ICA Full-Length Exam Simulation

Question 1

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 2

You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?

Accepted Answer

timeout. The timeout setting is defined within the route rule of a VirtualService.

Answer

deadline

Answer

maxRequestDuration

Answer

requestTimeout

Question 3

If you want to perform traffic shadowing, which field do you use?

Accepted Answer

mirror. The mirror field in a VirtualService enables traffic shadowing.

Answer

redirect

Answer

weight

Answer

fault

Question 4

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. Option D, 'istioctl analyze', is correct because it statically inspects the mesh configuration (Istio resources, namespaces, and optionally live cluster state) and reports potential misconfigurations, warnings, and errors that affect mesh health. Option E, 'istioctl proxy-config', is correct because it queries the Envoy configuration of a specific sidecar or gateway (for example, clusters, listeners, routes, endpoints, and bootstrap) to diagnose traffic-routing and connectivity problems in the mesh. The other options are not valid istioctl debugging actions: 'istioctl delete pod' (A) is not an istioctl subcommand for deleting pods, 'istioctl monitor' (B) is not a supported istioctl command for mesh health monitoring, and 'istioctl update mesh' (C) is not a valid istioctl command for updating mesh configuration.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh

Question 5

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

Accepted Answer

The legacy service is not using an Istio sidecar to handle mTLS handshakes.. A PeerAuthentication policy with mode: STRICT at the namespace scope requires all inbound traffic to workloads in that namespace to use Istio mutual TLS. Only workloads with an Istio sidecar proxy can originate and terminate mTLS, so a legacy service without a sidecar cannot complete the mTLS handshake and its connections fail. The fix is either to inject a sidecar into the legacy service or to use a permissive mode or port-level exception during migration.

Answer

The Gateway is misconfigured for the legacy service.

Answer

The DestinationRule for the service is missing the 'mode: ISTIO_MUTUAL' setting.

Answer

The AuthorizationPolicy is missing a rule for the legacy service.

Question 6

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 7

If a VirtualService has a route to a service that has no pods matching the label, what happens?

Accepted Answer

503 Service Unavailable. In Istio, a VirtualService route points to a Kubernetes Service by name. If that Service has no endpoints because no pods match its label selector, Envoy has no healthy upstream cluster members to route to. Istio's default behavior in this case is to return HTTP 503 Service Unavailable (with the 'no healthy upstream' response flag), rather than silently dropping or rerouting traffic.

Answer

Traffic is routed to the default

Answer

Traffic is dropped

Answer

Traffic is routed to external

Question 8

You want to route traffic to a specific version of a service based on a header. Where do you define the subset?

Accepted Answer

DestinationRule. In Istio, a DestinationRule defines the named subsets of a service (for example, v1 and v2) by selecting pods with specific labels. A VirtualService then references those subsets when routing traffic, so the subset definition itself lives in the DestinationRule. This separation lets routing rules (VirtualService) stay decoupled from the actual pod groupings (DestinationRule).

Answer

Gateway

Answer

ServiceEntry

Answer

VirtualService

Question 9

Which command is used to display the currently active PeerAuthentication policies in the mesh?

Accepted Answer

kubectl get peerauthentication -A. The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.

Answer

istioctl analyze

Answer

istioctl get peerauthentication

Answer

kubectl describe mtls

Question 10

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 11

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. To move a namespace from revision 1-18 to 1-19, you update the istio.io/rev label on the namespace from 1-18 to 1-19 and then restart the pods so the sidecar injector (mutating webhook) re-injects the new revision's proxy. Istio does not automatically restart pods on label change, so the restart is mandatory for the new sidecar to take effect.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically

Question 12

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Accepted Answer

Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.. A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.

Answer

Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.

Answer

Apply a global MeshConfig setting to enforce mTLS.

Answer

Create an AuthorizationPolicy that denies all traffic without a client certificate.

Question 13

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Accepted Answer

It defaults to ALLOW.. If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.

Answer

The request is rejected.

Answer

It defaults to DENY.

Answer

The policy is invalid.

Question 14

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 15

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 16

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 17

Which field in the DestinationRule allows defining different versions of a service?

Accepted Answer

subsets. The subsets block in DestinationRule allows grouping pods by label to create versions.

Answer

hosts

Answer

trafficPolicy

Answer

loadBalancer

Question 18

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

Accepted Answer

The proxy cannot reach the JWKS URI.. A RequestAuthentication policy in Istio validates JWTs by fetching the JSON Web Key Set (JWKS) from the issuer's specified JWKS URI. If the proxy cannot reach that URI (due to network policies, DNS failures, or the endpoint being down), it cannot retrieve the public keys needed to verify the token's signature, causing validation to fail even when the issuer claim is correct. This is a common operational issue in service meshes where egress restrictions or misconfigured service entries block access to external identity providers.

Answer

The pod is missing a sidecar.

Answer

The namespace is missing.

Answer

The JWT is too long.

Question 19

What is the purpose of 'istioctl analyze'?

Accepted Answer

Identify configuration issues. To identify configuration issues across the mesh.

Answer

Scale deployments

Answer

Check proxy version

Answer

Visualize traffic

Question 20

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

Accepted Answer

istiod. istiod is the Istio control plane component that watches Gateway API resources (Gateway and HTTPRoute) and translates them into Envoy xDS configuration pushed to the gateway proxy pods. When you define a Gateway resource, istiod's config controller reconciles it and generates the corresponding listener, route, cluster, and endpoint configuration for the Envoy data plane.

Answer

The Kiali operator

Answer

The Envoy proxy sidecar

Answer

The ingress-gateway deployment