CertArea
All Linux Foundation / CNCF exams

Free ICA practice test: 30 questions with answers

30 original questions for Istio Certified Associate, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions

ICA exam guide: topics, cost and format

All 30 ICA questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Istio architecture and installation (6 questions)

  1. Question 1

    In Istio, which component is responsible for the proxy that runs alongside each workload and handles traffic?

    1. AEnvoy sidecar proxy
    2. BHelm chart repository
    3. Cetcd
    4. DKubernetes scheduler
    Show answer and explanation
    Correct answer: A

    Istio injects Envoy proxies as sidecars next to workloads, and they handle routing, security, and telemetry for traffic. The scheduler places pods, etcd stores cluster state, and Helm is a packaging tool.

  2. Question 2

    Which component of the Istio control plane distributes configuration and certificates to the Envoy proxies?

    1. ACoreDNS only
    2. Bistiod
    3. Ckubelet
    4. Dkube-proxy
    Show answer and explanation
    Correct answer: B

    istiod is the consolidated control plane that pushes configuration to proxies and manages certificates. Kubelet and kube-proxy are Kubernetes node components, and CoreDNS resolves names.

  3. Question 3

    A namespace should have its pods automatically receive Envoy sidecars. Which label is used to enable automatic sidecar injection?

    1. Aistio-injection=enabled
    2. Btier=backend
    3. Capp=frontend only
    4. Denv=prod
    Show answer and explanation
    Correct answer: A

    Labelling a namespace with istio-injection=enabled enables automatic sidecar injection for new pods. The other labels do not trigger injection.

  4. Question 4

    A pod was created before the namespace label was applied and does not have a sidecar. What must be done for it to receive one?

    1. ADisable the control plane
    2. BRestart the pod or redeploy the workload so injection runs
    3. CEdit the proxy binary by hand
    4. DDelete the namespace
    Show answer and explanation
    Correct answer: B

    Injection happens when a pod is created, so existing pods must be restarted or redeployed to receive the sidecar. Deleting namespaces, editing binaries, and disabling the control plane are not required.

  5. Question 5

    Which tool is commonly used to install and configure Istio on a Kubernetes cluster?

    1. Aistioctl
    2. Bterraform destroy
    3. Cdocker build
    4. Dkubectl describe only
    Show answer and explanation
    Correct answer: A

    istioctl installs, configures, and analyzes Istio deployments. kubectl describe inspects objects, docker build creates images, and terraform destroy removes infrastructure.

  6. Question 6

    Which Istio resource defines the set of hosts and ports that a service mesh gateway exposes to external traffic?

    1. AServiceEntry only
    2. BGateway
    3. CVirtualService only
    4. DPeerAuthentication
    Show answer and explanation
    Correct answer: B

    A Gateway resource configures ports, protocols, and hosts for ingress or egress at the edge of the mesh. VirtualService routes traffic, PeerAuthentication sets mTLS policy, and ServiceEntry adds external services to the registry.

Traffic management (6 questions)

  1. Question 7

    A team wants to send 10 percent of traffic to a new version of a service and 90 percent to the current version. Which configuration does this in Istio?

    1. AA PeerAuthentication policy that sets percentage traffic splits by version
    2. BA VirtualService with weighted route destinations for each subset
    3. CA ServiceEntry registered for each version to split traffic between them
    4. DA Gateway with a per-listener weight field on server block
    Show answer and explanation
    Correct answer: B

    Weighted destinations in a VirtualService split traffic between subsets by percentage. Gateways define listeners, PeerAuthentication sets mTLS, and ServiceEntry adds external hosts.

  2. Question 8

    A DestinationRule defines subsets named v1 and v2 based on labels. What must the VirtualService reference to route traffic to v2?

    1. AThe namespace of the printer deployment in the mesh
    2. BThe subset name v2 in the route destination
    3. CThe pod IP address of the endpoint directly
    4. DThe node name of the host machine hosting
    Show answer and explanation
    Correct answer: B

    Routes reference subsets defined in the DestinationRule by name, which keeps routing independent of pod IPs. Node names and printer namespaces are unrelated.

  3. Question 9

    A service must retry failed requests up to three times with a per-try timeout. Which Istio configuration provides this?

    1. ARetry block in the Gateway server spec
    2. BA PeerAuthentication retry count value
    3. CRetry policy in the VirtualService route
    4. DA ServiceEntry connection timeout
    Show answer and explanation
    Correct answer: C

    Retry settings such as attempts and per-try timeout belong in the VirtualService route. The Gateway, PeerAuthentication, and ServiceEntry resources do not define retry behaviour.

  4. Question 10

    A client should receive an error quickly if a backend takes longer than two seconds, instead of waiting indefinitely. Which setting should be configured?

    1. AA higher replica count on the Deployment
    2. BA larger pod memory limit for the container
    3. CA request timeout in the VirtualService route
    4. DA longer TLS certificate lifetime value
    Show answer and explanation
    Correct answer: C

    A request timeout in the route makes the proxy return a timeout error after the limit. Memory limits, replica counts, and certificate lifetimes do not control request duration.

  5. Question 11

    A team wants to limit the number of concurrent connections to a backend and eject unhealthy instances from the load balancing pool. Which resource provides these controls?

    1. AServiceEntry with a printer queue for each external hostname in the mesh registry
    2. BNamespace label applied to each workload pod in the namespace for grouping
    3. CDestinationRule with connection pool and outlier detection settings
    4. DGateway with a banner displayed on the external listener for visitors
    Show answer and explanation
    Correct answer: C

    DestinationRule carries connection pool limits and outlier detection, which eject failing instances. The other resources do not define those traffic policies.

  6. Question 12

    A team wants to test how a service behaves when a backend returns errors, by injecting faults for a small share of requests. Which Istio feature supports this?

    1. ATurning off sidecars for the test
    2. BChanging the production database schema
    3. CDeleting the service
    4. DFault injection in a VirtualService
    Show answer and explanation
    Correct answer: D

    VirtualService fault injection can add delays or aborts to a percentage of requests for resilience testing. Schema changes, deleting services, and disabling sidecars do not test resilience in a controlled way.

Troubleshooting (6 questions)

  1. Question 13

    A service returns 503 errors through the mesh, and the team suspects the sidecar cannot find healthy endpoints. Which command shows whether the proxy has received the endpoints for a service?

    1. Adocker logs --since 1h istio-proxy
    2. Bhelm test istiod -n istio-system --logs
    3. Ckubectl cordon worker-node-03 -v=6
    4. Distioctl proxy-config endpoints
    Show answer and explanation
    Correct answer: D

    istioctl proxy-config endpoints shows the endpoints a sidecar knows about, which reveals missing or unhealthy backends. Cordoning nodes, Docker logs, and Helm tests do not show proxy endpoint state.

  2. Question 14

    A workload cannot reach an external API after a ServiceEntry was created. Which first check is most useful?

    1. ARestart the office printer on the third floor and reinstall its driver on site today
    2. BRemove the sidecar proxies from the calling workloads and recreate them unchanged in staging
    3. CConfirm the ServiceEntry host, port, and protocol match the external service
    4. DChange the namespace name and rename the Deployment labels on the pods
    Show answer and explanation
    Correct answer: C

    A mismatch in host, port, or protocol prevents the external route from working, so checking them is the first step. Printers, namespace names, and removing sidecars do not address the configuration.

  3. Question 15

    After a configuration change, some proxies do not reflect the new routes. Which command shows whether each proxy is synchronized with the control plane?

    1. Akubectl top node worker-1
    2. Bhelm list -n istio-system
    3. Cdocker stats --all
    4. Distioctl proxy-status
    Show answer and explanation
    Correct answer: D

    istioctl proxy-status reports whether each proxy is synced with istiod, which identifies stale configuration. The other commands report node usage, chart releases, and container statistics.

  4. Question 16

    A VirtualService is not applied to traffic from a particular namespace. Which check is most likely to reveal the cause?

    1. ARename the cluster so that its Kubernetes context name matches the Istio mesh ID, then restart istiod in the istio-system namespace
    2. BChange the color of the namespace label to a dark shade of blue so the dashboard highlights it, and then refresh the Kiali graph
    3. CConfirm the VirtualService's gateway or host binding matches the traffic and that the namespace has sidecar injection
    4. DTurn off the access logging on the ingress gateway and on the sidecars in the affected namespace, then review the resulting output in Kiali
    Show answer and explanation
    Correct answer: C

    Routes apply only when their host or gateway binding matches and the traffic flows through a sidecar. Colours, cluster names, and disabled logging are not relevant.

  5. Question 17

    A pod is missing its sidecar even though the namespace is labelled for injection. What is the most likely cause?

    1. AThe pod uses the default service account, which lacks RBAC rights to view
    2. BThe pod has a long name that exceeds the 63-character DNS label limit
    3. CThe pod has too much memory requested in its spec for the webhook to process
    4. DThe pod was created before the label, or injection was skipped by a pod annotation
    Show answer and explanation
    Correct answer: D

    Injection happens at pod creation, so pods created earlier need a restart, and an annotation can disable injection. Memory, service account names, and pod name length do not prevent injection.

  6. Question 18

    Requests between two services fail with a TLS handshake error after enabling strict mTLS. Which cause is most likely?

    1. AThe services are both using the same image tag, so the sidecars share one config
    2. BThe printer is offline on the third floor since the last firmware update today
    3. CA workload without a sidecar is trying to call a strict mTLS service
    4. DThe DNS server has a long TTL of 86400 seconds causing delays
    Show answer and explanation
    Correct answer: C

    Strict mTLS requires both sides to present mesh certificates, so a caller without a sidecar fails the handshake. Image tags, DNS TTLs, and printers are unrelated.

Security (6 questions)

  1. Question 19

    A namespace should require mTLS for all workloads inside it. Which resource sets this policy?

    1. APeerAuthentication with mTLS mode STRICT
    2. BSidecar egress hosts scoped to the namespace
    3. CServiceEntry that registers external hosts
    4. DGateway with SIMPLE TLS termination on port 443
    Show answer and explanation
    Correct answer: A

    PeerAuthentication sets the mTLS mode, and STRICT requires mutual TLS for inbound traffic. Gateways, ServiceEntries, and sidecar printer names do not enforce mTLS for the namespace.

  2. Question 20

    A service should accept only requests from a specific service account in another namespace. Which resource defines this?

    1. ANamespace label only
    2. BAuthorizationPolicy
    3. CDestinationRule
    4. DVirtualService weight
    Show answer and explanation
    Correct answer: B

    AuthorizationPolicy allows or denies requests based on identities such as service accounts, namespaces, and paths. DestinationRules set traffic policies, VirtualService weights split traffic, and labels alone do not authorize.

  3. Question 21

    A service must accept requests only when they carry a valid JSON Web Token issued by a trusted identity provider. Which pair of resources fits?

    1. ARequestAuthentication and AuthorizationPolicy
    2. BServiceEntry for external hosts and an ingress Gateway
    3. CDestinationRule with a connection pool and a Sidecar
    4. DPeerAuthentication with STRICT mTLS alone
    Show answer and explanation
    Correct answer: A

    RequestAuthentication validates JWTs from the issuer, and AuthorizationPolicy requires a valid principal for access. PeerAuthentication handles mTLS, while ServiceEntry, Gateway, DestinationRule, and Sidecar do not validate tokens.

  4. Question 22

    Which default authorization behaviour applies in Istio when no authorization policy exists for a workload?

    1. ATraffic is denied for everything
    2. BTraffic is queued until an admin approves it
    3. CTraffic is allowed
    4. DTraffic is encrypted and then dropped
    Show answer and explanation
    Correct answer: C

    Without any AuthorizationPolicy, Istio allows traffic by default, so policies are needed to restrict access. Denying everything is the behaviour only once a deny-all policy is applied, and queueing or dropping are not default behaviours.

  5. Question 23

    A team wants a deny-by-default posture for a namespace, and then to explicitly allow only specific traffic. Which approach fits?

    1. ATurning off sidecar injection in the namespace and using NetworkPolicy
    2. BRemoving the istio-injection label from the namespace object so new pods lack a sidecar
    3. CAllowing traffic by default and adding deny exceptions in a rollout phase after validation
    4. DAn empty-rule deny policy followed by allow policies for the required callers
    Show answer and explanation
    Correct answer: D

    An ALLOW policy set creates an allowlist, and a deny-all policy blocks by default before exceptions are added. Allowing everything, disabling sidecars, and removing labels do not achieve a default-deny posture.

  6. Question 24

    Which Istio concept provides strong cryptographic identity for each workload, based on its Kubernetes service account?

    1. AA hostname written in a pod annotation for ops
    2. BAn IP address assigned by the pod's CNI plugin
    3. CSPIFFE-style workload identity issued in certificates
    4. DA shared password stored in a ConfigMap volume
    Show answer and explanation
    Correct answer: C

    Istio uses SPIFFE-style identities in certificates that encode the workload's service account. Shared passwords, fixed IPs, and comments do not provide cryptographic workload identity.

Observability (6 questions)

  1. Question 25

    A team wants service-level metrics such as request rate, error rate, and latency for every service in the mesh. Which telemetry does Istio provide by default?

    1. AStandard metrics emitted by the Envoy proxies
    2. BMonthly vendor invoices for cloud billing
    3. COffice seating charts for the east wing
    4. DPrinter toner usage reports for copy room
    Show answer and explanation
    Correct answer: A

    Envoy sidecars emit standard metrics such as request counts and latency, which Prometheus can collect. Printer reports, invoices, and seating charts are unrelated.

  2. Question 26

    Which tool is commonly used with Istio to store and visualize its metrics over time?

    1. AMicrosoft Paint on Windows
    2. BPrometheus with Grafana
    3. CHelm lint for charts
    4. DGit blame on a Helm chart
    Show answer and explanation
    Correct answer: B

    Prometheus collects metrics and Grafana visualizes them, which is a common Istio observability setup. Paint, Helm linting, and Git blame do not store or display mesh metrics.

  3. Question 27

    Which Istio capability shows the path a request takes across multiple services so that slow hops can be found?

    1. ADNS caching
    2. BLoad balancing only
    3. CAccess control lists
    4. DDistributed tracing
    Show answer and explanation
    Correct answer: D

    Distributed tracing links spans across services to show the request path and timing. ACLs, DNS caching, and load balancing do not show request paths with timings.

  4. Question 28

    A team wants Envoy access logs for requests through a specific workload. Which Istio configuration enables this?

    1. AA ServiceEntry annotation for hosts
    2. BA Gateway banner for the ingress port
    3. CA printer log tray for copier rooms
    4. DTelemetry resource enabling access logging
    Show answer and explanation
    Correct answer: D

    The Telemetry resource configures access logging and other telemetry for workloads or namespaces. Printer trays, banners, and comments do not configure proxy access logs.

  5. Question 29

    Which tool provides a visual map of services and the traffic between them in an Istio mesh?

    1. ANotepad
    2. BHelm search
    3. CDocker Desktop only
    4. DKiali
    Show answer and explanation
    Correct answer: D

    Kiali visualizes the service graph, traffic flows, and configuration health in an Istio mesh. Notepad, Helm search, and Docker Desktop do not provide mesh topology views.

  6. Question 30

    Which statement about Istio telemetry is correct?

    1. ATelemetry is sold as a separate paid add-on product from a vendor
    2. BTelemetry can be scoped to a mesh, namespace, or workload
    3. CTelemetry requires rewriting each application's source code at scale
    4. DTelemetry settings are fixed in the Envoy binary
    Show answer and explanation
    Correct answer: B

    Istio telemetry configuration can be applied at different scopes, from the whole mesh to a single workload. It is not a separate paid product, it does not require rewriting applications, and it can be customized.