ICA Securing Workloads Practice Question
You have a namespace 'prod' and you need to ensure that all workloads in this namespace only accept mutual TLS (mTLS) encrypted traffic. What is the most effective way to configure this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.
A PeerAuthentication policy scoped to the namespace with mode set to STRICT ensures all sidecars in that namespace enforce mTLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Apply a DestinationRule with trafficPolicy.tls.mode set to ISTIO_MUTUAL.
Why it's wrong here
DestinationRules configure the client-side behavior, not the server-side acceptance policy.
- ✗
Apply a global MeshConfig setting to enforce mTLS.
Why it's wrong here
MeshConfig is not the appropriate place for per-namespace mTLS enforcement.
- ✓
Apply a PeerAuthentication resource with spec.mtls.mode set to STRICT in the 'prod' namespace.
Why this is correct
Setting the mode to STRICT ensures that only mTLS traffic is accepted.
- ✗
Create an AuthorizationPolicy that denies all traffic without a client certificate.
Why it's wrong here
AuthorizationPolicy controls access based on attributes, but PeerAuthentication is the correct resource for mTLS protocol enforcement.
About these practice questions
This ICA question is part of Courseiva's 292-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This ICA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ICA exam.