ICA Traffic Management Practice Test 2 — 15 Questions

Question 1

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 2

Which command is used to view the current Istio configuration resources in a namespace?

Accepted Answer

kubectl get. kubectl get is the standard tool to list Kubernetes resources, including Istio CRDs.

Answer

istioctl proxy-config

Answer

istioctl dashboard

Answer

istioctl analyze

Question 3

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn

Question 4

What is the default Istio load balancing algorithm?

Accepted Answer

ROUND_ROBIN. ROUND_ROBIN is the default load balancing strategy in Istio.

Answer

RANDOM

Answer

PASSTHROUGH

Answer

LEAST_CONN

Question 5

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway

Question 6

A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?

Accepted Answer

DestinationRule. DestinationRule allows the configuration of traffic policies including circuit breaking via the outlierDetection field.

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 7

A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?

Accepted Answer

istioctl proxy-config routes. istioctl proxy-config routes displays the routing table as understood by the Envoy proxy.

Answer

istioctl describe

Answer

istioctl analyze

Answer

kubectl logs

Question 8

You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?

Accepted Answer

subset. The subset field in the destination object refers to the named subset in the DestinationRule.

Answer

host

Answer

weight

Answer

port

Question 9

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

Accepted Answer

fault. The fault field in the route block allows for abort or delay injection.

Answer

weight

Answer

retry

Answer

mirror

Question 10

Which command helps troubleshoot configuration issues by analyzing the cluster for errors?

Accepted Answer

istioctl analyze. istioctl analyze scans for common misconfigurations in the cluster.

Answer

istioctl debug

Answer

istioctl check

Answer

kubectl describe

Question 11

What does the 'mirror' feature in a VirtualService do?

Accepted Answer

Sends a copy of live traffic to a test service. Mirroring sends a copy of traffic to a different service without affecting the primary response.

Answer

Splits traffic 50/50

Answer

Encrypts traffic

Answer

Retries failed requests

Question 12

How do you specify a custom header match in a VirtualService?

Accepted Answer

Using the match field in a VirtualService. The match block within a VirtualService route supports header matching using the headers key.

Answer

Using a DestinationRule

Answer

Using a ServiceEntry

Answer

Using a Gateway

Question 13

Where do you define the hosts that a Gateway will listen on?

Accepted Answer

Gateway. The hosts field inside the servers block of a Gateway resource defines the hostnames.

Answer

ServiceEntry

Answer

DestinationRule

Answer

VirtualService

Question 14

What is the purpose of the 'sidecar' resource in Istio?

Accepted Answer

To limit the configuration sent to a proxy. Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.

Answer

To encrypt traffic

Answer

To manage external services

Answer

To define load balancing

Question 15

You need to inspect the envoy config for a specific pod. Which command do you use?

Accepted Answer

istioctl proxy-config all. istioctl proxy-config all <pod-name> shows all configuration for that proxy.

Answer

istioctl get config

Answer

kubectl get proxy

Answer

istioctl inspect