How should I use these Advanced Scenarios practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Advanced Scenarios questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Advanced Scenarios domain.

ICA · topic practice

Advanced Scenarios practice questions

Practise Istio Certified Associate (ICA, CNCF/Linux Foundation) (ICA) Advanced Scenarios practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Advanced Scenarios

Practice 10 questions Browse domain →

What the exam tests

What to know about Advanced Scenarios

Advanced Scenarios questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Advanced Scenarios exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Advanced Scenarios questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Advanced Scenarios explanation →

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

Trap 1: A ServiceEntry with 'resolution: DNS'.

ServiceEntry handles routing and discovery, not identity and trust.

Trap 2: An AuthorizationPolicy allowing all traffic.

This affects authorization, not the trust domain required for mTLS encryption.

Trap 3: An EgressGateway with TLS origination.

EgressGateway is for traffic exiting the mesh to external services, not for inter-cluster traffic.

Study all Advanced Scenarios common traps →

A
A shared 'cacerts' secret containing the root CA certificate.
All clusters must trust the same root CA to validate identities across cluster boundaries.
B
A ServiceEntry with 'resolution: DNS'.
Why wrong: ServiceEntry handles routing and discovery, not identity and trust.
C
An AuthorizationPolicy allowing all traffic.
Why wrong: This affects authorization, not the trust domain required for mTLS encryption.
D
An EgressGateway with TLS origination.
Why wrong: EgressGateway is for traffic exiting the mesh to external services, not for inter-cluster traffic.

Advanced Scenarios practice questions

What to know about Advanced Scenarios

Common Advanced Scenarios exam traps

Advanced Scenarios questions

In a multi-primary deployment, you want to ensure that traffic between clusters is encrypted via mTLS. Which resource must be configured on both clusters?

When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?

You are using Kiali to debug a service mesh. You notice a red line between two services. What does this indicate?

When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?

In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?

You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?

In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?

You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?

How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?

What is the primary function of the 'PeerAuthentication' resource?

In a multi-cluster environment with a shared control plane, what is the purpose of the 'istio-remote-secret'?

In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?

Which component in Istio is responsible for collecting telemetry data and sending it to observability tools like Prometheus?

You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?

You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?

When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?

What is the result of setting 'outlierDetection' in a DestinationRule?

Which Istio component handles the generation of xDS configuration?

What is the main advantage of using Istio's 'locality-aware load balancing'?

When inspecting Envoy stats, what does 'upstream_rq_timeout' represent?

Track your progress over time

Start a Advanced Scenarios only practice session

Related ICA topic practice pages

Advanced Scenarios practice questions

Istio Installation Upgrade And Configuration practice questions

Resilience And Fault Injection practice questions

Securing Workloads practice questions

Traffic Management practice questions

ICA fundamentals practice questions

ICA scenario practice questions

ICA troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid