ICA Resilience And Fault Injection Practice Test 3 — 15 Questions

Question 1

To test how your application handles service unavailability, you want to return an HTTP 503 error for 20% of requests to the 'catalog' service. Which fault injection setting do you use?

Accepted Answer

abort. The 'abort' fault injection setting in Istio is specifically designed to return an HTTP error code (such as 503) for a specified percentage of requests to a target service. By configuring an abort fault with an HTTP status of 503 and a percentage value of 20, you directly simulate service unavailability for 20% of traffic to the 'catalog' service. This is the intended mechanism for testing how applications handle HTTP error responses.

Answer

circuitBreaker

Answer

outlierDetection

Answer

delay

Question 2

You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?

Accepted Answer

DestinationRule. Connection pool limits such as `maxConnections` and `http1MaxPendingRequests` are configured in the DestinationRule's `trafficPolicy.connectionPool` section, which applies to the destination service. This is where Istio exposes Envoy's circuit-breaking settings for outbound traffic to a service.

Answer

EnvoyFilter

Answer

ServiceEntry

Answer

VirtualService

Question 3

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 4

You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?

Accepted Answer

It is ejected for 30 seconds. The host is ejected from the load balancing pool for 30 seconds.

Answer

It is ejected for 1 second

Answer

It is removed permanently

Answer

It is ignored because the interval is too small

Question 5

You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?

Accepted Answer

timeout. The timeout setting is defined within the route rule of a VirtualService.

Answer

deadline

Answer

maxRequestDuration

Answer

requestTimeout

Question 6

To test the resilience of your microservice architecture, you want to introduce a 5-second delay to 50% of the requests directed to the 'catalog-service'. Where do you define this configuration?

Accepted Answer

VirtualService. A VirtualService is used to define traffic routing rules, including fault injection such as delays and aborts. To introduce a 5-second delay to 50% of requests to 'catalog-service', you configure a fault delay in the VirtualService's HTTP route. This allows testing resilience without modifying the application.

Answer

DestinationRule

Answer

Gateway

Answer

ServiceEntry

Question 7

You want to configure your microservice to be more resilient. Which THREE of the following are valid fields within an 'outlierDetection' policy in a DestinationRule?

Accepted Answer

consecutive5xxErrors. In Istio's DestinationRule, the outlierDetection policy supports consecutive5xxErrors (A), which sets the number of consecutive 5xx errors that trigger ejection of a host from the load-balancing pool. It also supports interval (B), which defines the time interval between ejection sweep analyses of the hosts. And it supports baseEjectionTime (D), which specifies the minimum ejection duration for an outlier host, multiplied by the number of times it has been ejected. The options http2MaxRequests (C) and maxRequestsPerConnection (E) are not part of outlierDetection; they belong to the connectionPool settings (specifically the http and tcp subfields) of a DestinationRule's trafficPolicy, used for connection-pool limits rather than outlier ejection.

Answer

http2MaxRequests

Answer

maxRequestsPerConnection

Question 8

An application is experiencing intermittent errors. You decide to use outlier detection to eject unhealthy pods. Which field in the DestinationRule controls the ejection of hosts after a certain number of 5xx errors?

Accepted Answer

consecutive5xxErrors. The 'consecutive5xxErrors' field in the 'outlierDetection' section of a DestinationRule is used to eject unhealthy hosts.

Answer

baseEjectionTime

Answer

interval

Answer

maxConnections

Question 9

You need to limit the number of concurrent connections to the 'orders' service. Which field in the DestinationRule do you configure?

Accepted Answer

trafficPolicy.connectionPool.tcp.maxConnections. In Istio's DestinationRule, connectionPool.tcp.maxConnections limits the number of concurrent TCP connections to the upstream service. For the 'orders' service, this is the correct field to cap concurrent connections at the TCP layer.

Answer

trafficPolicy.connectionPool.http.maxRequests

Answer

trafficPolicy.circuitBreaker.maxConnections

Answer

trafficPolicy.outlierDetection.maxConnections

Answer

trafficPolicy.loadBalancer.maxConnections

Question 10

A service is returning 5xx errors frequently. You want to eject instances that return 5 consecutive 5xx errors. Which OutlierDetection setting is required?

Accepted Answer

consecutive5xx: 5. The `consecutive5xx` field in Istio's OutlierDetection configuration is specifically designed to count consecutive 5xx HTTP response codes from an upstream host. When the count reaches the configured threshold (5 in this case), the host is ejected from the load balancing pool for a period defined by `baseEjectionTime`. This directly matches the requirement to eject instances after 5 consecutive 5xx errors, making `consecutive5xx: 5` the correct setting.

Answer

interval: 5s

Answer

maxEjectionPercent: 5

Answer

consecutiveErrors: 5

Answer

baseEjectionTime: 5s

Question 11

Where do you define the connection pool settings for a service?

Accepted Answer

DestinationRule. Connection pool settings are part of the trafficPolicy within a DestinationRule.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Answer

Sidecar

Question 12

Which of the following is a valid method for performing fault injection?

Accepted Answer

Using a VirtualService to inject delays.. Istio supports both delay and abort faults via VirtualService.

Answer

Using a ServiceEntry to redirect traffic.

Answer

Using a DestinationRule to drop connections.

Answer

Using an EnvoyFilter to rewrite headers.

Answer

Using a Gateway to block traffic.

Question 13

You notice that a pod is being ejected by Outlier Detection despite only having occasional errors. How do you increase the interval between ejection scans?

Accepted Answer

Set outlierDetection.interval to a higher value.. To increase the interval between ejection scans in Istio's outlier detection, you set 'outlierDetection.interval' to a higher value. This field controls how often the ejection scan occurs. Increasing it reduces the frequency of scans, thus increasing the interval.

Answer

Disable outlierDetection.

Answer

Set outlierDetection.baseEjectionTime to a higher value.

Answer

Set outlierDetection.maxEjectionPercent to a higher value.

Answer

Set outlierDetection.consecutive5xx to a higher value.

Answer

Set connectionPool.tcp.maxConnections to a lower value.

Question 14

You want to ensure that a request to the 'search' service fails fast if it takes longer than 2 seconds. How is this configured?

Accepted Answer

In the VirtualService, set 'timeout: 2s' in the route rule.. In Istio, request timeouts are configured in the VirtualService resource, specifically within the HTTP route rule using the 'timeout' field (e.g., 'timeout: 2s'). This tells the Envoy sidecar to abort the request if it doesn't receive a response from the destination within the specified duration, causing the client to receive a 504 Gateway Timeout. The timeout is applied per route, allowing granular control over different services or subsets. This is the standard and documented way to enforce fail-fast behavior for a service like 'search'.

Answer

In the EnvoyFilter, set 'timeout: 2s'.

Answer

In the Gateway, set 'timeout: 2s'.

Answer

In the DestinationRule, set 'timeout: 2s'.

Answer

In the ServiceEntry, set 'timeout: 2s'.

Question 15

You want to ensure that a pod is only ejected if it fails consistently. Which setting is most appropriate?

Accepted Answer

Increase interval, increase consecutive5xx.. A combination of a longer interval and a higher consecutive error threshold ensures only sustained failures trigger ejection.

Answer

Decrease interval, decrease consecutive5xx.

Answer

Decrease interval, increase consecutive5xx.

Answer

Disable outlierDetection and use only circuitBreaking.

Answer

Increase interval, decrease consecutive5xx.