CKS Minimize Microservice Vulnerabilities Practice Question
A pod runs with a service mesh sidecar (Istio). The team wants to enforce mutual TLS (mTLS) for all traffic between services in the 'production' namespace. Which resource should be applied?
⚠ Common exam trap
CNCF often tests the distinction between PeerAuthentication (which enforces mTLS on the server side) and DestinationRule (which configures client-side TLS), leading candidates to mistakenly choose DestinationRule for namespace-wide mTLS enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PeerAuthentication with mode: STRICT in the namespace
PeerAuthentication with mode: STRICT enforces mutual TLS at the service mesh level by requiring all traffic within the namespace to use TLS certificates for both sides of the connection. This is the correct Istio resource to enforce mTLS for all services in the 'production' namespace, as it sets a namespace-wide policy that overrides any permissive defaults.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DestinationRule with trafficPolicy: tls: mode: ISTIO_MUTUAL
Why it's wrong here
DestinationRule configures client-side traffic policies for a specific service host, not namespace-wide security. Even with mode: ISTIO_MUTUAL, it only instructs the sidecar to send mTLS to that particular destination; it does not reject plaintext traffic or enforce mTLS across all workloads in the namespace. To enforce mTLS at the namespace level, you need a PeerAuthentication policy with mode: STRICT, which is the authoritative control for requiring mutual TLS.
- ✗
VirtualService with TLS settings
Why it's wrong here
VirtualService is a traffic-management resource that defines routing rules based on host, URI, or headers; its TLS match conditions are used only to route traffic based on TLS attributes like SNI, not to enforce authentication or encryption. A VirtualService with TLS settings cannot require mutual TLS or reject non-mTLS connections because it has no concept of enforcing a PeerAuthentication mode. Therefore, it is irrelevant for the requirement of enforcing mTLS across all workloads in the production namespace.
- ✓
PeerAuthentication with mode: STRICT in the namespace
Why this is correct
PeerAuthentication is the Istio policy resource specifically designed to control mTLS adoption at mesh, namespace, or workload granularity. Setting mode: STRICT in the production namespace requires every service-to-service communication to be mutual TLS; any plaintext request will be rejected by the sidecar proxies, effectively enforcing the team's requirement. This is the standard and recommended way to enforce mTLS for an entire namespace.
- ✗
ServiceEntry with mTLS enabled
Why it's wrong here
A ServiceEntry is used to add external services to the Istio service registry, not to enforce mTLS between internal services within the same cluster. It fails because the requirement is to secure inter-service traffic inside the 'production' namespace, which is governed by PeerAuthentication and DestinationRule policies, not ServiceEntry. This option is tempting because ServiceEntry can configure TLS settings for external endpoints, making it appear relevant for mTLS, but it cannot enforce mutual TLS on internal mesh traffic.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 114-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.