Istio Certified Associate (ICA) Practice Exam

What the Istio Certified Associate (ICA) exam covers

• Istio Architecture173 questions
• Traffic Management178 questions
• Security151 questions
• Observability145 questions

Free Istio Certified Associate (ICA) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 647.

1. Question 1Istio Architecture

   What is a service mesh like Istio primarily used for?

   • AManaging service-to-service traffic, security (mTLS), and observability via sidecar proxiesCorrect
   • BProvisioning cluster nodes and scheduling pods onto worker machines
   • CAssigning pod IP addresses and enforcing L3 network policies at the CNI layer
   • DStoring container images and serving them to the cluster's runtime
   ✓ Correct answer: A

   Service mesh manages service-to-service communication, security, and observability using sidecar proxies. Service mesh capabilities provide critical functionality for production Kubernetes deployments. These features enable organizations to manage complexity in microservice architectures.

   Why the other options are wrong

   • BNode provisioning and pod scheduling are Kubernetes control-plane duties, not service-mesh functions.
   • CIP allocation and L3 policy belong to the CNI plugin, not to Istio's L7 mesh.
   • DImage storage is a container registry's job, unrelated to a service mesh.
2. Question 2Traffic Management

   In a VirtualService, which field key splits HTTP traffic by percentage across subsets?

   • Ahttp.route[].destination with a 'weight' value on each route entryCorrect
   • Bhttp.route[].destination with a 'canaryPercent' value per subset
   • Chttp.split[].subset with a 'ratio' field per destination
   • Dhttp.match[].percentage applied to each header rule
   ✓ Correct answer: A

   VirtualService defines traffic routing rules, retries, and timeouts for service traffic. VirtualService defines intelligent routing policies including weighted traffic splitting, retries, and timeouts. This enables advanced deployment patterns like canary releases without application modification.

   Why the other options are wrong

   • BThere is no canaryPercent field; VirtualService splits use the weight field.
   • CThere is no http.split.ratio construct in the VirtualService schema.
   • Dmatch.percentage is used for fault injection, not for weighting route subsets.
3. Question 3Security

   During an incident you must immediately block all traffic to a compromised namespace's services while leaving the rest of the mesh untouched. Which is the cleanest mesh-native action?

   • ADelete istiod so no policies are pushed
   • BRemove the root CA from istiod
   • CApply a deny-all AuthorizationPolicy scoped to the affected namespaceCorrect
   • DSet the whole mesh PeerAuthentication to DISABLE
   ✓ Correct answer: C

   . VirtualService defines intelligent routing policies including weighted traffic splitting, retries, and timeouts. This enables advanced deployment patterns like canary releases without application modification.

   Why the other options are wrong

   • ADelete istiod so no policies are pushed is incorrect because this does not provide the specific technical capability required by the question.
   • BRemove the root CA from istiod is incorrect because this does not provide the specific technical capability required by the question.
   • DSet the whole mesh PeerAuthentication to DISABLE is incorrect because this does not provide the specific technical capability required by the question.
4. Question 4Observability

   Your dashboards aggregate istio_requests_total by destination_service, but a canary's v1 and v2 are merged. Which label distinguishes the versions for per-subset monitoring?

   • Asource_workload (identifies the client workload initiating the request)
   • Bdestination_version (derived from the version label / DestinationRule subset)Correct
   • Cconnection_security_policy (reports the mTLS status of the connection)
   • Dresponse_flags (encodes Envoy's per-response error and routing conditions)
   ✓ Correct answer: B

   . Service mesh capabilities provide critical functionality for production Kubernetes deployments. These features enable organizations to manage complexity in microservice architectures.

   Why the other options are wrong

   • Asource_workload identifies the calling workload, not which version subset served the request.
   • Cconnection_security_policy reports mTLS status, not the destination version.
   • Dresponse_flags encodes Envoy response conditions, not the served subset version.
5. Question 5ObservabilitySelect all that apply

   During an incident you must quickly determine both the per-service error rate and exactly which request hop is slow across a multi-service call chain. Which TWO observability signals/tools should you combine? (Choose TWO)

   • Aistio_requests_total in Prometheus/Grafana to compute error rate by response_codeCorrect
   • BDistributed traces (e.g., Jaeger) to see per-hop span latency in the chainCorrect
   • CKubernetes events for the istiod pod
   • DEtcd WAL fsync metrics
   ✓ Correct answer: A, B

   Distributed traces (e.g., Jaeger) to see per-hop span latency in the chain Both istio_requests_total in Prometheus/Grafana to compute error rate by response_code and Distributed traces (e.g., Jaeger) to see per-hop span latency in the chain are essential components within the Observability domain. These features work together to provide comprehensive functionality required for effective platform implementation. Understanding how these capabilities integrate is critical for certification-level knowledge.

   Why the other options are wrong

   • CKubernetes events for the istiod pod is incorrect because this does not provide the specific technical capability required by the question.
   • Detcd WAL fsync metrics is incorrect because etcd is the Kubernetes data store, not a traffic proxy.
6. Question 6Istio Architecture

   You need to apply a specific Envoy configuration that Istio does not expose through any first-class CRD - for example, adding a custom Lua filter to the HTTP filter chain. Which Istio resource allows this?

   • AVirtualService with a corsPolicy block
   • BEnvoyFilterCorrect
   • CDestinationRule with a trafficPolicy.tls customCertificates field
   • DServiceEntry
   ✓ Correct answer: B

   The EnvoyFilter resource provides a patch mechanism to add, remove, or modify any part of the Envoy configuration that istiod generates, including inserting custom filters (Lua, WASM, ext_proc, etc.) into HTTP or network filter chains. It is an escape hatch for advanced use cases that the high-level Istio APIs do not cover. Changes made via EnvoyFilter are fragile across upgrades because they patch generated config directly.

   Why the other options are wrong

   • AVirtualService's corsPolicy handles Cross-Origin Resource Sharing headers at the HTTP routing level; it does not allow inserting arbitrary Envoy filters into the filter chain.
   • CDestinationRule's trafficPolicy.tls section configures TLS origination settings for outbound connections; it has no mechanism for inserting custom Envoy filters.
   • DServiceEntry registers external or internal services in the Istio service registry so that Envoy can route to them; it does not modify the Envoy filter chain.
7. Question 7Observability

   Which istioctl subcommand allows you to inspect the current value of a specific Envoy runtime configuration flag on a running sidecar pod?

   • Aistioctl proxy-config bootstrap <pod>Correct
   • Bistioctl proxy-config route <pod>
   • Cistioctl proxy-status <pod>
   • Distioctl analyze <pod>
   ✓ Correct answer: A

   The 'istioctl proxy-config bootstrap' command retrieves and displays the Envoy bootstrap configuration for a given pod. This JSON document contains the initial static resources, admin configuration, and runtime layer values that Envoy was started with - including feature flags and overrides injected by Istio at startup. It is the correct place to inspect low-level Envoy runtime settings.

   Why the other options are wrong

   • B'istioctl proxy-config route' shows the HTTP route configuration derived from VirtualServices and Service definitions; it does not show bootstrap or runtime flag values.
   • C'istioctl proxy-status' shows the sync state of CDS, LDS, RDS, and EDS resources for proxies, not bootstrap or runtime configuration details.
   • D'istioctl analyze' runs static analysis of Istio configuration resources in the cluster to detect misconfigurations; it does not inspect live Envoy runtime state.
8. Question 8Istio Architecture

   In Istio ambient mode, what role does a waypoint proxy play in the architecture?

   • AIt replaces the Kubernetes API server for in-mesh service discovery, resolving endpoints for every workload in the namespace or service account
   • BIt is a deployed Envoy proxy that provides L7 processing (routing, AuthorizationPolicy with HTTP rules) for a namespace or service accountCorrect
   • CIt runs as a privileged init container injected into every pod to apply HTTP routing and AuthorizationPolicy at L7
   • DIt is the node-level component that enforces L4 mTLS for the mesh and terminates transport-layer authentication per node
   ✓ Correct answer: B

   In ambient mode, ztunnel handles L4 (mTLS, basic telemetry) per node, while L7 capabilities such as HTTP routing, retries, and HTTP-level AuthorizationPolicy are provided by a separately deployed waypoint proxy associated with a namespace or service account. This lets teams opt into L7 only where needed.

   Why the other options are wrong

   • AThe waypoint proxy handles L7 policy, not service discovery, which continues to come from the Kubernetes API via istiod.
   • CThe waypoint is a standalone deployment, not a per-pod privileged init container.
   • DL4 mTLS enforcement at the node is ztunnel's role; the waypoint provides L7 processing.
9. Question 9Traffic Management

   A team adds `corsPolicy.allowOrigins: [{exact: "https://app.example.com"}]` to a VirtualService route. Which requests will receive CORS headers from the proxy?

   • ACross-origin browser requests whose Origin header exactly matches https://app.example.comCorrect
   • BAny request that includes an Origin header, regardless of its value
   • COnly same-origin requests coming from https://app.example.com directly
   • DOnly preflight OPTIONS requests, never the actual cross-origin request
   ✓ Correct answer: A

   Istio's corsPolicy evaluates the request Origin header against allowOrigins; a match (here an exact match on https://app.example.com) causes Envoy to inject the appropriate Access-Control-* headers and handle preflight. Non-matching or absent Origins do not get CORS responses.

   Why the other options are wrong

   • BCORS headers are returned only when the Origin exactly matches the allowlist, not for any Origin value.
   • CCORS policy applies to cross-origin requests; same-origin requests do not trigger the CORS handling.
   • DBoth preflight and actual cross-origin requests with a matching Origin receive CORS headers, not just OPTIONS.
10. Question 10Security

    Which field of a PeerAuthentication resource selects the specific workloads that the policy applies to within its namespace?

    • Aspec.mtls.mode
    • Bspec.selector.matchLabelsCorrect
    • Cspec.portLevelMtls
    • Dmetadata.namespace
    ✓ Correct answer: B

    A PeerAuthentication without a selector applies to the whole namespace (or whole mesh if in the root namespace). Adding spec.selector.matchLabels narrows enforcement to pods carrying those labels.

    Why the other options are wrong

    • Aspec.mtls.mode sets the mTLS mode (STRICT/PERMISSIVE/DISABLE), not which workloads are targeted.
    • Cspec.portLevelMtls overrides the mode on specific ports, not which workloads are selected.
    • Dmetadata.namespace places the resource in a namespace but does not select individual workloads.

Related Cloud Native resources

• Istio Certified Associate (ICA) study guideKey concepts
• Cloud Native practice examsAll Cloud Native
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• KCSA practice examRelated
• CKS practice examRelated
• CKA practice examRelated

Istio Certified Associate (ICA) practice exam FAQ