ICA Hard Questions — 25 Difficult Questions

Question 1

You need to integrate an external database into the mesh that does not support mTLS. How do you configure it securely?

Accepted Answer

Define a ServiceEntry and use an EgressGateway for controlled access.. Use a ServiceEntry to define the external service, and an EgressGateway to handle TLS origination if needed, or simply restrict traffic via an AuthorizationPolicy.

Answer

Run a sidecar on the database server.

Answer

Enable 'PERMISSIVE' mTLS mode for the entire mesh.

Answer

Create a Kubernetes Service with the database IP.

Question 2

How do you define a circuit breaker that limits the number of pending requests?

Accepted Answer

http1MaxPendingRequests. The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.

Answer

maxRequestsInQueue

Answer

maxPending

Answer

pendingRequestsLimit

Answer

maxPendingRequests

Question 3

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Accepted Answer

from. An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).

Answer

action

Answer

selector

Question 4

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 5

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Accepted Answer

A shared 'cacerts' secret containing the root CA certificate.. For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.

Answer

A ServiceEntry with 'resolution: DNS'.

Answer

An AuthorizationPolicy allowing all traffic.

Answer

An EgressGateway with TLS origination.

Question 6

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. To connect to an external service with mTLS, you need to define the service, configure egress, and provide the client certificates.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 7

Which of the following is true regarding Outlier Detection in Istio?

Accepted Answer

It automatically ejects instances that return 5xx errors.. Outlier Detection requires a destination rule and works by ejecting unhealthy instances based on their error rates.

Answer

It only works with TCP services.

Answer

It can be configured in a VirtualService.

Answer

It is used to rate limit traffic.

Answer

It requires an external monitoring tool.

Question 8

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Accepted Answer

The client proxy initiates mTLS handshakes.. STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.

Answer

All non-Istio traffic is automatically routed to the gateway.

Answer

The proxy automatically upgrades HTTP to HTTPS.

Question 9

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 10

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

Accepted Answer

The Envoy 'buffer' filter configuration.. The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.

Answer

The 'tcp-metadata' filter.

Answer

The 'outlier-detection' settings.

Answer

The 'circuit-breaker' settings.

Question 11

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 12

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Redundancy across clusters and proper routing are essential for HA.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 13

You observe that your sidecars are crashing due to 'Out of Memory' (OOM). What is a likely configuration error?

Accepted Answer

The Sidecar resource is not scoped, causing the proxy to track all services in the mesh.. Over-subscribing sidecars with too many services or complex routing rules (like large numbers of VirtualServices) can lead to high memory consumption in the sidecar proxy.

Answer

The ingress gateway has too many listeners.

Answer

The Kubernetes node is under-provisioned.

Answer

The MTU size is too small.

Question 14

Which THREE components are critical for establishing a secure multi-cluster 'primary-remote' configuration?

Accepted Answer

Remote cluster kubeconfig secret. Cross-cluster identity, trust, and API access are the core requirements.

Answer

Kiali visualization plugin

Answer

External DNS provider

Question 15

Which THREE features does the Kubernetes Gateway API offer that are significantly different from legacy Ingress?

Accepted Answer

Support for multiple protocols beyond HTTP/HTTPS. Gateway API is designed for better multi-tenancy, clearer roles, and advanced routing capabilities.

Answer

Automatic certificate management

Answer

Direct integration with Prometheus

Question 16

Which TWO options are required to properly implement an abort fault injection in a VirtualService?

Accepted Answer

httpStatus. To implement an abort, you must specify the 'percentage' and the 'httpStatus' code within the 'fault' block.

Answer

headers

Answer

match

Answer

fixedDelay

Question 17

You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?

Accepted Answer

Increase interval, increase consecutive5xx.. A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.

Answer

Decrease interval, decrease consecutive5xx.

Answer

Decrease interval, increase consecutive5xx.

Answer

Disable outlierDetection and use only circuitBreaking.

Answer

Increase interval, decrease consecutive5xx.

Question 18

You want to configure a circuit breaker that only allows 100 concurrent requests to a service. Which field is correct?

Accepted Answer

trafficPolicy.connectionPool.http.maxRequests. trafficPolicy.connectionPool.http.http1MaxPendingRequests or maxRequests (in versions) is used to control concurrency.

Answer

trafficPolicy.outlierDetection.maxRequests

Answer

trafficPolicy.connectionPool.http.http2MaxRequests

Answer

trafficPolicy.circuitBreaker.maxRequests

Answer

trafficPolicy.connectionPool.tcp.maxConnections

Question 19

Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?

Accepted Answer

http. tcp, http, and http2 are the three protocol-specific pools within the connectionPool object.

Answer

grpc

Answer

tls

Question 20

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.