ICA Exam Guide: Istio Certified Associate Domains (2026)

Overview

What ICA actually certifies

The Istio Certified Associate is the CNCF and Linux Foundation credential for engineers who run Istio. The Linux Foundation describes the exam as online, proctored, performance-based and multiple-choice, lasting 2 hours, priced at $250 for the exam alone, with no prerequisites, one free retake, a 12-month eligibility window and a certification valid for two years. Neither a question count nor a pass mark is published.

Four domains carry the weights: Traffic Management 35 %, Securing Workloads 25 %, Installation, Upgrade & Configuration 20 % and Troubleshooting 20 %. That distribution is more even than PCA's or OTCA's — there is no domain you can afford to skip, and the one people under-prepare is Troubleshooting, because it is the only one you cannot revise by reading feature documentation.

Gnoseed is not affiliated with CNCF or the Linux Foundation and neither sells nor proctors this exam; it offers free spaced-repetition practice on the material the blueprint names. Verify every figure above against the official exam page before you book — prices, formats and blueprints all move, and this one moved recently.

Breakdown

The exam at a glance

One exam, four domains, and a format that is not the pure multiple-choice paper its sibling associate exams are.

ICA

Istio Certified Associate

AssociatePerformance-based and multiple choice · online proctored · 2 h · $250Prereq: None

Traffic Management (35 %) is the largest domain and the broadest: ingress and egress, routing inside the mesh, traffic policies through DestinationRules, traffic shifting, connecting to workloads and services outside the mesh, the resilience features (circuit breaking, failover, outlier detection, timeouts, retries) and fault injection. Securing Workloads (25 %) is authorization, authentication with mTLS and JWT, and securing edge traffic with TLS. Installation, Upgrade & Configuration (20 %) covers istioctl and Helm installs, sidecar or ambient mode, customisation, and canary versus in-place upgrades. Troubleshooting (20 %) splits into configuration, control plane and data plane.

Choose this if…

You already run Istio and want the gaps in your mental model found
You are the person paged when a mesh route or an mTLS policy misbehaves
You want a mesh credential that is Istio-specific rather than conceptual

Study with Gnoseed

Service Mesh: Istio & Linkerd · 118 cards Kubernetes Fundamentals · 89 cards

Check which blueprint you are studying

Five domains became four in August 2025

This is the first thing to get right, because the wrong blueprint costs you weeks. The ICA curriculum used to have five domains — Traffic Management 40 %, Resilience and Fault Injection 20 %, Securing Workloads 20 %, Advanced Scenarios 13 %, Installation 7 % — and that split is still what most study guides, course descriptions and forum posts quote.

The Linux Foundation's own program-changes notice puts the current blueprint into effect on 12 August 2025: four domains, Installation raised from 7 % to 20 %, Resilience folded into Traffic Management, Advanced Scenarios replaced by an explicit Troubleshooting domain, and the exam environment upgraded to Istio v1.26. The notice is blunt about which version applies to you: the only date that matters is the date you sit the exam, not the date you bought it.

The practical consequence is that installation went from a rounding error to a fifth of the paper, and it now names installing Istio in sidecar or ambient mode explicitly. If your preparation predates ambient, it predates the blueprint.

Where the marks are

Traffic Management is 35 % because it swallowed resilience

Read the sub-competencies rather than the domain title. Traffic Management now contains seven of them, and two are what used to be a domain of their own: using resilience features — circuit breaking, failover, outlier detection, timeouts and retries — and using fault injection. So the retry-budget and outlier-detection material is not adjacent to the exam, it is a third of the largest domain.

The other five are the routing surface: ingress and egress configuration, routing within the mesh, traffic policies via DestinationRules, traffic shifting, and connecting in-mesh workloads to external workloads and services. That last one is the competency people skip — ServiceEntry, outboundTrafficPolicy and the difference between a host that is merely reachable and a host that is in the mesh registry.

Troubleshooting at 20 % is the domain that rewards practice over reading. Its three competencies — configuration, control plane, data plane — map onto a small set of tools you either have at your fingertips or you do not: istioctl analyze for static configuration mistakes, istioctl proxy-status for whether config even reached a proxy, istioctl proxy-config for what that proxy actually holds, and Envoy's access-log response flags for what happened to a single request.

What this deck covers and what it does not

One module is deliberately off-blueprint

The Service Mesh track was written as a vendor-neutral course, so the mapping is worth stating plainly. Three modules — Traffic Management, Resilience Patterns and Security & mTLS — cover two of the four domains: Traffic Management, which now includes resilience and fault injection, and Securing Workloads. The other two domains are why two further modules exist: Istio Install, Upgrade & Ambient and Troubleshooting the Mesh were added for exactly the material the vendor-neutral course left thin — Helm charts and profiles, revisions and canary upgrades, ztunnel and waypoints, and the istioctl diagnostic set.

Mesh Observability is not on the ICA blueprint at all. Unlike the older curriculum some sites still publish, the current one has no observability domain — telemetry appears only where it helps you debug. Study that module because a mesh you cannot see is a mesh you cannot run, not because the exam asks.

Two more honest gaps. The Mesh Concepts module is partly vendor-neutral comparison, including Linkerd, which ICA does not test — it is there to make the ideas transfer, and the Istio-specific cards in it (Envoy, istiod, ambient, xDS) are the exam-relevant ones. And installing Istio with istioctl or Helm is a competency you cannot flashcard: the cards cover what each chart and profile contains and what an upgrade actually changes, but the command reps have to happen against a cluster.

Be honest about the format

A hands-on exam is not one you can pass on recall

PCA and OTCA are pure multiple-choice papers, which makes flashcards an unusually good fit for them. ICA is described as performance-based and multiple-choice, so treat it as a practical exam with a written component rather than the reverse. Beyond that wording the Linux Foundation does not break the exam down further, and the specific ratios circulating on prep sites are inference — do not plan around them.

What spaced repetition genuinely buys you here is speed and precision under a two-hour clock: knowing without hesitation that a VirtualService takes its first matching rule, that appProtocol beats a port name, that STALE in proxy-status points at the path between the proxy and istiod, that a DestinationRule without a TLS block defaults to DISABLE and breaks mTLS with 503s. Those are facts you either recall in seconds or lose minutes rediscovering.

What it does not buy you is muscle memory. Build a cluster, install Istio both ways, break it on purpose and fix it — then use the cards to keep the knowledge from decaying between the lab session and the exam date. If you want the multiple-choice-shaped CNCF associate exams instead, PCA, OTCA and CGOA have no terminal at all, and the Kubernetes certification guide covers where ICA sits next to CKA and CKAD.

FAQ

Common questions

What are the ICA exam domains and their weights? +

Four domains: Traffic Management 35 %, Securing Workloads 25 %, Installation, Upgrade & Configuration 20 %, and Troubleshooting 20 %. If you see a five-domain list with Resilience and Advanced Scenarios, that is the pre-August-2025 blueprint.

Is the ICA exam hands-on? +

Partly. The Linux Foundation describes it as performance-based and multiple-choice, so unlike PCA and OTCA it is not a pure knowledge paper — you should expect to work in a live environment as well as answer questions. Prepare with a cluster, not only with cards.

Which Istio version does the ICA exam use? +

The program-changes notice that introduced the current blueprint states the exam environment was upgraded to Istio v1.26 and that installing in ambient mode is now part of the installation domain. Check the official page before booking in case it has moved again.

How much does ICA cost and how long is it valid? +

The exam alone is $250 and includes one free retake, with a 12-month eligibility window from purchase. The certification is valid for two years. Bundles with a Linux Foundation course or subscription are sold at higher price points.

Do I need to know ambient mode for ICA? +

Yes. Installing Istio in sidecar or ambient mode is named in the installation domain of the current blueprint, so ztunnel, waypoint proxies and what each of them can and cannot do are fair game. Older study material predates this.

Are there prerequisites, and should I take CKA first? +

There are no formal prerequisites, but ICA assumes working Kubernetes knowledge — every task happens in a cluster. CKA is not required and is a much broader exam; if Pods, Services and Deployments are already comfortable, you can go straight at ICA.

Does ICA cover Linkerd or service mesh theory in general? +

No. ICA is Istio-specific, and its blueprint names Istio resources and istioctl rather than mesh concepts in the abstract. Vendor-neutral mesh material is useful background, but nothing on the exam depends on Linkerd.

Learn the resources, then break a cluster

Plant your first seed today. Ten minutes a day on Istio resource semantics and the istioctl diagnostic set leaves your lab time free for the part cards cannot teach.

Start learning free

ICA: The Istio Certified Associate Exam, Domain by Domain