ICA Securing Workloads Practice Test 4 — 15 Questions

Question 1

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Accepted Answer

The policy is ignored.. AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.

Answer

The policy is logged but not enforced.

Answer

The workload crashes.

Answer

Traffic is denied by default.

Question 2

Which THREE things are required for mTLS to be successful?

Accepted Answer

PeerAuthentication configuration. mTLS needs certificates issued to the workloads, a mutual agreement on using mTLS (PeerAuthentication), and sidecar proxies to perform the handshake.

Answer

External load balancer

Answer

Ingress Gateway

Question 3

Which resource is used to define the root certificate for a custom CA?

Accepted Answer

cacerts. The 'cacerts' secret in the 'istio-system' namespace is used to provide custom root certificates.

Answer

istio-ca-secret

Answer

root-secret

Answer

istio-root-ca

Question 4

Which command is used to display the currently active PeerAuthentication policies in the mesh?

Accepted Answer

kubectl get peerauthentication -A. The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.

Answer

istioctl analyze

Answer

istioctl get peerauthentication

Answer

kubectl describe mtls

Question 5

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Accepted Answer

It defaults to ALLOW.. If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.

Answer

The request is rejected.

Answer

It defaults to DENY.

Answer

The policy is invalid.

Question 6

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

Accepted Answer

It forwards the token to the application.. When set to true, the proxy forwards the original JWT to the application, allowing the application to use the token for backend calls.

Answer

It deletes the token from the request.

Answer

It encrypts the token.

Answer

It logs the token to the audit log.

Question 7

How can you restrict traffic to a service based on the presence of a specific request header?

Accepted Answer

Use the 'when' field with 'request.headers'.. In Istio's AuthorizationPolicy, the 'when' field defines additional conditions that must be satisfied for the rule to apply, and 'request.headers' is a supported attribute key. Using 'when' with 'request.headers["X-Custom"]' matching a specific value restricts traffic based on the presence or value of a request header.

Answer

Use the 'from' field.

Answer

Use an EnvFilter.

Answer

Use the 'to' field.

Question 8

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

Accepted Answer

PERMISSIVE mTLS. Istio defaults to PERMISSIVE mode, which allows both mTLS and plaintext traffic.

Answer

STRICT mTLS

Answer

Plaintext only

Answer

Disabled

Question 9

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

Accepted Answer

Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.. A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.

Answer

Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.

Answer

Apply a global MeshConfig setting to enforce mTLS.

Answer

Create an AuthorizationPolicy that denies all traffic without a client certificate.

Question 10

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?

Accepted Answer

RequestAuthentication. RequestAuthentication is specifically designed to configure how Istio validates JWT tokens.

Answer

AuthorizationPolicy

Answer

ServiceEntry

Answer

PeerAuthentication

Question 11

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

Accepted Answer

The sidecar fetches it directly from the URL specified in the 'jwksUri' field of the RequestAuthentication resource.. The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.

Answer

It is hardcoded in the Envoy binary.

Answer

The Istio Control Plane (istiod) fetches it and pushes it to the sidecar.

Answer

The user must manually upload the public key as a Kubernetes Secret.

Question 12

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

Accepted Answer

Apply a PeerAuthentication with mode: PERMISSIVE using a selector that targets the legacy service.. You can apply a PeerAuthentication policy at the workload level (using 'selector') to override the namespace-wide policy.

Answer

Add an annotation 'sidecar.istio.io/inject: false'.

Answer

Delete the namespace-wide PeerAuthentication policy.

Answer

Use an AuthorizationPolicy to allow plaintext traffic.

Question 13

Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?

Accepted Answer

rules.when. The `rules.when` field in an Istio AuthorizationPolicy is specifically designed to define conditions that must be met for a request to be allowed. It supports a variety of condition keys, including `request.auth.claims`, which allows you to match against verified JWT claims. This is the correct mechanism to restrict access based on JWT claims because it evaluates the claims after the JWT has been validated by Istio's authentication policy.

Answer

rules.from.principals

Answer

rules.to.operation.methods

Answer

rules.from.source.namespaces

Question 14

Which of the following is NOT a valid action in an Istio AuthorizationPolicy?

Accepted Answer

REDIRECT. Istio AuthorizationPolicy supports exactly three actions: ALLOW, DENY, and AUDIT. REDIRECT is not a valid action — it is a feature of VirtualService (HTTP redirect) and RequestAuthentication/Envoy routing, not of AuthorizationPolicy. AUDIT is valid and logs requests that match the policy without allowing or denying them, which is why it is included as a legitimate action.

Answer

AUDIT

Answer

ALLOW

Answer

DENY

Question 15

Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?

Accepted Answer

Istiod. Istiod is the control plane component responsible for distributing configuration to sidecars via the xDS protocol.

Answer

Kubernetes API Server

Answer

Prometheus

Answer

Envoy