292 questions total · 4pages · All types, answers revealed
Page 4 of 4
A service is experiencing high latency. You want to implement a circuit breaker to prevent cascading failures. Which resource do you use?
DestinationRule defines outlierDetection for circuit breaking.
Why this answer
DestinationRule allows the configuration of traffic policies including circuit breaking via the outlierDetection field.
You want to configure outlier detection to eject hosts that return 5xx errors. Is it possible to monitor more than just 5xx codes?
This allows targeting specific types of errors commonly associated with network/mesh issues.
Why this answer
Outlier detection supports consecutive Gateway errors (502, 503, 504) as well as 5xx codes.
How can you restrict traffic to a service based on the presence of a specific request header?
This is the correct way to validate headers.
Why this answer
The 'when' field in an AuthorizationPolicy supports checking request headers using 'request.headers[<header-name>]'.
You have a service that occasionally hangs. You want to ensure that if a request takes longer than 2 seconds, it fails immediately. Which field do you configure?
The timeout field sets the per-request deadline.
Why this answer
The timeout field in the HTTPRoute of a VirtualService dictates the deadline.
You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?
Egress Gateways can handle mTLS termination/origination for external traffic.
Why this answer
You must use an Egress Gateway with mTLS configured to the external service.
What is the default behavior when no VirtualService is defined for a service?
Default behavior.
Why this answer
Istio routes traffic to all available pods in the service in a round-robin fashion.
You are debugging an Istio installation issue. Which command allows you to view the currently applied IstioOperator configuration in the cluster?
This displays the applied IstioOperator CR.
Why this answer
The 'kubectl get istiooperator -n istio-system' command displays the custom resources that define the Istio installation.
You need to route 10% of traffic to a new version of your service. Which object do you configure?
VirtualService supports weighted routing rules.
Why this answer
VirtualService allows weight-based routing to different subsets.
How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?
The two-step validation is the standard pattern.
Why this answer
You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.
What is the result of applying an AuthorizationPolicy that has no 'action' field?
Default action is ALLOW.
Why this answer
If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.
Which TWO of the following are valid fields within a DestinationRule's 'trafficPolicy'?
Valid field for defining connection limits.
Why this answer
connectionPool and outlierDetection are primary components of the trafficPolicy.
You are debugging a performance issue and suspect Envoy is buffering too much data. Which filter settings might be causing this?
The buffer filter explicitly stores request data in memory, impacting performance.
Why this answer
The 'buffer' filter in Envoy can be configured to buffer requests, which can lead to increased latency if not tuned properly.
You notice that a pod is being ejected by Outlier Detection despite only having occasional errors. How do you increase the interval between ejection scans?
Increasing the interval makes the detector scan less frequently, reducing the likelihood of premature ejection.
Why this answer
The interval field in OutlierDetection determines how often the health check is performed.
Which field in a VirtualService can you use to retry a request?
This is the block for configuring retries.
Why this answer
The 'retries' field in the HTTP route block allows defining retry attempts and timeout per try.
Which Istio component handles the generation of xDS configuration?
Istiod is responsible for xDS server functionality.
Why this answer
Istiod is the monolithic control plane component that computes the configuration for all sidecars.
You are installing Istio for a development cluster and want to use a predefined configuration that includes the core components but disables unnecessary features like telemetry to save resources. Which profile should you choose?
The minimal profile provides the smallest footprint.
Why this answer
The 'minimal' profile installs only the base resources and the control plane, making it ideal for resource-constrained development environments.
Which resource is used to configure circuit breaking for a service?
DestinationRule contains the trafficPolicy block for circuit breaking.
Why this answer
DestinationRule is the resource where circuit breaking settings are defined within the trafficPolicy.
You are observing 503 errors. You want to automatically retry failed requests. Where is this configured?
VirtualService contains the retries field.
Why this answer
Retries are configured within the HTTPRoute block of a VirtualService.
You are configuring Jaeger for distributed tracing in Istio. You observe that traces are missing spans for external service calls. What is the most likely cause?
Istio-sidecars cannot magically maintain trace contexts across opaque network boundaries without application-level header propagation.
Why this answer
Tracing relies on the propagation of B3 or W3C Trace Context headers. If external services do not support this, the trace chain is broken.
What is the main advantage of using Istio's 'locality-aware load balancing'?
This is the primary goal of locality-aware routing.
Why this answer
It prioritizes traffic to endpoints in the same zone or region to reduce latency and egress costs.
You need to enforce a 5-second timeout on all calls to a specific service. Where is this configured?
The 'timeout' field is defined in the HTTPRoute object.
Why this answer
Timeouts are a property of the route in a VirtualService.
Which field in the DestinationRule allows defining different versions of a service?
subsets defines traffic destinations by labels.
Why this answer
The subsets block in DestinationRule allows grouping pods by label to create versions.
What is the purpose of 'istioctl analyze'?
It scans for errors.
Why this answer
To identify configuration issues across the mesh.
Which THREE of these are valid reasons to use a ServiceEntry?
Correct use case.
Why this answer
ServiceEntry is used to expose external APIs, add external databases, or redirect traffic to a different domain entirely.
What is the default Istio load balancing algorithm?
ROUND_ROBIN is the default load balancing algorithm.
Why this answer
ROUND_ROBIN is the default load balancing strategy in Istio.
Which items can be configured under DestinationRule trafficPolicy? (Choose THREE)
Valid field.
Why this answer
TrafficPolicy allows setting connectionPool, loadBalancer, and outlierDetection.
Which tool would you use to verify if a pod has an active mTLS connection?
Viewing secrets confirms certificates are present.
Why this answer
The 'istioctl proxy-config secret' command shows the certificates loaded into the proxy, which is a good indicator of mTLS readiness.
You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?
A workload-level policy overrides a namespace-level policy.
Why this answer
You can apply a PeerAuthentication policy at the workload level (using 'selector') to override the namespace-wide policy.
Which are valid connectionPool settings? (Choose THREE)
Valid field.
What happens when a circuit breaker trips?
The circuit breaker 'opens,' preventing further requests from reaching the unhealthy target.
Why this answer
The circuit breaker stops sending traffic to the unhealthy host, protecting the system from overload.
Which commands verify Istio configurations? (Choose TWO)
Config verification.
Why this answer
istioctl analyze and istioctl proxy-config are used for verification.
Which protocols can be defined in a Gateway server? (Choose THREE)
Valid protocol.
Which component is responsible for the actual enforcement of circuit breaking and fault injection?
Envoy is the data plane proxy that enforces the rules defined in the CRDs.
Why this answer
The Envoy proxy (sidecar) performs the enforcement based on the configuration pushed by Istiod.
You have multiple VirtualServices for the same host. How does Istio determine which one to use?
Istio merges routes for the same host.
Why this answer
Istio merges them based on the configuration logic, but you should avoid duplicate rules to prevent unpredictable behavior.
You need to add a custom CA certificate to the Istio control plane during installation. How do you pass this using IstioOperator?
This provides the required path for custom CA certificates.
Why this answer
You use the 'spec.values.global.certificates' or specific secret mounts to provide custom certificates to Istiod.
You have a Gateway but traffic is blocked. Which resource most likely governs the connection permission?
AuthorizationPolicy defines who can access what.
Why this answer
AuthorizationPolicy handles the access control between services and gateways.
Where do you define the connection pool settings for a service?
DestinationRules define how traffic is handled once it reaches a destination, including connection pooling.
Why this answer
Connection pool settings are part of the trafficPolicy within a DestinationRule.
Which tool allows you to perform traffic shifting between two versions of a service?
VirtualService is the primary tool for traffic shifting and weighting.
Why this answer
A VirtualService is used to define traffic weights for different subsets (versions) defined in a DestinationRule.
Which TWO mechanisms are used to secure traffic within the mesh?
Enables mTLS.
Why this answer
PeerAuthentication (for mTLS mode) and AuthorizationPolicy (for access control) are key.
In OutlierDetection, what is the effect of setting 'maxEjectionPercent' to 0?
If no hosts can be ejected, the feature cannot function.
Why this answer
Setting this to 0 effectively disables outlier detection, as no hosts can be ejected.
You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?
The 'when' clause allows checking specific claims against values.
Why this answer
AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.
Which THREE features does the Kubernetes Gateway API offer that are significantly different from legacy Ingress?
Native support for TCP, UDP, and gRPC.
Why this answer
Gateway API is designed for better multi-tenancy, clearer roles, and advanced routing capabilities.
What are common reasons to use a ServiceEntry? (Choose THREE)
Standard use case.
Which tool provides a GUI for visualizing your traffic management rules?
Visual dashboard.
Why this answer
Kiali is the standard visualization tool for Istio.
In a multi-tenancy setup, which Istio resource should you use to restrict which namespaces a sidecar can see?
The Sidecar resource allows fine-grained control over the services and namespaces visible to a proxy.
Why this answer
Sidecar resources can be used to limit the scope of service discovery, effectively hiding services in other namespaces.
When configuring circuit breaking, what does 'maxRequestsPerConnection' control?
This limits how many requests a single keep-alive connection processes before being closed.
Why this answer
It limits the number of requests that can be sent over a single keep-alive connection, useful to prevent connection starvation.
What does the 'mirror' feature in a VirtualService do?
Mirroring duplicates traffic for observation.
Why this answer
Mirroring sends a copy of traffic to a different service without affecting the primary response.
Which field in the VirtualService allows you to redirect traffic to a different URI?
Redirect sends a specific response code to the client.
Why this answer
The redirect field within the HTTPRoute allows URI or authority changes.
You want to implement a 'Deny-All' strategy for your mesh and explicitly whitelist only necessary traffic. What is the correct order to achieve this?
An empty DENY policy denies everything, then specific ALLOW policies override or permit necessary paths.
Why this answer
Apply a global AuthorizationPolicy with action 'DENY' and selector 'matchLabels: {}', then apply granular 'ALLOW' policies for specific services.
Which TWO fields are mandatory in a Gateway resource?
Selector binds the resource to a specific ingress controller.
Why this answer
A Gateway requires a selector to bind to ingress gateways and servers for port configuration.
If a VirtualService has a route to a service that has no pods matching the label, what happens?
503 is the standard error when destinations are missing.
Why this answer
If no pods exist, the proxy will return a 503 error because it has no destination endpoints.
What is the primary purpose of the 'RequestAuthentication' resource?
It tells the proxy how to check token validity.
Why this answer
RequestAuthentication is used to define which JWT issuers are trusted and how to validate tokens.
Which TWO pieces of information are displayed in the Kiali 'Graph' view?
Visualizes the health of the nodes in the graph.
Why this answer
The Graph view shows the topology of the mesh and the traffic flow.
When designing for high availability in a multi-cluster Istio mesh, which THREE strategies are recommended?
Ensures traffic failover within the region/zone.
Why this answer
Redundancy across clusters and proper routing are essential for HA.
Which TWO of the following are valid sources for an AuthorizationPolicy?
Principals refer to the identity of the caller.
Why this answer
AuthorizationPolicies can match based on 'principals' (identity) and 'namespaces'.
Can you configure fault injection for specific traffic patterns, such as user headers?
The 'match' field allows you to apply faults only to specific traffic (e.g., specific header values).
Why this answer
Yes, fault injection can be scoped to specific route matches in a VirtualService.
What is the benefit of defining a 'sidecar' resource in Istio?
Sidecar limits the scope of service discovery.
Why this answer
It restricts the configuration pushed to Envoy to only what the service needs, reducing memory usage.
When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?
The application can inspect claims.
Why this answer
When set to true, the proxy forwards the original JWT to the application, allowing the application to use the token for backend calls.
Which TWO options are required to properly implement an abort fault injection in a VirtualService?
Required to define the error to return.
Why this answer
To implement an abort, you must specify the 'percentage' and the 'httpStatus' code within the 'fault' block.
Which command is used to view the effective configuration of a specific Envoy proxy?
This command displays the Envoy proxy configuration.
Why this answer
istioctl proxy-config is the standard tool for inspecting sidecar config.
When migrating to the Kubernetes Gateway API in Istio, you define a Gateway resource. Which component is responsible for translating this Gateway resource into Envoy configuration?
Istiod acts as the controller for Gateway API resources, translating them into xDS configuration for Envoy.
Why this answer
The istiod control plane watches the Kubernetes Gateway API resources and generates the corresponding Envoy proxy configuration.
Which TWO of the following are valid fault injection types in Istio?
Injects a time delay into the request.
Why this answer
Istio natively supports abort (returning an error) and delay (simulating latency).
Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?
RequestAuthentication is the primary resource for JWT validation in Istio.
Why this answer
RequestAuthentication is specifically designed to configure how Istio validates JWT tokens.
Which THREE settings are part of the 'connectionPool' configuration in a DestinationRule?
Contains connection settings for HTTP.
To test the resilience of your microservice architecture, you want to introduce a 5-second delay to 50% of the requests directed to the 'catalog-service'. Where do you define this configuration?
Fault injection is specifically supported within VirtualService routing rules.
Why this answer
Fault injection policies are defined within the 'http' routing rules of a VirtualService.
Which TWO of the following are valid modes for PeerAuthentication?
Forces mTLS for all connections.
Why this answer
The two primary modes for PeerAuthentication are PERMISSIVE and STRICT.
You need to configure the IstioOperator CR to disable mTLS globally for a legacy migration. Which field correctly sets the global peer authentication policy?
This is the correct path for the Helm-based configuration in IstioOperator.
Why this answer
The 'spec.meshConfig.defaultConfig.peerAuthenticationPolicy' is not the correct path; the global mTLS setting is handled via 'spec.values.global.mtls.enabled'.
Page 4 of 4
Practice ICA by domain
Target a specific domain to shore up weak areas.