292 questions total · 4pages · All types, answers revealed
Which of the following are valid Gateway configurations? (Choose TWO)
Required for Gateway.
Why this answer
Gateways require a 'selector' to find the ingress pods and 'servers' to define listeners.
What is the purpose of 'minHealthPercent' in the OutlierDetection configuration?
This prevents 'ejection storms' where too many pods are removed at once.
Why this answer
It prevents the ejection of hosts if it would cause the total cluster health to fall below a specific percentage.
Which load balancing policy would you choose to ensure requests from the same user always hit the same pod?
Consistent hashing provides session affinity.
Why this answer
Consistent hashing based on a header or cookie ensures session stickiness.
You are implementing multi-tenancy using Istio Namespaces. To ensure strict isolation where Service A in Namespace X cannot send traffic to Service B in Namespace Y, what is the best approach?
A default deny policy ensures that no cross-namespace traffic is allowed unless explicitly permitted.
Why this answer
AuthorizationPolicies are the primary tool for fine-grained access control. A 'deny-all' policy in the target namespace followed by explicit permit rules enforces strict isolation.
Which THREE things are required for mTLS to be successful?
Defines the mTLS requirement.
Why this answer
mTLS needs certificates issued to the workloads, a mutual agreement on using mTLS (PeerAuthentication), and sidecar proxies to perform the handshake.
Which THREE components are involved in the Istio certificate management process?
Acts as the CA.
Why this answer
The certificate lifecycle involves Istiod (CA), the control plane agent, and the workload sidecar/proxy.
Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?
Rejection confirms the policy is enforcing security.
Why this answer
Correct operation is confirmed by successful communication under STRICT mode (using sidecars) and by observing mTLS metrics/logs.
Which TWO resources are essential for configuring traffic splitting between versions?
Defines routing.
Why this answer
A VirtualService is required to define the traffic weights, and a DestinationRule is required to define the subsets (versions).
You have a cluster with multiple revisions of Istio installed. You want to move a namespace from revision '1-18' to '1-19'. What is the correct procedure?
Updating the label and restarting the pods forces the injector to use the new sidecar version.
Why this answer
You must update the 'istio.io/rev' label on the namespace to the new revision and then perform a rolling restart of the pods in that namespace.
You need to ensure that a request to the 'orders' service times out if it takes longer than 2 seconds. Which field in the VirtualService should you configure?
The timeout field is the standard way to define request duration limits.
Why this answer
The timeout setting is defined within the route rule of a VirtualService.
What is the result of setting 'outlierDetection' in a DestinationRule?
This is the core function of outlier detection to improve system availability.
Why this answer
Outlier detection automatically ejects unhealthy hosts from the load balancing pool based on failure thresholds.
What happens when an AuthorizationPolicy is applied to a workload without a sidecar?
Policy enforcement requires the sidecar.
Why this answer
AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.
Which are valid uses for ServiceEntry? (Choose THREE)
Valid use.
A VirtualService is not correctly routing traffic to a new version. Which tool helps verify the actual route configuration loaded in the proxy?
proxy-config routes shows the live routing configuration.
Why this answer
istioctl proxy-config routes displays the routing table as understood by the Envoy proxy.
You want to inject a 5-second delay into requests for testing. Which resource allows this?
VirtualService fault injection defines delays.
Why this answer
VirtualService allows fault injection configuration including delays.
Which THREE fields are found within the 'trafficPolicy' block of a DestinationRule?
Defines LB policy.
Why this answer
loadBalancer, connectionPool, and outlierDetection are the primary components of a trafficPolicy.
Where do you define the hosts that a Gateway will listen on?
Gateway uses hosts for the listener configuration.
Why this answer
The hosts field inside the servers block of a Gateway resource defines the hostnames.
A service 'orders' requires a specific AuthorizationPolicy that allows GET requests only from the 'frontend' service while denying all other methods. Which configuration is correct?
This policy correctly restricts access to the GET method for the specified service account.
Why this answer
The AuthorizationPolicy should specify the 'GET' method in the 'rules' section and match the 'frontend' principal in the 'from' source block.
To perform a canary deployment, you have two versions of a service. Which resource do you use to split traffic between them?
VirtualService handles the routing logic and traffic weights.
Why this answer
VirtualService supports weight-based routing to split traffic between subsets.
In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?
No constraints mean no filtering.
Why this answer
An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.
A DestinationRule is configured with a 'v1' subset but traffic is failing. Where should you check for the label match?
The subset labels must match the pod labels in the DR spec.
Why this answer
DestinationRule uses 'subsets' that map to 'labels' on Kubernetes pods.
Which command is used to display the currently active PeerAuthentication policies in the mesh?
Standard kubectl command for K8s resources.
Why this answer
The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.
Which type of routing allows you to route to different services based on URL path?
VirtualService enables path-based routing.
Why this answer
VirtualService 'match' can use 'uri' with 'prefix' or 'exact' matches to route to different services.
How can you verify the current configuration being pushed to an Envoy sidecar without using Kiali?
This command is the standard way to inspect the Envoy sidecar configuration from the CLI.
Why this answer
The 'istioctl proxy-config' command allows users to inspect the current state of the Envoy proxy.
Which resource type is used for mTLS policy?
Enforces mTLS.
Why this answer
PeerAuthentication is the specific CRD for mTLS.
Which THREE elements are part of a 'RequestAuthentication' resource?
Part of the jwtRule.
Why this answer
RequestAuthentication includes the selector, the list of JWT rules (issuer, jwksUri), and the target namespace/scope.
Which THREE components are critical for establishing a secure multi-cluster 'primary-remote' configuration?
Allows the primary control plane to access the remote API.
Why this answer
Cross-cluster identity, trust, and API access are the core requirements.
What is the primary function of the 'PeerAuthentication' resource?
PeerAuthentication is the dedicated resource for controlling authentication, specifically mTLS.
Why this answer
PeerAuthentication allows you to define the mTLS mode (STRICT, PERMISSIVE, DISABLE) for workloads within a namespace or the entire mesh.
You notice that your Kiali dashboard shows services as 'missing'. What is a likely cause?
Kiali must be configured to watch specific namespaces for service discovery.
Why this answer
If Kiali cannot find the service in the registry, it is likely because the namespace is not included in the Kiali configuration or the service lacks proper labels.
When configuring an IstioOperator file, what does the 'spec.meshConfig' section primarily control?
This is the primary purpose of meshConfig.
Why this answer
The 'meshConfig' section defines the mesh-wide configuration options that apply to all proxies in the mesh.
How do you specify a custom header match in a VirtualService?
match allows defining criteria like headers to select routes.
Why this answer
The match block within a VirtualService route supports header matching using the headers key.
Which THREE commands can be used to manage or inspect the Istio mesh configuration?
Command exists to check versions.
Why this answer
The 'istioctl' tool provides 'analyze', 'proxy-config', and 'version' commands for mesh inspection and management.
What is the primary function of the 'root-cert.pem' file in the Istio control plane?
Workloads verify the peer's certificate against the root CA.
Why this answer
The root certificate is used to sign the intermediate CA certificates that sign workload certificates, establishing the trust chain.
You have a DestinationRule with outlier detection enabled. If a host returns 5 consecutive 5xx errors and the 'interval' is set to 1s, what happens if 'baseEjectionTime' is 30s?
baseEjectionTime defines the duration of the ejection.
Why this answer
The host is ejected from the load balancing pool for 30 seconds.
In a VirtualService, where is the fault injection policy defined?
This is where routing rules and their associated fault policies reside.
Why this answer
The fault field is defined inside the route action block of a VirtualService.
You want to inject a fault to test application resilience. Which field in the VirtualService supports this?
fault allows injecting aborts or delays.
Why this answer
The fault field in the route block allows for abort or delay injection.
You need to route traffic to a service based on the 'x-user-type' header. How is this defined?
match block handles header routing.
Why this answer
The match field in a VirtualService can include a 'headers' condition with exact or regex matching.
You have an external dependency that is not in the Kubernetes registry. How do you allow the mesh services to communicate with it?
ServiceEntry allows manual registration of services outside the mesh.
Why this answer
ServiceEntry is required to include external endpoints in the Istio service registry.
What is the command to view the status of all pods including proxies?
This lists pods and their readiness.
Why this answer
kubectl get pods shows the status of containers, including the istio-proxy sidecar.
You need to define a local service that is not in the cluster. How?
ServiceEntry registers services.
Why this answer
ServiceEntry with location: MESH_INTERNAL allows defining services that are technically outside the K8s registry but internal to the mesh.
Which of the following is NOT a valid action in an Istio AuthorizationPolicy?
REDIRECT is not an action in AuthorizationPolicy.
Why this answer
'AUDIT' and 'DENY' and 'ALLOW' are valid, but 'REDIRECT' is not a valid action in AuthorizationPolicy.
How do you define a circuit breaker that limits the number of pending requests?
This controls the queue size for HTTP requests.
Why this answer
The 'http1MaxPendingRequests' field is used to limit the number of pending requests in the connection pool.
Gateway handles TLS termination.
You need to restrict traffic to a specific subset of a service defined in a DestinationRule. What should you use in your VirtualService destination block?
subset maps to the named subset in DestinationRule.
Why this answer
The subset field in the destination object refers to the named subset in the DestinationRule.
Which TWO of the following are valid ways to verify the status of an Istio control plane deployment?
Valid command to verify control plane health.
Why this answer
Using 'istioctl verify-install' checks the health of the control plane, and checking the status of the 'istiod' deployment via kubectl is a standard Kubernetes verification method.
You want to simulate a 5-second network latency for 10% of requests to the 'cart' service. Which VirtualService configuration is correct?
The correct structure for fault injection involves defining the delay duration and the percentage of requests.
Why this answer
The fault injection delay policy requires both a percentage and a fixedDelay duration.
Which TWO settings are configured within the 'outlierDetection' block?
Time between checks.
Why this answer
consecutive5xxErrors and interval determine how a host is ejected from the load balancing pool.
Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?
In ambient mode, the ztunnel handles mTLS configuration.
Why this answer
PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.
If you want to perform traffic shadowing, which field do you use?
mirror is for shadowing.
Why this answer
The mirror field in a VirtualService enables traffic shadowing.
What is the default timeout for an HTTP request in Istio when no VirtualService is defined?
15 seconds is the standard default timeout value in the Envoy proxy configuration managed by Istio.
Why this answer
Istio defaults to 15 seconds for request timeouts if not explicitly configured.
Which field in the VirtualService allows you to redirect an incoming request to a different path?
redirect sends a 301 response.
Why this answer
The 'redirect' field in the VirtualService route allows for URI or authority redirection.
Which field in VirtualService is used for A/B testing?
weight defines traffic splits.
Why this answer
The weight field is used to split traffic between versions (subsets) for A/B testing.
You want to enforce mTLS globally for all services in the cluster. Which resource should you apply?
PeerAuthentication defines the mTLS mode for the mesh.
Why this answer
PeerAuthentication at the root namespace (istio-system) enforces global mTLS.
You want to force all traffic to an external service to go through an EgressGateway. What is required?
This pattern is the standard way to enforce egress traffic control.
Why this answer
A ServiceEntry to register the external host, and a VirtualService to route that traffic to the EgressGateway.
Which THREE settings are part of the 'outlierDetection' configuration in a DestinationRule?
Defines the duration of the analysis window.
Why this answer
The standard fields include consecutive5xxErrors, interval, and baseEjectionTime.
What information can you get from 'istioctl proxy-config'? (Choose THREE)
Valid command.
Why this answer
proxy-config allows viewing routes, endpoints, and clusters.
What is the standard path to install istioctl?
Standard method.
Why this answer
Downloading the binary from the Istio release page is the standard method.
A team wants to enable sidecar injection for a specific namespace without modifying the deployment manifests. What is the most efficient way to achieve this?
Labels are the standard way to trigger injection.
Why this answer
Labeling the namespace with 'istio-injection=enabled' triggers the sidecar injector webhook to automatically inject proxies into new pods.
Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?
Connectivity is required for key verification.
Why this answer
The most common reason is that the 'jwksUri' is unreachable from the Istio proxy, often due to network policies or egress restrictions.
What happens if you have two VirtualServices for the same host?
Istio attempts to merge them.
Why this answer
Istio merges them if possible, or the behavior is undefined/conflicting depending on the match criteria.
When configuring a retry policy for a VirtualService, which parameter defines the maximum time allowed for a single attempt?
perTryTimeout is the timeout for each individual attempt.
Why this answer
The perTryTimeout field controls the duration for an individual attempt within a retry policy.
What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?
Without policies, Istio does not restrict access.
Why this answer
By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.
You need to expose an application running in the mesh to traffic from outside the cluster. Which resource is required to define the entry point?
Gateway defines the entry point for traffic entering the mesh.
Why this answer
Gateway resources are used to configure load balancers operating at the edge of the mesh.
Which of the following is true about the 'principals' vs 'source.principals' fields?
Both refer to the authenticated identity (SPIFFE ID).
Why this answer
They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.
Which TWO parameters affect the 'aggressiveness' of Outlier Detection?
Shorter interval = faster checks.
Why this answer
A short interval and a low consecutive error threshold make the system more aggressive.
Which THREE components are involved in configuring a robust resilience strategy?
Handles circuit breaking/outlier detection.
Why this answer
VirtualService, DestinationRule, and Retries/Timeouts (within VS) are key.
What are the types of resolution in a ServiceEntry? (Choose TWO)
Valid type.
Why this answer
ServiceEntry supports DNS and NONE resolution types.
Which TWO actions can be taken via the 'istioctl' command to debug mesh health?
Identifies misconfigurations.
Why this answer
istioctl is the primary diagnostic tool for Istio.
You are performing a canary upgrade of the Istio control plane using the revision-based approach. After deploying the new revision, how do you verify which pods are currently pointing to the new control plane?
This identifies pods associated with specific revisions.
Why this answer
You verify the configuration by checking the 'istio.io/rev' label on the pods to see which revision they are assigned to.
Which component is responsible for enforcing traffic policies in the data plane?
Envoy is the data plane proxy.
Why this answer
The Envoy proxy (injected as a sidecar) handles all data plane traffic management.
You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?
In STRICT mode, mTLS is mandatory. Without a sidecar, the service cannot participate in the mTLS handshake.
Why this answer
Setting PeerAuthentication to STRICT forces mTLS for all traffic. If the legacy service does not have an Istio sidecar or is not configured to perform mTLS, it will be rejected.
In a primary-remote multi-cluster deployment with a shared control plane, a remote cluster service is unreachable. You observe the ServiceEntry is created correctly, but the remote cluster does not have the corresponding Service object. What is the most likely cause?
The primary control plane requires a secret containing the remote cluster's kubeconfig to manage resources.
Why this answer
In a shared control plane model, the primary cluster's control plane must be able to reach the remote cluster's Kubernetes API server to watch for service changes and push endpoints.
What is the primary purpose of the 'subset' field in a VirtualService destination?
Subsets map to specific labels.
Why this answer
It references the named subset defined in the corresponding DestinationRule.
You want to route traffic to a specific version of a service based on a header. Where do you define the subset?
Subsets are defined within the DestinationRule.
Why this answer
Subsets are defined in the DestinationRule to map labels to specific versions.
You need to route traffic for an external service that uses TLS. How do you configure the ServiceEntry?
ServiceEntry with DNS resolution handles external TLS hosts.
Why this answer
The ServiceEntry must define resolution and location, and the destination port must specify the protocol.
Practice ICA by domain
Target a specific domain to shore up weak areas.