ICA Timed Practice Test 2 — 10 Questions

Question 1

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. To move a namespace from revision 1-18 to 1-19, you update the istio.io/rev label on the namespace from 1-18 to 1-19 and then restart the pods so the sidecar injector (mutating webhook) re-injects the new revision's proxy. Istio does not automatically restart pods on label change, so the restart is mandatory for the new sidecar to take effect.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically

Question 2

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Accepted Answer

Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.. A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.

Answer

Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.

Answer

Apply a global MeshConfig setting to enforce mTLS.

Answer

Create an AuthorizationPolicy that denies all traffic without a client certificate.

Question 3

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Accepted Answer

It defaults to ALLOW.. If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.

Answer

The request is rejected.

Answer

It defaults to DENY.

Answer

The policy is invalid.

Question 4

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 5

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Question 6

You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?

Accepted Answer

DestinationRule. The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.

Answer

Sidecar

Answer

VirtualService

Answer

EnvoyFilter

Question 7

Which field in the DestinationRule allows defining different versions of a service?

Accepted Answer

subsets. The subsets block in DestinationRule allows grouping pods by label to create versions.

Answer

hosts

Answer

trafficPolicy

Answer

loadBalancer

Question 8

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

Accepted Answer

The proxy cannot reach the JWKS URI.. A RequestAuthentication policy in Istio validates JWTs by fetching the JSON Web Key Set (JWKS) from the issuer's specified JWKS URI. If the proxy cannot reach that URI (due to network policies, DNS failures, or the endpoint being down), it cannot retrieve the public keys needed to verify the token's signature, causing validation to fail even when the issuer claim is correct. This is a common operational issue in service meshes where egress restrictions or misconfigured service entries block access to external identity providers.

Answer

The pod is missing a sidecar.

Answer

The namespace is missing.

Answer

The JWT is too long.

Question 9

What is the purpose of 'istioctl analyze'?

Accepted Answer

Identify configuration issues. To identify configuration issues across the mesh.

Answer

Scale deployments

Answer

Check proxy version

Answer

Visualize traffic

Question 10

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

Accepted Answer

istiod. istiod is the Istio control plane component that watches Gateway API resources (Gateway and HTTPRoute) and translates them into Envoy xDS configuration pushed to the gateway proxy pods. When you define a Gateway resource, istiod's config controller reconciles it and generates the corresponding listener, route, cluster, and endpoint configuration for the Envoy data plane.

Answer

The Kiali operator

Answer

The Envoy proxy sidecar

Answer

The ingress-gateway deployment