ICA Multiple Select — 20 Questions

Question 1

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Accepted Answer

from. An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).

Answer

action

Answer

selector

Question 2

Which THREE of the following are valid ways to control egress traffic in Istio?

Accepted Answer

Sidecar resource with egress policy. Egress control can be achieved via mesh-level configuration, gateway-based routing, or sidecar-level restrictions.

Answer

Kiali Dashboard

Answer

PeerAuthentication

Question 3

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. istioctl is the primary diagnostic tool for Istio.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh

Question 4

Which THREE items are required to configure mTLS for an external service that is being added to the mesh?

Accepted Answer

DestinationRule with TLS config. To connect to an external service with mTLS, you need to define the service, configure egress, and provide the client certificates.

Answer

EnvoyFilter for mTLS

Answer

AuthorizationPolicy

Question 5

Which TWO are common causes for a service to be ejected by Outlier Detection?

Accepted Answer

Consecutive gateway failures.. Repeated 5xx errors and gateway failures are the two primary reasons.

Answer

High disk usage on the pod.

Answer

Too many users logged in.

Answer

High CPU usage on the pod.

Question 6

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Accepted Answer

The client proxy initiates mTLS handshakes.. STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.

Answer

All non-Istio traffic is automatically routed to the gateway.

Answer

The proxy automatically upgrades HTTP to HTTPS.

Question 7

Which THREE commands can be used to manage or inspect the Istio mesh configuration?

Accepted Answer

istioctl version. The 'istioctl' tool provides 'analyze', 'proxy-config', and 'version' commands for mesh inspection and management.

Answer

istioctl deploy

Answer

istioctl upgrade

Question 8

Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?

Accepted Answer

MeshConfig telemetry settings. Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).

Answer

Local sidecar memory limits

Answer

VirtualService timeouts

Question 9

When configuring a Gateway API resource, which TWO properties are defined within the 'listeners' block?

Accepted Answer

Port. Listeners define the protocol, port, and hostname bindings for the gateway.

Answer

Request retries

Answer

Circuit breaker policy

Answer

Service account

Question 10

When using Kiali to debug service communication, which TWO metrics are most useful for identifying performance bottlenecks?

Accepted Answer

Request latency (P99). Latency and request rates (throughput) are the primary indicators of performance issues.

Answer

Number of active connections

Answer

CPU usage of the sidecar

Answer

Memory usage of the application

Question 11

Which THREE items can you configure in a VirtualService to improve resilience?

Accepted Answer

Retries. Timeouts, Retries, and Fault Injection are all controlled within a VirtualService.

Answer

Connection Pool

Answer

Outlier Detection

Question 12

When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?

Accepted Answer

Locality-aware load balancing. Redundancy across clusters and proper routing are essential for HA.

Answer

Disabling mTLS for performance

Answer

Using a single ingress gateway for all traffic

Question 13

Which THREE components are critical for establishing a secure multi-cluster 'primary-remote' configuration?

Accepted Answer

Remote cluster kubeconfig secret. Cross-cluster identity, trust, and API access are the core requirements.

Answer

Kiali visualization plugin

Answer

External DNS provider

Question 14

Which THREE features does the Kubernetes Gateway API offer that are significantly different from legacy Ingress?

Accepted Answer

Support for multiple protocols beyond HTTP/HTTPS. Gateway API is designed for better multi-tenancy, clearer roles, and advanced routing capabilities.

Answer

Automatic certificate management

Answer

Direct integration with Prometheus

Question 15

Which TWO options are required to properly implement an abort fault injection in a VirtualService?

Accepted Answer

httpStatus. To implement an abort, you must specify the 'percentage' and the 'httpStatus' code within the 'fault' block.

Answer

headers

Answer

match

Answer

fixedDelay

Question 16

Which TWO of the following are true regarding PeerAuthentication policies?

Accepted Answer

They must be applied in the 'istio-system' namespace to work globally.. They can be applied at mesh, namespace, or workload level, and the mode can be STRICT or PERMISSIVE.

Answer

They cannot be used with sidecar-less ambient mode.

Answer

They validate JWT tokens.

Answer

They support the 'DENY' action.

Question 17

Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?

Accepted Answer

http. tcp, http, and http2 are the three protocol-specific pools within the connectionPool object.

Answer

grpc

Answer

tls

Question 18

Which TWO settings in a DestinationRule are used for load balancing?

Accepted Answer

loadBalancer.simple. TrafficPolicy includes the load balancing settings for a service.

Answer

connectionPool

Answer

outlierDetection

Answer

trafficPolicy.tls

Question 19

Which TWO of the following are valid HTTP fault injection delay settings?

Accepted Answer

fixedDelay. fixedDelay and percentage are the two required components.

Answer

maxDelay

Answer

randomDelay

Answer

minDelay

Question 20

Which TWO pieces of information are displayed in the Kiali 'Graph' view?

Accepted Answer

Health status (errors/warnings). The Graph view shows the topology of the mesh and the traffic flow.

Answer

Kubernetes node IP addresses

Answer

Sidecar image versions

Answer

User login history