KCNA Cloud Native Architecture Practice Question
In Istio, which component is responsible for enforcing traffic policies and collecting telemetry data at the pod level?
⚠ Common exam trap
CNCF often tests the misconception that Mixer is still the primary policy enforcement and telemetry component, but the trap here is that Mixer was deprecated and removed; candidates who haven't kept up with Istio's evolution may incorrectly select Mixer (Option A) instead of recognizing that Envoy now handles both roles via in-proxy extensions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Envoy proxy
Envoy proxy is the correct answer because in Istio, each pod is deployed with an Envoy sidecar proxy that intercepts all inbound and outbound traffic. This proxy enforces traffic policies (e.g., routing rules, fault injection, rate limiting) and collects telemetry data (e.g., metrics, logs, traces) at the pod level, sending it to the observability backends. The sidecar model ensures policy enforcement and telemetry collection happen without modifying the application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mixer
Why it's wrong here
Mixer was the pre-1.5 component for policy checks and telemetry, now removed; current Istio enforces policy and collects telemetry in the Envoy sidecar. Mixer is tempting because it historically performed these functions, and would be correct for legacy Istio versions before its deprecation.
- ✓
Envoy proxy
Why this is correct
Envoy is the sidecar proxy injected into each pod, and it is the data-plane component that applies the traffic policies pushed by istiod and emits the telemetry (metrics, logs, traces) for that workload. This satisfies the pod-level enforcement and collection requirement.
- ✗
Pilot
Why it's wrong here
Pilot distributes configuration to Envoy sidecars; it does not itself enforce per-pod policy or gather telemetry. It is tempting because Pilot handles traffic-management configuration, and would be correct for a question about propagating routing rules and service discovery to the data plane.
- ✗
Citadel
Why it's wrong here
Citadel manages certificates and identity for mutual TLS; it does not enforce traffic policy or collect telemetry at pod level. It is tempting because Citadel concerns service-to-service security, and would be correct for a question about certificate issuance, rotation, or workload identity in Istio.
Go deeper
Related to this question
Learn chapter
Observability: Monitoring, Logging, and Tracing
Key term
Service Mesh
A service mesh is a dedicated infrastructure layer that manages communication between microservices, handling tasks like service discovery, load balancing, encryption, and observability without requiring changes to application code.
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on KCNA
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which component in a service mesh is responsible for collecting telemetry data and enforcing traffic policies?
medium- A.Control plane
- ✓ B.Sidecar proxy (data plane)
- C.Certificate authority
- D.Service mesh ingress gateway
Why B: In a service mesh, the sidecar proxy (part of the data plane) is the component that actually intercepts service-to-service traffic, enforces traffic policies (routing, retries, timeouts, mTLS), and emits telemetry (metrics, logs, traces) for each request. The control plane configures the sidecars but does not handle live traffic itself.
Variation 2. Which service mesh component is typically deployed as a sidecar proxy alongside application containers?
easy- A.Kiali
- B.Istiod
- C.Prometheus
- ✓ D.Envoy proxy
Why D: Envoy proxy is the most common sidecar proxy in service meshes like Istio and Linkerd. Istiod is the control plane component, Kiali is a visualization tool, and Prometheus is a monitoring system.
Variation 3. Which service mesh component is responsible for handling inter-service communication as a sidecar proxy?
medium- A.Mixer
- B.Pilot
- ✓ C.Envoy
- D.Citadel
Why C: Envoy is the correct answer because it is the sidecar proxy component in Istio that handles all inter-service communication. It intercepts traffic between microservices and applies routing, load balancing, and security policies defined by the control plane. Envoy runs as a sidecar container alongside each service instance, managing inbound and outbound traffic at the L4/L7 layer.
Variation 4. Which component in a service mesh is responsible for handling traffic management, security, and observability as a sidecar proxy?
medium- A.Pilot
- B.Mixer
- C.Citadel
- ✓ D.Envoy
Why D: Envoy is the sidecar proxy used in service meshes like Istio, where it handles all data plane traffic. It intercepts inbound and outbound traffic for each service instance, enforcing traffic routing, mutual TLS, and telemetry collection. Unlike control plane components, Envoy runs as a sidecar container alongside the application, making it directly responsible for the actual traffic management, security, and observability functions at runtime.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.