KCSA Platform Security Practice Question
A security engineer is configuring a service mesh using Istio to ensure that all east-west traffic between microservices is mutually authenticated and encrypted. Which custom resource must be configured with a STRICT mTLS mode to enforce this requirement cluster-wide?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PeerAuthentication
Istio uses the PeerAuthentication custom resource to define how traffic is authenticated between services. Setting it to STRICT mode ensures that all incoming traffic to the workload must be TLS encrypted and authenticated via mTLS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PeerAuthentication
Why this is correct
PeerAuthentication defines whether mTLS is enabled or disabled for workloads in a specific namespace or the entire mesh, supporting STRICT mode.
- ✗
EnvoyFilter
Why it's wrong here
EnvoyFilter allows customization of Envoy proxy configuration directly, which is a low-level tool and not the standard way to enforce cluster-wide mTLS.
- ✗
AuthorizationPolicy
Why it's wrong here
AuthorizationPolicy is used for access control (granting or denying permissions based on identity), not for configuring the mTLS transport mode.
- ✗
DestinationRule
Why it's wrong here
DestinationRule configures traffic policies after routing has occurred, including client-side TLS settings, but cluster-wide mTLS transport requirements are primarily driven by PeerAuthentication.
About these practice questions
Courseiva writes every KCSA question from scratch — 320 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint
This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.