KCNA Service Mesh 2 — Questions and Answers
Question 1: Which component in Istio is responsible for enforcing traffic policies at the data plane?
- Pilot
- Citadel
- Envoy sidecar proxy (Correct answer)
- Galley
Correct answer: Envoy sidecar proxy
Envoy sidecar proxies are the data plane components that intercept and enforce traffic policies in Istio.
Question 2: What is the primary purpose of a VirtualService resource in Istio?
- Define service discovery endpoints
- Configure traffic routing rules for a service (Correct answer)
- Manage TLS certificates
- Set resource limits on pods
Correct answer: Configure traffic routing rules for a service
A VirtualService defines how requests are routed to a service, enabling traffic splitting, retries, and fault injection.
Question 3: Which service mesh feature allows you to test application resilience by injecting delays or errors into requests?
- Circuit breaking
- Fault injection (Correct answer)
- Traffic mirroring
- Load balancing
Correct answer: Fault injection
Fault injection lets you deliberately introduce delays or HTTP errors to test how your application handles failures.
Question 4: What does an Istio DestinationRule primarily configure?
- Ingress gateway hostnames
- Policies applied to traffic after routing, such as load balancing and TLS settings (Correct answer)
- Service-to-service authorization policies
- Sidecar injection namespaces
Correct answer: Policies applied to traffic after routing, such as load balancing and TLS settings
DestinationRule configures policies like connection pooling, load balancing algorithms, and TLS for traffic destined for a service.
Question 5: In a service mesh, what is 'traffic mirroring' (also called shadowing) used for?
- Duplicating traffic to a secondary service for testing without affecting production responses (Correct answer)
- Encrypting traffic between services
- Balancing load across multiple replicas
- Routing traffic based on HTTP headers
Correct answer: Duplicating traffic to a secondary service for testing without affecting production responses
Traffic mirroring sends a copy of live traffic to a mirror service so you can test new versions without impacting production users.
Question 6: Which Istio resource is used to expose services outside the mesh via an ingress gateway?
- ServiceEntry
- VirtualService with a Gateway reference (Correct answer)
- DestinationRule
- AuthorizationPolicy
Correct answer: VirtualService with a Gateway reference
A VirtualService bound to a Gateway resource configures the Istio ingress gateway to route external traffic to internal services.
Question 7: What is the role of Istio's ServiceEntry resource?
- Add external services to the mesh's service registry (Correct answer)
- Define retry policies for internal services
- Configure mutual TLS between pods
- Create load balancer rules
Correct answer: Add external services to the mesh's service registry
ServiceEntry adds external services (outside the cluster) to Istio's internal service registry so they can be managed with mesh policies.
KCNA Service Mesh 2
Which component in Istio is responsible for enforcing traffic policies at the data plane?