Traffic Management

Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?

How do you handle SNI-based routing in a Gateway?

You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?

A mesh operator needs to configure a DestinationRule so that the sidecar reuses existing HTTP/2 connections to an upstream service and automatically ejects endpoints that return repeated 5xx errors. Which two configuration elements are required to meet these goals? (Choose two.)

Which resources control mTLS settings? (Choose TWO)

When using a ServiceEntry for a TCP service, what protocol should be specified?

What is the primary function of the 'istio-proxy' container in a pod?

You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?

What is the default load balancing policy if none is specified in the DestinationRule?

Which TWO components must be configured to allow external traffic to enter the mesh?

What is the purpose of the 'retryOn' field in a VirtualService?

You need to expose a service to traffic outside the mesh using Istio. Which resource is required to configure the entry point for incoming traffic?

What is the purpose of the 'istio-system' namespace?

Where do you configure the hostnames that a Gateway should accept?

Which command helps troubleshoot configuration issues by analyzing the cluster for errors?

Which THREE features are supported by the Istio 'trafficPolicy' in a DestinationRule?

A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?

To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?

Which THREE configurations affect the way traffic is distributed across pods?

Which THREE are valid load balancing policies in Istio?

Which actions can a VirtualService perform on a request? (Choose TWO)

Which command lists all virtual services in the current namespace?

You want to limit the number of concurrent connections to a service. Which field in the DestinationRule handles this?

Which TWO actions can a VirtualService perform on a request?

Which of the following are valid DestinationRule fields? (Choose THREE)

You want to perform a 'headers' modification on an incoming request. Which resource allows this?

To strip a URL prefix before passing a request to a backend service, which field do you use?

Which are valid match conditions in VirtualService? (Choose THREE)

How do you implement a circuit breaker to eject a pod that returns 5xx errors?

You want to access an external API (e.g., api.google.com) from within your mesh. What must you configure?

You need to inspect the envoy config for a specific pod. Which command do you use?

Which THREE are types of traffic management patterns?

Which of the following are valid traffic management components in Istio? (Choose TWO)

What protocol does the Gateway resource support?

Which resource is used to provide a unified entry point for multiple services?

You need to ensure that traffic is only routed to healthy pods. What feature does this?

How do you specify a header-based match in a VirtualService?

Which THREE settings are required in a VirtualService for a canary deployment?

What is the function of the 'weight' parameter in a VirtualService route?

You want to limit the total number of concurrent connections to a service. Where is this defined?

Which of these are valid sub-commands for istioctl? (Choose TWO)

Which parameters can be configured in a VirtualService retry policy? (Choose TWO)

Your team runs a payments service in the 'prod' namespace with a Kubernetes Service named 'payments' listening on port 8443. During a canary rollout you created a Gateway 'payments-gw' in the 'istio-system' namespace and a VirtualService 'payments-vs' in the 'prod' namespace that references the gateway as 'payments-gw'. Clients report HTTP 404 errors when calling the service, but the sidecar-injected payments pods show healthy endpoints and the Gateway pod logs report 'no matching route'. Which change resolves the routing failure?

A platform engineer is migrating a legacy service into the mesh. The service exposes an HTTP API on port 8080 but also a raw TCP admin port on 9090. The engineer wants the sidecar to treat port 8080 as HTTP so that Istio can apply request-level routing, while treating port 9090 as opaque TCP. Which configuration achieves this?

Which of the following are valid Gateway configurations? (Choose TWO)

Which load balancing policy would you choose to ensure requests from the same user always hit the same pod?

Which TWO resources are essential for configuring traffic splitting between versions?

A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?

You want to inject a 5-second delay into requests for testing. Which resource allows this?

Which THREE fields are found within the 'trafficPolicy' block of a DestinationRule?

Where do you define the hosts that a Gateway will listen on?

To perform a canary deployment, you have two versions of a service. Which resource do you use to split traffic between them?

A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?

Which type of routing allows you to route to different services based on URL path?

Which resource type is used for mTLS policy?

How do you specify a custom header match in a VirtualService?

You want to inject a fault to test application resilience. Which field in the VirtualService supports this?

You need to route traffic to a service based on the 'x-user-type' header. How is this defined?

You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?

What is the command to view the status of all pods including proxies?

You need to define a local service that is not in the cluster. How?

A team wants to shift 10 percent of traffic to a new version of a service for a canary, while keeping 90 percent on the stable version. Both versions are healthy and registered as subsets in a DestinationRule. Which VirtualService configuration accomplishes this?

You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?

Which TWO settings are configured within the 'outlierDetection' block?

If you want to perform traffic shadowing, which field do you use?

Which field in the VirtualService allows you to redirect an incoming request to a different path?

Which field in VirtualService is used for A/B testing?

You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?

What information can you get from 'istioctl proxy-config'? (Choose THREE)

What is the standard path to install istioctl?

When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?

You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?

Which component is responsible for enforcing traffic policies in the data plane?

What is the primary purpose of the 'subset' field in a VirtualService destination?

You want to route traffic to a specific version of a service based on a header. Where do you define the subset?

A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?

You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?

What is the default behavior when no VirtualService is defined for a service?

You need to route 10% of traffic to a new version of your service. Which object do you configure?

A developer needs to expose an internal service to external clients through the Istio ingress gateway on port 443 using TLS termination at the gateway. The service listens on port 80 inside the mesh. Which pairing of resources is required?

You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?

You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?

Which field in the DestinationRule allows defining different versions of a service?

What is the purpose of 'istioctl analyze'?

What is the default Istio load balancing algorithm?

Which items can be configured under DestinationRule trafficPolicy? (Choose THREE)

Which TWO mechanisms are used to secure traffic within the mesh?

Which tool provides a GUI for visualizing your traffic management rules?

What does the 'mirror' feature in a VirtualService do?

Which field in the VirtualService allows you to redirect traffic to a different URI?

Which TWO fields are mandatory in a Gateway resource?

If a VirtualService has a route to a service that has no pods matching the label, what happens?

Which command is used to view the effective configuration of a specific Envoy proxy?