KCNA Cloud Native Architecture Practice Question
Which component in a service mesh is responsible for handling traffic management, security, and observability as a sidecar proxy?
⚠ Common exam trap
KCNA often tests the distinction between control plane and data plane components in a service mesh, causing candidates to confuse control plane components like Pilot, Mixer, and Citadel with the actual data plane proxy (Envoy) that handles traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Envoy
Envoy is the sidecar proxy used in service meshes like Istio, where it handles all data plane traffic. It intercepts inbound and outbound traffic for each service instance, enforcing traffic routing, mutual TLS, and telemetry collection. Unlike control plane components, Envoy runs as a sidecar container alongside the application, making it directly responsible for the actual traffic management, security, and observability functions at runtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pilot
Why it's wrong here
Pilot is Istio's control-plane component that distributes configuration to proxies; it is not the sidecar itself. It is tempting because Pilot governs traffic-management policy, so candidates assume it also enforces that policy, but enforcement happens in the Envoy sidecar injected alongside each workload.
- ✗
Mixer
Why it's wrong here
Mixer is Istio's control-plane component for telemetry collection and policy checks; it is not a sidecar proxy and was removed in later Istio versions. It is tempting because Mixer addresses observability, but the component actually handling traffic, security and telemetry per pod is the Envoy sidecar.
- ✗
Citadel
Why it's wrong here
Citadel is Istio's control-plane certificate authority that issues and rotates workload identities; it does not sit in the data path as a sidecar. It is tempting because Citadel handles the security concern the question mentions, but the proxy that terminates mTLS and enforces policy is Envoy.
- ✓
Envoy
Why this is correct
Envoy is the sidecar proxy deployed alongside each workload in a service mesh, intercepting inbound and outbound traffic. It enforces traffic routing, mutual TLS, and telemetry collection, satisfying the stem's requirement for a component handling management, security and observability.
Go deeper
Related to this question
Learn chapter
Cloud Native Application Design Principles
Key term
Service Mesh
A service mesh is a dedicated infrastructure layer that manages communication between microservices, handling tasks like service discovery, load balancing, encryption, and observability without requiring changes to application code.
About these practice questions
Courseiva writes every KCNA question from scratch — 930 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CNCF exam blueprint
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.