ICA Hard Questions — 25 Difficult Questions

Question 1

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 2

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Accepted Answer

A shared 'cacerts' secret containing the root CA certificate.. For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.

Answer

A ServiceEntry with 'resolution: DNS'.

Answer

An AuthorizationPolicy allowing all traffic.

Answer

An EgressGateway with TLS origination.

Question 3

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. To move a namespace from revision 1-18 to 1-19, you update the istio.io/rev label on the namespace from 1-18 to 1-19 and then restart the pods so the sidecar injector (mutating webhook) re-injects the new revision's proxy. Istio does not automatically restart pods on label change, so the restart is mandatory for the new sidecar to take effect.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically

Question 4

You have a Gateway but traffic is blocked. Which resource most likely governs the connection permission?

Accepted Answer

AuthorizationPolicy. In Istio, an AuthorizationPolicy is the resource that defines access control rules for workloads, specifying which requests are allowed or denied based on identity, method, path, and other attributes. Even if a Gateway accepts traffic, the AuthorizationPolicy governs whether the connection is permitted to reach the destination workload.

Answer

VirtualService

Answer

DestinationRule

Answer

Gateway

Question 5

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

Accepted Answer

The proxy cannot reach the JWKS URI.. A RequestAuthentication policy in Istio validates JWTs by fetching the JSON Web Key Set (JWKS) from the issuer's specified JWKS URI. If the proxy cannot reach that URI (due to network policies, DNS failures, or the endpoint being down), it cannot retrieve the public keys needed to verify the token's signature, causing validation to fail even when the issuer claim is correct. This is a common operational issue in service meshes where egress restrictions or misconfigured service entries block access to external identity providers.

Answer

The pod is missing a sidecar.

Answer

The namespace is missing.

Answer

The JWT is too long.

Question 6

You need to route traffic to a service based on the 'x-user-type' header. How is this defined?

Accepted Answer

VirtualService match. The match field in a VirtualService can include a 'headers' condition with exact or regex matching.

Answer

ServiceEntry

Answer

DestinationRule subset

Answer

Gateway host

Question 7

Which THREE factors influence whether a service in the mesh will accept traffic?

Accepted Answer

AuthorizationPolicy rules. In an Istio service mesh, whether a workload accepts traffic is governed first by AuthorizationPolicy rules (A), which define ALLOW/DENY/CUSTOM enforcement on incoming requests and determine if a request is permitted to reach the workload. PeerAuthentication policy mode (C) also matters because it controls the mutual TLS mode (STRICT, PERMISSIVE, DISABLE) for incoming connections, so a client that cannot satisfy the required mTLS mode will be rejected before application-level authorization. Envoy proxy configuration state (D) is decisive as well, since the sidecar's listeners, filter chains, and route/RBAC configs actually enforce acceptance; if the proxy is misconfigured, stale, or not synced with istiod, traffic may be refused regardless of the intended policy. The other options do not directly determine acceptance: MeshConfig proxyMetadata (B) only injects environment metadata into proxies and does not by itself gate traffic, and the Kubernetes Service port definition (E) merely exposes/forwards traffic at the L4 Service level without enforcing mesh authorization or mTLS acceptance.

Answer

Global MeshConfig 'proxyMetadata' settings

Answer

Kubernetes Service Port definition

Question 8

Which of the following is true regarding Outlier Detection in Istio?

Accepted Answer

It automatically ejects instances that return 5xx errors.. Outlier Detection requires a destination rule and works by ejecting unhealthy instances based on their error rates.

Answer

It only works with TCP services.

Answer

It can be configured in a VirtualService.

Answer

It is used to rate limit traffic.

Answer

It requires an external monitoring tool.

Question 9

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. Option A (DestinationRule with TLS config) is correct because mTLS to an external service is enabled by a DestinationRule whose trafficPolicy.tls.mode is set to MUTUAL (or ISTIO_MUTUAL for mesh-internal), specifying the client certificate, private key, and CA used for the outbound TLS handshake. Option C (ServiceEntry) is correct because external services must first be registered into Istio's service registry via a ServiceEntry so the mesh knows the host, ports, and resolution, and can apply the DestinationRule to it. Option D (Kubernetes Secret for client certificates) is correct because the DestinationRule's TLS settings reference a Secret containing the client certificate, private key, and CA certificate (e.g., via credentialName) that Istio uses to present during the mTLS handshake. Option B (EnvoyFilter for mTLS) is not required, as EnvoyFilter is a low-level escape hatch for custom Envoy configuration and is not the standard mechanism for configuring mTLS to external services. Option E (AuthorizationPolicy) is not required, since AuthorizationPolicy controls access to workloads inside the mesh and does not establish the mTLS credentials or service registration needed for an external service.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 10

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 11

You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?

Accepted Answer

The Sidecar resource is not scoped, causing the proxy to track all services in the mesh.. Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.

Answer

The ingress gateway has too many listeners.

Answer

The Kubernetes node is under-provisioned.

Answer

The MTU size is too small.

Question 12

You want to configure a circuit breaker that only allows 100 concurrent requests to a service. Which field is correct?

Accepted Answer

trafficPolicy.connectionPool.http.maxRequests. trafficPolicy.connectionPool.http.http1MaxPendingRequests or maxRequests (in versions) is used to control concurrency.

Answer

trafficPolicy.outlierDetection.maxRequests

Answer

trafficPolicy.connectionPool.http.http2MaxRequests

Answer

trafficPolicy.circuitBreaker.maxRequests

Answer

trafficPolicy.connectionPool.tcp.maxConnections

Question 13

Which of the following is true about the 'principals' vs 'source.principals' fields?

Accepted Answer

They refer to the same concept.. They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.

Answer

Only 'principals' is valid.

Answer

Only 'source.principals' is valid.

Answer

They refer to different concepts.

Question 14

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Question 15

When using 'maxRequests' in connectionPool, what happens when the threshold is reached?

Accepted Answer

Additional requests are rejected with a 503.. In Envoy, maxRequests is a circuit-breaking limit that rejects new requests with a 503 error when the limit is exceeded.

Answer

The client is disconnected.

Answer

The timeout is extended.

Answer

Requests are queued until capacity is available.

Answer

The service is automatically scaled.

Question 16

How do you define a regex match in a VirtualService?

Accepted Answer

regex field. The match block URI uses the 'regex' field for pattern matching.

Answer

uri-regex

Answer

match-regex

Answer

pattern field

Question 17

You are debugging a '403 Forbidden' error on a service protected by an AuthorizationPolicy. Which tool is most effective for inspecting the policy enforcement in the data plane?

Accepted Answer

istioctl proxy-config log <pod-name> --level debug. The 'istioctl proxy-config' command allows you to view the actual policy configuration loaded into the Envoy proxy.

Answer

istioctl proxy-config rds <pod-name>

Answer

istioctl proxy-config listener <pod-name>

Answer

istioctl proxy-config policy <pod-name>

Question 18

What is the purpose of 'minHealthPercent' in the OutlierDetection configuration?

Accepted Answer

It limits the number of hosts that can be ejected to keep the cluster healthy.. It prevents the ejection of hosts if it would cause the total cluster health to fall below a specific percentage.

Answer

It sets the frequency of health checks.

Answer

It defines the threshold for the circuit breaker to trip.

Answer

It sets the minimum load for a host to be considered healthy.

Answer

It ensures at least this percentage of pods remain healthy.

Question 19

Which THREE of the following are valid sub-fields of 'outlierDetection'?

Accepted Answer

maxEjectionPercent. The outlierDetection field in Istio's DestinationRule supports several sub-fields for circuit breaking and ejection behavior. Option A, maxEjectionPercent, is correct because it defines the maximum percentage of hosts in a load balancing pool that can be ejected due to outlier detection. Option E, baseEjectionTime, is correct as it specifies the minimum ejection duration for a host, which is multiplied by the number of times the host has been ejected. Option null (interval) is correct because it sets the time interval between ejection sweep analyses, controlling how frequently outlier detection runs. Option B, consecutive5xx, is not a valid sub-field; the correct field is consecutive5xxErrors, which counts consecutive 5xx responses before ejection. Option C, retryOn, belongs to retry policies, not outlierDetection. Option D, maxConnections, is a connection pool setting, not part of outlierDetection.

Answer

consecutive5xx

Answer

retryOn

Answer

maxConnections

Question 20

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror