20+ practice questions focused on Advanced Scenarios — one of the most tested topics on the Istio Certified Associate (ICA, CNCF/Linux Foundation) (ICA) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Advanced Scenarios PracticeIn a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?
Explanation: For multi-cluster mTLS, a shared root CA (or identical intermediate CA) must be configured in the 'cacerts' secret within the istio-system namespace.
You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?
Explanation: To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, the best approach is to configure an AuthorizationPolicy in Namespace Y with a 'DENY' action for all principals. This explicitly denies all traffic to services in Namespace Y, effectively blocking any cross-namespace communication unless explicitly allowed.
In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?
Explanation: In a primary-remote Istio deployment, the primary cluster's istiod needs access to the remote cluster's API server to create the Service object corresponding to a ServiceEntry. This access is provided via a kubeconfig stored as a secret in the primary cluster. If that kubeconfig secret is missing, istiod cannot reach the remote cluster's API server, so the Service object is never created even though the ServiceEntry exists in the primary cluster.
You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?
Explanation: In Istio distributed tracing, spans for external service calls are missing when the application does not propagate the required trace headers (e.g., x-request-id, x-b3-traceid, x-b3-spanid) across service boundaries. Istio's sidecar proxies generate and forward spans only when trace context headers are present; if the application strips or fails to forward them, the trace chain breaks and external call spans are not correlated.
In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?
Explanation: In Istio multi-cluster, a 404 Not Found from the client sidecar typically means the Envoy proxy has no route for the requested host because the service was never imported into the local cluster's service registry. Istio's default visibility is namespace-scoped, and cross-cluster service discovery only works if the service is explicitly exported via an ExportTo policy (or the mesh-wide default is overridden). Without that export, the local control plane never programs a route for service B, so the sidecar returns 404.
+15 more Advanced Scenarios questions available
Practice all Advanced Scenarios questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Advanced Scenarios. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Advanced Scenarios questions on the ICA frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Advanced Scenarios is tested as part of the Istio Certified Associate (ICA, CNCF/Linux Foundation) (ICA) blueprint. Practicing with targeted Advanced Scenarios questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free ICA practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Advanced Scenarios is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Advanced Scenarios practice session with instant scoring and detailed explanations.
Start Advanced Scenarios Practice →