ICA Traffic Management — 25 Questions

Question 1

Which command is used to view the current Istio configuration resources in a namespace?

Accepted Answer

kubectl get. Istio configuration resources — VirtualService, DestinationRule, Gateway, ServiceEntry, etc. — are Kubernetes Custom Resources (CRDs), so they are viewed with standard kubectl commands such as 'kubectl get virtualservices -n <namespace>' or 'kubectl get destinationrules'. The istioctl tool is used for analysis, debugging, and proxy inspection, not for listing configuration resources.

Answer

istioctl proxy-config

Answer

istioctl dashboard

Answer

istioctl analyze

Question 2

What is the purpose of the 'sidecar' resource in Istio?

Accepted Answer

To limit the configuration sent to a proxy. Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.

Answer

To encrypt traffic

Answer

To manage external services

Answer

To define load balancing

Question 3

How do you configure a connection timeout for an external service?

Accepted Answer

VirtualService timeout. In the VirtualService, the timeout field defines the request timeout duration.

Answer

EnvoyFilter

Answer

DestinationRule

Answer

ServiceEntry

Question 4

When a request fails, where can you check the reason for the failure in the Istio ecosystem?

Accepted Answer

Kiali. Kiali provides visual traffic flow analysis and error code identification.

Answer

DestinationRule status

Answer

istioctl analyze

Answer

Gateway logs

Question 5

How do you define a circuit breaker that trips after 3 consecutive errors?

Accepted Answer

DestinationRule. The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.

Answer

ServiceEntry

Answer

Gateway

Answer

VirtualService

Question 6

How do you limit the number of active requests to a service?

Accepted Answer

DestinationRule. The connectionPool field in DestinationRule supports maxRequestsPerConnection.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 7

You need to route traffic for an external service that uses TLS. How do you configure the ServiceEntry?

Accepted Answer

By creating a ServiceEntry with resolution DNS. The ServiceEntry must define resolution and location, and the destination port must specify the protocol.

Answer

By using an EnvoyFilter

Answer

By creating a Gateway

Answer

Using a VirtualService only

Question 8

How do you configure an Istio Gateway to handle HTTPS?

Accepted Answer

Gateway. A Gateway requires a 'servers' block with 'tls' settings and a reference to a Kubernetes secret.

Answer

DestinationRule

Answer

VirtualService

Answer

ServiceEntry

Question 9

Which command helps you check if a specific VirtualService is active?

Accepted Answer

kubectl get virtualservices. istioctl proxy-config routes <pod-name> will show if the route exists in the proxy.

Answer

kubectl logs

Answer

istioctl get routes

Answer

istioctl check

Question 10

What happens if you have two VirtualServices for the same host?

Accepted Answer

They are merged. Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.

Answer

The last one wins

Answer

Both ignored

Answer

Error thrown

Question 11

How do you define a regex match in a VirtualService?

Accepted Answer

regex field. The match block URI uses the 'regex' field for pattern matching.

Answer

uri-regex

Answer

match-regex

Answer

pattern field

Question 12

How do you force a connection pool to use HTTP/1.1 instead of HTTP/2?

Accepted Answer

DestinationRule. In Istio, the DestinationRule resource configures traffic policy for a service after routing has occurred, including the HTTP protocol version via http: - name: h2c or by setting the protocol in the port name (e.g., http2). To force HTTP/1.1 instead of HTTP/2, you modify the DestinationRule's trafficPolicy or port naming. VirtualService handles routing rules, not protocol selection.

Answer

VirtualService

Answer

Gateway

Answer

ServiceEntry

Question 13

Which criteria can be used in a VirtualService 'match' block? (Choose THREE)

Accepted Answer

uri. In an Istio VirtualService, the 'match' block supports request-routing criteria such as B. uri, which matches on the request path (exact, prefix, or regex), C. headers, which matches on HTTP request headers, and D. sourceLabels, which matches on the labels of the source workload (the calling pod). These three are valid fields within an HTTPMatchRequest used to select which traffic a route applies to. A. connectionPool is not a match criterion; it is a DestinationRule trafficPolicy setting controlling TCP connection limits. E. weight is not a match criterion either; it is a route-level field that distributes traffic across destinations.

Answer

connectionPool

Answer

weight

Question 14

Which of these are valid load balancer algorithms in DestinationRule? (Choose TWO)

Accepted Answer

ROUND_ROBIN. In Istio's DestinationRule, the trafficPolicy.loadBalancer field supports a defined set of algorithms, and ROUND_ROBIN (D) is one of them — it is the default algorithm that distributes requests to each healthy endpoint in turn. LEAST_CONN (E) is also a valid Istio load balancer algorithm, selecting the endpoint with the fewest active requests to better handle uneven load. The other options are not part of the Istio DestinationRule load balancer enum: RANDOM_HASH (A) is not a defined value (Istio offers RANDOM and consistent hashing via consistentHash, not RANDOM_HASH), PRIORITY (B) is a Kubernetes Service/EndpointSlice concept rather than an Istio DestinationRule algorithm, and FIRST_COME (C) is not a recognized Istio load balancing option.

Answer

RANDOM_HASH

Answer

PRIORITY

Answer

FIRST_COME

Question 15

What are common reasons to use a ServiceEntry? (Choose THREE)

Accepted Answer

To enable mTLS for an external service. Option A is correct because a ServiceEntry can define an external service with TLS settings, and when combined with a DestinationRule that has trafficPolicy.tls.mode set to MUTUAL or ISTIO_MUTUAL, Istio can originate mTLS to that external endpoint, enabling mTLS for an external service. Option C is correct because ServiceEntry adds external hosts (e.g., api.external.com) into Istio's internal service registry, allowing mesh sidecars and gateways to resolve and route to services that are not part of the Kubernetes cluster. Option E is correct because once an external service is registered via ServiceEntry, Istio can apply VirtualService and DestinationRule routing policies (such as subsets, weights, retries, and timeouts) to manage routing for external traffic. Option B is not correct because ingress gateway ports are configured on the Gateway resource (spec.servers[].port), not on a ServiceEntry. Option D is not correct because encryption of internal pod traffic is handled by Istio mutual TLS (PeerAuthentication and sidecar proxies), not by ServiceEntry.

Answer

To configure ingress gateway ports

Answer

To encrypt internal pod traffic

Question 16

What are the types of resolution in a ServiceEntry? (Choose TWO)

Accepted Answer

NONE. In Istio's ServiceEntry resource, the resolution field defines how the proxy resolves the service's endpoints, and the two valid values are NONE and DNS. Option B (NONE) is correct because it tells Istio that the service has no resolvable endpoints via the registry, so traffic is routed to the original destination IP or handled by the sidecar without endpoint resolution, typically used for external services accessed via a gateway or when the destination is resolved elsewhere. Option D (DNS) is correct because it instructs Istio to resolve the service's endpoints asynchronously using DNS queries, which is the standard setting for external services whose IPs are discovered through DNS. The unmarked options do not belong: DYNAMIC, STATIC, and EXTERNAL are not valid resolution modes in a ServiceEntry — STATIC was used in older Istio versions but is deprecated/removed, and DYNAMIC and EXTERNAL are not recognized values for the resolution field.

Answer

DYNAMIC

Answer

STATIC

Answer

EXTERNAL

Question 17

What are valid statuses returned by outlierDetection? (Choose THREE)

Accepted Answer

consecutiveGatewayErrors. Outlier detection tracks consecutive errors and success rates to decide if a host should be ejected.

Answer

http1MaxPendingRequests

Answer

maxConnections

Question 18

Which protocols can be defined in a Gateway server? (Choose THREE)

Accepted Answer

TCP. In a Gateway server configuration, the protocols that can be defined are TCP (B), HTTP (C), and HTTPS (E). TCP is a transport-layer protocol that the Gateway can use to define how connections are established and managed between clients and backend services. HTTP and HTTPS are application-layer protocols that the Gateway can define to route and secure web traffic, with HTTPS adding TLS encryption. UDP (A) is not included because the Gateway server in this context does not define UDP-based protocols. FTP (D) is also not included because it is not one of the protocols supported for definition in this Gateway server scenario.

Answer

UDP

Answer

FTP

Question 19

What are valid fields in the VirtualService 'http' route? (Choose TWO)

Accepted Answer

match. In an Istio VirtualService, the 'http' section is a list of HTTP route rules, and each rule must contain a 'match' field (option C) that specifies the request-matching conditions (such as URI, headers, method, or query parameters) used to select which traffic the rule applies to. Each HTTP route rule must also contain a 'route' field (option E), which defines the destination(s) — the list of weighted destinations with hosts, subsets, and ports — that matching traffic is forwarded to. The 'tls' field (option D) is not part of an HTTP route rule; it belongs to the 'tls' top-level section of a VirtualService used for TLS/SNI routing. 'mTLS' (option A) is not a VirtualService field at all — mutual TLS is configured via PeerAuthentication and DestinationRule (e.g., trafficPolicy.tls.mode: ISTIO_MUTUAL). 'podSelector' (option B) is not a VirtualService field; workload selection is done with labels/selectors in Kubernetes resources and Istio's Gateway/ServiceEntry or DestinationRule subset labels, not in an HTTP route.

Answer

mTLS

Answer

podSelector

Answer

tls

Question 20

Which components are part of the Istio control plane? (Choose TWO)

Accepted Answer

Kubernetes API. istiod is the core component of the Istio control plane.

Answer

Kiali

Answer

Ingress Gateway

Answer

Envoy