ICA Securing Workloads — 25 Questions

Question 1

Which TWO of the following are valid modes for PeerAuthentication?

Accepted Answer

STRICT. The two primary modes for PeerAuthentication are PERMISSIVE and STRICT.

Answer

ENABLED

Answer

OPTIONAL

Answer

DISABLED

Question 2

Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?

Accepted Answer

Define a RequestAuthentication resource specifying the issuer and jwksUri.. Option B is correct because Istio's RequestAuthentication resource is the mechanism that configures JWT validation, requiring the issuer and jwksUri so the sidecar can fetch the JSON Web Key Set and verify the token's signature and issuer. Option D is correct because Istio's JWT authentication expects the token to be presented in the standard 'Authorization: Bearer <token>' HTTP header, which the Envoy proxy extracts and validates against the RequestAuthentication configuration. Option E is correct because after RequestAuthentication validates the token, an AuthorizationPolicy is needed to enforce access control based on specific claims such as 'iss' or 'sub', allowing or denying requests according to those values. Option A is not required for OIDC/JWT authentication; PeerAuthentication with mode STRICT enforces mutual TLS between workloads, which is a separate transport-security concern and does not validate JWTs. Option C is not required because Istio's RequestAuthentication and Envoy's built-in JWT filter handle token parsing natively, so a custom EnvoyFilter to parse the JWT is unnecessary.

Answer

Apply a PeerAuthentication resource with mode STRICT.

Answer

Create an EnvoyFilter to parse the JWT.

Question 3

You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?

Accepted Answer

Set source.namespaces: ['prod'] in the rule.. AuthorizationPolicy uses the 'source' field to restrict traffic by namespace using the 'namespaces' attribute.

Answer

Set source.principals: ['prod'] in the rule.

Answer

Set source.ipBlocks: ['prod'] in the rule.

Answer

Set source.remoteIp: ['prod'] in the rule.

Question 4

You are debugging a '403 Forbidden' error on a service protected by an AuthorizationPolicy. Which tool is most effective for inspecting the policy enforcement in the data plane?

Accepted Answer

istioctl proxy-config log <pod-name> --level debug. The 'istioctl proxy-config' command allows you to view the actual policy configuration loaded into the Envoy proxy.

Answer

istioctl proxy-config rds <pod-name>

Answer

istioctl proxy-config listener <pod-name>

Answer

istioctl proxy-config policy <pod-name>

Question 5

Which protocol is used for the Istio data plane mTLS communication?

Accepted Answer

TLS 1.2/1.3. Istio uses mutual TLS (mTLS) over HTTP/2 or standard HTTP to provide encryption and identity.

Answer

VPN

Answer

SSH

Answer

IPsec

Question 6

Which THREE elements are part of a 'RequestAuthentication' resource?

Accepted Answer

issuer. In Istio's RequestAuthentication CRD, the issuer field (B) is correct because each JWT rule must identify the token issuer whose tokens are accepted, matched against the token's iss claim. jwtRules (D) is correct because it is the core list defining how JWTs are validated, including the issuer, JWKS location (jwksUri or jwks), audiences, and forwardOriginalToken behavior. selector (E) is correct because it determines which workloads the RequestAuthentication policy applies to via label selectors, scoping the JWT validation to specific pods. The remaining options do not belong: accessPolicy (A) is not a field of RequestAuthentication (authorization behavior is configured separately in AuthorizationPolicy), and mTLSMode (C) is not part of this resource since mutual TLS settings belong to PeerAuthentication.

Answer

accessPolicy

Answer

mTLSMode

Question 7

Which of the following is true about the 'principals' vs 'source.principals' fields?

Accepted Answer

They refer to the same concept.. They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.

Answer

Only 'principals' is valid.

Answer

Only 'source.principals' is valid.

Answer

They refer to different concepts.

Question 8

How can you debug a failing AuthorizationPolicy rule?

Accepted Answer

Run 'istioctl analyze'.. istioctl analyze performs static analysis of Istio configuration (AuthorizationPolicies, VirtualServices, Gateways, etc.) against the cluster's actual state and reports misconfigurations, conflicts, and schema errors. It is the first-line tool for diagnosing why an AuthorizationPolicy is not taking effect, catching issues like missing selectors, wrong namespaces, or conflicting rules before runtime debugging.

Answer

Check Kubernetes logs for the API server.

Answer

Restart the sidecar.

Answer

Update the service account.

Question 9

Which THREE conditions must be met for a PeerAuthentication policy to enforce STRICT mTLS?

Accepted Answer

Sidecar sidecar-injection enabled. Option A is correct because STRICT mTLS enforcement requires that workloads actually have an Envoy sidecar proxy injected (via sidecar-injection enabled, e.g., istio-injection=enabled on the namespace or manual injection); without a sidecar, the pod cannot participate in Istio's mTLS and the policy cannot be enforced. Option D is correct because the PeerAuthentication resource must explicitly set mtls.mode: STRICT (or inherit STRICT from a mesh/namespace-level policy), since the default mode is PERMISSIVE, which allows plaintext and would not enforce strict mutual TLS. Option E is correct because STRICT mTLS depends on Istio's workload certificate provisioning (SDS-delivered certs from istiod/CA, e.g., Citadel) being healthy; if certificates cannot be issued or rotated, the sidecars cannot complete the mTLS handshake and traffic fails rather than being enforced. Option B is not required because PeerAuthentication can be applied to any namespace, not just 'default', and scope is determined by the policy's namespace or selector. Option C is not required because STRICT mTLS operates at the sidecar/proxy layer regardless of how the Service is exposed (ClusterIP, NodePort, LoadBalancer, or Ingress), so the Service type is irrelevant to mTLS enforcement.

Answer

Namespace must be 'default'

Answer

Service must be exposed via NodePort

Question 10

A service 'orders' requires a specific AuthorizationPolicy that allows GET requests only from the 'frontend' service while denying all other methods. Which configuration is correct?

Accepted Answer

Set 'action: ALLOW', 'rules: [{from: [{source: {principals: [cluster.local/ns/default/sa/frontend]}}], to: [{operation: {methods: [GET]}}]}]'.. The AuthorizationPolicy should specify the 'GET' method in the 'rules' section and match the 'frontend' principal in the 'from' source block.

Answer

Create an EnvoyFilter to intercept and drop requests.

Answer

Use a PeerAuthentication policy to filter based on HTTP methods.

Answer

Set 'action: DENY', 'rules: [{to: [{operation: {methods: [POST, PUT, DELETE]}}]}]'.

Question 11

You want to implement a 'Deny-All' strategy for your mesh and explicitly whitelist only necessary traffic. What is the correct order to achieve this?

Accepted Answer

Create an AuthorizationPolicy with action 'DENY' and no rules, then add ALLOW policies.. Istio AuthorizationPolicy supports ALLOW, DENY, and CUSTOM actions. To implement a deny-all-then-allow model, you create a DENY policy with an empty spec (no rules), which matches all requests and denies them, then layer ALLOW policies for specific workloads. Because Istio evaluates DENY before ALLOW, the empty DENY acts as a default-deny baseline while explicit ALLOW rules carve out permitted traffic.

Answer

Modify the Istio mesh configuration to default to DENY.

Answer

Use NetworkPolicies instead of AuthorizationPolicies.

Answer

Use PeerAuthentication to block all traffic.

Question 12

Which TWO of the following are valid sources for an AuthorizationPolicy?

Accepted Answer

principals. In Istio's AuthorizationPolicy, the `from` field defines valid sources, and its `source` sub-field supports `principals` (option C), which matches the peer identity derived from the mTLS client certificate (e.g., `cluster.local/ns/default/sa/my-app`), and `ipBlocks` (option E), which matches the source IP address or CIDR range of the request. Both C and E are legitimate source selectors because they describe where traffic originates — an authenticated workload identity or a network address — which is exactly what the `source` stanza is designed to express. By contrast, `httpMethods` (B) and `headers` (D) are request-attribute matchers that belong under the `to`/`when` operation conditions, not under `source`, and `headers` is not even a standalone top-level field in AuthorizationPolicy. Option A (`headers`) is therefore invalid as a source, and option B (`httpMethods`) restricts the operation rather than identifying the origin of the request.

Answer

headers

Answer

httpMethods

Answer

jwtClaims

Question 13

Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?

Accepted Answer

source.principal. The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.

Answer

destination.port

Answer

connection.mtls

Answer

request.auth.principal

Question 14

Which THREE items are required to successfully authenticate a user via JWT in Istio?

Accepted Answer

The 'audiences' field to restrict token scope.. Option C is correct because the 'audiences' field in the JWT rule restricts which tokens are accepted by validating the aud claim, ensuring the token was issued for this specific service. Option D is correct because 'jwksUri' specifies the JSON Web Key Set endpoint from which Istio fetches the public keys needed to verify the token's signature. Option E is correct because the 'issuer' field in RequestAuthentication validates the iss claim, ensuring the token comes from a trusted identity provider. Option A is not required because PeerAuthentication configures mTLS between workloads, not end-user JWT authentication. Option B is not required because JWT authentication validates tokens from an external IdP and does not need a Kubernetes ServiceAccount per user.

Answer

A PeerAuthentication resource.

Answer

A Kubernetes ServiceAccount per user.

Question 15

Which TWO of the following are true regarding PeerAuthentication policies?

Accepted Answer

They must be applied in the 'istio-system' namespace to work globally.. Option B is correct because a PeerAuthentication policy placed in the root namespace (typically 'istio-system', or the configured root namespace) acts as a mesh-wide default that applies to all workloads unless overridden by a namespace- or workload-specific policy. Option E is correct because PeerAuthentication's 'mtls.mode' field accepts 'STRICT', 'PERMISSIVE', 'DISABLE', and 'UNSET', with STRICT requiring mTLS and PERMISSIVE allowing both plaintext and mTLS traffic. Option A is wrong because ambient mode still uses PeerAuthentication (enforced via ztunnel) for mTLS, so it is not limited to sidecar mode. Option C is wrong because JWT validation is handled by RequestAuthentication, not PeerAuthentication. Option D is wrong because DENY is an action of AuthorizationPolicy, whereas PeerAuthentication only controls mutual TLS mode.

Answer

They cannot be used with sidecar-less ambient mode.

Answer

They validate JWT tokens.

Answer

They support the 'DENY' action.

Question 16

You have deployed Istio with mutual TLS enabled globally. A new service 'inventory' is added to the mesh, but its sidecar is not injected due to a misconfiguration. What will happen to traffic between 'inventory' and other services that have sidecars?

Accepted Answer

Traffic will be rejected because the source does not have a sidecar to originate mTLS, and the destination requires mTLS.. With global mTLS enabled in STRICT mode, destination sidecars require mTLS. A source without a sidecar cannot originate mTLS, so its plaintext traffic will be rejected by the destination sidecar. This enforces the security policy but can cause connectivity issues if sidecar injection is missed. The correct answer reflects this rejection.

Answer

Traffic will be automatically upgraded to mTLS by the destination sidecar, even if the source lacks a sidecar.

Answer

Traffic will be allowed if the destination has PERMISSIVE mode enabled, otherwise it will be rejected.

Answer

Traffic will be sent in plaintext, and the destination sidecar will reject it because it expects mTLS.

Question 17

Your security team requires that all inbound requests to the 'orders' service carry a valid JWT from issuer 'https://auth.example.com' with audience 'orders-api'. You apply a RequestAuthentication policy with the appropriate issuer and jwksUri, and an AuthorizationPolicy that requires request.auth.claims[aud] to equal 'orders-api'. However, you notice that requests without any JWT are still being allowed. What is the most likely cause?

Accepted Answer

The AuthorizationPolicy does not include a rule that denies requests when request.auth is absent, so unauthenticated requests bypass the JWT claim check.. RequestAuthentication validates JWTs but does not reject requests without one. To enforce authentication, an AuthorizationPolicy must explicitly require a valid JWT, for example by checking request.auth.claims or request.auth.present. If the policy only checks a claim like aud, requests without a token will lack that claim and thus not match the rule; but if the policy has no rule that denies such requests and the default is allow, they slip through. The fix is to add a rule that requires authentication.

Answer

The RequestAuthentication policy is applied to the wrong namespace, so it is not enforced for the 'orders' service.

Answer

The RequestAuthentication policy is missing the 'audiences' field, so audience validation is skipped.

Answer

The AuthorizationPolicy is missing the 'action: DENY' field, so it defaults to allow.

Question 18

You are troubleshooting why an AuthorizationPolicy is not blocking traffic as expected in the 'secure' namespace. Which TWO of the following are common reasons for an AuthorizationPolicy to be ineffective? (Choose two.)

Accepted Answer

The sidecar proxy is not injected into the target workload, so the policy cannot be enforced.. An AuthorizationPolicy can be ineffective if it is applied to the wrong namespace or lacks a matching selector, or if the target workload does not have a sidecar proxy to enforce it. These are two fundamental requirements for policy enforcement. Without a matching workload and a sidecar, the policy is not applied. Other issues like DENY vs ALLOW precedence or missing fields are less common or not applicable in typical scenarios.

Answer

The AuthorizationPolicy uses a DENY action, but an ALLOW policy with a broader match is also present.

Answer

The AuthorizationPolicy is configured with an action of CUSTOM, but no custom authorization provider is registered.

Answer

The AuthorizationPolicy is missing a 'requestPrincipals' field, so it cannot match any requests.

Question 19

You are reviewing the security posture of a service mesh. You need to verify that mutual TLS is enforced for all workloads in the 'default' namespace. Which TWO of the following are valid ways to enforce or verify mTLS enforcement in Istio? (Choose two.)

Accepted Answer

Use 'istioctl authn tls-check' to verify that the mTLS status between two workloads is OK.. Enforcing mTLS in Istio is done by applying a PeerAuthentication policy with mode STRICT, which makes workloads reject plaintext traffic. Verification can be performed using 'istioctl authn tls-check' to confirm the effective mTLS status between workloads. Other options either disable mTLS or are insufficient for enforcement. Together, applying STRICT mode and verifying with istioctl provide a robust approach.

Answer

Create a DestinationRule with trafficPolicy.tls.mode: DISABLE for all services in the namespace.

Answer

Set the 'meshConfig.enableAutoMtls' flag to false in the IstioOperator configuration.

Answer

Check the 'istio_requests_total' metric for the 'connection_security_policy' label set to 'mutual_tls'.

Question 20

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

Accepted Answer

Create an AuthorizationPolicy with 'source.ipBlocks: ["10.0.0.0/24"]'.. The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.

Answer

Configure the Gateway to filter by IP.

Answer

Use a ServiceEntry to restrict traffic.

Answer

Create a PeerAuthentication policy with 'ipBlocks'.