ICA Traffic Management Practice Test 2 — 15 Questions

Question 1

What are the types of resolution in a ServiceEntry? (Choose TWO)

Accepted Answer

NONE. In Istio's ServiceEntry resource, the resolution field defines how the proxy resolves the service's endpoints, and the two valid values are NONE and DNS. Option B (NONE) is correct because it tells Istio that the service has no resolvable endpoints via the registry, so traffic is routed to the original destination IP or handled by the sidecar without endpoint resolution, typically used for external services accessed via a gateway or when the destination is resolved elsewhere. Option D (DNS) is correct because it instructs Istio to resolve the service's endpoints asynchronously using DNS queries, which is the standard setting for external services whose IPs are discovered through DNS. The unmarked options do not belong: DYNAMIC, STATIC, and EXTERNAL are not valid resolution modes in a ServiceEntry — STATIC was used in older Istio versions but is deprecated/removed, and DYNAMIC and EXTERNAL are not recognized values for the resolution field.

Answer

DYNAMIC

Answer

STATIC

Answer

EXTERNAL

Question 2

What are valid statuses returned by outlierDetection? (Choose THREE)

Accepted Answer

consecutiveGatewayErrors. Outlier detection tracks consecutive errors and success rates to decide if a host should be ejected.

Answer

http1MaxPendingRequests

Answer

maxConnections

Question 3

Which protocols can be defined in a Gateway server? (Choose THREE)

Accepted Answer

TCP. In a Gateway server configuration, the protocols that can be defined are TCP (B), HTTP (C), and HTTPS (E). TCP is a transport-layer protocol that the Gateway can use to define how connections are established and managed between clients and backend services. HTTP and HTTPS are application-layer protocols that the Gateway can define to route and secure web traffic, with HTTPS adding TLS encryption. UDP (A) is not included because the Gateway server in this context does not define UDP-based protocols. FTP (D) is also not included because it is not one of the protocols supported for definition in this Gateway server scenario.

Answer

UDP

Answer

FTP

Question 4

What are valid fields in the VirtualService 'http' route? (Choose TWO)

Accepted Answer

match. In an Istio VirtualService, the 'http' section is a list of HTTP route rules, and each rule must contain a 'match' field (option C) that specifies the request-matching conditions (such as URI, headers, method, or query parameters) used to select which traffic the rule applies to. Each HTTP route rule must also contain a 'route' field (option E), which defines the destination(s) — the list of weighted destinations with hosts, subsets, and ports — that matching traffic is forwarded to. The 'tls' field (option D) is not part of an HTTP route rule; it belongs to the 'tls' top-level section of a VirtualService used for TLS/SNI routing. 'mTLS' (option A) is not a VirtualService field at all — mutual TLS is configured via PeerAuthentication and DestinationRule (e.g., trafficPolicy.tls.mode: ISTIO_MUTUAL). 'podSelector' (option B) is not a VirtualService field; workload selection is done with labels/selectors in Kubernetes resources and Istio's Gateway/ServiceEntry or DestinationRule subset labels, not in an HTTP route.

Answer

mTLS

Answer

podSelector

Answer

tls

Question 5

Which components are part of the Istio control plane? (Choose TWO)

Accepted Answer

Kubernetes API. istiod is the core component of the Istio control plane.

Answer

Kiali

Answer

Ingress Gateway

Answer

Envoy

Question 6

Which are valid connectionPool settings? (Choose THREE)

Accepted Answer

http2. In Oracle GoldenGate, the connectionPool parameter accepts specific protocol values for the connection pool, and the valid settings are http2 (B), http (C), and tcp (D). Option B (http2) is correct because HTTP/2 is a supported protocol for connection pooling, typically used for REST-enabled services. Option C (http) is correct because plain HTTP is a standard supported protocol value for connectionPool. Option D (tcp) is correct because TCP is also a valid connectionPool protocol setting for raw TCP-based connections. Options A (grpc) and E (udp) are not valid connectionPool settings, as gRPC is not a recognized value and UDP is connectionless, so it is not supported for connection pooling in this context.

Answer

grpc

Answer

udp

Question 7

What are the primary ways to limit traffic to a service? (Choose TWO)

Accepted Answer

VirtualService. In Istio, a VirtualService [CORRECT] is the primary resource for traffic management because its routing rules (match conditions on hosts, paths, headers, and weights) determine which requests reach a service's subsets, effectively limiting and shaping traffic to that service. A DestinationRule [CORRECT] is equally essential because it defines the subsets and traffic policies (load balancing, connection pool limits, outlier detection) that apply after routing, thereby controlling how much and which traffic actually reaches the service's endpoints. Together, VirtualService routing plus DestinationRule policies are the canonical pair for limiting traffic to a service. Gateway is not correct here because it governs ingress/egress at the edge rather than limiting traffic to an internal service. ServiceEntry is not correct because it registers external services into the mesh registry, not limits traffic to a service. Sidecar is not correct because it scopes the configuration visible to a workload's proxy, not the traffic limits applied to a target service.

Answer

Gateway

Answer

ServiceEntry

Answer

Sidecar

Question 8

Which commands verify Istio configurations? (Choose TWO)

Accepted Answer

istioctl analyze. istioctl analyze and istioctl proxy-config are used for verification.

Answer

istioctl check-config

Answer

kubectl verify

Answer

kubectl status

Question 9

Which are valid TLS modes in PeerAuthentication? (Choose TWO)

Accepted Answer

PERMISSIVE. Valid mTLS modes are STRICT and PERMISSIVE.

Answer

REQUIRED

Answer

DISABLE

Answer

ENABLED

Question 10

Which are valid uses for ServiceEntry? (Choose THREE)

Accepted Answer

Configure external TLS. ServiceEntry is an Istio networking resource used to add entries to Istio's internal service registry so that mesh workloads can reach services not automatically discovered, which is exactly what option D (register external services) describes. Option E (define DNS resolution) is correct because ServiceEntry supports resolution modes such as DNS, STATIC, and NONE, letting you control how the proxy resolves the external hostname. Option A (configure external TLS) is correct because a ServiceEntry can specify ports and combine with DestinationRule/TLS origination settings to enable TLS to external services, including configuring the external endpoint's TLS behavior. Options B (load balance ingress) and C (limit mesh size) are not valid uses: ingress load balancing is handled by Gateway/VirtualService resources, and ServiceEntry has no role in constraining or sizing the mesh.

Answer

Load balance ingress

Answer

Limit mesh size

Question 11

To enable mTLS between services, which resource must be created to define the connection settings?

Accepted Answer

DestinationRule. DestinationRule defines the trafficPolicy, including the tls settings for mTLS.

Answer

PeerAuthentication

Answer

VirtualService

Answer

Gateway

Question 12

You have a Gateway but traffic is blocked. Which resource most likely governs the connection permission?

Accepted Answer

AuthorizationPolicy. In Istio, an AuthorizationPolicy is the resource that defines access control rules for workloads, specifying which requests are allowed or denied based on identity, method, path, and other attributes. Even if a Gateway accepts traffic, the AuthorizationPolicy governs whether the connection is permitted to reach the destination workload.

Answer

VirtualService

Answer

DestinationRule

Answer

Gateway

Question 13

What is the benefit of defining a 'sidecar' resource in Istio?

Accepted Answer

Improve proxy performance/memory usage. It restricts the configuration pushed to Envoy to only what the service needs, reducing memory usage.

Answer

Enable mTLS

Answer

Increase security

Answer

Manage routing

Question 14

You have multiple VirtualServices for the same host. How does Istio determine which one to use?

Accepted Answer

Istio merges them. Istio merges them based on the configuration logic, but you should avoid duplicate rules to prevent unpredictable behavior.

Answer

Alphabetical order

Answer

The one in the default namespace

Answer

The latest one applied

Question 15

Which THREE of these are valid reasons to use a ServiceEntry?

Accepted Answer

Expose an external REST API. A ServiceEntry is correct because it lets you register an external REST API (an external HTTP/HTTPS endpoint outside the mesh) into Istio's service registry so mesh workloads can route to it via Envoy, with DNS resolution, ports, and protocols declared in the ServiceEntry. C is correct because an external database (e.g., a TCP service on a specific host/port) can be added to the mesh registry via a ServiceEntry, enabling controlled egress and traffic policies to that external dependency. D is correct because a ServiceEntry can define resolution and endpoints (including a different host/address than the original) so traffic can be redirected to another host, often combined with VirtualService/DestinationRule for routing. B is not a ServiceEntry use case; Gateway ingress is managed with a Gateway resource (plus VirtualService), not ServiceEntry. E is not a ServiceEntry use case; mTLS for internal services is configured via PeerAuthentication (and related mesh/security policies), not by registering external services.

Answer

Manage Gateway ingress

Answer

Configure mTLS for internal services