ICA Advanced Scenarios Practice Test 2 — 15 Questions

Question 1

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. Option A (DestinationRule with TLS config) is correct because mTLS to an external service is enabled by a DestinationRule whose trafficPolicy.tls.mode is set to MUTUAL (or ISTIO_MUTUAL for mesh-internal), specifying the client certificate, private key, and CA used for the outbound TLS handshake. Option C (ServiceEntry) is correct because external services must first be registered into Istio's service registry via a ServiceEntry so the mesh knows the host, ports, and resolution, and can apply the DestinationRule to it. Option D (Kubernetes Secret for client certificates) is correct because the DestinationRule's TLS settings reference a Secret containing the client certificate, private key, and CA certificate (e.g., via credentialName) that Istio uses to present during the mTLS handshake. Option B (EnvoyFilter for mTLS) is not required, as EnvoyFilter is a low-level escape hatch for custom Envoy configuration and is not the standard mechanism for configuring mTLS to external services. Option E (AuthorizationPolicy) is not required, since AuthorizationPolicy controls access to workloads inside the mesh and does not establish the mTLS credentials or service registration needed for an external service.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 2

You are configuring mutual TLS (mTLS) for a service that is external to the mesh but needs to communicate securely with mesh services. You have created a ServiceEntry for the external service. Which TWO additional configurations are required to enable mTLS for this external service? (Choose two.)

Accepted Answer

The client certificate, private key, and CA certificate must be mounted into the sidecar proxy container.. To enable mTLS for an external service, you need to configure the client-side TLS settings via a DestinationRule, specifying the certificates and mode. Additionally, those certificates must be mounted into the sidecar proxy container so they can be used during the TLS handshake. The ServiceEntry alone is insufficient; it only registers the service. PeerAuthentication and Gateway are not involved in outbound mTLS.

Answer

A ServiceEntry with resolution: DNS and location: MESH_EXTERNAL.

Answer

A PeerAuthentication with mtls.mode: STRICT applied to the namespace of the client pods.

Answer

A Gateway resource with TLS termination configured for the external service.

Question 3

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

Accepted Answer

istiod. istiod is the Istio control plane component that watches Gateway API resources (Gateway and HTTPRoute) and translates them into Envoy xDS configuration pushed to the gateway proxy pods. When you define a Gateway resource, istiod's config controller reconciles it and generates the corresponding listener, route, cluster, and endpoint configuration for the Envoy data plane.

Answer

The Kiali operator

Answer

The Envoy proxy sidecar

Answer

The ingress-gateway deployment

Question 4

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

Accepted Answer

The traffic is encountering high error rates or being blocked by an Istio policy.. In Kiali's graph view, edge colors encode traffic health: green means healthy, yellow means degraded, and red means the request/response flow is failing. A red line specifically indicates that the destination workload is returning errors (typically 5xx) or that traffic is being denied by an Istio policy such as an AuthorizationPolicy or a misconfigured PeerAuthentication. Kiali derives this from Envoy sidecar telemetry (istio_requests_total), so the red edge is a symptom of actual request failures, not a topology or encryption state.

Answer

The services are located in different clusters.

Answer

The service is not part of the mesh.

Answer

The connection is encrypted using mTLS.

Question 5

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

Accepted Answer

Gateway. The Gateway resource defines the entry point, including listeners, ports, and protocols.

Answer

Service

Answer

Ingress

Answer

HTTPRoute

Question 6

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

Accepted Answer

Sidecar resource. Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.

Answer

DestinationRule

Answer

VirtualService

Answer

PeerAuthentication

Question 7

How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?

Accepted Answer

istioctl proxy-config. The `istioctl proxy-config` command retrieves the actual Envoy configuration (clusters, listeners, routes, endpoints) from a specific sidecar, allowing you to verify what is currently pushed without Kiali. It queries the Envoy admin API on the proxy and formats the output. This is the standard CLI method for inspecting sidecar config.

Answer

istioctl analyze

Answer

kubectl get virtualservice

Answer

kubectl describe pod

Question 8

What is the primary function of the 'PeerAuthentication' resource?

Accepted Answer

Configure mTLS mode for workloads.. PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.

Answer

Apply rate limits to requests.

Answer

Limit egress traffic to external sites.

Answer

Route traffic based on headers.

Question 9

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

Accepted Answer

To allow the control plane to manage the remote cluster's services.. In Istio's multi-cluster model with a shared (primary) control plane, the istio-remote-secret is a Secret created in the primary cluster that contains the kubeconfig credentials for a remote cluster. It allows the primary control plane (istiod) to connect to and manage the remote cluster's API server — discovering its services, endpoints, and injecting configuration — so the remote cluster's workloads participate in the mesh.

Answer

To store custom headers for cross-cluster traffic.

Answer

To identify the cluster in the mesh.

Answer

To encrypt traffic between clusters.

Question 10

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

Accepted Answer

HTTPRoute. HTTPRoute is the specific Gateway API resource for routing HTTP traffic based on hostnames, paths, and headers.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 11

What is the result of setting 'outlierDetection' in a DestinationRule?

Accepted Answer

Unhealthy endpoints are temporarily ejected from the load balancing pool.. The outlierDetection field in an Istio DestinationRule configures outlier ejection, which is Istio's implementation of passive health checking. When an endpoint in the load balancing pool returns a consecutive number of 5xx errors (default consecutive5xxErrors: 5) within a defined interval, Envoy ejects that endpoint from the pool for a base ejection time (default 30s), preventing traffic from being routed to the unhealthy pod. This is analogous to circuit breaking at the endpoint level and improves overall service reliability without requiring active health checks.

Answer

Logs are sent to a remote collector.

Answer

Traffic is automatically retried.

Answer

Connections are encrypted.

Question 12

Which Istio component handles the generation of xDS configuration?

Accepted Answer

istiod. Istiod is the monolithic control plane component that computes the configuration for all sidecars.

Answer

Kiali

Answer

Envoy

Answer

Prometheus

Question 13

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 14

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Accepted Answer

The number of requests that exceeded the timeout to an upstream service.. This metric indicates the number of requests that timed out while waiting for a response from the upstream service.

Answer

The average time of all requests.

Answer

The total number of upstream connections.

Answer

The number of successful requests.

Question 15

Which tool allows you to perform traffic shifting between two versions of a service?

Accepted Answer

VirtualService. A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.

Answer

PeerAuthentication

Answer

Gateway

Answer

DestinationRule