You are debugging a '403 Forbidden' error on a service protected by an AuthorizationPolicy. Which tool is most effective for inspecting the policy enforcement in the data plane?
A service 'orders' requires a specific AuthorizationPolicy that allows GET requests only from the 'frontend' service while denying all other methods. Which configuration is correct?
You have deployed Istio with mutual TLS enabled globally. A new service 'inventory' is added to the mesh, but its sidecar is not injected due to a misconfiguration. What will happen to traffic between 'inventory' and other services that have sidecars?
Your security team requires that all inbound requests to the 'orders' service carry a valid JWT from issuer 'https://auth.example.com' with audience 'orders-api'. You apply a RequestAuthentication policy with the appropriate issuer and jwksUri, and an AuthorizationPolicy that requires request.auth.claims[aud] to equal 'orders-api'. However, you notice that requests without any JWT are still being allowed. What is the most likely cause?
You are troubleshooting why an AuthorizationPolicy is not blocking traffic as expected in the 'secure' namespace. Which TWO of the following are common reasons for an AuthorizationPolicy to be ineffective? (Choose two.)
You are reviewing the security posture of a service mesh. You need to verify that mutual TLS is enforced for all workloads in the 'default' namespace. Which TWO of the following are valid ways to enforce or verify mTLS enforcement in Istio? (Choose two.)
You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?
You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?
You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?
Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?
You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?
Your team runs an Istio service mesh in STRICT mutual TLS mode across the cluster. A new workload in the 'payments' namespace must accept only traffic from workloads that present a SPIFFE identity of 'cluster.local/ns/payments/sa/payment-processor'. All other inbound traffic, including from other namespaces, must be denied. You create an AuthorizationPolicy in the 'payments' namespace. Which configuration correctly enforces this requirement?
You are configuring a RequestAuthentication policy for a workload that must accept JWTs from two different issuers: 'https://accounts.google.com' and 'https://auth.example.com'. Each issuer uses a different JWKS endpoint. Which configuration correctly validates tokens from both issuers?
You want to enforce that only requests with a valid JWT issued by 'https://accounts.example.com' are allowed to access the 'orders' service. You have applied a RequestAuthentication policy. What additional step is required to actually block requests without a valid JWT?
You need to configure mutual TLS for a specific workload 'database' in the 'data' namespace, but you want to allow plaintext traffic from a legacy service that cannot use mTLS. Which PeerAuthentication configuration should you use?
You are using Istio's authorization policies to secure a workload. You want to allow requests only from a specific service account in another namespace, but only for HTTP GET requests to the path '/api/v1/data'. The service account is 'data-reader' in namespace 'analytics'. Which AuthorizationPolicy rule correctly implements this?