ICA Practice Test 8 — 10 Questions

Question 1

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

Accepted Answer

Envoy Proxy. The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.

Answer

Citadel

Answer

Ingress Gateway

Answer

Istiod

Question 2

How do you implement a circuit breaker to eject a pod that returns 5xx errors?

Accepted Answer

DestinationRule outlierDetection. Circuit breaking in Istio is implemented via DestinationRule's outlierDetection field, which configures Envoy's outlier detection to eject endpoints that return consecutive 5xx errors (or gateway errors) from the load balancing pool for a specified interval. The key parameters are consecutive5xxErrors, interval, baseEjectionTime, and maxEjectionPercent. This is the canonical Istio mechanism for passive health checking and circuit breaking at the destination level.

Answer

PeerAuthentication

Answer

VirtualService fault injection

Answer

VirtualService retry policy

Question 3

What is the default load balancing policy if none is specified in the DestinationRule?

Accepted Answer

ROUND_ROBIN. Istio defaults to ROUND_ROBIN if not specified.

Answer

RANDOM

Answer

LEAST_CONN

Answer

PASSTHROUGH

Question 4

What is the primary purpose of the 'RequestAuthentication' resource?

Accepted Answer

To define JWT validation requirements.. RequestAuthentication is used to define which JWT issuers are trusted and how to validate tokens.

Answer

To issue new JWTs.

Answer

To store user credentials.

Answer

To encrypt traffic between services.

Question 5

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 6

You want to force all traffic to an external service to go through an EgressGateway. What is required?

Accepted Answer

A ServiceEntry for the host and a VirtualService to direct traffic to the egress gateway.. A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.

Answer

Only a ServiceEntry.

Answer

A PeerAuthentication policy.

Answer

Only an EgressGateway.

Question 7

Which THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?

Accepted Answer

interval. In Istio's DestinationRule, the outlierDetection block configures passive health checking (circuit breaking) that ejects unhealthy hosts from the load-balancing pool. Option A, interval, is correct because it defines the time interval between ejection sweep analyses of the hosts (e.g., 10s), controlling how often the outlier detection scan runs. Option B, baseEjectionTime, is correct because it specifies the minimum ejection duration for an outlier host, and the actual ejection time is multiplied by the number of times the host has been ejected. Option E, consecutive5xxErrors, is correct because it is the threshold of consecutive 5xx errors a host must return before it is ejected from the pool. Option C, requestRetryCount, is not part of outlierDetection; retry behavior is configured under the DestinationRule's trafficPolicy retries or the VirtualService retries block. Option D, maxConnectionTimeout, is not a valid outlierDetection field; connection pool timeouts are configured under connectionPool.tcp (e.g., connectTimeout) in the DestinationRule.

Answer

requestRetryCount

Answer

maxConnectionTimeout

Question 8

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 9

What is the standard path to install istioctl?

Accepted Answer

Binary download. Downloading the binary from the Istio release page is the standard method.

Answer

apt-get

Answer

kubectl plugin

Answer

npm install

Question 10

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn