ICA Traffic Management — 50 Questions

Question 1

How do you limit the number of active requests to a service?

Accepted Answer

DestinationRule. The connectionPool field in DestinationRule supports maxRequestsPerConnection.

Answer

Gateway

Answer

VirtualService

Answer

ServiceEntry

Question 2

Which command helps you check if a specific VirtualService is active?

Accepted Answer

kubectl get virtualservices. istioctl proxy-config routes <pod-name> will show if the route exists in the proxy.

Answer

kubectl logs

Answer

istioctl get routes

Answer

istioctl check

Question 3

What are valid statuses returned by outlierDetection? (Choose THREE)

Accepted Answer

consecutiveGatewayErrors. Outlier detection tracks consecutive errors and success rates to decide if a host should be ejected.

Answer

http1MaxPendingRequests

Answer

maxConnections

Question 4

Which components are part of the Istio control plane? (Choose TWO)

Accepted Answer

Kubernetes API. istiod is the core component of the Istio control plane.

Answer

Kiali

Answer

Ingress Gateway

Answer

Envoy

Question 5

Which are valid TLS modes in PeerAuthentication? (Choose TWO)

Accepted Answer

PERMISSIVE. Valid mTLS modes are STRICT and PERMISSIVE.

Answer

REQUIRED

Answer

DISABLE

Answer

ENABLED

Question 6

To enable mTLS between services, which resource must be created to define the connection settings?

Accepted Answer

DestinationRule. DestinationRule defines the trafficPolicy, including the tls settings for mTLS.

Answer

PeerAuthentication

Answer

VirtualService

Answer

Gateway

Question 7

Which THREE components are involved in setting up fault injection for testing?

Accepted Answer

Application Service. VirtualService (for the rule), DestinationRule (for the target), and the application itself to experience the injected fault.

Answer

Gateway

Answer

EnvoyFilter

Question 8

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 9

Which THREE settings are required in a VirtualService for a canary deployment?

Accepted Answer

http routes. Canary deployments require host definition, http/tcp route definitions, and weight assignments.

Answer

tcp

Answer

tls

Question 10

You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?

Accepted Answer

VirtualService. Timeouts are a property of the route in a VirtualService.

Answer

Gateway

Answer

DestinationRule

Answer

ServiceEntry

Question 11

Which TWO fields are mandatory in a Gateway resource?

Accepted Answer

selector. A Gateway requires a selector to bind to ingress gateways and servers for port configuration.

Answer

subsets

Answer

tls

Answer

hosts

Question 12

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

Accepted Answer

Gateway. Gateway resources are used to configure load balancers operating at the edge of the mesh.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 13

A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?

Accepted Answer

DestinationRule spec. DestinationRule uses 'subsets' that map to 'labels' on Kubernetes pods.

Answer

EnvoyFilter

Answer

VirtualService

Answer

Gateway spec

Question 14

A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?

Accepted Answer

VirtualService. VirtualService uses the weight field in the route block to distribute traffic percentages.

Answer

Sidecar

Answer

DestinationRule

Answer

Gateway

Question 15

You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?

Accepted Answer

Create a ServiceEntry. ServiceEntry is required to include external endpoints in the Istio service registry.

Answer

Create a VirtualService

Answer

Create an EnvoyFilter

Answer

Create a DestinationRule

Question 16

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 17

Which command is used to view the current Istio configuration resources in a namespace?

Accepted Answer

kubectl get. kubectl get is the standard tool to list Kubernetes resources, including Istio CRDs.

Answer

istioctl proxy-config

Answer

istioctl dashboard

Answer

istioctl analyze

Question 18

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn

Question 19

What is the default Istio load balancing algorithm?

Accepted Answer

ROUND_ROBIN. ROUND_ROBIN is the default load balancing strategy in Istio.

Answer

RANDOM

Answer

PASSTHROUGH

Answer

LEAST_CONN

Question 20

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway