ICA — Istio Certified Associate
This Is What the ICA Exam Looks Like
In one line
ICA is a hands-on exam, and you pass by scoring at least 68% within 120 minutes.
Why read this first
The most common failure in certification study is not from not knowing the content but from walking in without knowing the shape of the exam. If you do not know what score the passing line is, how tight the time is, or which domains have the most questions, you cannot set your preparation priorities.
Official specifications
| Item | Value |
|---|---|
| Format | Hands-on |
| Time limit | 120 minutes |
| Passing line | 68% |
| Number of tasks | 15–20 tasks |
| Exam fee | $250 (includes one retake) |
| Validity | 2 years |
These values come from the candidate documentation at docs.linuxfoundation.org. The certification
introduction page does not state the passing score or the number of questions, so if you prepare by looking only at that page,
you walk into the exam room without knowing the passing line.
Domain weights
| Domain | Weight | | |---|---:|| | Installation, Upgrades, and Configuration | 20% | | | Traffic Management | 35% | | | Securing Workloads | 25% | | | Troubleshooting | 20% | |
Domains with larger weights have more questions. When you allocate your study time, use these ratios as your guide. This practice exam also distributes questions in the same ratios.
This is where answers split
When you grade a practice exam, the questions you miss cluster in one form. You miss them not because you do not know the content but because you missed which of two similar concepts was being asked about. When you read a question and one of the pairs below comes to mind, sort it first by the criterion in the third column.
| This | That | What separates them |
|---|---|---|
| VirtualService | DestinationRule | If it is about subsets and load-balancing policy, it is DestinationRule |
| Gateway | Ingress | If it defines the mesh entry, it is Gateway |
| PeerAuthentication | RequestAuthentication | If it is mTLS between workloads, it is Peer |
| AuthorizationPolicy | NetworkPolicy | If it has L7 conditions (path, method), it is Authorization |
| Sidecar | Ambient | If there is no proxy per Pod, it is ambient |
This does not mean you should memorize the table. If you mark which pair each question you got wrong fell into, the place to study again becomes much narrower than a domain name.
What you may look at while solving
During the exam you can open the documents below. You view them with Firefox inside the remote desktop.
istio.io/docsistio.io/blogkubernetes.io/docs
There are three rules. Searching inside the documentation sites is allowed, but you must not click external search results. You can also view the Korean translated pages, but the English is the latest, so it is recommended. And a Quick Reference link is given separately for each question, and that link is added to the allowlist.
Being able to look and being able to find are different. Rather than memorizing content, getting familiar with the structure of the documentation saves time.
What you actually go through at the exam site
Many people know all the content but get flustered by the procedure and lose time.
The exam is taken with online proctoring on PSI's Bridge platform. The procedure in which the proctor checks by video takes up to 30 minutes, and during this time the questions do not open and the time limit does not start either. Even so, you should keep your schedule clear for 30 minutes of check-in plus the exam time.
There are four things checked at check-in. Agreeing to the non-disclosure agreement, a government-issued ID that matches the registered name exactly, showing the room by panning the webcam, and closing unapproved software. Because of that last item, turning off background programs such as Slack or cloud sync in advance saves time.
There are a few conditions that are easy to get caught on when taking the exam in Korea. The ID must have a signature, so a passport is the safest. You may use only one monitor, and dual monitors are not supported. There must be nothing on the desk or under it, taking notes on paper is prohibited, and reading the questions aloud is not allowed either. On a company network or VPN, access to AWS S3 is blocked and can cause a failure in the pre-check.
You can change a reservation only up to 24 hours before the start. And if you book and do not show up, you lose not only the exam fee but also your eligibility for a retake. The result arrives by email within 24 hours after the exam ends.
The exam fee includes one retake, and you must complete both the exam and the retake within 12 months of the first purchase date. There is no official waiting period, so you can retake right after you receive the result. Rather than postponing because you are not perfectly prepared, it is often better to sit for it once and find out which domain is weak.
The certification is valid for 2 years. On top of this overlaps the CARE program introduced in 2026. If you pass CKA or CKAD, KCNA is renewed automatically, and if you pass CKS, KCSA and CKA are renewed automatically. However, you must earn the lower certifications first for this chain to work. If you earn CKA first and KCNA later, that CKA will not renew KCNA. If you are aiming for Golden Kubestronaut, this order determines the renewal burden for the next several years.
How to use this practice exam
The time limit is set the same as the real exam. The remaining time is shown at the top of the screen, and when time runs out it is submitted automatically and unanswered questions are treated as wrong. This is because the real exam also grades only what you have answered at that point.
It matters that you sit and finish in one go. If you look things up as you go, the score goes up, but that score does not predict the real exam. What you want to check is not whether you know it but whether you clear the passing line within the time limit.
After reading the explanations of the questions you missed, study again the domains those questions belong to.