38 of 113 questions · Page 2/2 · Traffic Management · Answers revealed
Which field in the VirtualService allows you to redirect an incoming request to a different path?
redirect sends a 301 response.
Why this answer
The 'redirect' field in the VirtualService route allows for URI or authority redirection.
Which field in VirtualService is used for A/B testing?
weight defines traffic splits.
Why this answer
The weight field is used to split traffic between versions (subsets) for A/B testing.
You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?
PeerAuthentication defines the mTLS mode for the mesh.
Why this answer
PeerAuthentication at the root namespace (istio-system) enforces global mTLS.
What information can you get from 'istioctl proxy-config'? (Choose THREE)
Valid command.
Why this answer
proxy-config allows viewing routes, endpoints, and clusters.
What is the standard path to install istioctl?
Standard method.
Why this answer
Downloading the binary from the Istio release page is the standard method.
What happens if you have two VirtualServices for the same host?
Istio attempts to merge them.
Why this answer
Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.
When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?
perTryTimeout is the timeout for each individual attempt.
Why this answer
The perTryTimeout field controls the duration for an individual attempt within a retry policy.
You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?
Gateway defines the entry point for traffic entering the mesh.
Why this answer
Gateway resources are used to configure load balancers operating at the edge of the mesh.
What are the types of resolution in a ServiceEntry? (Choose TWO)
Valid type.
Why this answer
ServiceEntry supports DNS and NONE resolution types.
Which component is responsible for enforcing traffic policies in the data plane?
Envoy is the data plane proxy.
Why this answer
The Envoy proxy (injected as a sidecar) handles all data plane traffic management.
What is the primary purpose of the 'subset' field in a VirtualService destination?
Subsets map to specific labels.
Why this answer
It references the named subset defined in the corresponding DestinationRule.
You want to route traffic to a specific version of a service based on a header. Where do you define the subset?
Subsets are defined within the DestinationRule.
Why this answer
Subsets are defined in the DestinationRule to map labels to specific versions.
You need to route traffic for an external service that uses TLS. How do you configure the ServiceEntry?
ServiceEntry with DNS resolution handles external TLS hosts.
Why this answer
The ServiceEntry must define resolution and location, and the destination port must specify the protocol.
A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?
DestinationRule defines outlierDetection for circuit breaking.
Why this answer
DestinationRule allows the configuration of traffic policies including circuit breaking via the outlierDetection field.
You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?
The timeout field sets the per-request deadline.
Why this answer
The timeout field in the HTTPRoute of a VirtualService dictates the deadline.
What is the default behavior when no VirtualService is defined for a service?
Default behavior.
Why this answer
Istio routes traffic to all available pods in the service in a round-robin fashion.
You need to route 10% of traffic to a new version of your service. Which object do you configure?
VirtualService supports weighted routing rules.
Why this answer
VirtualService allows weight-based routing to different subsets.
You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?
VirtualService contains the retries field.
Why this answer
Retries are configured within the HTTPRoute block of a VirtualService.
You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?
The 'timeout' field is defined in the HTTPRoute object.
Why this answer
Timeouts are a property of the route in a VirtualService.
Which field in the DestinationRule allows defining different versions of a service?
subsets defines traffic destinations by labels.
Why this answer
The subsets block in DestinationRule allows grouping pods by label to create versions.
What is the purpose of 'istioctl analyze'?
It scans for errors.
Why this answer
To identify configuration issues across the mesh.
Which THREE of these are valid reasons to use a ServiceEntry?
Correct use case.
Why this answer
ServiceEntry is used to expose external APIs, add external databases, or redirect traffic to a different domain entirely.
What is the default Istio load balancing algorithm?
ROUND_ROBIN is the default load balancing algorithm.
Why this answer
ROUND_ROBIN is the default load balancing strategy in Istio.
Which items can be configured under DestinationRule trafficPolicy? (Choose THREE)
Valid field.
Why this answer
TrafficPolicy allows setting connectionPool, loadBalancer, and outlierDetection.
Which are valid connectionPool settings? (Choose THREE)
Valid field.
Why this answer
connectionPool allows settings for tcp, http, and http2.
Which commands verify Istio configurations? (Choose TWO)
Config verification.
Why this answer
istioctl analyze and istioctl proxy-config are used for verification.
Which protocols can be defined in a Gateway server? (Choose THREE)
Valid protocol.
Why this answer
Gateways support HTTP, HTTPS, and TCP.
You have multiple VirtualServices for the same host. How does Istio determine which one to use?
Istio merges routes for the same host.
Why this answer
Istio merges them based on the configuration logic, but you should avoid duplicate rules to prevent unpredictable behavior.
You have a Gateway but traffic is blocked. Which resource most likely governs the connection permission?
AuthorizationPolicy defines who can access what.
Why this answer
AuthorizationPolicy handles the access control between services and gateways.
Which TWO mechanisms are used to secure traffic within the mesh?
Enables mTLS.
Why this answer
PeerAuthentication (for mTLS mode) and AuthorizationPolicy (for access control) are key.
What are common reasons to use a ServiceEntry? (Choose THREE)
Standard use case.
Why this answer
ServiceEntries allow adding external endpoints, enabling TLS for external services, and managing DNS-based resolution for external hosts.
Which tool provides a GUI for visualizing your traffic management rules?
Visual dashboard.
Why this answer
Kiali is the standard visualization tool for Istio.
What does the 'mirror' feature in a VirtualService do?
Mirroring duplicates traffic for observation.
Why this answer
Mirroring sends a copy of traffic to a different service without affecting the primary response.
Which field in the VirtualService allows you to redirect traffic to a different URI?
Redirect sends a specific response code to the client.
Why this answer
The redirect field within the HTTPRoute allows URI or authority changes.
Which TWO fields are mandatory in a Gateway resource?
Selector binds the resource to a specific ingress controller.
Why this answer
A Gateway requires a selector to bind to ingress gateways and servers for port configuration.
If a VirtualService has a route to a service that has no pods matching the label, what happens?
503 is the standard error when destinations are missing.
Why this answer
If no pods exist, the proxy will return a 503 error because it has no destination endpoints.
What is the benefit of defining a 'sidecar' resource in Istio?
Sidecar limits the scope of service discovery.
Why this answer
It restricts the configuration pushed to Envoy to only what the service needs, reducing memory usage.
Which command is used to view the effective configuration of a specific Envoy proxy?
This command displays the Envoy proxy configuration.
Why this answer
istioctl proxy-config is the standard tool for inspecting sidecar config.
Ready to test yourself?
Try a timed practice session using only Traffic Management questions.