KCNA Service Mesh 5 — Questions and Answers
Question 1: Which CNCF project provides a specification for defining service mesh interfaces so applications can work with multiple mesh implementations?
- SMI (Service Mesh Interface) (Correct answer)
- SPIFFE
- OPA (Open Policy Agent)
- Flagger
Correct answer: SMI (Service Mesh Interface)
SMI provides a standard set of Kubernetes CRDs for traffic management, observability, and access control that work across different mesh implementations.
Question 2: What is 'traffic splitting' in a service mesh primarily used for?
- Distributing traffic between two or more service versions for A/B testing or progressive delivery (Correct answer)
- Encrypting traffic between nodes
- Splitting large payloads across multiple requests
- Separating ingress and egress traffic paths
Correct answer: Distributing traffic between two or more service versions for A/B testing or progressive delivery
Traffic splitting lets you route a defined percentage of requests to different service versions, enabling A/B tests and progressive rollouts.
Question 3: In service mesh observability, what are the 'golden signals' that SREs typically monitor?
- CPU, memory, disk, network
- Latency, traffic, errors, saturation (Correct answer)
- Requests, retries, timeouts, resets
- Pods, nodes, namespaces, clusters
Correct answer: Latency, traffic, errors, saturation
Google SRE's four golden signals — latency, traffic, errors, and saturation — are the core metrics a service mesh surfaces per service.
Question 4: Which Flagger feature automatically rolls back a canary deployment when error rate or latency thresholds are exceeded?
- Traffic mirroring
- Progressive delivery with automated analysis (Correct answer)
- Manual gate approval
- Header-based routing
Correct answer: Progressive delivery with automated analysis
Flagger performs automated canary analysis by comparing metrics against thresholds and rolling back if the canary fails.
Question 5: What is the key advantage of using a service mesh for retries compared to implementing retries in application code?
- Application code cannot implement retries
- The mesh handles retries transparently without modifying application code (Correct answer)
- Mesh retries are always faster than application retries
- Only the mesh can retry HTTP/2 requests
Correct answer: The mesh handles retries transparently without modifying application code
Service mesh retries are implemented in the proxy layer, so applications need no changes and retry logic is consistently applied across all services.
Question 6: In Istio, what does setting outlier detection on a DestinationRule accomplish?
- Encrypts traffic to anomalous endpoints
- Automatically ejects unhealthy endpoints from the load balancing pool (Correct answer)
- Logs unusual traffic patterns to a SIEM
- Blocks traffic from unknown source IPs
Correct answer: Automatically ejects unhealthy endpoints from the load balancing pool
Outlier detection monitors upstream hosts and removes those that exceed error thresholds from the load balancing rotation for a cooldown period.
Question 7: Which statement best describes the difference between a service mesh and a Kubernetes NetworkPolicy?
- NetworkPolicy operates at L7 (application layer); service mesh at L3 (network layer)
- Service mesh provides L7 traffic management and observability; NetworkPolicy provides L3/L4 IP/port-based network segmentation (Correct answer)
- They are functionally identical and interchangeable
- NetworkPolicy requires a sidecar proxy; service mesh does not
Correct answer: Service mesh provides L7 traffic management and observability; NetworkPolicy provides L3/L4 IP/port-based network segmentation
NetworkPolicy enforces IP and port rules at L3/L4, while a service mesh adds L7 capabilities like HTTP routing, retries, tracing, and mTLS identity.
KCNA Service Mesh 5
Which CNCF project provides a specification for defining service mesh interfaces so applications can work with multiple mesh implementations?