ICA Traffic Management — 15 Questions

Question 1

Which command is used to view the current Istio configuration resources in a namespace?

Accepted Answer

kubectl get. Istio configuration resources — VirtualService, DestinationRule, Gateway, ServiceEntry, etc. — are Kubernetes Custom Resources (CRDs), so they are viewed with standard kubectl commands such as 'kubectl get virtualservices -n <namespace>' or 'kubectl get destinationrules'. The istioctl tool is used for analysis, debugging, and proxy inspection, not for listing configuration resources.

Answer

istioctl proxy-config

Answer

istioctl dashboard

Answer

istioctl analyze

Question 2

What is the purpose of the 'sidecar' resource in Istio?

Accepted Answer

To limit the configuration sent to a proxy. Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.

Answer

To encrypt traffic

Answer

To manage external services

Answer

To define load balancing

Question 3

How do you configure a connection timeout for an external service?

Accepted Answer

VirtualService timeout. In the VirtualService, the timeout field defines the request timeout duration.

Answer

EnvoyFilter

Answer

DestinationRule

Answer

ServiceEntry

Question 4

When a request fails, where can you check the reason for the failure in the Istio ecosystem?

Accepted Answer

Kiali. Kiali provides visual traffic flow analysis and error code identification.

Answer

DestinationRule status

Answer

istioctl analyze

Answer

Gateway logs

Question 5

How do you define a circuit breaker that trips after 3 consecutive errors?

Accepted Answer

DestinationRule. The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.

Answer

ServiceEntry

Answer

Gateway

Answer

VirtualService

Question 6

How do you limit the number of active requests to a service?

Accepted Answer

DestinationRule. The connectionPool field in DestinationRule supports maxRequestsPerConnection.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 7

You need to route traffic for an external service that uses TLS. How do you configure the ServiceEntry?

Accepted Answer

By creating a ServiceEntry with resolution DNS. The ServiceEntry must define resolution and location, and the destination port must specify the protocol.

Answer

By using an EnvoyFilter

Answer

By creating a Gateway

Answer

Using a VirtualService only

Question 8

How do you configure an Istio Gateway to handle HTTPS?

Accepted Answer

Gateway. A Gateway requires a 'servers' block with 'tls' settings and a reference to a Kubernetes secret.

Answer

DestinationRule

Answer

VirtualService

Answer

ServiceEntry

Question 9

Which command helps you check if a specific VirtualService is active?

Accepted Answer

kubectl get virtualservices. istioctl proxy-config routes <pod-name> will show if the route exists in the proxy.

Answer

kubectl logs

Answer

istioctl get routes

Answer

istioctl check

Question 10

What happens if you have two VirtualServices for the same host?

Accepted Answer

They are merged. Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.

Answer

The last one wins

Answer

Both ignored

Answer

Error thrown

Question 11

How do you define a regex match in a VirtualService?

Accepted Answer

regex field. The match block URI uses the 'regex' field for pattern matching.

Answer

uri-regex

Answer

match-regex

Answer

pattern field

Question 12

How do you force a connection pool to use HTTP/1.1 instead of HTTP/2?

Accepted Answer

DestinationRule. In Istio, the DestinationRule resource configures traffic policy for a service after routing has occurred, including the HTTP protocol version via http: - name: h2c or by setting the protocol in the port name (e.g., http2). To force HTTP/1.1 instead of HTTP/2, you modify the DestinationRule's trafficPolicy or port naming. VirtualService handles routing rules, not protocol selection.

Answer

VirtualService

Answer

Gateway

Answer

ServiceEntry

Question 13

Which criteria can be used in a VirtualService 'match' block? (Choose THREE)

Accepted Answer

uri. In an Istio VirtualService, the 'match' block supports request-routing criteria such as B. uri, which matches on the request path (exact, prefix, or regex), C. headers, which matches on HTTP request headers, and D. sourceLabels, which matches on the labels of the source workload (the calling pod). These three are valid fields within an HTTPMatchRequest used to select which traffic a route applies to. A. connectionPool is not a match criterion; it is a DestinationRule trafficPolicy setting controlling TCP connection limits. E. weight is not a match criterion either; it is a route-level field that distributes traffic across destinations.

Answer

connectionPool

Answer

weight

Question 14

Which of these are valid load balancer algorithms in DestinationRule? (Choose TWO)

Accepted Answer

ROUND_ROBIN. In Istio's DestinationRule, the trafficPolicy.loadBalancer field supports a defined set of algorithms, and ROUND_ROBIN (D) is one of them — it is the default algorithm that distributes requests to each healthy endpoint in turn. LEAST_CONN (E) is also a valid Istio load balancer algorithm, selecting the endpoint with the fewest active requests to better handle uneven load. The other options are not part of the Istio DestinationRule load balancer enum: RANDOM_HASH (A) is not a defined value (Istio offers RANDOM and consistent hashing via consistentHash, not RANDOM_HASH), PRIORITY (B) is a Kubernetes Service/EndpointSlice concept rather than an Istio DestinationRule algorithm, and FIRST_COME (C) is not a recognized Istio load balancing option.

Answer

RANDOM_HASH

Answer

PRIORITY

Answer

FIRST_COME

Question 15

What are common reasons to use a ServiceEntry? (Choose THREE)

Accepted Answer

To enable mTLS for an external service. Option A is correct because a ServiceEntry can define an external service with TLS settings, and when combined with a DestinationRule that has trafficPolicy.tls.mode set to MUTUAL or ISTIO_MUTUAL, Istio can originate mTLS to that external endpoint, enabling mTLS for an external service. Option C is correct because ServiceEntry adds external hosts (e.g., api.external.com) into Istio's internal service registry, allowing mesh sidecars and gateways to resolve and route to services that are not part of the Kubernetes cluster. Option E is correct because once an external service is registered via ServiceEntry, Istio can apply VirtualService and DestinationRule routing policies (such as subsets, weights, retries, and timeouts) to manage routing for external traffic. Option B is not correct because ingress gateway ports are configured on the Gateway resource (spec.servers[].port), not on a ServiceEntry. Option D is not correct because encryption of internal pod traffic is handled by Istio mutual TLS (PeerAuthentication and sidecar proxies), not by ServiceEntry.

Answer

To configure ingress gateway ports

Answer

To encrypt internal pod traffic