ICA Securing Workloads — 15 Questions

Question 1

You are debugging a '403 Forbidden' error on a service protected by an AuthorizationPolicy. Which tool is most effective for inspecting the policy enforcement in the data plane?

Accepted Answer

istioctl proxy-config log <pod-name> --level debug. The 'istioctl proxy-config' command allows you to view the actual policy configuration loaded into the Envoy proxy.

Answer

istioctl proxy-config rds <pod-name>

Answer

istioctl proxy-config listener <pod-name>

Answer

istioctl proxy-config policy <pod-name>

Question 2

Which TWO of the following are valid modes for PeerAuthentication?

Accepted Answer

STRICT. The two primary modes for PeerAuthentication are PERMISSIVE and STRICT.

Answer

ENABLED

Answer

OPTIONAL

Answer

DISABLED

Question 3

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

Accepted Answer

Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.. The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.

Answer

Configure the Gateway to filter by IP.

Answer

Use a ServiceEntry to restrict traffic.

Answer

Create a PeerAuthentication policy with 'ipBlocks'.

Question 4

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

Accepted Answer

Allow all traffic.. By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.

Answer

Allow only traffic within the same namespace.

Answer

Deny all traffic.

Answer

Require mTLS for all traffic.

Question 5

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

Accepted Answer

Use the 'when' field with 'key: request.auth.claims[custom-claim]' and 'values' to match.. AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.

Answer

Use the 'principals' field.

Answer

Use the 'from' field in the 'source' object.

Answer

Use an 'EnvoyFilter' because AuthorizationPolicy does not support claims.

Question 6

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

Accepted Answer

Envoy Proxy. The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.

Answer

Citadel

Answer

Ingress Gateway

Answer

Istiod

Question 7

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

Accepted Answer

Define a RequestAuthentication resource specifying the issuer and jwksUri.. To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.

Answer

Apply a PeerAuthentication resource with mode STRICT.

Answer

Create an EnvoyFilter to parse the JWT.

Question 8

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

Accepted Answer

The legacy service is not using an Istio sidecar to handle mTLS handshakes.. Setting PeerAuthentication to STRICT forces mTLS for all traffic. If the legacy service does not have an Istio sidecar or is not configured to perform mTLS, it will be rejected.

Answer

The Gateway is misconfigured for the legacy service.

Answer

The DestinationRule for the service is missing the 'mode: ISTIO_MUTUAL' setting.

Answer

The AuthorizationPolicy is missing a rule for the legacy service.

Question 9

You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?

Accepted Answer

Set source.namespaces: ['prod'] in the rule.. AuthorizationPolicy uses the 'source' field to restrict traffic by namespace using the 'namespaces' attribute.

Answer

Set source.principals: ['prod'] in the rule.

Answer

Set source.ipBlocks: ['prod'] in the rule.

Answer

Set source.remoteIp: ['prod'] in the rule.

Question 10

Which THREE items are included in an Istio SPIFFE ID?

Accepted Answer

Trust domain. The SPIFFE ID format used by Istio follows 'spiffe:///ns//sa/'.

Answer

Cluster Name

Answer

IP Address

Question 11

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Accepted Answer

from. An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).

Answer

action

Answer

selector

Question 12

If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?

Accepted Answer

DENY policies always take precedence over ALLOW policies.. The 'DENY' action takes precedence over 'ALLOW'. If any DENY policy matches, the request is rejected regardless of any ALLOW policy.

Answer

ALLOW policies take precedence.

Answer

The policy with the highest priority field wins.

Answer

The policy applied most recently wins.

Question 13

What is the primary function of the 'root-cert.pem' file in the Istio control plane?

Accepted Answer

To establish the chain of trust for mTLS.. The root certificate is used to sign the intermediate CA certificates that sign workload certificates, establishing the trust chain.

Answer

To authorize HTTP requests.

Answer

To authenticate JWT tokens.

Answer

To encrypt user data in transit.

Question 14

What does the 'jwksUri' field in a RequestAuthentication resource define?

Accepted Answer

The URL to fetch the public keys for JWT validation.. The jwksUri specifies the endpoint where the JWT issuer publishes its public keys, used by Istio to verify the token signature.

Answer

The URL to register the application.

Answer

The location where JWTs are stored.

Answer

The address of the Identity Provider login page.

Question 15

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Accepted Answer

It is enforced by the ztunnel on the node.. PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.

Answer

It requires manual certificate rotation.

Answer

It only works with sidecar proxies.

Answer

PeerAuthentication is not supported in ambient mode.