KCNA Cloud Native Architecture Practice Question
In Istio, which component is responsible for enforcing traffic policies and collecting telemetry data at the pod level?
⚠ Common exam trap
CNCF often tests the misconception that Mixer is still the primary policy enforcement and telemetry component, but the trap here is that Mixer was deprecated and removed; candidates who haven't kept up with Istio's evolution may incorrectly select Mixer (Option A) instead of recognizing that Envoy now handles both roles via in-proxy extensions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Envoy proxy
Envoy proxy is the correct answer because in Istio, each pod is deployed with an Envoy sidecar proxy that intercepts all inbound and outbound traffic. This proxy enforces traffic policies (e.g., routing rules, fault injection, rate limiting) and collects telemetry data (e.g., metrics, logs, traces) at the pod level, sending it to the observability backends. The sidecar model ensures policy enforcement and telemetry collection happen without modifying the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mixer
Why it's wrong here
Mixer was a legacy component for policy and telemetry; it has been deprecated in favor of per-proxy telemetry.
- ✓
Envoy proxy
Why this is correct
Envoy runs as a sidecar and handles data-plane tasks.
- ✗
Pilot
Why it's wrong here
Pilot is the control plane component that translates policies into Envoy configurations.
- ✗
Citadel
Why it's wrong here
Citadel handles certificate issuance and identity.
Go deeper
Related to this question
Learn chapter
Observability: Monitoring, Logging, and Tracing
Key term
Service Mesh
A service mesh is a dedicated infrastructure layer that manages communication between microservices, handling tasks like service discovery, load balancing, encryption, and observability without requiring changes to application code.
About these practice questions
One of 833 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which component in a service mesh is responsible for collecting telemetry data and enforcing traffic policies?
medium- A.Control plane
- ✓ B.Sidecar proxy (data plane)
- C.Certificate authority
- D.Service mesh ingress gateway
Why B: The sidecar proxy (often Envoy) intercepts all traffic and collects metrics, traces, and logs, and also enforces traffic management rules.
Variation 2. Which service mesh component is typically deployed as a sidecar proxy alongside application containers?
easy- A.Kiali
- B.Istiod
- C.Prometheus
- ✓ D.Envoy proxy
Why D: Envoy proxy is the most common sidecar proxy in service meshes like Istio and Linkerd. Istiod is the control plane component, Kiali is a visualization tool, and Prometheus is a monitoring system.
Variation 3. Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?
medium- A.Mixer
- B.Pilot
- ✓ C.Envoy
- D.Citadel
Why C: Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.
Variation 4. Which component in a service mesh is responsible for handling traffic management, security, and observability as a sidecar proxy?
medium- A.Pilot
- B.Mixer
- C.Citadel
- ✓ D.Envoy
Why D: Envoy is the most common sidecar proxy used in service meshes like Istio.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.