ICA Traffic Management Practice Test 3 — 15 Questions

Question 1

Which THREE components are involved in setting up fault injection for testing?

Accepted Answer

Application Service. VirtualService (for the rule), DestinationRule (for the target), and the application itself to experience the injected fault.

Answer

Gateway

Answer

EnvoyFilter

Question 2

Which TWO parameters are used to define a 'match' criteria in a VirtualService?

Accepted Answer

headers. Headers and authority (or URI) are valid match conditions.

Answer

timeout

Answer

subset

Answer

retries

Question 3

An SRE is debugging why a client in the mesh receives a 503 response when calling a service that has three pods, one of which is in a different namespace and lacks a sidecar. The DestinationRule defines trafficPolicy with connectionPool.http.http1MaxPendingRequests set to 1 and http2MaxRequests set to 1. The SRE wants to eliminate the 503 caused by connection pool exhaustion. Which change addresses the root cause?

Accepted Answer

Increase http1MaxPendingRequests and http2MaxRequests in the DestinationRule trafficPolicy to values that match the expected concurrency.. The 503 stems from Envoy's upstream connection pool rejecting requests once http1MaxPendingRequests or http2MaxRequests is exceeded, which is a documented cause of overflow 503s. Raising those limits in the DestinationRule trafficPolicy connectionPool block restores capacity for legitimate concurrency. The other changes either target unrelated mechanisms or mask the symptom without lifting the actual request ceiling.

Answer

Change the load balancer policy to LEAST_REQUEST so that traffic is distributed more evenly across the three pods.

Answer

Set the outlierDetection.consecutive5xxErrors field to a high value so the pod is not ejected from the load balancing pool.

Answer

Add an EnvoyFilter that increases the listener's max_connections value on the inbound sidecar of the destination pods.

Question 4

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 5

Which THREE settings are required in a VirtualService for a canary deployment?

Accepted Answer

http routes. In an Istio VirtualService, a canary deployment is expressed through HTTP routing rules, so option B (http routes) is required because the http stanza holds the match and route entries that split traffic between the stable and canary subsets. Option D (weight) is required because each route destination must carry a weight value (for example 90/10) so the mesh can distribute traffic proportionally between the two versions. Option E (hosts) is required because the VirtualService must declare the destination hosts (the service DNS names, such as reviews.prod.svc.cluster.local) that the routing rules apply to. Options A (tcp) and C (tls) are not required here: tcp and tls are alternative protocol-specific stanzas used for TCP or TLS routing, and a canary deployment based on HTTP traffic does not need them.

Answer

tcp

Answer

tls

Question 6

You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?

Accepted Answer

VirtualService. Timeouts are a property of the route in a VirtualService.

Answer

Gateway

Answer

DestinationRule

Answer

ServiceEntry

Question 7

Which TWO fields are mandatory in a Gateway resource?

Accepted Answer

selector. In an Istio Gateway resource, the servers field (E) is mandatory because it defines the ports, protocols, hosts, and TLS settings that the gateway listens on—without at least one server entry the gateway has nothing to configure. The selector field (C) is also mandatory since it binds the Gateway to the specific Envoy proxy pods (via labels such as istio: ingressgateway) that should implement the configuration. The subsets field (A) belongs to a DestinationRule's traffic policy, not to a Gateway, so it is not required here. The tls field (B) is optional and only needed when a server terminates or originates TLS. The hosts field (D) is configured inside each server entry, not as a top-level mandatory Gateway field.

Answer

subsets

Answer

tls

Answer

hosts

Question 8

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

Accepted Answer

Gateway. In Istio, a Gateway resource configures the Envoy proxy at the edge of the mesh to accept inbound traffic on specified ports and protocols (HTTP, HTTPS, TCP, etc.). It is the required entry point definition that binds a load balancer or ingress IP to the mesh, and it is then referenced by a VirtualService to route traffic to internal services. Without a Gateway, external traffic has no defined listener to enter the mesh.

Answer

ServiceEntry

Answer

VirtualService

Answer

DestinationRule

Question 9

A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?

Accepted Answer

DestinationRule spec. DestinationRule uses 'subsets' that map to 'labels' on Kubernetes pods.

Answer

EnvoyFilter

Answer

VirtualService

Answer

Gateway spec

Question 10

A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?

Accepted Answer

VirtualService. VirtualService uses the weight field in the route block to distribute traffic percentages.

Answer

Sidecar

Answer

DestinationRule

Answer

Gateway

Question 11

You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?

Accepted Answer

Create a ServiceEntry. A ServiceEntry adds an external service to Istio's internal service registry, giving it a mesh-internal hostname, ports, and resolution mode. Once registered, mesh sidecars can route to the external dependency through Istio's traffic management (with policies, TLS origination, etc.). This is the canonical way to allow egress to services not in the Kubernetes registry.

Answer

Create a VirtualService

Answer

Create an EnvoyFilter

Answer

Create a DestinationRule

Question 12

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

Accepted Answer

PeerAuthentication. PeerAuthentication at the root namespace (istio-system) enforces global mTLS.

Answer

ServiceEntry

Answer

AuthorizationPolicy

Answer

DestinationRule

Question 13

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

Accepted Answer

perTryTimeout. The perTryTimeout field controls the duration for an individual attempt within a retry policy.

Answer

timeout

Answer

maxRetries

Answer

retryOn

Question 14

What is the default Istio load balancing algorithm?

Accepted Answer

ROUND_ROBIN. ROUND_ROBIN is the default load balancing strategy in Istio.

Answer

RANDOM

Answer

PASSTHROUGH

Answer

LEAST_CONN

Question 15

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Accepted Answer

PeerAuthentication. PeerAuthentication defines mTLS settings for the mesh.

Answer

VirtualService

Answer

ServiceEntry

Answer

Gateway