ICA Practice Questions

Question 1

Which TWO parameters affect the 'aggressiveness' of Outlier Detection?

Accepted Answer

interval. A short interval and a low consecutive error threshold make the system more aggressive.

Answer

baseEjectionTime

Answer

minHealthPercent

Answer

maxEjectionPercent

Question 2

You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?

Accepted Answer

timeout. The timeout setting is defined within the route rule of a VirtualService.

Answer

deadline

Answer

maxRequestDuration

Answer

requestTimeout

Question 3

If you want to perform traffic shadowing, which field do you use?

Accepted Answer

mirror. The mirror field in a VirtualService enables traffic shadowing.

Answer

redirect

Answer

weight

Answer

fault

Question 4

Which TWO actions can be taken via the 'istioctl' command to debug mesh health?

Accepted Answer

istioctl analyze. Option D, 'istioctl analyze', is correct because it statically inspects the mesh configuration (Istio resources, namespaces, and optionally live cluster state) and reports potential misconfigurations, warnings, and errors that affect mesh health. Option E, 'istioctl proxy-config', is correct because it queries the Envoy configuration of a specific sidecar or gateway (for example, clusters, listeners, routes, endpoints, and bootstrap) to diagnose traffic-routing and connectivity problems in the mesh. The other options are not valid istioctl debugging actions: 'istioctl delete pod' (A) is not an istioctl subcommand for deleting pods, 'istioctl monitor' (B) is not a supported istioctl command for mesh health monitoring, and 'istioctl update mesh' (C) is not a valid istioctl command for updating mesh configuration.

Answer

istioctl delete pod

Answer

istioctl monitor

Answer

istioctl update mesh

Question 5

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

Accepted Answer

The legacy service is not using an Istio sidecar to handle mTLS handshakes.. A PeerAuthentication policy with mode: STRICT at the namespace scope requires all inbound traffic to workloads in that namespace to use Istio mutual TLS. Only workloads with an Istio sidecar proxy can originate and terminate mTLS, so a legacy service without a sidecar cannot complete the mTLS handshake and its connections fail. The fix is either to inject a sidecar into the legacy service or to use a permissive mode or port-level exception during migration.

Answer

The Gateway is misconfigured for the legacy service.

Answer

The DestinationRule for the service is missing the 'mode: ISTIO_MUTUAL' setting.

Answer

The AuthorizationPolicy is missing a rule for the legacy service.

Question 6

What does an AuthorizationPolicy's 'operation' field represent?

Accepted Answer

HTTP methods and paths.. The operation field defines the methods (GET, POST) and paths allowed or denied.

Answer

Certificate details.

Answer

IP addresses.

Answer

User identities.

Question 7

If a VirtualService has a route to a service that has no pods matching the label, what happens?

Accepted Answer

503 Service Unavailable. In Istio, a VirtualService route points to a Kubernetes Service by name. If that Service has no endpoints because no pods match its label selector, Envoy has no healthy upstream cluster members to route to. Istio's default behavior in this case is to return HTTP 503 Service Unavailable (with the 'no healthy upstream' response flag), rather than silently dropping or rerouting traffic.

Answer

Traffic is routed to the default

Answer

Traffic is dropped

Answer

Traffic is routed to external

Question 8

You want to route traffic to a specific version of a service based on a header. Where do you define the subset?

Accepted Answer

DestinationRule. In Istio, a DestinationRule defines the named subsets of a service (for example, v1 and v2) by selecting pods with specific labels. A VirtualService then references those subsets when routing traffic, so the subset definition itself lives in the DestinationRule. This separation lets routing rules (VirtualService) stay decoupled from the actual pod groupings (DestinationRule).

Answer

Gateway

Answer

ServiceEntry

Answer

VirtualService

Question 9

Which command is used to display the currently active PeerAuthentication policies in the mesh?

Accepted Answer

kubectl get peerauthentication -A. The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.

Answer

istioctl analyze

Answer

istioctl get peerauthentication

Answer

kubectl describe mtls

Question 10

You need to route 10% of traffic to a new version of your service. Which object do you configure?

Accepted Answer

VirtualService. VirtualService allows weight-based routing to different subsets.

Answer

DestinationRule

Answer

ServiceEntry

Answer

Gateway

Question 11

You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?

Accepted Answer

Update label and restart pods. To move a namespace from revision 1-18 to 1-19, you update the istio.io/rev label on the namespace from 1-18 to 1-19 and then restart the pods so the sidecar injector (mutating webhook) re-injects the new revision's proxy. Istio does not automatically restart pods on label change, so the restart is mandatory for the new sidecar to take effect.

Answer

Use 'istioctl install --revision 1-19' on the namespace

Answer

Update label and run 'istioctl proxy-config rev 1-19'

Answer

Just update the label; Istio handles it automatically

Question 12

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Accepted Answer

Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.. A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.

Answer

Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.

Answer

Apply a global MeshConfig setting to enforce mTLS.

Answer

Create an AuthorizationPolicy that denies all traffic without a client certificate.

Question 13

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Accepted Answer

It defaults to ALLOW.. If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.

Answer

The request is rejected.

Answer

It defaults to DENY.

Answer

The policy is invalid.

Question 14

Which resource is used to configure circuit breaking for a service?

Accepted Answer

DestinationRule. DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.

Answer

PeerAuthentication

Answer

Gateway

Answer

VirtualService

Answer

EnvoyFilter

Question 15

What is the main advantage of using Istio's 'locality-aware load balancing'?

Accepted Answer

It minimizes latency and egress costs by routing to local endpoints.. It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.

Answer

It enables automatic retries.

Answer

It increases the number of available endpoints.

Answer

It prevents cross-cluster communication.

Istio Certified Associate (ICA, CNCF/Linux Foundation) ICA practice test

Three ways to study

Study ICA by domain

Study ICA by topic

Istio Installation Upgrade And Configuration practice questions

Advanced Scenarios practice questions

Resilience And Fault Injection practice questions

Traffic Management practice questions

Securing Workloads practice questions

ICA fundamentals practice questions

ICA scenario practice questions

ICA troubleshooting practice questions

Istio Certified Associate (ICA, CNCF/Linux Foundation) (ICA) practice questions