Securing Workloads

Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?

A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?

Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?

If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?

What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?

You are using Istio's authorization policies to secure a workload. You want to allow requests only from a specific service account in another namespace, but only for HTTP GET requests to the path '/api/v1/data'. The service account is 'data-reader' in namespace 'analytics'. Which AuthorizationPolicy rule correctly implements this?

Which of the following describes the role of the 'trust-domain' in Istio?

Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?

Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?

Which THREE items are included in an Istio SPIFFE ID?

What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?

Which THREE factors influence whether a service in the mesh will accept traffic?

If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?

Which resource is used to define the root certificate for a custom CA?

Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?

What is the correct syntax for a principal in an AuthorizationPolicy?

How do you ensure that a workload ignores a global PeerAuthentication policy?

When multiple AuthorizationPolicies target the same workload, how are they combined?

You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?

You want to enforce that only requests with a valid JWT issued by 'https://accounts.example.com' are allowed to access the 'orders' service. You have applied a RequestAuthentication policy. What additional step is required to actually block requests without a valid JWT?

Which TWO of the following are true regarding the RequestAuthentication resource?

What does the 'jwksUri' field in a RequestAuthentication resource define?

You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?

What does an AuthorizationPolicy's 'operation' field represent?

When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?

Which THREE things are required for mTLS to be successful?

Which THREE components are involved in the Istio certificate management process?

Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?

What happens when an AuthorizationPolicy is applied to a workload without a sidecar?

Your team runs an Istio service mesh in STRICT mutual TLS mode across the cluster. A new workload in the 'payments' namespace must accept only traffic from workloads that present a SPIFFE identity of 'cluster.local/ns/payments/sa/payment-processor'. All other inbound traffic, including from other namespaces, must be denied. You create an AuthorizationPolicy in the 'payments' namespace. Which configuration correctly enforces this requirement?

In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?

Which command is used to display the currently active PeerAuthentication policies in the mesh?

What is the primary function of the 'root-cert.pem' file in the Istio control plane?

Which of the following is NOT a valid action in an Istio AuthorizationPolicy?

You need to configure mutual TLS for a specific workload 'database' in the 'data' namespace, but you want to allow plaintext traffic from a legacy service that cannot use mTLS. Which PeerAuthentication configuration should you use?

Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?

Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?

What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?

You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?

How can you restrict traffic to a service based on the presence of a specific request header?

You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?

How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?

What is the result of applying an AuthorizationPolicy that has no 'action' field?

Which tool would you use to verify if a pod has an active mTLS connection?

You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?

You are configuring a RequestAuthentication policy for a workload that must accept JWTs from two different issuers: 'https://accounts.google.com' and 'https://auth.example.com'. Each issuer uses a different JWKS endpoint. Which configuration correctly validates tokens from both issuers?

You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?

What is the primary purpose of the 'RequestAuthentication' resource?

When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?

Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?