59 questions · Securing Workloads · All types, answers revealed
Which component is responsible for distributing the security policies (like AuthorizationPolicy) to the Envoy sidecars?
Istiod handles configuration distribution.
Why this answer
Istiod is the control plane component responsible for distributing configuration to sidecars via the xDS protocol.
Which protocol is used for the Istio data plane mTLS communication?
Istio relies on standard TLS protocols.
Why this answer
Istio uses mutual TLS (mTLS) over HTTP/2 or standard HTTP to provide encryption and identity.
A security team requires that all traffic to the 'payments' service must originate from a specific IP range (10.0.0.0/24). How can this be achieved?
ipBlocks is the correct field for CIDR-based authorization.
Why this answer
The AuthorizationPolicy supports 'source.ipBlocks' to whitelist or blacklist specific CIDR ranges.
Which Istio component is responsible for enforcing the AuthorizationPolicy at the workload level?
Envoy is the data plane component that enforces security policies locally on the pod.
Why this answer
The Envoy proxy (sidecar) intercepts all inbound and outbound traffic and enforces policies defined in AuthorizationPolicy.
If you set 'mode: PERMISSIVE' in PeerAuthentication, what does this allow?
This enables gradual adoption of mTLS.
Why this answer
PERMISSIVE mode allows both mTLS and plaintext traffic to coexist, which is ideal for migrations.
What happens if a RequestAuthentication policy is applied, but no JWT is provided in the request?
RequestAuthentication only defines validation, not access policy.
Why this answer
By default, if the request does not include a token, the request is allowed to pass. The AuthorizationPolicy should then be used to deny requests without a valid token.
Which of the following describes the role of the 'trust-domain' in Istio?
Identities across different meshes with the same trust domain trust each other.
Why this answer
The trust domain identifies the administrative boundary for identities. It is used to construct the SPIFFE ID.
Which field in the AuthorizationPolicy is used to restrict access based on the verified JWT claims?
The 'when' block allows attribute-based filtering, including JWT claims.
Why this answer
The 'when' clause in an AuthorizationPolicy allows you to specify conditions based on attributes, including JWT claims like 'request.auth.claims'.
Which THREE fields in an AuthorizationPolicy are evaluated under the 'rules' section?
Defines the source of the traffic.
Why this answer
An AuthorizationPolicy rule contains 'from' (source), 'to' (operation), and 'when' (conditions).
How can you debug a failing AuthorizationPolicy rule?
This tool identifies issues with Istio resources.
Why this answer
The 'istioctl analyze' command can detect invalid policy configurations that prevent them from taking effect.
Which THREE items are included in an Istio SPIFFE ID?
The root of trust for the identity.
Why this answer
The SPIFFE ID format used by Istio follows 'spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>'.
What is the default behavior of Istio mTLS if no PeerAuthentication policy is applied?
Permissive mode is the default, allowing for incremental migration.
Why this answer
Istio defaults to PERMISSIVE mode, which allows both mTLS and plaintext traffic.
Which THREE factors influence whether a service in the mesh will accept traffic?
Determines if the request is permitted.
Why this answer
Traffic acceptance depends on PeerAuthentication (mTLS), AuthorizationPolicy (access), and the Envoy proxy configuration (xDS).
If you apply an AuthorizationPolicy with a 'DENY' action and an 'ALLOW' action in the same namespace, how does Istio resolve them?
This is the core evaluation logic in Istio RBAC.
Why this answer
The 'DENY' action takes precedence over 'ALLOW'. If any DENY policy matches, the request is rejected regardless of any ALLOW policy.
Which resource is used to define the root certificate for a custom CA?
This is the specific secret name Istio looks for.
Why this answer
The 'cacerts' secret in the 'istio-system' namespace is used to provide custom root certificates.
Which THREE actions occur when 'mode: STRICT' is set in a PeerAuthentication policy?
The client must adapt to the server's requirement.
Why this answer
STRICT mode forces mTLS, causes the proxy to reject plain text, and mandates that both client and server sidecars perform the handshake.
What is the correct syntax for a principal in an AuthorizationPolicy?
Matches the SPIFFE URI format.
Why this answer
The principal follows the SPIFFE ID format: 'cluster.local/ns/default/sa/my-service'.
How do you ensure that a workload ignores a global PeerAuthentication policy?
Selectors allow granular overrides.
Why this answer
A workload-specific PeerAuthentication policy (with a selector) will override a global (namespace or root) policy.
When multiple AuthorizationPolicies target the same workload, how are they combined?
Multiple ALLOW policies are combined so that if any match, access is granted.
Why this answer
If multiple policies are applied to the same workload, they are evaluated using an additive approach (OR logic) for ALLOW policies within the same namespace.
You have a global PeerAuthentication policy. What is the effect of applying a new PeerAuthentication policy in the 'default' namespace with no selector?
Namespaced policy has precedence over global.
Why this answer
Namespaced policies override global ones within that namespace. A policy with no selector applies to all workloads in that namespace.
Which THREE conditions must be met for a PeerAuthentication policy to enforce STRICT mTLS?
The proxy must be present.
Why this answer
STRICT mode requires an Istio-enabled sidecar, the PeerAuthentication mode set to STRICT, and the absence of conflicting policies.
Which THREE actions are required to successfully secure a workload using OIDC and JWT authentication in Istio?
This tells Istio how to validate the JWT.
Why this answer
To use JWT, you must define a RequestAuthentication policy, ensure the workload accepts the token, and use an AuthorizationPolicy to enforce 'DENY' or 'ALLOW' based on claims.
Which TWO of the following are true regarding PeerAuthentication policies?
Global policy requires root namespace deployment.
Why this answer
They can be applied at mesh, namespace, or workload level, and the mode can be STRICT or PERMISSIVE.
You want to allow traffic only from a specific namespace 'prod' to the 'backend' service. How should you define the 'AuthorizationPolicy'?
This correctly filters requests originating from the prod namespace.
Why this answer
AuthorizationPolicy uses the 'source' field to restrict traffic by namespace using the 'namespaces' attribute.
Which TWO of the following are true regarding the RequestAuthentication resource?
Selectors allow granular policy targeting.
Why this answer
RequestAuthentication is used to validate JWTs and can be applied at the namespace or workload level.
What does the 'jwksUri' field in a RequestAuthentication resource define?
This is the definition of a JWKS URI.
Why this answer
The jwksUri specifies the endpoint where the JWT issuer publishes its public keys, used by Istio to verify the token signature.
Which attribute can be used in an AuthorizationPolicy to verify that the request was made via mTLS?
If 'source.principal' is present, the connection is authenticated via mTLS.
Why this answer
The 'source.principal' attribute is only populated if the connection is authenticated via mTLS, making it a reliable way to verify mTLS use.
You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?
Setting the mode to STRICT ensures that only mTLS traffic is accepted.
Why this answer
A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.
What does an AuthorizationPolicy's 'operation' field represent?
Used for layer 7 traffic control.
Why this answer
The operation field defines the methods (GET, POST) and paths allowed or denied.
Which THREE items are required to successfully authenticate a user via JWT in Istio?
Optional but highly recommended for security.
Why this answer
You need the issuer URL, the JWKS URI, and the audience to validate the JWT correctly.
When using JWT authentication, where does the Istio sidecar fetch the public key (JWKS) required for token verification?
The sidecar directly queries the JWKS endpoint.
Why this answer
The sidecar automatically fetches the JWKS from the URL defined in the 'jwksUri' field within the RequestAuthentication policy.
Which THREE things are required for mTLS to be successful?
Defines the mTLS requirement.
Why this answer
mTLS needs certificates issued to the workloads, a mutual agreement on using mTLS (PeerAuthentication), and sidecar proxies to perform the handshake.
Which THREE components are involved in the Istio certificate management process?
Acts as the CA.
Why this answer
The certificate lifecycle involves Istiod (CA), the control plane agent, and the workload sidecar/proxy.
Which TWO scenarios indicate that a PeerAuthentication policy is working correctly?
Rejection confirms the policy is enforcing security.
Why this answer
Correct operation is confirmed by successful communication under STRICT mode (using sidecars) and by observing mTLS metrics/logs.
What happens when an AuthorizationPolicy is applied to a workload without a sidecar?
Policy enforcement requires the sidecar.
Why this answer
AuthorizationPolicy relies on the Envoy sidecar to enforce rules. If no sidecar is present, the policy is ignored for that traffic.
A service 'orders' requires a specific AuthorizationPolicy that allows GET requests only from the 'frontend' service while denying all other methods. Which configuration is correct?
This policy correctly restricts access to the GET method for the specified service account.
Why this answer
The AuthorizationPolicy should specify the 'GET' method in the 'rules' section and match the 'frontend' principal in the 'from' source block.
In an AuthorizationPolicy, what does the 'ALLOW' action mean when combined with an empty rule set?
No constraints mean no filtering.
Why this answer
An empty 'rules' section in an 'ALLOW' policy effectively allows all requests that meet the identity criteria, or if no source/to constraints are specified, it allows everything.
Which command is used to display the currently active PeerAuthentication policies in the mesh?
Standard kubectl command for K8s resources.
Why this answer
The 'kubectl get peerauthentication -A' command is the standard way to list all PeerAuthentication resources in the cluster.
Which THREE elements are part of a 'RequestAuthentication' resource?
Part of the jwtRule.
Why this answer
RequestAuthentication includes the selector, the list of JWT rules (issuer, jwksUri), and the target namespace/scope.
What is the primary function of the 'root-cert.pem' file in the Istio control plane?
Workloads verify the peer's certificate against the root CA.
Why this answer
The root certificate is used to sign the intermediate CA certificates that sign workload certificates, establishing the trust chain.
Which of the following is NOT a valid action in an Istio AuthorizationPolicy?
REDIRECT is not an action in AuthorizationPolicy.
Why this answer
'AUDIT' and 'DENY' and 'ALLOW' are valid, but 'REDIRECT' is not a valid action in AuthorizationPolicy.
Which of the following is true regarding PeerAuthentication and sidecar-less ambient mode?
In ambient mode, the ztunnel handles mTLS configuration.
Why this answer
PeerAuthentication applies to the ztunnel in ambient mode to enforce mTLS for traffic between nodes.
Why might a 'RequestAuthentication' policy fail to validate a JWT even if the issuer is correct?
Connectivity is required for key verification.
Why this answer
The most common reason is that the 'jwksUri' is unreachable from the Istio proxy, often due to network policies or egress restrictions.
What is the default behavior of Istio when no AuthorizationPolicy is present for a workload?
Without policies, Istio does not restrict access.
Why this answer
By default, Istio allows all traffic (PERMISSIVE/ALLOW ALL) unless an explicit policy is defined.
Which of the following is true about the 'principals' vs 'source.principals' fields?
Both refer to the authenticated identity (SPIFFE ID).
Why this answer
They are synonymous in the context of AuthorizationPolicy; 'principals' is a shorthand within the 'source' object for identifying the workload's SPIFFE ID.
You have a namespace 'finance' where all traffic must be encrypted using mutual TLS. You apply a PeerAuthentication policy with 'mode: STRICT' at the namespace scope. A developer reports that a legacy service in the same namespace is failing to communicate. What is the most likely reason?
In STRICT mode, mTLS is mandatory. Without a sidecar, the service cannot participate in the mTLS handshake.
Why this answer
Setting PeerAuthentication to STRICT forces mTLS for all traffic. If the legacy service does not have an Istio sidecar or is not configured to perform mTLS, it will be rejected.
How can you restrict traffic to a service based on the presence of a specific request header?
This is the correct way to validate headers.
Why this answer
The 'when' field in an AuthorizationPolicy supports checking request headers using 'request.headers[<header-name>]'.
You have an external service 'legacy-db' outside the mesh. You want to allow access to it from 'webapp' while ensuring 'webapp' presents a valid certificate. How is this achieved?
Egress Gateways can handle mTLS termination/origination for external traffic.
Why this answer
You must use an Egress Gateway with mTLS configured to the external service.
How can you restrict a service to only accept requests from users authenticated via a specific JWT issuer?
The two-step validation is the standard pattern.
Why this answer
You define a RequestAuthentication policy that specifies the trusted issuer, and then use an AuthorizationPolicy that checks for the 'request.auth.claims[iss]' claim.
What is the result of applying an AuthorizationPolicy that has no 'action' field?
Default action is ALLOW.
Why this answer
If the action field is missing, it defaults to 'ALLOW', which is the standard behavior in Istio.
Which tool would you use to verify if a pod has an active mTLS connection?
Viewing secrets confirms certificates are present.
Why this answer
The 'istioctl proxy-config secret' command shows the certificates loaded into the proxy, which is a good indicator of mTLS readiness.
You have a legacy service that cannot handle mTLS. How can you exclude this specific service from the namespace-wide STRICT mTLS policy?
A workload-level policy overrides a namespace-level policy.
Why this answer
You can apply a PeerAuthentication policy at the workload level (using 'selector') to override the namespace-wide policy.
You have a requirement to use a custom JWT claim to authorize users. How can you map this claim in an 'AuthorizationPolicy'?
The 'when' clause allows checking specific claims against values.
Why this answer
AuthorizationPolicy supports 'when' conditions to evaluate JWT claims using the 'request.auth.claims' key.
You want to implement a 'Deny-All' strategy for your mesh and explicitly whitelist only necessary traffic. What is the correct order to achieve this?
An empty DENY policy denies everything, then specific ALLOW policies override or permit necessary paths.
Why this answer
Apply a global AuthorizationPolicy with action 'DENY' and selector 'matchLabels: {}', then apply granular 'ALLOW' policies for specific services.
What is the primary purpose of the 'RequestAuthentication' resource?
It tells the proxy how to check token validity.
Why this answer
RequestAuthentication is used to define which JWT issuers are trusted and how to validate tokens.
Which TWO of the following are valid sources for an AuthorizationPolicy?
Principals refer to the identity of the caller.
Why this answer
AuthorizationPolicies can match based on 'principals' (identity) and 'namespaces'.
When using JWT, what is the 'forwardOriginalToken' flag in the RequestAuthentication resource?
The application can inspect claims.
Why this answer
When set to true, the proxy forwards the original JWT to the application, allowing the application to use the token for backend calls.
Your team needs to allow end-users to authenticate using JWT tokens issued by an external OIDC provider. Which resource should you define to validate these tokens?
RequestAuthentication is the primary resource for JWT validation in Istio.
Why this answer
RequestAuthentication is specifically designed to configure how Istio validates JWT tokens.
Which TWO of the following are valid modes for PeerAuthentication?
Forces mTLS for all connections.
Why this answer
The two primary modes for PeerAuthentication are PERMISSIVE and STRICT.
Ready to test yourself?
Try a timed practice session using only Securing Workloads questions.