KCNA Service Mesh 4

Question 1

What is an 'ambient mesh' in the context of Istio's evolution?

Accepted Answer

A sidecar-less mesh architecture using shared node-level proxies (ztunnel)

Answer

Istio ambient mesh removes per-pod sidecars by using a per-node ztunnel proxy for L4 and optional waypoint proxies for L7 policies.

Question 2

Which service mesh feature prevents cascading failures by stopping requests to an unhealthy service after a threshold of failures?

Accepted Answer

Circuit breaker

Answer

A circuit breaker opens after a configured failure threshold, stopping further requests to the unhealthy service and allowing it time to recover.

Question 3

In Istio, which resource type enforces access control by allowing or denying requests based on source identity or HTTP attributes?

Accepted Answer

AuthorizationPolicy

Answer

AuthorizationPolicy defines allow/deny rules based on service account identities, namespaces, HTTP methods, and headers.

Question 4

What is the SPIFFE standard used for in a service mesh?

Accepted Answer

Providing a framework for cryptographic service identity via SVIDs

Answer

SPIFFE (Secure Production Identity Framework for Everyone) provides a standard for issuing cryptographic identities (SVIDs) to workloads.

Question 5

Which observability concept involves tracking a request across multiple services using correlated trace spans?

Accepted Answer

Distributed tracing

Answer

Distributed tracing propagates a trace ID across service calls, allowing you to see the full path and latency of a request through the system.

(KCNA) Kubernetes and Cloud Native Associate Practice Test