ICA (Istio Certified Associate): exam format, domains and the Golden path

What is the ICA exam?

ICA is the Istio Certified Associate exam from the Linux Foundation and CNCF. It is a proctored, online exam in which you work with Istio in a live environment from a command line, and the result is graded on the state of the mesh. It covers installing, upgrading and configuring Istio, managing traffic with virtual services, destination rules and gateways, securing workloads with mutual TLS and authorization policies, and troubleshooting a mesh that is not behaving as expected. The Linux Foundation page describes the delivery as performance-based and multiple-choice, so expect a mix of practical tasks and questions. Officially it is the Istio Certified Associate certification, a performance-based exam in the Golden tier of the 16-certification Golden Kubestronaut program. The sections below cover its official domains, the verified format and cost, and its place in the path.

Preparation means building and breaking a mesh: installing Istio with a profile, injecting sidecars, routing traffic by weight and header, shifting traffic between versions, applying PeerAuthentication and AuthorizationPolicy, and using istioctl to find misconfiguration.

ICA exam domains and weights

ICA has four domains. Traffic Management is the largest at 35%. Securing Workloads follows at 25%, then Installation, Upgrade & Configuration and Troubleshooting at 20% each. Traffic management is the heart of Istio: virtual services, destination rules, gateways, retries, timeouts, fault injection and traffic shifting. Securing workloads covers mutual TLS and authorization, while installation covers profiles and upgrades and troubleshooting is about reading proxy and control plane state. Weights come from the official certification page, checked on 23 October 2026. The official list has 4 domains: the largest is Traffic Management at 35% and the smallest is Troubleshooting at 20%, so a sensible plan splits study time roughly in proportion to these weights.

Because the resources compose, a good practice habit is to build one scenario end to end: install, route traffic, secure it, then break it and diagnose it with istioctl. That covers all four domains in a single exercise.

ICA exam format and cost

The ICA exam facts below were read from the official Linux Foundation pages on 2026-10-23, and every row of the table links to the page it came from. Format: Online, proctored, performance-based and multiple-choice. Questions: 15-20 performance-based tasks. Duration: 120 minutes. Passing score: 68%. Price: 250 US dollars. Certification validity: 2 years. Prerequisites: None. Retake policy: One retake per exam purchase if a passing score is not achieved. Curriculum version: Exam environment runs Istio v1.29. Prices and policies change, so confirm them on the official ICA page before you book. If the Linux Foundation changes a value, this page is updated and shows the date it was last verified.

A performance-based exam is graded on whether the cluster or system ends up in the requested state, not on how you got there. With 120 minutes for the whole task set, speed with the command line and the official documentation matters as much as knowledge: do the quick tasks first and come back to the slow ones.

Treat the table as the single source for numbers on this page. If a row says the Linux Foundation does not publish a value, we print that instead of guessing, and the official ICA page remains the final word on registration and policy.

How GoldenKube practice works for ICA

ICA is a performance-based exam, graded on real tasks in a terminal environment, and GoldenKube does not offer practice for it yet; terminal labs are planned. This page therefore covers the exam itself, with its official domains, weights and facts, and shows where ICA sits in the Golden Kubestronaut program, but it does not link to a practice session. For the other certifications in the program that do have a bank, GoldenKube works as a practice loop: one question at a time, instant feedback with an explanation, adaptive ordering toward weak domains, spaced repetition for missed questions, and a mock exam mode. The first 10 answers need no sign-up, and after that a free account saves progress with no credit card. Until ICA is covered, prepare from the official curriculum and the project documentation.

• Read the official ICA curriculum and exam page for the authoritative domain list.
• Use the weights above to decide how much time each domain deserves.
• Practice on a real cluster or system in a terminal, since the exam is performance-based.

Where ICA sits in the Golden Kubestronaut path

ICA is a Golden-tier certification, not one of the 5 core Kubestronaut certifications, and Golden Kubestronaut requires all 16 certifications in the program, so ICA is a required step. Its own prerequisites, per the Linux Foundation: None. The program page lists all 16 certifications side by side and marks which ones GoldenKube can practice today. The content assumes you are comfortable with Kubernetes services, Deployments and networking, so it makes sense to take it after CKA or at least KCNA. In the program it sits with CCA, which also covers service mesh features through Cilium, and with CNPE, whose platform tasks include traffic and security controls. Comparing the two meshes is a useful way to learn what is general and what is Istio-specific.

GoldenKube does not offer practice for ICA yet. The program page lists all sixteen certifications and shows which of them can be practiced today.

Frequently asked questions