292 questions total · 4pages · All types, answers revealed
Page 1 of 4
Page 2Which THREE fields are found in the 'http' connectionPool configuration?
Limits connection idle time.
Why this answer
http2MaxRequests, maxRequestsPerConnection, and idleTimeout are valid fields.
You want to limit the number of concurrent connections to the 'payment' service to 100. Where is this configuration set?
Connection pool settings are defined in the DestinationRule under trafficPolicy.
Why this answer
Connection pool settings are configured under trafficPolicy in the DestinationRule.
Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?
Istiod handles configuration distribution.
Why this answer
Istiod is the control plane component responsible for distributing configuration to sidecars via the xDS protocol.
Which resource configuration is necessary to allow a service to communicate with a database outside the mesh using TLS?
Both are required to handle discovery and TLS policy.
Why this answer
A ServiceEntry is needed to register the database host, and a DestinationRule is needed to define TLS settings.
When using Istio with Kubernetes Gateway API, which object handles traffic routing rules based on path prefixes?
HTTPRoute is the standard resource for HTTP routing in the Gateway API.
What happens if a request times out in Istio?
This is the default standard error returned by Envoy when a timeout is reached.
Why this answer
If a request exceeds the timeout, the proxy terminates the request and returns a 504 Gateway Timeout.
When using Kiali to debug service communication, which TWO metrics are most useful for identifying performance bottlenecks?
Helps identify slow services.
Why this answer
Latency and request rates (throughput) are the primary indicators of performance issues.
How do you handle SNI-based routing in a Gateway?
The TLS block manages SNI and protocol handling.
You notice your traffic is not being routed correctly despite a VirtualService. Which step is most likely to resolve common issues?
Mismatching subsets is the most common cause of routing failure.
Why this answer
Ensuring the DestinationRule exists with the correct subsets is mandatory for VirtualService routing.
You want to exclude a specific container in a pod from being injected with the Istio proxy. How is this achieved?
This tells the injector to ignore the pod.
Why this answer
You add the annotation 'sidecar.istio.io/inject: "false"' to the pod template or the specific container annotation if supported via sidecar lifecycle hooks.
Which resources control mTLS settings? (Choose TWO)
Client-side configuration.
Why this answer
PeerAuthentication and DestinationRule (for client-side) control mTLS.
What is the purpose of the 'sidecar' resource in Istio?
Sidecar limits service discovery scope.
Why this answer
Sidecar limits the visibility of services for a specific proxy, reducing memory consumption.
Which command is used to restart an Istio sidecar without restarting the application container?
Since sidecars are separate containers in the same pod, the only way to restart one is to restart the entire pod.
Why this answer
In Kubernetes, you cannot restart just one container in a pod. You must restart the pod.
Which TWO of the following are true about Istio Circuit Breakers?
The sidecar enforces it.
Why this answer
Circuit breaking is implemented in the proxy and applies to individual load balancer pools.
Which TWO fields are required when configuring an 'abort' fault injection in a VirtualService?
Defines the error code to return.
Why this answer
Abort requires both the percentage and the specific status code to be returned.
Which protocol is used for the Istio data plane mTLS communication?
Istio relies on standard TLS protocols.
A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?
ipBlocks is the correct field for CIDR-based authorization.
Why this answer
The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.
You are performing an in-place upgrade of Istio. You have updated the control plane, but your data plane proxies are still running the old image. What is the standard process to upgrade the proxies?
Rolling restart is required to re-inject the updated sidecar proxy.
Why this answer
To upgrade the data plane proxies, you must perform a rolling restart of the pods to trigger the injector to pull the new sidecar image.
You want to configure your microservice to be more resilient. Which THREE of the following are valid fields within an 'outlierDetection' policy in a DestinationRule?
A valid field.
Why this answer
The outlierDetection object supports consecutive5xxErrors, interval, and baseEjectionTime.
What is the default value for 'consecutive5xx' in OutlierDetection?
The standard default is 5.
Why this answer
The default value for consecutive5xx in Istio/Envoy is 5.
When using a ServiceEntry for a TCP service, what protocol should be specified?
TCP is the correct protocol for non-HTTP services.
How do you configure a connection timeout for an external service?
timeout defines request duration.
Why this answer
In the VirtualService, the timeout field defines the request timeout duration.
What is the primary function of the 'istio-proxy' container in a pod?
The sidecar intercepts traffic.
Why this answer
It intercepts all network traffic to and from the application container.
You need to limit the number of concurrent connections to the 'orders' service. Which field in the DestinationRule do you configure?
This field specifically governs the maximum concurrent TCP connections.
If you want to use a custom proxy image for your sidecars, where should this be specified in the IstioOperator configuration?
This is the correct path to override the image.
Why this answer
The 'spec.values.global.proxy.image' field is used to override the default image for the sidecar proxies.
Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?
Envoy is the data plane component that enforces security policies locally on the pod.
Why this answer
The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.
You want to test a new version of a service by sending a copy of live traffic to it. What feature should you use?
Mirroring sends a copy of the request.
Why this answer
Traffic mirroring allows sending a copy of traffic to a different service without affecting the main response.
What is the default load balancing policy if none is specified in the DestinationRule?
Round robin is the default policy.
Why this answer
Istio defaults to ROUND_ROBIN if not specified.
Which TWO components must be configured to allow external traffic to enter the mesh?
Essential for routing.
Why this answer
A Gateway is required to listen for traffic, and a VirtualService is required to route it to the correct service.
When using Kubernetes Gateway API with Istio, which resource acts as the entry point for incoming traffic?
In Gateway API, the Gateway resource defines the load balancer entry point.
Why this answer
The Gateway resource defines the entry point, including listeners, ports, and protocols.
In a multi-cluster Istio setup, you notice that service 'A' in cluster 1 cannot communicate with service 'B' in cluster 2, even though 'Cross-Cluster' is enabled. The logs show '404 Not Found'. What is the most likely reason?
Istio requires services to be explicitly exported to other namespaces or clusters using 'exportTo' in the Service/Gateway configurations.
Why this answer
Even with multi-cluster discovery, services must be explicitly defined in the mesh registry via ServiceEntry, or the internal DNS name must be resolvable.
You want to configure a circuit breaker that only allows 100 concurrent requests to a service. Which field is correct?
This field caps the number of concurrent requests in the pool.
Why this answer
trafficPolicy.connectionPool.http.http1MaxPendingRequests or maxRequests (in versions) is used to control concurrency.
Which field in the trafficPolicy of a DestinationRule controls the maximum number of pending requests in the connection pool?
maxPendingRequests controls the limit of queued requests.
Why this answer
maxRequestsPerConnection is used for HTTP/1.1 and maxPendingRequests for total pending requests.
Which profile is recommended for a production environment where high availability and performance are required?
Default profile provides production-ready configuration.
Why this answer
The 'default' profile is optimized for production use cases with HA settings enabled.
If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?
This enables gradual adoption of mTLS.
Why this answer
PERMISSIVE mode allows both mTLS and plaintext traffic to coexist, which is ideal for migrations.
Which TWO of the following are valid HTTP fault injection delay settings?
Defines the duration of the delay.
Why this answer
fixedDelay and percentage are the two required components.
What is the purpose of the 'retryOn' field in a VirtualService?
retryOn lists the triggers.
Why this answer
It specifies the conditions (e.g., 5xx, gateway-error) that trigger a retry.
You need to expose a service to traffic outside the mesh using Istio. Which resource is required to configure the entry point for incoming traffic?
Gateway manages the ingress or egress traffic.
Why this answer
The Gateway resource describes a load balancer operating at the edge of the mesh.
What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?
RequestAuthentication only defines validation, not access policy.
Why this answer
By default, if the request does not include a token, the request is allowed to pass. The AuthorizationPolicy should then be used to deny requests without a valid token.
Which THREE of the following are valid sub-fields of 'outlierDetection'?
Limits number of ejected pods.
Why this answer
interval, baseEjectionTime, and maxEjectionPercent are core fields of outlierDetection.
You need to limit the number of concurrent connections to the 'order-service' to prevent cascading failures. Which Istio resource should you configure?
DestinationRule is the correct resource to define connectionPool settings.
Why this answer
The DestinationRule resource allows you to define traffic policies, including connection pool settings, which control concurrent connections and requests.
When using IstioOperator to customize the installation, you want to change the number of replicas for the Istiod control plane. Where should this be defined?
This field directly controls the replica count for the pilot component.
Why this answer
The 'spec.components.pilot.k8s.hpaSpec' or 'spec.components.pilot.k8s.replicaCount' fields are the correct places to define scale for the pilot component.
What is the purpose of the 'istio-system' namespace?
Home of istiod.
Why this answer
It contains the Istio control plane components.
When configuring a multi-cluster mesh, what does a 'ServiceEntry' with 'location: MESH_EXTERNAL' signify?
This is the intended definition of MESH_EXTERNAL.
Why this answer
It tells Istio that the service is external to the mesh, but it should be treated as a first-class citizen for routing and policy purposes.
What is the purpose of the 'istio-sidecar-injector' service in the Istio control plane?
This is the primary function of the injector.
Why this answer
The sidecar injector is a MutatingAdmissionWebhook that intercepts pod creation requests to inject the proxy container.
How do you specify the percentage of traffic that should experience a fault?
This is the correct nested structure for defining the fault rate.
Why this answer
The 'percentage' field within the fault injection block uses a 'value' field (0-100).
Where do you configure the hostnames that a Gateway should accept?
Gateway configures the entry port and hosts.
Why this answer
The hosts field in the Gateway resource defines the allowed hostnames.
Which setting is used to limit the number of retries for a request?
The 'attempts' field defines the maximum number of retry tries.
Why this answer
The 'retries' policy in a VirtualService allows you to define the number of attempts.
Which TWO are common causes for a service to be ejected by Outlier Detection?
Primary network indicator.
Why this answer
Repeated 5xx errors and gateway failures are the two primary reasons.
Which command helps troubleshoot configuration issues by analyzing the cluster for errors?
istioctl analyze performs cluster diagnostic scans.
Why this answer
istioctl analyze scans for common misconfigurations in the cluster.
What is the consequence of having a timeout that is shorter than the average latency of the service?
The proxy will cut off slow but otherwise healthy requests, returning 504.
Why this answer
If the timeout is too short, requests will be terminated prematurely, causing valid requests to fail.
Which of the following describes the role of the 'trust-domain' in Istio?
Identities across different meshes with the same trust domain trust each other.
Why this answer
The trust domain identifies the administrative boundary for identities. It is used to construct the SPIFFE ID.
Which of the following describes the difference between Circuit Breaking and Outlier Detection?
Correct distinction: CB manages concurrency/load, OD manages instance reliability.
Why this answer
Circuit Breaking is for request limits (concurrency), while Outlier Detection is for host health (ejection).
Which of the following is a valid method for performing fault injection?
VirtualService allows the 'fault' block to inject delays or aborts.
Why this answer
Istio supports both delay and abort faults via VirtualService.
How do you force a connection pool to use HTTP/1.1 instead of HTTP/2?
ConnectionPool is in DestinationRule.
Why this answer
The http1MaxPendingRequests field in DestinationRule is used, but protocol selection is often automatic; for specific tuning, use connectionPool.
Which THREE features are supported by the Istio 'trafficPolicy' in a DestinationRule?
Policy for connection limits.
Why this answer
Load balancing, connection pooling, and outlier detection are standard traffic policies.
Which TWO fields in the IstioOperator CR are commonly used to configure ingress gateway resources?
Main location for component definition.
Why this answer
The 'spec.components.ingressGateways' and 'spec.values.gateways.istio-ingressgateway' are the standard configuration areas for gateway resources.
Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?
The 'when' block allows attribute-based filtering, including JWT claims.
Why this answer
The 'when' clause in an AuthorizationPolicy allows you to specify conditions based on attributes, including JWT claims like 'request.auth.claims'.
A team wants to perform a canary deployment by shifting 10% of traffic to a new version of their service. Which resource allows this weighting?
VirtualService supports traffic shifting via weighted routing.
Why this answer
VirtualService uses the weight field in the route block to distribute traffic percentages.
Which THREE items are required to configure mTLS for an external service that is being added to the mesh?
Configures the TLS/mTLS parameters.
Why this answer
To connect to an external service with mTLS, you need to define the service, configure egress, and provide the client certificates.
Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?
Defines the source of the traffic.
Why this answer
An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).
Which of the following is true regarding Outlier Detection in Istio?
This is its primary function when configured.
Why this answer
Outlier Detection requires a destination rule and works by ejecting unhealthy instances based on their error rates.
How can you debug a failing AuthorizationPolicy rule?
This tool identifies issues with Istio resources.
Why this answer
The 'istioctl analyze' command can detect invalid policy configurations that prevent them from taking effect.
Which criteria can be used in a VirtualService 'match' block? (Choose THREE)
Valid match.
Why this answer
VirtualService matches support URI, HTTP headers, and source labels.
Which THREE items are included in an Istio SPIFFE ID?
The root of trust for the identity.
Why this answer
The SPIFFE ID format used by Istio follows 'spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>'.
Which THREE configuration areas are essential for ensuring observability in a complex Istio mesh?
Global settings for the observability pipeline.
Why this answer
Observability requires data generation (telemetry), data collection (proxy/mesh config), and visualization (dashboards).
To ensure traffic to a service is encrypted via mTLS, where should you verify the policy?
PeerAuthentication defines mTLS enforcement.
Why this answer
PeerAuthentication defines mTLS settings for the mesh.
Which THREE configurations affect the way traffic is distributed across pods?
Defines distribution algorithm.
Why this answer
Subset definitions, loadBalancer policy, and VirtualService weights all influence distribution.
What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?
Permissive mode is the default, allowing for incremental migration.
Why this answer
Istio defaults to PERMISSIVE mode, which allows both mTLS and plaintext traffic.
Which THREE factors influence whether a service in the mesh will accept traffic?
Determines if the request is permitted.
Why this answer
Traffic acceptance depends on PeerAuthentication (mTLS), AuthorizationPolicy (access), and the Envoy proxy configuration (xDS).
Which THREE are valid load balancing policies in Istio?
Valid policy.
Why this answer
ROUND_ROBIN, LEAST_CONN, and RANDOM are the built-in load balancing policies.
Which actions can a VirtualService perform on a request? (Choose TWO)
Valid action.
Why this answer
VirtualService can perform routing (to a specific destination) and header manipulation.
Which command lists all virtual services in the current namespace?
This is the correct kubectl command.
Why this answer
kubectl get virtualservices is the standard command to list this CRD.
You are troubleshooting a service that is failing to communicate with another service in a different namespace. Which TWO of the following items should you check to ensure connectivity?
Ensures mTLS modes are compatible (e.g., both are STRICT).
Why this answer
Communication requires both network routing (usually allowed by default) and Istio-level authorization.
You want to ensure that a request to the 'search' service fails fast if it takes longer than 2 seconds. How is this configured?
The timeout field in the route rule is the standard way to limit request time.
Why this answer
The timeout field in a VirtualService route rule controls the request duration limit.
Page 1 of 4
Page 2Practice ICA by domain
Target a specific domain to shore up weak areas.