Securing Workloads

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

Which THREE items are included in an Istio SPIFFE ID?

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?

What is the primary function of the 'root-cert.pem' file in the Istio control plane?

What does the 'jwksUri' field in a RequestAuthentication resource define?

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

How do you ensure that a workload ignores a global PeerAuthentication policy?

What is the primary purpose of the 'RequestAuthentication' resource?

Which of the following describes the role of the 'trust-domain' in Istio?

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

Which THREE components are involved in the Istio certificate management process?

Which tool would you use to verify if a pod has an active mTLS connection?

Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?

What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

What does an AuthorizationPolicy's 'operation' field represent?

You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?

What is the correct syntax for a principal in an AuthorizationPolicy?

If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Which THREE things are required for mTLS to be successful?

Which resource is used to define the root certificate for a custom CA?

Which command is used to display the currently active PeerAuthentication policies in the mesh?

What is the result of applying an AuthorizationPolicy that has no 'action' field?

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

How can you restrict traffic to a service based on the presence of a specific request header?

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?

Which of the following is NOT a valid action in an Istio AuthorizationPolicy?

Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?

When multiple AuthorizationPolicies target the same workload, how are they combined?

Which TWO of the following are true regarding the RequestAuthentication resource?

You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?

Which THREE factors influence whether a service in the mesh will accept traffic?

Your team runs an Istio service mesh in STRICT mutual TLS mode across the cluster. A new workload in the 'payments' namespace must accept only traffic from workloads that present a SPIFFE identity of 'cluster.local/ns/payments/sa/payment-processor'. All other inbound traffic, including from other namespaces, must be denied. You create an AuthorizationPolicy in the 'payments' namespace. Which configuration correctly enforces this requirement?

You are configuring a RequestAuthentication policy for a workload that must accept JWTs from two different issuers: 'https://accounts.google.com' and 'https://auth.example.com'. Each issuer uses a different JWKS endpoint. Which configuration correctly validates tokens from both issuers?

You want to enforce that only requests with a valid JWT issued by 'https://accounts.example.com' are allowed to access the 'orders' service. You have applied a RequestAuthentication policy. What additional step is required to actually block requests without a valid JWT?

You need to configure mutual TLS for a specific workload 'database' in the 'data' namespace, but you want to allow plaintext traffic from a legacy service that cannot use mTLS. Which PeerAuthentication configuration should you use?

You are using Istio's authorization policies to secure a workload. You want to allow requests only from a specific service account in another namespace, but only for HTTP GET requests to the path '/api/v1/data'. The service account is 'data-reader' in namespace 'analytics'. Which AuthorizationPolicy rule correctly implements this?