In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?
In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?
You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?
In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?
You are configuring mutual TLS (mTLS) for a service that is external to the mesh but needs to communicate securely with mesh services. You have created a ServiceEntry for the external service. Which TWO additional configurations are required to enable mTLS for this external service? (Choose two.)
When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?
You are troubleshooting a service that is failing to communicate with another service in a different namespace. Which TWO of the following items should you check to ensure connectivity?
You manage an Istio mesh with two ingress gateways: one public, one private. You need to allow external clients to reach a service through the public gateway, but only if they present a valid client certificate. The private gateway must remain unaffected. Which Istio resource should you configure to enforce this requirement at the public gateway?
You are running an Istio mesh with several clusters. You need to ensure that all outbound traffic from the mesh to external services is visible and controlled. You have already configured a ServiceEntry for an external API at api.external.com. However, you notice that traffic to this API is not being logged in Kiali and no telemetry is collected. What is the most likely cause?
You are troubleshooting a production Istio mesh where a critical service is experiencing intermittent 503 errors. You suspect that the Envoy sidecar is rejecting requests due to a misconfiguration in the DestinationRule. Which Istio command would you use to inspect the Envoy configuration for a specific pod to verify the applied outlier detection settings?
You are deploying a new version of a microservice in your Istio mesh. You want to perform a canary rollout where 10% of traffic goes to the new version, but you also want to ensure that requests from a specific test user always go to the new version regardless of the overall percentage. Which Istio traffic management feature should you use to achieve this?
You are running an Istio mesh in a single Kubernetes cluster and have enabled sidecar injection in the 'payments' namespace. A client pod in that namespace cannot reach an external HTTPS API at api.example.com because the sidecar intercepts all outbound traffic and rejects it. You must allow only that host while keeping traffic to all other unknown external hosts blocked. What should you configure?
Your team wants to ship an application's logs and metrics to a centralized platform without redeploying the application or changing its code. The application already runs with an injected sidecar. Which Istio capability should you use to emit telemetry to an external backend?
A production mesh shows intermittent 503 responses from one service. You suspect the sidecar's circuit breaker is tripping. You need to confirm which outlier-detection and connection-pool settings are active for that destination. Which Istio resource holds these settings, and how do you inspect them at runtime?
You are using Istio's telemetry features to monitor your mesh. You want to collect metrics on the number of requests that result in a 5xx error for a specific service. Which Istio component is responsible for generating these metrics?
You are troubleshooting why a client cannot reach a service in another namespace within the same mesh. The client's sidecar shows the destination cluster exists, but requests fail. You want to verify whether the client's proxy has the correct listener and route for the destination's port. Which istioctl command sequence should you use?