ICA Quick Quiz — 10 Questions

Question 1

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 2

You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?

Accepted Answer

timeout. The timeout setting is defined within the route rule of a VirtualService.

Answer

deadline

Answer

maxRequestDuration

Answer

requestTimeout

Question 3

If you want to perform traffic shadowing, which field do you use?

Accepted Answer

mirror. The mirror field in a VirtualService enables traffic shadowing.

Answer

redirect

Answer

weight

Answer

fault

Question 4

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. Option D, 'istioctl analyze', is correct because it statically inspects the mesh configuration (Istio resources, namespaces, and optionally live cluster state) and reports potential misconfigurations, warnings, and errors that affect mesh health. Option E, 'istioctl proxy-config', is correct because it queries the Envoy configuration of a specific sidecar or gateway (for example, clusters, listeners, routes, endpoints, and bootstrap) to diagnose traffic-routing and connectivity problems in the mesh. The other options are not valid istioctl debugging actions: 'istioctl delete pod' (A) is not an istioctl subcommand for deleting pods, 'istioctl monitor' (B) is not a supported istioctl command for mesh health monitoring, and 'istioctl update mesh' (C) is not a valid istioctl command for updating mesh configuration.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh

Question 5

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

Accepted Answer

The legacy service is not using an Istio sidecar to handle mTLS handshakes.. A PeerAuthentication policy with mode: STRICT at the namespace scope requires all inbound traffic to workloads in that namespace to use Istio mutual TLS. Only workloads with an Istio sidecar proxy can originate and terminate mTLS, so a legacy service without a sidecar cannot complete the mTLS handshake and its connections fail. The fix is either to inject a sidecar into the legacy service or to use a permissive mode or port-level exception during migration.

Answer

The Gateway is misconfigured for the legacy service.

Answer

The DestinationRule for the service is missing the 'mode: ISTIO_MUTUAL' setting.

Answer

The AuthorizationPolicy is missing a rule for the legacy service.

Question 6

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 7

If a VirtualService has a route to a service that has no pods matching the label, what happens?

Accepted Answer

503 Service Unavailable. In Istio, a VirtualService route points to a Kubernetes Service by name. If that Service has no endpoints because no pods match its label selector, Envoy has no healthy upstream cluster members to route to. Istio's default behavior in this case is to return HTTP 503 Service Unavailable (with the 'no healthy upstream' response flag), rather than silently dropping or rerouting traffic.

Answer

Traffic is routed to the default

Answer

Traffic is dropped

Answer

Traffic is routed to external

Question 8

You want to route traffic to a specific version of a service based on a header. Where do you define the subset?

Accepted Answer

DestinationRule. In Istio, a DestinationRule defines the named subsets of a service (for example, v1 and v2) by selecting pods with specific labels. A VirtualService then references those subsets when routing traffic, so the subset definition itself lives in the DestinationRule. This separation lets routing rules (VirtualService) stay decoupled from the actual pod groupings (DestinationRule).

Answer

Gateway

Answer

ServiceEntry

Answer

VirtualService

Question 9

Which command is used to display the currently active PeerAuthentication policies in the mesh?

Accepted Answer

kubectl get peerauthentication -A. The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.

Answer

istioctl analyze

Answer

istioctl get peerauthentication

Answer

kubectl describe mtls

Question 10

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway