Linux Foundation / CNCF ICA: Istio Certified Associate

Last checked October 22, 2026 against the official Linux Foundation / CNCF exam page.

1. Question 1Istio architecture and installation

   In Istio, which component is responsible for the proxy that runs alongside each workload and handles traffic?

   1. AEnvoy sidecar proxy
   2. BHelm chart repository
   3. Cetcd
   4. DKubernetes scheduler
   Show answer and explanationHide answer

   Correct answer: A

   Istio injects Envoy proxies as sidecars next to workloads, and they handle routing, security, and telemetry for traffic. The scheduler places pods, etcd stores cluster state, and Helm is a packaging tool.

2. Question 2Traffic management

   A team wants to send 10 percent of traffic to a new version of a service and 90 percent to the current version. Which configuration does this in Istio?

   1. AA PeerAuthentication policy that sets percentage traffic splits by version
   2. BA VirtualService with weighted route destinations for each subset
   3. CA ServiceEntry registered for each version to split traffic between them
   4. DA Gateway with a per-listener weight field on server block
   Show answer and explanationHide answer

   Correct answer: B

   Weighted destinations in a VirtualService split traffic between subsets by percentage. Gateways define listeners, PeerAuthentication sets mTLS, and ServiceEntry adds external hosts.

3. Question 3Troubleshooting

   A service returns 503 errors through the mesh, and the team suspects the sidecar cannot find healthy endpoints. Which command shows whether the proxy has received the endpoints for a service?

   1. Adocker logs --since 1h istio-proxy
   2. Bhelm test istiod -n istio-system --logs
   3. Ckubectl cordon worker-node-03 -v=6
   4. Distioctl proxy-config endpoints
   Show answer and explanationHide answer

   Correct answer: D

   istioctl proxy-config endpoints shows the endpoints a sidecar knows about, which reveals missing or unhealthy backends. Cordoning nodes, Docker logs, and Helm tests do not show proxy endpoint state.

4. Question 4Security

   A namespace should require mTLS for all workloads inside it. Which resource sets this policy?

   1. APeerAuthentication with mTLS mode STRICT
   2. BSidecar egress hosts scoped to the namespace
   3. CServiceEntry that registers external hosts
   4. DGateway with SIMPLE TLS termination on port 443
   Show answer and explanationHide answer

   Correct answer: A

   PeerAuthentication sets the mTLS mode, and STRICT requires mutual TLS for inbound traffic. Gateways, ServiceEntries, and sidecar printer names do not enforce mTLS for the namespace.

5. Question 5Observability

   A team wants service-level metrics such as request rate, error rate, and latency for every service in the mesh. Which telemetry does Istio provide by default?

   1. AStandard metrics emitted by the Envoy proxies
   2. BMonthly vendor invoices for cloud billing
   3. COffice seating charts for the east wing
   4. DPrinter toner usage reports for copy room
   Show answer and explanationHide answer

   Correct answer: A

   Envoy sidecars emit standard metrics such as request counts and latency, which Prometheus can collect. Printer reports, invoices, and seating charts are unrelated.