ICA Traffic Management Practice Test 7 — 15 Questions

Question 1

Where do you configure the hostnames that a Gateway should accept?

Accepted Answer

Gateway. The hosts field in the Gateway resource defines the allowed hostnames.

Answer

DestinationRule

Answer

ServiceEntry

Answer

VirtualService

Question 2

You want to inject a 5-second delay into requests for testing. Which resource allows this?

Accepted Answer

VirtualService. VirtualService allows fault injection configuration including delays.

Answer

Sidecar

Answer

EnvoyFilter

Answer

DestinationRule

Answer

Gateway

Question 3

You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?

Accepted Answer

VirtualService. Retries are configured within the HTTPRoute block of a VirtualService.

Answer

ServiceEntry

Answer

DestinationRule

Answer

Gateway

Question 4

You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?

Accepted Answer

mirroring. Traffic mirroring allows sending a copy of traffic to a different service without affecting the main response.

Answer

subsetting

Answer

fault injection

Answer

canary

Question 5

You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?

Accepted Answer

Ensure DestinationRule subsets match VirtualService destination labels. Ensuring the DestinationRule exists with the correct subsets is mandatory for VirtualService routing.

Answer

Delete the Gateway

Answer

Increase the sidecar memory limit

Answer

Restart the ingress gateway

Question 6

What is the primary purpose of the 'subset' field in a VirtualService destination?

Accepted Answer

To route to a specific version/label set. It references the named subset defined in the corresponding DestinationRule.

Answer

To specify a namespace

Answer

To handle failover

Answer

To limit traffic to one pod

Question 7

Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?

Accepted Answer

ServiceEntry and DestinationRule. A ServiceEntry is needed to register the database host, and a DestinationRule is needed to define TLS settings.

Answer

Only PeerAuthentication

Answer

Only Gateway

Answer

Only VirtualService

Question 8

When using a ServiceEntry for a TCP service, what protocol should be specified?

Accepted Answer

TCP. The resolution must be set to DNS or STATIC, and the protocol must match the traffic type (TCP).

Answer

HTTP

Answer

HTTPS

Answer

GRPC

Question 9

To strip a URL prefix before passing a request to a backend service, which field do you use?

Accepted Answer

rewrite. The rewrite field in a VirtualService can modify the URI path.

Answer

prefix

Answer

path

Answer

redirect

Question 10

Which load balancing policy would you choose to ensure requests from the same user always hit the same pod?

Accepted Answer

consistentHash. Consistent hashing based on a header or cookie ensures session stickiness.

Answer

LEAST_CONN

Answer

ROUND_ROBIN

Answer

PASSTHROUGH

Question 11

Which command is used to view the effective configuration of a specific Envoy proxy?

Accepted Answer

istioctl proxy-config. istioctl proxy-config is the standard tool for inspecting sidecar config.

Answer

istioctl dashboard

Answer

kubectl get virtualservice

Answer

kubectl describe

Question 12

You have a Gateway but traffic is blocked. Which resource most likely governs the connection permission?

Accepted Answer

AuthorizationPolicy. AuthorizationPolicy handles the access control between services and gateways.

Answer

VirtualService

Answer

DestinationRule

Answer

Gateway

Question 13

How do you specify a header-based match in a VirtualService?

Accepted Answer

In the 'match' block. The 'match' field allows conditions like 'headers' to be evaluated.

Answer

In the 'subset' policy

Answer

In the 'destination' block

Answer

In the 'subset' definition

Question 14

What is the default load balancing policy if none is specified in the DestinationRule?

Accepted Answer

ROUND_ROBIN. Istio defaults to ROUND_ROBIN if not specified.

Answer

RANDOM

Answer

LEAST_CONN

Answer

PASSTHROUGH

Question 15

You want to limit the total number of concurrent connections to a service. Where is this defined?

Accepted Answer

DestinationRule. connectionPool settings in the DestinationRule control connection limits.

Answer

AuthorizationPolicy

Answer

Gateway

Answer

VirtualService