ICA Practice Test 9 — 10 Questions

Question 1

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

Accepted Answer

Gateway. In Istio, a Gateway resource configures the Envoy proxy at the edge of the mesh to accept inbound traffic on specified ports and protocols (HTTP, HTTPS, TCP, etc.). It is the required entry point definition that binds a load balancer or ingress IP to the mesh, and it is then referenced by a VirtualService to route traffic to internal services. Without a Gateway, external traffic has no defined listener to enter the mesh.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 2

What is the command to view the status of all pods including proxies?

Accepted Answer

kubectl get pods. In Istio, sidecar proxies run as containers inside the application pods, so they appear as additional containers in the pod's status. The standard Kubernetes command kubectl get pods shows each pod's status, including the number of ready containers (e.g., 2/2 when both the app and the istio-proxy sidecar are ready), which is how you verify proxy health alongside the app.

Answer

istioctl pods

Answer

istioctl status

Answer

kubectl describe proxy

Question 3

To test the resilience of your microservice architecture, you want to introduce a 5-second delay to 50% of the requests directed to the 'catalog-service'. Where do you define this configuration?

Accepted Answer

VirtualService. A VirtualService is used to define traffic routing rules, including fault injection such as delays and aborts. To introduce a 5-second delay to 50% of requests to 'catalog-service', you configure a fault delay in the VirtualService's HTTP route. This allows testing resilience without modifying the application.

Answer

DestinationRule

Answer

Gateway

Answer

ServiceEntry

Question 4

Which THREE items are included in an Istio SPIFFE ID?

Accepted Answer

Trust domain. An Istio SPIFFE ID follows the format spiffe:///ns//sa/, so the three components it includes are the trust domain (A), the namespace (D), and the service account (C). The trust domain (A) is the first segment after the spiffe:// scheme and identifies the identity's issuing authority, which in Istio defaults to cluster.local. The namespace (D) appears in the /ns/ path segment and scopes the workload identity to its Kubernetes namespace. The service account (C) appears in the /sa/ path segment and represents the Kubernetes service account under which the workload runs. Cluster Name (B) is not part of the SPIFFE ID format—it is a separate Istio concept used in multi-cluster configurations and mesh expansion. IP Address (E) is not encoded in a SPIFFE ID; Istio identities are based on service account and namespace, not network addresses.

Answer

Cluster Name

Answer

IP Address

Question 5

Which field in VirtualService is used for A/B testing?

Accepted Answer

weight. The weight field is used to split traffic between versions (subsets) for A/B testing.

Answer

redirect

Answer

match

Answer

subset

Question 6

Which TWO settings in a DestinationRule are used for load balancing?

Accepted Answer

loadBalancer.simple. TrafficPolicy includes the load balancing settings for a service.

Answer

connectionPool

Answer

outlierDetection

Answer

trafficPolicy.tls

Question 7

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. MeshConfig telemetry settings (B) are essential because the mesh-wide MeshConfig controls how Envoy sidecars emit telemetry, including access logging, metrics, and tracing defaults that determine whether observability data is generated at all. Tracing sampling rate (D) is essential because it governs what fraction of requests are captured as distributed traces; without an appropriate sampling rate, you either lose visibility into request flows or overwhelm the tracing backend. Telemetry resource configuration (E) is essential because the Telemetry API resources define providers, metrics, access logging, and tracing behavior per workload or namespace, directly shaping the observability signals collected across the mesh. Local sidecar memory limits (A) affect resource consumption and stability but do not determine what telemetry is produced or exported, and VirtualService timeouts (C) are traffic-management controls for request deadlines, not observability configuration.

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 8

Which actions can a VirtualService perform on a request? (Choose TWO)

Accepted Answer

route. In Istio, a VirtualService defines how requests are routed to a service within the mesh, and its core capabilities include the route action (option A), which specifies destination hosts, subsets, and weights for matching traffic, and the headers action (option C), which allows modification of request and response headers via header manipulation rules. Both route and headers are valid top-level HTTP route actions in the VirtualService specification, making A and C correct for this scenario. The scale action (option B) is not part of VirtualService; scaling is handled by Kubernetes workload resources such as Deployments or HorizontalPodAutoscalers. The filter action (option D) is not a VirtualService action; traffic filtering is achieved through route match conditions or EnvoyFilter resources. The replicate action (option E) does not exist in the VirtualService API; traffic mirroring is instead configured using the mirror and mirrorPercentage fields under a route.

Answer

scale

Answer

filter

Answer

replicate

Question 9

Which TWO are common causes for a service to be ejected by Outlier Detection?

Accepted Answer

Consecutive gateway failures.. Outlier detection in service meshes (e.g., Istio/Envoy) ejects a host from the load-balancing pool when it exhibits repeated failures at the connection or request level. Option A is correct because consecutive gateway failures—such as TCP connection failures, timeouts, or HTTP 502/503/504 responses classified as gateway errors—trigger the consecutive-gateway-failures ejection policy. Option B is correct because consecutive 5xx responses from the upstream service are counted by the consecutive-5xx ejection policy and cause the endpoint to be ejected once the threshold is exceeded. Options C and E are incorrect because high disk or CPU usage are resource-pressure conditions handled by metrics-based autoscaling or resource limits, not by outlier detection's failure counters. Option D is incorrect because the number of logged-in users is an application-level metric unrelated to the consecutive failure thresholds that outlier detection evaluates.

Answer

High disk usage on the pod.

Answer

Too many users logged in.

Answer

High CPU usage on the pod.

Question 10

Which THREE fields are found in the 'http' connectionPool configuration?

Accepted Answer

idleTimeout. http2MaxRequests, maxRequestsPerConnection, and idleTimeout are valid fields.

Answer

maxConnections

Answer

maxRetries