all users.