KCNA Service Mesh 4 — Questions and Answers
Question 1: What is an 'ambient mesh' in the context of Istio's evolution?
- A mesh that only secures external traffic
- A sidecar-less mesh architecture using shared node-level proxies (ztunnel) (Correct answer)
- A mesh deployed without a control plane
- A mesh limited to HTTP/1.1 traffic
Correct answer: A sidecar-less mesh architecture using shared node-level proxies (ztunnel)
Istio ambient mesh removes per-pod sidecars by using a per-node ztunnel proxy for L4 and optional waypoint proxies for L7 policies.
Question 2: Which service mesh feature prevents cascading failures by stopping requests to an unhealthy service after a threshold of failures?
- Retry policy
- Circuit breaker (Correct answer)
- Rate limiting
- Canary deployment
Correct answer: Circuit breaker
A circuit breaker opens after a configured failure threshold, stopping further requests to the unhealthy service and allowing it time to recover.
Question 3: In Istio, which resource type enforces access control by allowing or denying requests based on source identity or HTTP attributes?
- PeerAuthentication
- RequestAuthentication
- AuthorizationPolicy (Correct answer)
- NetworkPolicy
Correct answer: AuthorizationPolicy
AuthorizationPolicy defines allow/deny rules based on service account identities, namespaces, HTTP methods, and headers.
Question 4: What is the SPIFFE standard used for in a service mesh?
- Defining load balancing algorithms
- Providing a framework for cryptographic service identity via SVIDs (Correct answer)
- Configuring DNS resolution for services
- Standardizing Prometheus metrics format
Correct answer: Providing a framework for cryptographic service identity via SVIDs
SPIFFE (Secure Production Identity Framework for Everyone) provides a standard for issuing cryptographic identities (SVIDs) to workloads.
Question 5: Which observability concept involves tracking a request across multiple services using correlated trace spans?
- Log aggregation
- Distributed tracing (Correct answer)
- Metric scraping
- Event streaming
Correct answer: Distributed tracing
Distributed tracing propagates a trace ID across service calls, allowing you to see the full path and latency of a request through the system.
Question 6: In a service mesh canary deployment, what percentage of traffic is initially sent to the new version?
- 100%
- 50%
- A small percentage, typically 1-10% (Correct answer)
- 0%, traffic is only mirrored
Correct answer: A small percentage, typically 1-10%
Canary deployments route a small fraction of live traffic to the new version to validate it before a full rollout.
Question 7: What protocol does Istio's Envoy proxy use to communicate with the Istiod control plane for configuration updates?
- REST/HTTP
- gRPC via xDS APIs (Correct answer)
- GraphQL
- WebSocket
Correct answer: gRPC via xDS APIs
Envoy proxies use the xDS (discovery service) APIs over gRPC to receive dynamic configuration updates from Istiod.
KCNA Service Mesh 4
What is an 'ambient mesh' in the context of Istio's evolution?