75 of 113 questions · Page 1/2 · Traffic Management · Answers revealed
Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?
Both are required to handle discovery and TLS policy.
Why this answer
A ServiceEntry is needed to register the database host, and a DestinationRule is needed to define TLS settings.
How do you handle SNI-based routing in a Gateway?
The TLS block manages SNI and protocol handling.
Why this answer
The TLS block in the Gateway server configuration handles SNI and certificate management.
You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?
Mismatching subsets is the most common cause of routing failure.
Why this answer
Ensuring the DestinationRule exists with the correct subsets is mandatory for VirtualService routing.
Which resources control mTLS settings? (Choose TWO)
Client-side configuration.
Why this answer
PeerAuthentication and DestinationRule (for client-side) control mTLS.
What is the purpose of the 'sidecar' resource in Istio?
Sidecar limits service discovery scope.
Why this answer
Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.
When using a ServiceEntry for a TCP service, what protocol should be specified?
TCP is the correct protocol for non-HTTP services.
Why this answer
The resolution must be set to DNS or STATIC, and the protocol must match the traffic type (TCP).
How do you configure a connection timeout for an external service?
timeout defines request duration.
Why this answer
In the VirtualService, the timeout field defines the request timeout duration.
What is the primary function of the 'istio-proxy' container in a pod?
The sidecar intercepts traffic.
Why this answer
It intercepts all network traffic to and from the application container.
You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?
Mirroring sends a copy of the request.
Why this answer
Traffic mirroring allows sending a copy of traffic to a different service without affecting the main response.
What is the default load balancing policy if none is specified in the DestinationRule?
Round robin is the default policy.
Why this answer
Istio defaults to ROUND_ROBIN if not specified.
Which TWO components must be configured to allow external traffic to enter the mesh?
Essential for routing.
Why this answer
A Gateway is required to listen for traffic, and a VirtualService is required to route it to the correct service.
What is the purpose of the 'retryOn' field in a VirtualService?
retryOn lists the triggers.
Why this answer
It specifies the conditions (e.g., 5xx, gateway-error) that trigger a retry.
You need to expose a service to traffic outside the mesh using Istio. Which resource is required to configure the entry point for incoming traffic?
Gateway manages the ingress or egress traffic.
Why this answer
The Gateway resource describes a load balancer operating at the edge of the mesh.
What is the purpose of the 'istio-system' namespace?
Home of istiod.
Why this answer
It contains the Istio control plane components.
Where do you configure the hostnames that a Gateway should accept?
Gateway configures the entry port and hosts.
Why this answer
The hosts field in the Gateway resource defines the allowed hostnames.
Which command helps troubleshoot configuration issues by analyzing the cluster for errors?
istioctl analyze performs cluster diagnostic scans.
Why this answer
istioctl analyze scans for common misconfigurations in the cluster.
How do you force a connection pool to use HTTP/1.1 instead of HTTP/2?
ConnectionPool is in DestinationRule.
Why this answer
The http1MaxPendingRequests field in DestinationRule is used, but protocol selection is often automatic; for specific tuning, use connectionPool.
Which THREE features are supported by the Istio 'trafficPolicy' in a DestinationRule?
Policy for connection limits.
Why this answer
Load balancing, connection pooling, and outlier detection are standard traffic policies.
A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?
VirtualService supports traffic shifting via weighted routing.
Why this answer
VirtualService uses the weight field in the route block to distribute traffic percentages.
Which criteria can be used in a VirtualService 'match' block? (Choose THREE)
Valid match.
Why this answer
VirtualService matches support URI, HTTP headers, and source labels.
To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?
PeerAuthentication defines mTLS enforcement.
Why this answer
PeerAuthentication defines mTLS settings for the mesh.
Which THREE configurations affect the way traffic is distributed across pods?
Defines distribution algorithm.
Why this answer
Subset definitions, loadBalancer policy, and VirtualService weights all influence distribution.
Which THREE are valid load balancing policies in Istio?
Valid policy.
Why this answer
ROUND_ROBIN, LEAST_CONN, and RANDOM are the built-in load balancing policies.
Which actions can a VirtualService perform on a request? (Choose TWO)
Valid action.
Why this answer
VirtualService can perform routing (to a specific destination) and header manipulation.
Which command lists all virtual services in the current namespace?
This is the correct kubectl command.
Why this answer
kubectl get virtualservices is the standard command to list this CRD.
You want to limit the number of concurrent connections to a service. Which field in the DestinationRule handles this?
connectionPool manages concurrent connections.
Why this answer
The connectionPool field in the trafficPolicy allows setting maxConnections for circuit breaking.
Which TWO actions can a VirtualService perform on a request?
Supported.
Why this answer
VirtualServices can rewrite paths and redirect traffic.
How do you define a circuit breaker that trips after 3 consecutive errors?
DestinationRule defines circuit breaking logic.
Why this answer
The outlierDetection field in DestinationRule uses consecutiveGatewayErrors.
Which command is used to view the current Istio configuration resources in a namespace?
kubectl get lists resources.
Why this answer
kubectl get is the standard tool to list Kubernetes resources, including Istio CRDs.
Which of the following are valid DestinationRule fields? (Choose THREE)
Valid field.
Why this answer
DestinationRule includes host, trafficPolicy, and subsets.
You want to perform a 'headers' modification on an incoming request. Which resource allows this?
VirtualService has a headers field for mutations.
Why this answer
VirtualService allows header manipulation (add, remove, replace) in the route action.
To strip a URL prefix before passing a request to a backend service, which field do you use?
Rewrite modifies the path.
Why this answer
The rewrite field in a VirtualService can modify the URI path.
When a request fails, where can you check the reason for the failure in the Istio ecosystem?
Kiali is the visualization and observability tool.
Why this answer
Kiali provides visual traffic flow analysis and error code identification.
Which are valid match conditions in VirtualService? (Choose THREE)
Valid match.
Why this answer
Match conditions include headers, uri, and port.
Which of these are valid load balancer algorithms in DestinationRule? (Choose TWO)
Valid algorithm.
Why this answer
ROUND_ROBIN and LEAST_CONN are valid load balancer settings in Istio.
Which TWO parameters are used to define a 'match' criteria in a VirtualService?
Valid match condition.
Why this answer
Headers and authority (or URI) are valid match conditions.
How do you implement a circuit breaker to eject a pod that returns 5xx errors?
OutlierDetection is the mechanism for ejecting unhealthy hosts.
Why this answer
OutlierDetection within the DestinationRule manages circuit breaking by ejecting unhealthy instances.
What are valid fields in the VirtualService 'http' route? (Choose TWO)
Valid field.
Why this answer
VirtualService route blocks use 'route' and 'match'.
You want to access an external API (e.g., api.google.com) from within your mesh. What must you configure?
ServiceEntry registers external hosts.
Why this answer
ServiceEntry allows adding entries to the Istio internal service registry for external endpoints.
You need to inspect the envoy config for a specific pod. Which command do you use?
proxy-config all shows full proxy state.
Why this answer
istioctl proxy-config all <pod-name> shows all configuration for that proxy.
Which THREE are types of traffic management patterns?
Supported pattern.
Why this answer
Canary deployments, traffic mirroring, and circuit breaking are all core Istio patterns.
Which of the following are valid traffic management components in Istio? (Choose TWO)
Valid component.
Why this answer
VirtualService and DestinationRule are the core traffic management resources.
What protocol does the Gateway resource support?
Gateways are protocol-agnostic for the defined ports.
Why this answer
Gateways support HTTP, HTTPS, GRPC, and TCP protocols.
Which resource is used to provide a unified entry point for multiple services?
Gateway is the standard ingress controller.
Why this answer
A Gateway resource, when combined with a VirtualService, provides a single ingress point.
You need to ensure that traffic is only routed to healthy pods. What feature does this?
Outlier detection tracks and ejects unhealthy hosts.
Why this answer
Outlier detection in DestinationRule ejects unhealthy hosts from the load balancing pool.
How do you specify a header-based match in a VirtualService?
Match conditions are defined in the match block of the route.
Why this answer
The 'match' field allows conditions like 'headers' to be evaluated.
Which THREE settings are required in a VirtualService for a canary deployment?
Routes define the destination subsets.
Why this answer
Canary deployments require host definition, http/tcp route definitions, and weight assignments.
What is the function of the 'weight' parameter in a VirtualService route?
Weight defines the traffic distribution percentage.
Why this answer
Weight determines the percentage of traffic directed to a specific destination.
You want to limit the total number of concurrent connections to a service. Where is this defined?
connectionPool handles connection limits.
Why this answer
connectionPool settings in the DestinationRule control connection limits.
Which of these are valid sub-commands for istioctl? (Choose TWO)
Valid command.
Why this answer
istioctl analyze and istioctl proxy-config are valid commands.
How do you define a regex match in a VirtualService?
Standard field for regex.
Why this answer
The match block URI uses the 'regex' field for pattern matching.
Which parameters can be configured in a VirtualService retry policy? (Choose TWO)
Valid parameter.
Why this answer
attempts and perTryTimeout are the primary fields for retry policies.
What are the primary ways to limit traffic to a service? (Choose TWO)
Routing.
Why this answer
You can use VirtualService (for routing) and DestinationRule (for circuit breaking/load balancing).
Which of the following are valid Gateway configurations? (Choose TWO)
Required for Gateway.
Why this answer
Gateways require a 'selector' to find the ingress pods and 'servers' to define listeners.
Which load balancing policy would you choose to ensure requests from the same user always hit the same pod?
Consistent hashing provides session affinity.
Why this answer
Consistent hashing based on a header or cookie ensures session stickiness.
Which TWO resources are essential for configuring traffic splitting between versions?
Defines routing.
Why this answer
A VirtualService is required to define the traffic weights, and a DestinationRule is required to define the subsets (versions).
Which are valid uses for ServiceEntry? (Choose THREE)
Valid use.
Why this answer
ServiceEntry is used for external service registry, TLS for external hosts, and DNS resolution.
A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?
proxy-config routes shows the live routing configuration.
Why this answer
istioctl proxy-config routes displays the routing table as understood by the Envoy proxy.
You want to inject a 5-second delay into requests for testing. Which resource allows this?
VirtualService fault injection defines delays.
Why this answer
VirtualService allows fault injection configuration including delays.
Which THREE fields are found within the 'trafficPolicy' block of a DestinationRule?
Defines LB policy.
Why this answer
loadBalancer, connectionPool, and outlierDetection are the primary components of a trafficPolicy.
Where do you define the hosts that a Gateway will listen on?
Gateway uses hosts for the listener configuration.
Why this answer
The hosts field inside the servers block of a Gateway resource defines the hostnames.
To perform a canary deployment, you have two versions of a service. Which resource do you use to split traffic between them?
VirtualService handles the routing logic and traffic weights.
Why this answer
VirtualService supports weight-based routing to split traffic between subsets.
A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?
The subset labels must match the pod labels in the DR spec.
Why this answer
DestinationRule uses 'subsets' that map to 'labels' on Kubernetes pods.
Which type of routing allows you to route to different services based on URL path?
VirtualService enables path-based routing.
Why this answer
VirtualService 'match' can use 'uri' with 'prefix' or 'exact' matches to route to different services.
Which resource type is used for mTLS policy?
Enforces mTLS.
Why this answer
PeerAuthentication is the specific CRD for mTLS.
How do you specify a custom header match in a VirtualService?
match allows defining criteria like headers to select routes.
Why this answer
The match block within a VirtualService route supports header matching using the headers key.
You want to inject a fault to test application resilience. Which field in the VirtualService supports this?
fault allows injecting aborts or delays.
Why this answer
The fault field in the route block allows for abort or delay injection.
You need to route traffic to a service based on the 'x-user-type' header. How is this defined?
match block handles header routing.
Why this answer
The match field in a VirtualService can include a 'headers' condition with exact or regex matching.
You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?
ServiceEntry allows manual registration of services outside the mesh.
Why this answer
ServiceEntry is required to include external endpoints in the Istio service registry.
What is the command to view the status of all pods including proxies?
This lists pods and their readiness.
Why this answer
kubectl get pods shows the status of containers, including the istio-proxy sidecar.
You need to define a local service that is not in the cluster. How?
ServiceEntry registers services.
Why this answer
ServiceEntry with location: MESH_INTERNAL allows defining services that are technically outside the K8s registry but internal to the mesh.
How do you configure an Istio Gateway to handle HTTPS?
Gateway handles TLS termination.
Why this answer
A Gateway requires a 'servers' block with 'tls' settings and a reference to a Kubernetes secret.
You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?
subset maps to the named subset in DestinationRule.
Why this answer
The subset field in the destination object refers to the named subset in the DestinationRule.
Which TWO settings are configured within the 'outlierDetection' block?
Time between checks.
Why this answer
consecutive5xxErrors and interval determine how a host is ejected from the load balancing pool.
If you want to perform traffic shadowing, which field do you use?
mirror is for shadowing.
Why this answer
The mirror field in a VirtualService enables traffic shadowing.
Ready to test yourself?
Try a timed practice session using only Traffic Management questions.