Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What primary function does Istio provide for microservices deployed in Kubernetes?
Understand the core purpose of a service mesh in a Kubernetes environment.
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What primary function does Istio provide for microservices deployed in Kubernetes?
Service-to-service communication, security, and observability
Persistent volume management and backup
Node scheduling and resource allocation
Container image scanning and vulnerability assessment
Correct answer
Service-to-service communication, security, and observability
Istio is a service mesh that manages how microservices share and secure traffic. It provides routing, resilience, and telemetry without changing application code.
Which component of Istio is responsible for intercepting and routing all service traffic?
Envoy proxy sidecar
Pilot
Citadel
Galley
Correct answer
Envoy proxy sidecar
The Envoy proxy sidecar is deployed alongside each service instance to manage inbound and outbound network traffic. It is the data plane component that executes routing rules.
What is the main purpose of a VirtualService in Istio?
To define routing rules and traffic policies for service subsets
To store application configuration as key-value pairs
To manage certificate issuance for mTLS
To monitor service latency and error rates
Correct answer
To define routing rules and traffic policies for service subsets
A VirtualService describes how requests are routed to services within the mesh. It allows splitting traffic between versions and setting retry or timeout policies.
Which Istio feature helps prevent cascading failures by limiting request volume during outages?
Circuit breaking
Peer authentication
Policy enforcement
Service discovery
Correct answer
Circuit breaking
Circuit breaking stops sending requests to unhealthy or overloaded service instances. This protects the system from failures spreading across services.
Which Istio component translates configuration into runtime instructions for proxies?
Pilot
Citadel
Mixer
Ingress Gateway
Correct answer
Pilot
Pilot provides configuration management and discovery services for Envoy proxies. It pushes routing and policy configurations based on VirtualService and DestinationRule resources.
What is a common use case for canary deployments in Istio?
Gradually shifting traffic to a new version to validate behavior
Automatically scaling pods based on CPU usage
Encrypting data at rest in persistent volumes
Replacing failed nodes in the cluster
Correct answer
Gradually shifting traffic to a new version to validate behavior
Canary deployments allow you to route a small percentage of traffic to a new version. This helps validate changes with minimal risk to all users.
Which resource definition is used to specify a subset of service instances for routing?
DestinationRule
ServiceEntry
Gateway
AuthorizationPolicy
Correct answer
DestinationRule
A DestinationRule defines subsets of a service based on labels, which can be referenced in routing rules. It also configures load balancing and outlier detection.
What does an Ingress Gateway in Istio typically manage?
Incoming HTTP/TCP traffic from outside the mesh
Internal service-to-service encryption
Database connection pooling
Kubernetes node health checks
Correct answer
Internal service-to-service encryption
The Ingress Gateway is an entry point into the service mesh that handles external incoming traffic. It terminates external connections and applies configured routing rules.
Which feature of Istio helps observe and troubleshoot service interactions?
Telemetry and distributed tracing
Node autoscaling
Pod security policies
Container runtime optimization
Correct answer
Telemetry and distributed tracing
Istio collects metrics, logs, and traces to provide visibility into service behavior. Tools like Kiali and Jaeger are often used to visualize this data.
What is the role of a ServiceEntry in Istio?
To allow external services to be part of the mesh networking
To define resource quotas for namespaces
To replace Kubernetes Services
To enforce network policies at the cluster level
Correct answer
To allow external services to be part of the mesh networking
A ServiceEntry adds external endpoints to the Istio internal service registry. This enables routing to services outside the mesh using defined rules.
Which practice helps ensure only trusted workloads can communicate in Istio?
Defining strict peer authentication and authorization policies
Increasing replica counts for high availability
Using host networking for all pods
Disabling sidecar injection
Correct answer
Defining strict peer authentication and authorization policies
Peer authentication enforces mTLS between services, and authorization policies define who can access whom. This reduces the attack surface within the mesh.
What does a Gateway resource define in Istio?
Load balancing and port configuration for ingress traffic
Persistent storage classes for stateful applications
Pod affinity rules for scheduling
Container image pull secrets
Correct answer
Persistent storage classes for stateful applications
A Gateway describes the load balancer configuration for incoming traffic, including ports and protocols. It works with VirtualServices to route external requests.
Which Istio feature allows you to apply policies based on request attributes?
AuthorizationPolicy
ConfigMap
DaemonSet
HorizontalPodAutoscaler
Correct answer
AuthorizationPolicy
AuthorizationPolicy lets you specify who can access which services and under what conditions. It uses request attributes like source principals and HTTP verbs.
What is a typical outcome of effective traffic management in Istio?
Improved deployment safety with rollback capabilities
Reduced need for container orchestration
Elimination of the need for monitoring tools
Automatic container image building
Correct answer
Improved deployment safety with rollback capabilities
Traffic management enables controlled rollouts, A/B testing, and instant rollbacks. This increases deployment confidence and reduces downtime risks.
Which Istio feature enables fine-grained control over traffic routing based on HTTP headers?
Route rules with header matching
Node taints
Pod anti-affinity
Storage class binding
Correct answer
Route rules with header matching
Istio allows defining routing rules that inspect HTTP headers to direct traffic to specific service subsets.
Recall the answer before opening each card.
Istio provides service-to-service communication, security, and observability for microservices in a Kubernetes environment, acting as a service mesh without requiring code changes.
The Envoy proxy sidecar is deployed alongside each service instance and handles all inbound and outbound network traffic, executing routing rules.
A VirtualService defines routing rules and traffic policies for service subsets, enabling traffic splitting based on headers, URI, or weights.
Circuit breaking stops requests to unhealthy or overloaded service instances, protecting the system from failures spreading across services.
Pilot provides configuration management and discovery services for Envoy proxies, pushing routing and policy configurations.
Gradually shifting a small percentage of traffic to a new version to validate behavior with minimal risk before full rollout.
A DestinationRule defines subsets based on labels, which can be referenced in routing rules, and configures load balancing and outlier detection.
The Ingress Gateway is an entry point into the service mesh that handles external incoming traffic, terminating external connections and applying routing rules.
Istio collects telemetry and distributed tracing data (metrics, logs, traces) for every service interaction, visualized with tools like Kiali and Jaeger.
A ServiceEntry adds external endpoints to the Istio internal service registry, enabling routing to services outside the mesh using defined rules.
By defining strict peer authentication (mTLS) and authorization policies that restrict who can access which services.
A Gateway describes the load balancer configuration for incoming traffic, including ports and protocols, and works with VirtualServices to route external requests.
Using AuthorizationPolicy, you specify who can access which services under what conditions, using attributes like source principals and HTTP verbs.
Improved deployment safety with controlled rollouts, A/B testing, and instant rollbacks, reducing downtime risks.
By defining route rules with header matching in a VirtualService, directing traffic to specific service subsets based on header values.
The data plane consists of Envoy proxy sidecars that intercept and route all service traffic, executing the configuration provided by the control plane.
Pilot is the control plane component that translates high-level routing rules into Envoy configurations and distributes them.
Create a VirtualService that routes a weighted percentage of traffic to a new version, using a DestinationRule to define subsets for the versions.
Mutual TLS (mTLS) encrypts and authenticates communication between services, ensuring only trusted workloads can participate in the mesh.
Istio automatically generates metrics, logs, and traces for every proxy-enforced service interaction, which can be exported to monitoring systems like Prometheus and Jaeger.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
The practice bank emphasizes the distinction between Istio's data plane, composed of Envoy proxy sidecars that intercept and route all service traffic, and the control plane, which includes components like Pilot that translate configuration into runtime instructions for proxies. Understanding this separation is critical for troubleshooting and configuring Istio. Questions on sidecar interception, Pilot's role, and Ingress Gateway as an entry point highlight architectural fundamentals.
Core traffic management tasks are exercised through questions about VirtualServices, DestinationRules, and canary deployments. You need to decide how to define routing rules (e.g., header matching), split traffic between versions, and apply resilience patterns like circuit breaking. Effective traffic management improves deployment safety and enables rollback capabilities. The practice set tests your ability to select the correct resource for a given routing or resilience scenario.
Security questions focus on ensuring only trusted workloads communicate within the mesh. You must understand peer authentication (mTLS) and authorization policies that restrict service-to-service access based on request attributes. The practice set tests your ability to apply security controls without disrupting legitimate traffic. Misconfiguring authentication or authorization can expose the mesh to attacks or block valid traffic.
Observability is addressed through questions on telemetry and distributed tracing, which are essential for troubleshooting and monitoring service interactions. The practice set also covers ServiceEntry resources that allow external services to be integrated into the mesh routing. Understanding how to collect metrics, logs, and traces, and how to extend the mesh to external endpoints, is key for operational visibility and hybrid deployments.
Study workflow
Before implementing Istio, assess your microservices architecture to determine if a service mesh is needed. Look for requirements around traffic management, security (mTLS), observability, and resilience. Document the services, their communication patterns, and any existing ingress/egress points. This assessment ensures you deploy Istio only where it adds value.
Use istioctl or a Helm chart to install the control plane components (Pilot, Citadel, Galley, etc.). Enable automatic sidecar injection by labeling namespaces with istio-injection=enabled. Verify that Envoy proxies are running alongside each pod. This step is critical for the data plane to function.
Create a VirtualService that routes a small percentage of traffic (e.g., 10%) to a new version of a service. Use a DestinationRule to define subsets (e.g., version: v2). Monitor metrics and traces to validate behavior. Gradually increase the weight for the new version until 100%, and then remove the old version.
Configure a PeerAuthentication policy to set STRICT mTLS mode for the entire mesh or specific namespaces. Then define AuthorizationPolicy resources to allow only necessary service-to-service calls. Test by deploying a dummy service and verifying it cannot access protected services without proper credentials.
Enable Istio’s telemetry and tracing components (Prometheus, Grafana, Jaeger). Configure Kiali to visualize the service graph and traces. Verify that requests generate spans and metrics appear in dashboards. Use the data to identify slow services, error rates, and traffic flow anomalies.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Istio is a service mesh that manages service-to-service communication, security, and observability. It offloads these concerns from application code by using Envoy sidecar proxies. This allows developers to focus on business logic while operations gain control over traffic, resilience, and access policies.
A VirtualService defines routing rules, such as which version of a service receives traffic based on headers or weights. A DestinationRule specifies how to handle traffic for a service’s subsets, including load balancing policies and circuit breaker settings. They work together: VirtualService routes, DestinationRule applies policies to the destination.
Pilot is the control plane component responsible for service discovery and configuration management. It translates high-level routing rules (VirtualServices, DestinationRules) into Envoy-specific configurations and distributes them to proxies. Pilot also manages service entries and monitors changes to the service registry.
While Istio is designed primarily for Kubernetes, it can be extended to other platforms using VMs or bare metal via the Mesh Expansion feature. However, the ICA exam focuses on Kubernetes environments. For non-Kubernetes deployments, additional configuration and manual sidecar injection are required.
A common mistake is applying an overly permissive or overly restrictive authorization policy. For example, using an ALLOW policy without specifying principals may allow all traffic, while a DENY policy with incorrect conditions can block legitimate traffic. Always test policies in a staging environment and use DENY policies as a safety net.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
