Securing Workloads

Which TWO of the following are valid modes for PeerAuthentication?

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?

Which THREE items are included in an Istio SPIFFE ID?

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?

What is the primary function of the 'root-cert.pem' file in the Istio control plane?

What does the 'jwksUri' field in a RequestAuthentication resource define?

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

How do you ensure that a workload ignores a global PeerAuthentication policy?

Which protocol is used for the Istio data plane mTLS communication?

What is the primary purpose of the 'RequestAuthentication' resource?

Which of the following describes the role of the 'trust-domain' in Istio?

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Which THREE components are involved in the Istio certificate management process?

Which tool would you use to verify if a pod has an active mTLS connection?

Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?

What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

What does an AuthorizationPolicy's 'operation' field represent?

You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?

Which THREE elements are part of a 'RequestAuthentication' resource?

What is the correct syntax for a principal in an AuthorizationPolicy?

If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Which of the following is true about the 'principals' vs 'source.principals' fields?

How can you debug a failing AuthorizationPolicy rule?

Which THREE things are required for mTLS to be successful?

Which resource is used to define the root certificate for a custom CA?

Which command is used to display the currently active PeerAuthentication policies in the mesh?

What is the result of applying an AuthorizationPolicy that has no 'action' field?

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

Which THREE conditions must be met for a PeerAuthentication policy to enforce STRICT mTLS?

How can you restrict traffic to a service based on the presence of a specific request header?

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

A service 'orders' requires a specific AuthorizationPolicy that allows GET requests only from the 'frontend' service while denying all other methods. Which configuration is correct?

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?

Which of the following is NOT a valid action in an Istio AuthorizationPolicy?

Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?

You want to implement a 'Deny-All' strategy for your mesh and explicitly whitelist only necessary traffic. What is the correct order to achieve this?

When multiple AuthorizationPolicies target the same workload, how are they combined?

Which TWO of the following are true regarding the RequestAuthentication resource?

Which TWO of the following are valid sources for an AuthorizationPolicy?

Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?

You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?

Which THREE items are required to successfully authenticate a user via JWT in Istio?

Which TWO of the following are true regarding PeerAuthentication policies?

Which THREE factors influence whether a service in the mesh will accept traffic?