100+ Free ICA Practice Questions

Pass your Istio Certified Associate (ICA) exam on the first try — instant access, no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately

100+ Questions

100% Free

1 / 10

Question 1

Score: 0/0

Which Istio resource defines the rules for how requests are routed to a service?

VirtualService

DestinationRule

ServiceEntry

Gateway

to track

2026 Statistics

Key Facts: ICA Exam

15-20

Tasks

Linux Foundation

120 min

Time Limit

Linux Foundation

68%

Passing Score

Linux Foundation

$250

Exam Fee

Linux Foundation

1 retake

Included

ICA product page

Istio 1.26

Tested Version

ICA FAQ

As of April 15, 2026, the Linux Foundation lists ICA as a 2-hour online proctored exam with 15 to 20 performance-based tasks, a 68% passing score, and a $250 exam-only fee. The current curriculum weights Traffic Management at 35%, Securing Workloads at 25%, Installation, Upgrade & Configuration at 20%, and Troubleshooting at 20%. One retake is included and the exam tests against Istio v1.26.

Sample ICA Practice Questions

Try these sample questions to test your ICA exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1Which Istio resource defines the rules for how requests are routed to a service?

A.VirtualService

B.DestinationRule

C.ServiceEntry

D.Gateway

Explanation: VirtualService specifies routing rules (match conditions, route targets, weighting, rewrites, retries, timeouts) applied to traffic addressed to a host in the mesh.

2What is a 'subset' in a DestinationRule used for?

A.Selecting a group of workload instances by labels (e.g., v1, v2) that a VirtualService can route to

B.Defining TLS material

C.Exposing the mesh externally

D.Configuring mTLS mode

Explanation: A DestinationRule declares named subsets with label selectors (e.g., version=v1). A VirtualService references those names to send specific traffic to one subset.

3Which field in a VirtualService performs a weighted split between two subsets?

A.http.route with multiple destinations each having a weight

B.http.match

C.http.redirect

D.http.rewrite

Explanation: Inside http, the 'route' field can list multiple destinations each with a weight. Weights sum to 100 and drive percentage-based traffic shifting.

4How does a Gateway resource differ from a Kubernetes Ingress?

A.Gateway configures an Istio ingress Envoy with fine-grained L4/L7 and TLS controls independent of backend routing

B.Gateway is an alternative to a Service; Ingress replaces DestinationRule

C.Gateway only works for egress

D.Gateway does not support TLS

Explanation: Istio Gateway binds listeners (ports, hosts, TLS) on an Envoy gateway proxy. VirtualServices attach routing to Gateways, decoupling ingress configuration from routing rules.

5Which resource is used to add a host NOT in the Kubernetes service registry to Istio's mesh view?

A.ServiceEntry

B.Sidecar

C.PeerAuthentication

D.RequestAuthentication

Explanation: ServiceEntry registers external or internal hosts with the mesh so sidecars can route to them consistently, with optional TLS and load balancing policy.

6Which VirtualService field configures a percentage of traffic to be mirrored to a secondary destination for testing?

A.mirror and mirrorPercentage

B.duplicate and percent

C.copy and rate

D.shadow and weight

Explanation: mirror sends a copy of traffic to another destination; mirrorPercentage controls the fraction mirrored. Responses are ignored, so it is safe for testing.

7Which VirtualService feature injects latency for chaos testing?

A.http.fault.delay with fixedDelay and percentage

B.http.delay

C.retries.timeout

D.rewrite.prefix

Explanation: Under http, fault.delay specifies fixedDelay and a percentage of requests to delay. Combined with fault.abort, it enables fault injection testing.

8Which VirtualService field returns an HTTP error code for a percentage of requests as a fault?

A.http.fault.abort with httpStatus and percentage

B.http.error

C.retries.abort

D.gateway.abort

Explanation: fault.abort forces an HTTP (or gRPC) error response for a configurable fraction of requests, which is the canonical abort-style fault injection.

9Which field configures request retries in a VirtualService?

A.http.retries with attempts and perTryTimeout

B.http.retry

C.retries.count

D.http.redo

Explanation: http.retries takes attempts, perTryTimeout, and retryOn policies. It governs client-side retry behavior in the Envoy proxy.

10Which VirtualService feature sets a timeout for an HTTP route?

A.http.timeout

B.route.timeout

C.retries.perTryTimeout

D.fault.timeout

Explanation: http.timeout is the overall request timeout for the route; perTryTimeout in retries applies to each attempt.

About the ICA Exam

The Istio Certified Associate (ICA) validates practical skills in the Istio service mesh including installation, traffic management, workload security, and troubleshooting. It is a remotely proctored, primarily performance-based exam where candidates solve real tasks against a live Istio environment.

Assessment

15-20 performance-based tasks (hands-on command line)

Time Limit

120 minutes

Passing Score

68%

Exam Fee

$250 (Cloud Native Computing Foundation (CNCF) / Linux Foundation (originally developed by Tetrate))

ICA Exam Content Outline

35%

Traffic Management

VirtualServices, DestinationRules, Gateways, ServiceEntries, Sidecars, traffic shifting, mirroring, fault injection, retries, timeouts, and circuit breaking.

25%

Securing Workloads

mTLS with PeerAuthentication, RequestAuthentication, AuthorizationPolicy, JWT validation, and SPIFFE identity.

20%

Installation, Upgrade & Configuration

istioctl profiles, Helm installation, Istio Operator, sidecar injection, ambient mode concepts, and upgrades.

20%

Troubleshooting

Using istioctl proxy-config, proxy-status, analyze, Envoy access logs, Grafana, Kiali, and common mesh failure modes.

How to Pass the ICA Exam

What You Need to Know

Passing score: 68%
Assessment: 15-20 performance-based tasks (hands-on command line)
Time limit: 120 minutes
Exam fee: $250

Keys to Passing

Complete 500+ practice questions
Score 80%+ consistently before scheduling
Focus on highest-weighted sections
Use our AI tutor for tough concepts

ICA Study Tips from Top Performers

1Prioritize hands-on practice; multiple-choice drills like this bank are a supplement, not a replacement.

2Master traffic shifting with VirtualService weighted subsets backed by DestinationRule.

3Know PeerAuthentication modes: PERMISSIVE, STRICT, DISABLE.

4Be fluent with AuthorizationPolicy actions: ALLOW, DENY, CUSTOM, AUDIT.

5Practice fault injection (delay and abort) on a VirtualService.

6Memorize key istioctl commands: install, analyze, proxy-config, proxy-status, dashboard.

7Understand the difference between sidecar mode and ambient mode (ztunnel, waypoint).

Frequently Asked Questions

Is the ICA exam multiple choice or hands-on?

ICA is primarily performance-based. Candidates solve 15 to 20 tasks against a live Istio environment through a command-line terminal during a 2-hour session. Our practice bank uses multiple-choice questions to drill concepts, but you should combine this with hands-on kubectl and istioctl practice.

What score do you need to pass ICA?

ICA requires a score of 68% or higher to pass. That is lower than most multiple-choice Linux Foundation exams because performance-based items are scored by task completion and partial credit is limited.

What are the official ICA domain weights?

The current ICA curriculum weights Traffic Management at 35%, Securing Workloads at 25%, Installation, Upgrade and Configuration at 20%, and Troubleshooting at 20%. Traffic management is the single heaviest domain, so VirtualServices, DestinationRules, and Gateways should feel automatic.

Which Istio version does the exam cover?

ICA currently tests against Istio v1.26. Ambient mesh (ambient mode) concepts are now in scope at an awareness level, but sidecar-based mesh remains the primary testing surface. Always check the official ICA FAQ page for the latest tested version before exam day.

How much does the ICA exam cost?

The Linux Foundation lists ICA at $250 for the exam only. Bundles with the LFS245 Istio Fundamentals course are sometimes offered at $299, and a THRIVE-ONE subscription bundle is $495. One retake is included.

How long should I study for ICA?

Most candidates with prior Kubernetes experience prepare in 4 to 8 weeks with 40 to 60 focused study hours, the majority spent hands-on. Time on the command line completing tasks under a timer is the single best predictor of passing.